Latest / Identity at the Center / #135 - DevSecOps with Mike Fraser

Transcript

#135 - DevSecOps with Mike Fraser · Identity at the Center

0:09
You're listening to the identity epicenter podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity.
0:27
The center podcast I'm Jeff. And that's Jim.
0:29
Hey, Jim. Hey, Jeff, how are you?
0:32
Oh, not so bad yourself. Good good.
0:34
I feel like we've been looking at each other, on our web cams
0:38
pretty much all day today. We did our livestream this
0:41
morning. So, I guess a Week Ago, by the
0:46
time, people are listening to this, it talked about our guests
0:50
today. I'm very excited to get into
0:52
this deaf's a cop. Sarina.
0:55
But before we go down down that route, I wanted to talk to you
1:00
about a meeting that we just had and a question that came up.
1:05
So the recommended to a client that they put together some
1:11
training on how to use their their IGA system, right?
1:17
Because one of the main pieces of feedback we got during our
1:20
workshops was that People didn't know that they could do certain
1:26
things in the tool that they could actually do, right?
1:29
So capability, existed, these folks have been living without
1:33
it. So our recommendation was to
1:37
train people up on that, but that's kind of a that's like a
1:41
big thing, right? Like, so how do you go about
1:43
doing that training? Where do you start?
1:46
How much do you do? What was your thought?
1:48
As we were having that conversation?
1:50
Yeah, I thought it was interesting because my mind
1:53
immediately we went to how much training do.
1:56
You actually need to put out there if the process is good
1:59
like, and I always use the example but Amazon's like a
2:02
perfect version of that, everyone knows how to spend
2:04
money on Amazon. I didn't take a class on how to
2:07
search for things and find what I want.
2:09
Add to a carton, you know, and buy it.
2:12
It's just a process and a full that makes sense in this work
2:15
and works. I think, in the case of
2:17
identity, there's clearly going to be some training that needs
2:19
to be done. But I always would I would take
2:22
a step back and just like okay how does this actually working
2:25
like this is make sense. Are we asking stupid questions
2:28
that we don't need to ask just a data on the screen relevant to
2:33
whatever is we're trying to get done?
2:35
You know the probably the classic example is like access
2:38
requests. I need to request access to this
2:40
thing and it's obscured or obfuscated by some weird, it
2:46
sounding Active Directory, Group name, that someone came up with
2:49
like 20 years ago and Morphed into like, oh, this is the, you
2:53
know, the axis that gives you marketing and admin access on
2:56
the Azure instance, like, okay, that totally makes sense.
3:00
So I like I think about it very critically because I think this
3:03
is like one of my true passions on the identity side is the
3:07
customer experience. Like if you had to do a lot of
3:09
training, you gotta really rethink is it's the way you're
3:13
presenting the customer to make sense and then once you get to
3:16
where you think you're going with that, you know, hit it from
3:18
Bunch different spots, lunch and learns.
3:21
Adios documentation. I think people learn different
3:24
ways, you know, have have a few options, but I think personally,
3:29
I would start with, you know, why do we need to do to the
3:31
training of the first place? Yeah, that's a really
3:34
interesting Viewpoint. I think one of the things that
3:41
the IG has platform for this particular organization is
3:47
designed that one hundred percent the time you have. 100%
3:51
of the options. And so I think if they brought
3:55
people in and said, look, here's the happy path and it's very
3:59
simple. And it's going to work 80
4:01
percent of the time, 20% of the time, you might need to go down
4:04
the path where every options available that would take care
4:09
of a lot of the problems. Yeah, I feel like this is a
4:12
situation where you want to put people on a rails experience as
4:16
much as you can, you know, maybe it's a rollercoaster, hopefully
4:19
maybe it's not as exciting. From an access perspective but
4:22
you know there's a defined path and sometimes having too much
4:27
control or power over that or even just choices in general can
4:32
really kind of impact the overall service and yeah the
4:36
usability of it right. We're not.
4:38
I know I think there's somewhere in between the Borg and everyone
4:41
doing the same thing. And you know I'm trying to think
4:44
like who would be more free you know freewheeling like where
4:46
everybody kind of whatever you want Q I guess would be the
4:49
other one we just kind of do it. Does whatever you Yes, that's a
4:51
star, star Star Trek next Generation reference.
4:54
So that's something right? Yeah, no.
4:58
I mean, you know I and I think the folks at this client had put
5:03
a lot of effort into written documentation and putting you
5:08
know notes and read you know, red block of text and people
5:13
don't even see it and they're not going to take time to read
5:16
the document. So you're right it has to be
5:19
easy. But Then on top of that
5:22
understanding, someone's not going to read a 20-page word doc
5:26
with a bunch of screenshots. Maybe a video would work better.
5:30
Yeah, for sure. I know I've done videos on the
5:32
past when I did roll out of an access request was, here's how
5:35
to use it. Did screen, share, you know,
5:38
screen recording. Basically, I definitely got
5:41
someone else to do the Talking part because my voice is it was
5:45
not exactly where I wanted to be.
5:46
And yet here I am doing a podcast, but I think there's a
5:50
variety of ways you Information out you'll never solve for
5:53
everything. Have the available options, you
5:57
could run metrics and see who's using what you have take you if
6:00
you've got like a web hosting and how many hits as a page, get
6:02
or if you've got a Wiki or something like that, you know
6:05
how many views Etc, find out what your users want from a
6:10
training perspective and then put your focus there rather than
6:13
trying to figure out on your own without any input from the folks
6:17
that you're going to be pushing this on to.
6:19
Well, I hope our listeners want Want deaf set cops because
6:22
that's where we're going to talk about today, right?
6:24
Yeah, for sure. This is a conversation.
6:26
We teased on our live stream this morning, talking about Deb
6:29
sex shops and some of the myths and things like that to go along
6:31
with it. I'm really excited to have this
6:33
conversation because I don't think we've actually gotten into
6:37
this topic at least on the identity side with at least very
6:41
much over the 134 episodes or so that we've put out already over
6:45
the last over two and a half years.
6:48
So yeah, we're going to talk tough suck-ups and I To
6:51
introduce Our Guest today is name, is Mike Fraser.
6:54
He's the VP of Dev SEC, Ops with Sophos.
6:56
Welcome to the show. Thanks for having me dropping in
6:59
gym. Yeah, thank you so much for
7:01
joining us and I'm curious to see where this conversation will
7:05
go. Not curious, but interested
7:07
because I think there's a lot of different ways that we can kind
7:09
of get through this, but this is the first time you're with us.
7:12
So we have tradition around here that we like to understand your
7:15
origin story. How did you get into the
7:18
wonderful world of cyber security?
7:21
Charity and they by extension identity and access management.
7:24
Is it something that that you chose, or did it choose you?
7:28
That's a great question. So I, I was in computers as a
7:32
kid and join the Air Force on. I was 18, but decided because I
7:38
had such an affinity for computers as a teenager that I
7:42
wanted to do something different.
7:43
And so, I actually worked on Weapons Systems likes a physical
7:47
weapon systems on F-15 fighter jets.
7:51
Men actually transition to, the gar become a cyber security
7:55
engineer. So I started in cyber very very
7:58
early in my career but then I because I have an
8:02
entrepreneurial Drive got into starting out and
8:08
brick-and-mortar computer repair shop.
8:10
And then I kind of move through Cloud.
8:14
Was there at the very early days of cloud where people are
8:17
scratching head going? What is this Cloud thing?
8:20
How do I I how do I even use it? And so, I actually started a
8:24
private Cloud company for the SMB.
8:27
Also found the timing was imperative when you're trying to
8:30
release a product and Hardware is very hard and so had a couple
8:35
different Consulting companies in cloud and cybersecurity and
8:40
virtual desktop infrastructure and then decided to get into
8:44
workspace as a service. And then finally into what is,
8:48
what was RE Factor, which was the whole reason.
8:51
So opposed where we were, I was really trying to solve the issue
8:55
of Bridging, the Gap between cyber security where I started
8:59
out my career, going to the other side in the software
9:01
engineering world and really being able to bridge.
9:03
The gap between cyber security and Dev or devops, which was
9:08
just a huge issue out there. And something I really wanted to
9:12
solve a new, it myself, is kind of being in the trenches as
9:17
both, the cyber security engineer and then coming over to
9:20
the Software engineering World in a fun fact, I went to get my
9:26
bachelor's and master's degree wall starting refactoring,
9:30
computer science because I needed to use my g.i. bill
9:33
benefit from Port expired, for my Air Force days, but I also
9:39
really wanted to fully immerse myself into the software
9:44
engineering / computer science side of the world side.
9:47
Truly, I had a good holistic understanding of the Trying to
9:51
solve nothing like an expiration date to us per action and all
9:55
facets of life. Let's talk a little bit about
9:58
refactor because I think it's an interesting thing.
10:02
Let's leave it that I T as code and I think we've been hearing,
10:05
you know, as code for a long time.
10:09
And I'd love to hear, you know, what exactly was refactor,
10:12
because I think that's how you ended up at Sophos.
10:15
Yeah, exactly. So I yeah, I actually coined the
10:17
term. It is code.
10:19
I In the whole, premise around what we were building a tree.
10:23
Factor was the around the principle of if everything
10:27
becomes code or becomes it is code.
10:30
It's not just about app development anymore.
10:33
We need to look at everything else.
10:34
That Rings. The cloud is infrastructures
10:36
code. Configuration is code, policy is
10:38
code. And really try to take the same
10:41
principles that devops was to adding infrastructure as code to
10:46
Agile software development and really create an agile approach
10:50
to More general-purpose automation with security built
10:55
into it. And I was also tired of seeing
10:58
everything in our world, in cyber, are all Point Solutions.
11:02
I wanted to build a platform that could cater to multiple
11:05
personas so that cyber security engineer could up skill and
11:09
actually be a part of what the devops team is doing and vice
11:12
versa, build something that had the features and functionality
11:15
because most cyber security products out there.
11:17
Devops doesn't want to touch because of the fact that it
11:20
Wasn't built for them. And it's too in some way
11:23
simplistic, the other way I look at it is kind of opinion people
11:28
that want something is very opinionated versus creating your
11:31
own opinions. So we had to balance, very
11:34
delicately between bowls, we have something I'm super
11:36
flexible but also, you can package up so that you could
11:39
basically put out your opinions and somebody could use the
11:42
automation content, they're very consumable way.
11:45
Seems like that ties in pretty well with what we kind of
11:47
started off the show today with training.
11:49
And how do you make Things usable for a variety of
11:52
audiences and now you're working with Sophos as AV as the VP of
11:58
devstack Ops which one very cool title to.
12:02
What the hell does that mean? Yes, they're coming on board to
12:07
say so and it's actually saw post.
12:08
It's a site that no, no, you're fine.
12:11
I'd say, give me six months to still try to be on point with
12:15
bouncing it correctly. So all good.
12:18
But yeah. So I so Refactor is now become
12:22
sofas Factory, which is basically it's the same product,
12:27
just just rebranded and I'm driving the dev second strategy.
12:32
But again, around this kind of holistic thought, process of
12:35
having more general-purpose automation, to be able to
12:39
support. Also the broader ecosystem to.
12:41
So, one of the big pieces that we were driving at refactor, was
12:45
I want everything. The basically become building
12:47
blocks that can be come from different vendors and this, Ice
12:51
nicely into the I Am side because it's a huge issue there
12:55
and but more generally kind of the broader ecosystem because
12:59
there's a lot of vendors that are trying to figure out how to
13:03
modernize their approach of the products that they've had in
13:06
market for a long time. And then you have a lot of new
13:10
vendors coming into the market that are a little bit more
13:12
bleeding edge for the typical cyber security teams out there
13:16
as well. And so that's like a huge huge
13:20
push on our end, but But I basically Sophos Factory product
13:24
and team at Sophos around F, PSI cops.
13:29
So Mike, we we try to make sure that we don't leave anyone in
13:32
the dust. And, you know, our listener base
13:35
is really all over the Spectrum in terms of background and years
13:41
of experience. So like to start off with kind
13:45
of a 10-1 around Dev SEC, Ops, which to me sounds like part of
13:52
three different words, development, security and
13:55
operations, right? I mean, doesn't that simple, it
13:58
could be. I think it's a little bit more,
14:01
a little bit more involved, exclamation to it, but my
14:05
philosophy undef set cops is, it's more General is so dense.
14:10
I got frillies about the principles of devops and then
14:13
adding in security to the mix. Also though I want to be clear
14:18
it's not just AB SEC redefined its really kind of a new
14:22
paradigm of again this whole concept of it is code.
14:26
So if it becomes codes and Looking at again, your
14:29
infrastructure, your configuration security is code
14:33
whether that's policy or, you know, developing towards apis
14:37
and other things that you're trying to programmatically
14:40
create so you can have a continuous process to build more
14:43
modern solutions. And Dave said cops to your point
14:46
is the combination of three different words and I look at it
14:50
as a collaborative process between Dev or devops security
14:56
and hops because the fact that Only if you're going to truly
14:59
achieve that set cops in an organization, it's not just
15:03
we're going to add security to the developers plate.
15:06
It's really thinking about this is a more collaborative process.
15:08
We have so many different domains, including I am inside
15:13
of cybersecurity that. There's no way that you can
15:16
expect developers to just say. Yeah, we're going to pick up all
15:19
things security because we're modernizing, that's the approach
15:22
here and then on the other side, on the cyber security side, I
15:25
really am passionate about seeing cyber security
15:27
practitioners up. Upscale and redefining the
15:30
definition of developers to because it's not just about app
15:34
development anymore. And so I want to give cyber
15:37
security practitioners and teens not just to see the table but to
15:40
be actively involved in the process.
15:42
And as cliche as it may sound really, truly start breaking
15:45
down the silos and organization so that they can all cohesively
15:49
work and collaborate together. Yeah.
15:51
When I think of the ideas code, I think about you know,
15:55
automation of the deployment of T infrastructure applications.
16:02
I think there's obviously an I am tying, but could you kind of
16:06
elaborate on that identity is critical to anything that you're
16:10
going to build? Obviously, you have to be able
16:13
to tie into various different systems.
16:18
You have to be able to also have the identity tied into any of
16:22
the automation that you're trying to do inside of these
16:25
more modern solutions. I look at the I MP says one of
16:30
the core building blocks when you're building more of these
16:34
steps, a cop's / ideas, code type of solutions.
16:38
Because at the end of the day, you have to be able to tie in
16:42
what you're doing into whether it's, you know, apis or SSO or
16:48
whatever it may be from an identity standpoint, you have to
16:51
be able to continuously tie into a to write and then looking at
16:55
other things like zero trust, and so on.
16:58
We want to be able to ensure over time that you're able to
17:03
get authorization to various different systems to, but it's
17:07
not necessary depending on what you're doing.
17:11
But because of the fact that you're tied into so many
17:13
different systems and everything changes to, right?
17:15
So if you take the building block approach, you may be using
17:18
one technology today. But, you know, six months a year
17:22
down the road, you may want to change something else or have
17:24
something in addition to, you really want to take a much more
17:28
Jeweler approach to that as you're tying into, it was
17:32
basically building a solution that has many different parts to
17:34
it and requires identity for each of the different parts
17:39
inside of the solution that you're building.
17:42
Yeah. Whenever I think of ideas code,
17:44
I'm thinking about like automated deployment of, you
17:50
know, infrastructure and the application.
17:52
So you need to have accounts that have the right to do
17:58
things. Was, you know, to pull from a
18:01
code repo or, you know, initiated new instance or
18:06
connect to a database. So there's a lot of accounts
18:10
that that it is code process requires.
18:15
So, is it the management of those and from an IM standpoint
18:19
of we're talking about mostly the authentication process or is
18:24
it like life cycle of those accounts?
18:26
You know what all would be first is my premise.
18:29
Correct. And and second is what are the,
18:33
you know what kind of components of I am is it authentication
18:38
authorization user life cycle? Things like that?
18:43
Yeah, that's a that's an interesting question.
18:45
So I think it's it's all all all.
18:48
All the above the issue with trying to figure out how you're
18:54
building towards a different solutions is there is around,
18:57
use cases. I have some customers that are
19:01
working to they wanted to on-boarding and off-boarding of
19:04
users and they're going to tie in a multiple different systems
19:06
do that and they're going to they're going to use a much more
19:10
dep SEC Ops type of approach. Then there's the, I need to tie
19:15
in to particular systems to your point.
19:19
Whether it's a repo, a code repo, or its I need to offer
19:24
authorization against this API or I need to be able.
19:28
All to, you know, tie into this VM and go set something up or
19:32
whatever may be and so there's all there's a different piece of
19:37
identity that's a part of that and a lot of what drives around
19:41
F PSI, cops around concept of CI CD, continuous integration,
19:45
continuous deployment in the the problem that exists with that is
19:51
that you end up giving the keys the kingdom when it comes to
19:54
that because you're tying into all these different systems and
19:57
you have to go face. Actually tied together different
20:01
steps that you're trying to automate in there and so when
20:04
you're doing that you have to be very careful about the level of
20:07
access and authorization that you're giving around who in a
20:13
lot of these systems. They don't really have any sort
20:16
of like privileged access management.
20:17
Other than like, yeah, you can have access to this or know you
20:20
can't and you're not thinking about the granularity inside of
20:24
the pipeline to create, even if you have granularity on how you
20:27
can access, To execute said pipelines.
20:30
And so that's still a problem that exists out there in the
20:34
space and something that I'm working towards trying to help
20:39
solve for because of the fact that it's a, it's a, it's a
20:42
problem out there. And if you're your point trying
20:45
to get into more of the steps that cops where you're
20:48
incorporating, other things outside of just traditional
20:50
active, you really have to think about how you're structuring the
20:55
identity piece to all this. And how that Ties into the
20:59
Automation and the continuous automation of that as well.
21:02
So that you can also be able to have an understanding and be
21:06
able to also audit like who's doing, what, where, when, and
21:09
how. Right.
21:11
Yeah. And when I, when I speak with
21:13
clients a lot, they're trying to get their arms around.
21:18
This whole Dev psi-cops process or devstack.
21:24
Anyway, they might not have the operation side down.
21:26
In other words, the Developers Are solving the problem because
21:30
they have the problem and they need to solve it in order to
21:33
move forward. So they kind of Define their
21:35
processes and everything. But even at a more fundamental
21:39
level just wondering, you know, when does an organization need
21:44
to kind of build a capability around dep SEC Ops, is it like,
21:48
you know, how, how large they get is it only certain types of
21:52
companies or what do you you know, in other words who needs
21:57
deficit, cops? I think every every organization
22:02
needs, that's a cop's, the conundrum though is Hannibal
22:07
where you're probing with the question, which is the size of
22:11
the company and the maturity of different teams in the company.
22:15
So the larger the organization, the more likely they have
22:19
different teams that are dedicated to supporting the
22:23
different pieces of the dev second outside again.
22:26
I don't look at this. It's just trying to add
22:30
particular tools into your just your devops, you know, an active
22:34
process. I think about it more
22:35
holistically. And so if you take that approach
22:39
to the what Dev Cyclops is then, you're really thinking about how
22:43
do I incorporate this type of approach as I'm modernizing and
22:49
also, how do I think about the ways that different teams can
22:55
support what they've created? And so that takes a turkey?
22:59
And type of skill set to be able to build.
23:01
I often equate. This also in the software
23:03
engineering world to software Engineers are great at people.
23:07
They can build stuff from scratch developers.
23:10
If you're just generalizing the term app developers have to have
23:14
code that they start from but they can then add additional
23:18
functionality to it and I take that same thought process to
23:22
what devstack copses you have those that can build something
23:24
from scratch and then you have those that can tweak and Sighs.
23:29
But they have to have something that's already created.
23:31
So you can apply the 80/20 rule, is that where 80% of the way
23:34
there? They can go and customize a 20%
23:37
of it to get the outcome of the end result they're looking for
23:39
and support it too. And I see that as the future of
23:43
of devstack cops in general is you're still going to need the
23:46
folks that are going to be able to create the base automation
23:49
content that you're going to use and then you're going to have
23:52
the other folks that can consume it.
23:54
But you have to think about this more about across.
23:56
I think you brought this up earlier Jim the full.
23:58
Form of technical talent to ensure that you can cater to
24:02
both sides of that. So you probably also heard, you
24:05
know, the shift left in the shift right out there.
24:09
And I look at it as like, you need to shift left for sure, try
24:13
to get as close to the beginning of the creation of whatever
24:16
you're trying to build through Dev Cyclops pipeline process.
24:20
But you need to also be able to take that and shift it right in
24:23
more of a consumable type of approach where it's more low
24:27
code, no code. So you have to have high quality
24:28
Code and Loco no code and be able to balance both of those on
24:33
both sides of that because just shifting left is not the answer
24:36
and just shifting right where I abstract everything and make it
24:39
super simplistic, you need to be able to do both and that's you
24:44
know that's the least, that's how I think about it.
24:47
Okay. I'm going to take the bait just
24:49
shifting left because I think we don't want to leave anybody in
24:52
the dust. My understanding is Shifting
24:55
left has to do with we're moving to it agile.
24:59
Software development process. Now we're testing earlier, we're
25:03
not doing that waterfall methodology.
25:05
Where we're going to build a product and then now guess what?
25:08
We're going to start testing it. It's this continuous integration
25:13
development process where we're testing as we're going.
25:17
So to work through talking about really is the automated testing
25:22
script based testing of applications that are running
25:25
all the time. Okay?
25:28
So Obviously I'm getting to my point of ignorance talk to us
25:32
about shift left. Yeah it's fine.
25:34
It's the concept of ship left. Is trying to incorporate
25:38
security is close to the beginning of the dev process so
25:42
that you can have the scanning. And Remediation happening is
25:47
suttas as close to the beginning of a pipeline process as
25:51
possible when you're releasing software.
25:54
Conceptually now, in cybersecurity the whole reason
25:58
this whole shift Of thing came to be is because of the fact
26:01
that most of the cyber security products out, there were being
26:05
used outside of the development process.
26:08
So now it's the concept of trying to reduce that insect.
26:11
Now we take this and move this forward to the concept of it is
26:15
code. It's not anymore about being a
26:18
part of just the dev process. Even though I'm taking the same
26:21
approach and how I create and release my Solutions now that
26:26
they're all software-defined, but I'm Also, thinking about how
26:30
I can build this from code, from the very beginning, but then
26:34
package it up in a consumable format where you have to now
26:38
shift, right? Because it needs to be in a
26:40
format that other folks that aren't just developers or devops
26:43
Engineers can actually consume. So there's a there and there's a
26:47
debate going on on this but I truly believe it's a shift left
26:51
first and then shift, right? And again it's not just about
26:55
app development, it's now about thinking about everything.
26:59
Holistically from a technology standpoint in your organization
27:02
that may or may not be about just application development and
27:07
there's a lot of organizations that aren't developing
27:08
applications at all right. But they need to take the same
27:11
approach now, they're Building Solutions because if I'm no
27:14
longer Racket and center rack and stacking infrastructure in
27:19
my data center or I'm now using the cloud, that's one great use
27:25
case, where this becomes a major issue at scale and You have to.
27:29
Now, start thinking about how do I build things from
27:31
infrastructures code? How do I set up guard rails and
27:34
policies around that? And then how do I tie in the
27:36
other building blocks that too? Because I may want to be able to
27:39
assess the infrastructure created against see is
27:42
benchmarks. I may want to be able to
27:44
remediate it. I may want to incorporate
27:46
Integrations to be able to pop that data into my ticketing
27:49
system or cmdb or whatever it may be.
27:52
And so again thinking about this more holistically and then how
27:55
do I, you know, tie in the other building blocks here.
27:58
Because I may want to incorporate using a particular
28:02
IM solution across the board, for every single building, block
28:05
that I create or multiple different.
28:08
I am Solutions depending on the organization and who supports
28:12
different implementations of different products that are
28:15
being used in the organization. So what is the x axis from your
28:20
definition of Shifting left? Because the way that I'm
28:23
picturing, it is all the way on the left, is the developer who
28:28
ever is. Creating the thing and then all
28:30
the way on the right is the consumer or the customer of
28:34
whatever that thing will eventually be and everything in
28:37
the middle is all the stuff that happens.
28:39
The people and parts that contribute to getting it all the
28:43
way to the right and he talked earlier about you know shift not
28:47
necessarily shifting, right? But you know, spreading out for
28:50
example the security responsibilities across the
28:54
spectrum is that and I thinking about that correctly in the
28:57
context of kind What you were looking at for my awesome.
29:01
I think everyone needs to be thinking about security, but I
29:05
do still think it's on the cyber security team and any ancillary
29:09
teams in the organization to be able to long-term still support
29:13
that. I think the problem though is as
29:15
lived in if I decide I'm going to need to go say cloud native,
29:19
but I'm going to deploy kubernetes cluster is usually
29:22
that's on the plate of the devops team, not the security
29:25
team and then screw team is either brought in after the fact
29:28
Or the devops team has to pick up on the security side.
29:31
And so my thought, in my opinion on this is that if you build
29:35
things and building blocks that each team has to maintain then
29:41
being able to bring them all together.
29:42
Then the security team still is able to manage the risk in your
29:47
organization and support different cybersecurity
29:50
products. They have to support, but being
29:52
able to work in conjunction with the dev or the devops team and
29:56
then also the Ops Team who's going to have to support any of
29:58
The stuff once it goes into production and other systems in
30:02
their organization that may not be directly tied to
30:05
cybersecurity. But it's imperative that there.
30:07
You're able to utilize those systems in conjunction with the
30:11
security products in the organization, but I don't, I'm
30:15
also against the thought process that developers are now going to
30:19
become the Security Experts and our, the devops engineers are
30:23
going to put this on their plate.
30:25
And so you probably heard talk out there about, oh, we can
30:28
build these Papa dep SEC out scenes.
30:30
Do you ever try to hire a devops engineer?
30:32
That is very difficult, if you ever try to hire a devstack
30:36
Opera engineer, that's like trying to find a rainbow color,
30:40
grimaud painted unicorn out there in the wild, right?
30:42
Like it's just not, it's not in reach to be able to think that
30:46
you can add a whole nother domain to somebody that already
30:48
had that has the expertise around to different domains
30:52
already. Devon Ops for.
30:54
So I did not hear you use the word contains.
30:58
Nurses station but I often hear Dev set cops, you know, linked
31:03
to things like Docker. And a lot of times that's when,
31:08
you know, engaging with the conversation with the client is
31:11
they've got Docker, they're doing a lot of deaf set, cops
31:15
work. How big is containerization in
31:19
the world? Dev cecrops is that?
31:21
Usually the driver? Or is it just part of the
31:24
puzzle? That's a great question.
31:26
So there's a school of thought. A out there that that data set,
31:30
cops is purely driven around to your point containers really,
31:36
you know, Cloud native Technologies, like kubernetes.
31:40
And it's interesting because I last year we ended up engaging
31:44
with platform 1 which is the Air Force's dep SEC cops initiative.
31:48
So we want a super small business Innovation, research
31:51
contract with Platform One around their initiative.
31:56
What I found though is kind of working through this is Really
32:00
the Legacy side of systems, you have to score that you should
32:03
still be able to apply Dev second principles, but it's not
32:06
directly tied to Cloud native or, you know, containerization
32:10
known as the other side where it's like, it may or may not
32:13
make sense for your organization to go that way.
32:16
I don't think that Dev set, cops and containerization are
32:19
mutually exclusive. I think that the principles and
32:22
the approach, the dep's a cop, should be able to be applied to
32:26
traditional you go infrastructure, use case.
32:28
Has that you can apply to like Network automation or
32:31
configuration management for devices that may or may not be
32:36
physical. And then also thinking about how
32:38
you're applying those same principles to, you know,
32:40
building kubernetes cluster Zone applying, you know, security
32:44
control suppose. So it's from my perspective
32:47
that's like Ops is a is the approach and how you're trying
32:51
to modernize, but being able to not, just put it into just
32:56
solely containers or containers. Reservation I think is is a way
33:01
to think about it in organizations and there's all
33:04
kinds of different use cases that I have worked with
33:07
customers on that are using it for that are again.
33:09
Aren't what you see out there is traditional Pure kubernetes or
33:15
containerization use cases? Yeah, I think Dev PSI cops,
33:19
probably the closest parallel in the, I am world, the traditional
33:24
I am world for me just privileged access management
33:27
where you've got this group. Up of Highly technical users and
33:33
your quote-unquote going to do something to them.
33:35
You're going to change the way they work by implementing some
33:39
technology, that's just between them and what they have to do
33:44
for their job. And so I think there's probably
33:48
a right way to do that and a wrong way to do that.
33:51
I'm wondering, you know, you've probably seen both but, you
33:55
know, you and you've implemented implemented death.
33:58
Cops program yourself kind of what's the right way to do that.
34:02
And if you could back with any real world example, I think that
34:05
would be interesting. Yeah, that's a great question.
34:08
I think, from my my perspective, when you're thinking about how
34:13
organizations are building out a deep sigh, cops program, the
34:20
keys to thinking about that, and to your point about like
34:24
privileged access management or different products that you're
34:28
trying, To incorporate this. The mix is who supports these
34:32
different products and what level are they add technically
34:36
to support anything, net new, and there's some examples in
34:40
the. I am space from different
34:42
vendors that may, you know, may have existed for a long time.
34:46
So they've been catering, primarily to the cyber security
34:49
teams. And now other products are
34:50
coming out, there are catering more to the developer side of
34:54
different teams. And so, you really have to think
34:57
about how these are Packaged up in use and then what else
35:02
they're supporting in conjunction with it is.
35:06
A lot of times it'll be like Hashi courts.
35:08
Good example though, so I'll bring them up around for of the
35:11
developer devops type of approach for how those Pro who
35:16
uses those products. But the security team has to
35:19
support, say the bolts implementation, and then how do
35:24
you incorporate those into the next piece?
35:27
Which is going to be All right, now that I can pull Secrets or
35:31
credentials and get authorization to then go creates
35:35
a infrastructure as code who is supporting that.
35:39
And I think that the ability to get cyber security to be
35:43
involved in that and be able to support that as you're building
35:46
out, your depths at cops program is imperative and also the go
35:50
back to my prior point, the upskilling part, because a lot
35:53
of times, this is completely outside of the scope of what
35:58
Cyber security, practitioners know, and understand.
36:01
And so, it's net. New skills that have to be
36:03
learned to be a part of this. So maybe I need to learn how I
36:07
can pull secrets programmatically from Vault, and
36:10
I need to know how I can build some infrastructure as code
36:13
saying Terror for many of the cloud native templates and
36:16
thinking about it again, back to the whole it is code
36:20
conversation. How does that get incorporated
36:23
into the the outcomes organizations, trying to drive?
36:28
I've through whether they're pushing to, go to the public
36:30
cloud or any sort of other initiatives that are going to
36:34
help them accelerate what they're trying to do.
36:37
And I think that's a huge piece of the hate to use this term but
36:42
of digital transformation, which is a completely loaded term.
36:45
But it's it's part of that process that organizations are
36:50
trying to go through that. They can basically modernize is
36:54
really what the root of that is and that requires different
36:57
teams to be a part of And also again the Alps killing piece to
37:01
so that the full spectrum of technical talent in the
37:03
organization can be a part of the deaf, psych Ops program that
37:07
you build inside your organization.
37:09
Yeah, my perspective on. Is that if I'm the in the
37:13
information security office, I don't need to run the hot Chic
37:17
or poor the The Vault or whatever technology is
37:22
necessarily backing up. I don't necessarily need my
37:26
folks to do the administration work.
37:28
What I want to make sure of is that the proper controls are in
37:32
place, the proper auditing is in place.
37:36
And you know what? I prefer to see is some
37:40
leadership from that development side, coming to the information
37:45
security office. To say, hey, we've got a process
37:49
here where we're managing identity and access and we want
37:54
to make sure that we're in alignment, that, you know, we
37:56
have the proper controls in place.
37:59
I think the same thing for privileged access management.
38:02
It shouldn't have to be that the I am team comes and says, hey we
38:06
need to take over your process. It should be that the
38:10
engineering team says, hey, we're managing all these servers
38:14
we need to make sure that we have proper controls and
38:19
auditing and place. So I think that that would be
38:23
idea. I don't know that it's always
38:24
going to happen but I do think it needs to be a partnership.
38:27
I don't think Some kind of antagonistic process where you
38:32
know, from a from a app Dev team or from an infrastructure team
38:37
where it's like, oh you guys are just want to come in like take
38:41
over this process and you're going to make my life suck?
38:45
Yeah. I think there's two ways to
38:48
think about it, to from that perspective.
38:51
And this goes to some of the work that I've been doing with
38:53
some, some largesse eyes as well, our system integrators
38:56
around, there's the tear And there's like the support of the
39:01
underlying infrastructure and the configuration of the
39:03
different. I am products that you have to
39:05
support which a lot of organizations are trying to
39:08
figure out how they can do, you know, in a much more modern,
39:12
sophisticated way of leveraging, kind of debts, that cops
39:16
approach to building it around infrastructure as code.
39:18
And and so on, then there's the other side of it to your point,
39:21
which is the how do I then use those products in the dev
39:26
cecrops pipelining. SS where I'm trying to build
39:29
these newer modern solutions and so that is also the other
39:34
approach and I think that it does to your point require a
39:40
relationship. That's not not confrontational
39:43
between development and devops whoever's managing that side of
39:48
it and the cybersecurity team who's going to have to support
39:51
the different products that are now being used inside of that
39:55
process to and not everything is going to be you know, too much.
39:58
Sample, like using hashing core, your Dev team and devops.
40:02
You may be using it, but you may have other.
40:03
I am most likely have other IM products in your organization.
40:08
And so, you have to think about how do I incorporate those into.
40:11
Is, I may have two or three or four different products inside
40:14
my organization. So I have to think about how
40:16
each one of those is used in. Can I have those as essentially
40:21
the building blocks I mentioned earlier as a part of that
40:23
process where I can swap one out for another if another team is
40:26
using and supporting it and I'm not just beholding to the Deb.
40:30
So the devops team because now they're forcing us to have to
40:33
use this this net new product I think longer term strategy is.
40:38
Can you package up the integration automation around
40:42
these? I am products in a consumable
40:45
way that you can have other teams using it without them
40:49
having to know the inner workings of say like how V
40:52
works. It's just like, oh, I just need
40:54
to build on these few inputs and I can run this.
40:57
And now I get the Result. So I'm looking for, I know, Brad
40:59
that secret and use it in my process, right?
41:03
And so, thinking about it, much more around the consumption
41:07
pieces, this critical, and how folks can can use this type of
41:11
stuff, you know, we've been talking off a lot about Dev,
41:14
sock, hops in the context. They think of it, kind of
41:18
already existing, but what happens if it doesn't exist.
41:24
How do you insert or create a culture of death cegavske?
41:28
It it seems to me like it's very much a culture in a mindset and
41:31
less the actual technology portion of it.
41:34
So the technology is an enabler, but if there is, if there is no
41:40
Dev SEC Ops today, how do I start one?
41:42
How do I insert myself into that process?
41:45
Yeah, that's a great question. I, you really need to look at
41:50
how you're doing work today. In your organization and who has
41:56
responsibilities for? The different work and you may
41:59
have a super mature Devol practice, you may have.
42:02
And I mean not doing any devops you organization.
42:05
So conceptually from a principle standpoint that would be.
42:08
The first thing is, how do I get things in place to be able to
42:13
even build what I would consider a more of a devops tile
42:17
practice. And some of that stuff is like,
42:19
continuous feedback loops between teams, so you can be
42:21
more collaborative. And you know what, either team
42:24
with different teams you're doing.
42:26
Then also thinking about it from a process standpoint, so
42:31
feedback scrape, but you need to have a semblance on the
42:34
understanding of what not just what other teams are doing but
42:38
how you can incorporate more of the agile process into what
42:43
you're trying to create and continuously update and monitor
42:48
as well, what your super critical.
42:50
And then from longer-term strategy, it's being able to get
42:56
a semblance on again around the The solution building side in
43:01
the organization heat, apply those principles to what you're
43:04
basically trying to create from a solution standpoint and then
43:07
being able to iterate quickly on that and having each of the
43:10
teams involved from a collaboration standpoint and
43:15
technology is critical to this but also is equally critical is
43:20
having the processes in program in place.
43:23
Because if you don't have an understanding on what you need
43:26
to do to build the practice or the Graham, you're not going to
43:29
have an understanding about how to even apply technology that
43:33
could help you to start redefining this in your
43:36
organization might commit. Ask you to put your your future
43:41
thinking cap on so Jeff. And I did a live stream today
43:45
and someone asks about Quantum Computing and how it would
43:48
impact password policies and pastoralists and, you know,
43:53
positions like these major trends that are happening around
43:57
us. Things like The cloud which, you
44:00
know, guess is the new trend anymore.
44:02
But I'm wondering what are some some Trends, or some things that
44:07
you see in the future, that that you get excited about what's
44:10
going to change in the dev SEC Ops landscape and make it
44:16
better. That's so, I don't know if I
44:19
will get into Quantum Computing and how we read from that, from
44:24
Dev SEC house, but I do think AI ML.
44:29
And it's funny because when I was in school, I took a a IML
44:35
class. I learned firsthand of the fact
44:39
that what we think about AI. It's very rudimentary.
44:43
A lot of its Brute Force type algorithms.
44:47
And I do see though that if you start taking the approach on dep
44:53
SEC, Ops the next kind of approach to it is, now how can I
44:57
apply? Any of the any of the data that
45:00
I'm now, building from what I'm doing to make better predictions
45:06
on what users want to do, or longer-term, even have the
45:11
robots, be able to go do stuff with it, which I know in a lot
45:16
of organizations is terrifying, but at the same time, I think
45:21
longer term will see more and more intelligent automation
45:25
where we're actually leveraging large.
45:28
Cassettes around machine learning and then being able to
45:30
apply more of an AI approach. Thinking about, you know, can I
45:35
now have these night out a machine, go do these things that
45:39
murder automate have machines, do it, but I'm controlling what
45:42
it does to actually be able to make decisions off of the data
45:46
that I build off of that. So that's, that's where I see
45:49
the next Trend. And maybe on the next podcast,
45:53
we'll talk about Quantum Computing, you know, a year or
45:55
two out because I may be more applicable at that point.
45:58
And I got a quick question for you, even great with your time.
46:01
I don't even got a couple minutes left here but You know
46:05
I'm a Star Trek guy, the Borg are they in AI.
46:10
Oh that's a that's a good question because there are
46:14
differing between machine and human interaction with human
46:22
rights framework. Yeah, cyborg of sorts.
46:26
I don't think the board themselves are I do think that
46:29
the control of the board is driven by hey, I bet it's
46:36
conceptually think about it from a collective standpoint.
46:39
It would be possible to be a I but I yeah it's that's a good
46:47
question. I think I'm on the fence on that
46:49
one. I thought I'd throw you on the
46:52
spot there. So let's wrap up with something
46:54
in the Star Trek universe. Who is your favorite Star Trek
46:59
Captain or officer. So I have I have two one.
47:07
Cumin and one synthetic. So Captain Picard for sure the
47:13
Next Generation You by far is my favorite captain of full-time
47:18
across all whole Star Trek and then data.
47:23
So a nice, a data and not data because of my love for the next
47:27
generation and data is is also right there up there with
47:33
Captain Picard so I like both of them equally Ali iconic
47:38
characters for sure. Jim about yourself, who's your
47:40
favorite Star Trek. ER, I'm not gonna have an
47:43
original answer here but be cards.
47:45
My favorite, I mean, I just think that guy was so cool.
47:49
Yeah, I don't know what it is about him, but like he totally
47:52
nailed that role for sure. You know, you can do hash cap
47:55
hashtag my captain or you know whatever you want to do it for
47:58
Picard for sure. I'm on that one, you know, I'm
48:01
old school but I like Spock. I mean, there's something about
48:04
the logic, the lack of ammo. And things like that, that
48:08
you're not, not sort of tainting, the decision-making
48:11
sometimes to a detriment for sure.
48:13
But yeah, I always thought it was a fascinating, you know, not
48:18
only character but roll right to be able to kind of show that,
48:21
and he kind of saw it go over with data, trying to figure out.
48:26
There are several episodes of him, trying to figure out the
48:28
Human Experience and emotion and things like that, which was
48:30
always a who, you know, going from the cold.
48:33
Yeah, thatís a cold. But the robot To him all of a
48:37
sudden experiencing happiness or sadness, or things like that,
48:41
and taking it to the extremes. So I guess Spock would be mine
48:44
for sure, over the captain, or was he?
48:47
There you go. Was question.
48:49
Who's your favorite character? It was Captain or officer and
48:53
Spock was definitely an officer. Although he did take command at
48:57
certain times based on what was happening.
49:00
You know, at the time with with Kirk, I'm surprised nobody
49:04
brought up the end of Troy or well.
49:06
I was going to say, I thought it was only the curry captain, and
49:11
who's definitely achieved my food not for a plug for the new
49:16
show part, but a lot of them are back on there.
49:19
So it's wrist to see them acting, you know, decades into
49:23
the future on from the Next Generation.
49:26
Yeah, it's exciting stuff out there rod on all fronts Star
49:32
Trek so yeah they boldly went where they are already before I
49:36
guess. It would be the way to put that
49:37
one. Mikey been super cool.
49:40
With your time was start to get things wrapped up here, I really
49:44
enjoyed the conversation today. I learned a lot sort of from
49:47
that Dev SEC Ops mindset. What is something that people
49:51
who are listening here? Just this conversation.
49:53
Just now should be taking away from from what we talked about,
49:57
the dep SEC Ops takes time and effort to build, you know, a
50:02
program in your organization. You're coming at it from the
50:05
cyber 30 practitioner side, think about how you can start
50:10
ups killing yourself. I kind of equate that to, you
50:13
know, you don't need to become a software engineer, but you
50:15
should know computer science, fundamentals, because the shift
50:19
is happening. And you at least want to have
50:22
the Baseline of understanding of how things are done.
50:25
And accomplished is everything, becomes everything is code or it
50:28
is code. And it's I'm super excited to
50:32
see where the market goes with around this.
50:35
It's I We're very very Forefront of this even though you've heard
50:39
that's a cop's for you know years.
50:43
Now I think we're getting to the point where it's starting to
50:46
truly accelerate but it's one of the basis of devstack cops.
50:49
It's change and that's very difficult for any organization.
50:54
And so that's a think of driving factor is the industry shifting
50:58
faster so fast that organizations have to adapt and
51:03
change. And I like to say with that
51:06
said, Now, choosing a Star Trek phrase resistance is futile.
51:11
So fruit prepare to be a citizen to be assimilated.
51:17
Jim. How about yourself final
51:18
thoughts for this? Episode of?
51:20
That was so good. So good.
51:23
Yeah, but I think, you know, kind of come from the, I am
51:29
program manager point of view and think about this is it's got
51:33
to be a partnership. Don't go in and try and take
51:36
things over. You know quote unquote insert
51:39
yourself understand from you know your users your developers
51:45
and your infrastructure team. What are their needs?
51:50
What are their concerns? And you let them know here are
51:54
our needs from infosec standpoint.
51:57
I think when that gets on the table then you can start to
52:01
solution around what those needs are.
52:04
And we can, you know, if you pursue this as kind of a
52:07
partnership all parties leading to try to make sure that all the
52:13
needs are taken care of. That's the right approach,
52:16
that's what I say. Yeah, collaboration partnership
52:19
is exactly what I was thinking to know what is expert in
52:21
everything, you know, be a good partner, I guess to the rest of
52:25
the business. We're whichever side you fall
52:27
on, okay. I think that'll do it for this
52:30
week. I will have in our show notes,
52:34
Mike's. LinkedIn.
52:35
Hopefully, you're cool with that, and connecting with people
52:37
out there, and also a link to Sophos.
52:40
Hopefully, I pronounced it correctly that time.
52:42
So you can learn more about what's happening there.
52:44
Good. Okay, cool.
52:46
And, you know, obviously you can check us out on the web identity
52:49
at the center of.com. We're on Twitter at idac
52:52
podcast. You can check out our live
52:54
streams which again we're trying to do those weekly slowly
52:57
growing, it slowly, figuring it out, but having interesting
53:00
conversations there as well. You can find us on YouTube at
53:03
idea c.y. I've and yeah, with that, we'll
53:06
go ahead and leave it my Q. Thanks so much for your time,
53:09
Jim sinks for your time and we'll talk with everyone.
53:12
The next one Jeremy guys, Thanks for listening to the identity at
53:19
the center podcast. If you like what you heard,
53:21
don't forget to subscribe and visit us on the web and identity
53:25
at the center.com.