Latest / Identity at the Center / #275 - IDAC Sponsor Spotlight - Sonrai Security

Transcript

#275 - IDAC Sponsor Spotlight - Sonrai Security · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:18
Jeff Stedman. Welcome to the Identity at the
0:26
Center podcast. I'm Jeff and that's Jim.
0:28
Hey, Jim. Hey, Jeff, how are you?
0:30
Oh, not so bad yourself. I'm excited for today's sequel.
0:35
This will be the first sequel we've had on the Identity at the
0:38
Center podcast. Yeah, we've got another sponsor
0:40
Spotlight episode. These are fully sponsored
0:42
episodes that we develop in collaboration with our partners.
0:46
And we're very excited to welcome back our first sponsor
0:48
Spotlight, which was Sundry Security.
0:51
We actually had Sandy Byrd join us way back in December of 2023.
0:55
Feels like so long ago, but welcome back to the show, Sandy.
0:59
Hey, thanks for thanks for having me back.
1:00
I just couldn't stay away so so much fun last time.
1:04
I think we talked about EVs at the end and Heroes.
1:07
We took an EV car, so it'll be interesting to see what today
1:09
brings for interesting topics. And we kind of kept that EV
1:12
conversation going because we were talking before we hit the
1:15
record button about EV stories and things like that.
1:17
So I feel like there's this natural affinity there.
1:19
But let's talk about Sun RE because you've got some new
1:22
things that you guys have announced.
1:23
I want to get to that in a second.
1:25
Now this is your second time being with us, so I'm not going
1:27
to make you go through your background.
1:29
You want to hear that? Go back and listen to episode
1:31
251. We asked Sandy all about how do
1:34
you get into the Zion space, but we do want to ask about sundry
1:37
security. Tell us a little bit about what
1:39
you guys do. Yeah.
1:41
And Sundry Security has been around for for several years and
1:44
we've spent a lot of time trying to get customers that are using
1:49
Cloud, AWS, Azure, GCP to least privilege and remove a lot of
1:54
identity risk out of their cloud.
1:55
So in that other episode, we talk about you know kind of four
1:58
steps to doing that quickly. We talk about unused identities
2:00
and getting rid of them. We talk about finding your
2:02
administrators removing some lateral movement has, but we've
2:07
also learned a lot in those those few years.
2:09
And so Sunri as it's kind of developed over time has come up
2:12
with solutions to you know fix these without generating
2:15
hundreds of thousands of tickets for your developers to go fix.
2:18
And I think we're going to spend some time on that today.
2:19
We're we're building some pretty innovative solutions in that
2:22
space and it'll be a lot of fun to talk about.
2:24
Yeah, I'm excited to get into it.
2:26
You know there was a question that I that I wanted to ask last
2:28
time and this is something actually we have listeners ask
2:31
when we have folks like you on. And that's really is how do we,
2:34
how do your clients or customers measure success with Sunri.
2:38
And I imagine we'll probably talk a little bit about that and
2:41
when we talk about the the the new feature that you guys just
2:44
rolled out. But at a very high level, how do
2:47
your customers measure success with your solutions?
2:51
Yeah, it's again, every customer does this slightly differently,
2:55
but there's definitely key performance indicators, you want
2:57
to want to call it that. The solution itself always
3:00
measured a risk score, right. So you know, we, we take a look
3:03
at all of the types of risks that are there.
3:05
We kind of generate a score from it.
3:07
You know, maybe you get a 85 or something like that and you want
3:10
to reduce that down to a 70 or 60 or 50 or whatever you want to
3:13
get to. And you hope that your
3:15
production environments and where your sensitive data is a
3:17
low risk and you know maybe your sandbox accounts are are high
3:20
risk, but generally you want them all to start to get to be
3:22
at a lower state. We spent a lot of time trying to
3:27
help customers do that. And so you say, well, what's
3:29
success and what's interesting is some customers built some
3:34
great process. They kind of operationalized it.
3:37
They found those critical things they wanted to fix.
3:39
They generated tickets back to their teams to say, you know,
3:42
these applications and workloads you've created are not at least
3:45
privileged. Here's a recommended fix for
3:48
that. Maybe it's a new policy in AWS.
3:49
Maybe it's a better role in in Azure.
3:52
Apply that to the, you know, whatever the workload is, deploy
3:56
that out. You know now you're closed the
3:58
ticket. And So what would happen is, is
4:00
that those tickets would get issued, The teams would actually
4:03
do that. They would always test them
4:04
through, you know, some sort of a staging or UAT environment.
4:08
It would work. They'd move it to prod, the
4:10
ticket would close. In summary, everybody would be
4:11
happy. We'd celebrate.
4:14
And So what happens is over time you close more and more of
4:16
those, the risk goes down and everybody's is kind of
4:19
celebrating. But when we actually started to
4:22
measure ourselves against that in a way we would find things
4:24
like, you know, maybe a customer fixes 2000 of these tickets over
4:29
a 10 month period and everybody's like this is we're
4:33
super happy about this. And then you look at their cloud
4:36
and you realize in the time that it took them to close 2000
4:38
identities, they've created 4000 more that are no longer at least
4:41
privilege. And we have to build a history
4:43
for that to figure out what least privilege is.
4:44
And that cycle starts all over again and you start thinking
4:49
there has to be a better way, right?
4:50
We can't. You know we have these
4:52
interesting customers that have you know, 50,100 thousand
4:55
identities that are workload identities.
4:57
If you're going to do that one at a time and have people test
5:01
them, not just like randomly rewrite the policies on them
5:03
all, which maybe I would say that you could do, but not
5:05
everyone's comfortable with. It's going to take, you know
5:09
you're going to measure this in months and years for success.
5:12
And I think you know customers today, we're all a little
5:15
distracted. We like these kind of quick
5:17
wins. We needed to find a way to get
5:19
to the quick wins faster and that's we're going to spend a
5:21
lot of time talking with today and the new product.
5:23
But you know customers definitely measure success using
5:26
those risk scores. Let's get those things lower.
5:28
I can show progress. Let's close tickets, right?
5:31
Issue tickets, close tickets. I can measure success that way.
5:34
But the real thing is, is like, is the actual cloud more secure
5:38
at the end of the day, right? And I think, you know, even
5:41
ourselves measuring ourselves as a customer needed a better way
5:43
for that customer to get to that point faster.
5:46
Sandia called this a sequel, and I think the best sequels are,
5:50
you know, a lot of the same characters, but a new story.
5:53
And you have a new story and it's you just announced this
5:57
thing called the 1st, the first cloud permissions firewall, and
6:02
by calling it the first it means nobody knows what it is.
6:06
So can you tell us what is the first cloud permissions
6:10
firewall? Yeah, there's a there was a lot
6:13
of discussions about using the word firewall.
6:15
Let me tell you, when we named this product there were it was
6:18
definitely a triggering word for everybody for pro or for con for
6:23
using this word. But we if you go back to that
6:26
original problem where we say we're trying to fix this 100,000
6:29
identities and we're fixing them one at a time.
6:32
And customers, we, we actually said customers are struggling
6:34
with this, right. If you didn't have a dedicated
6:36
team helping you know a lot of times the ticket doesn't get
6:39
fixed whatever it was and we said we have to flip this on its
6:41
head. The problem is, is every you
6:43
know, development team building a workload is free to create any
6:46
identity they want with any set of permissions that they want.
6:49
And across all three clouds you have like 4443 thousand
6:53
permissions. There's like today and you think
6:56
you know, do some relation back to firewalls, there's an awful
6:58
lot of ports and a lot of lot of IP space that you have.
7:01
And no one says, oh you can just have all the IP space in all of
7:05
the ports. It's not how the world worked in
7:07
networks. And so when we looked at the
7:08
permission space, it wasn't terribly different than that.
7:10
We were kind of letting the developers do anything they want
7:12
and we said can was there a way to flip this on its head to
7:15
create a default deny state And he said 43,000 permissions.
7:19
Most of these things are insensitive, but there are some
7:22
of them that are really sensitive, right?
7:23
Like there are permissions in cloud that allow you to take,
7:26
and this is one of my favorite ones, take the file system off
7:29
of this running workload and make it a URL on the Internet so
7:32
that you can share it somewhere. It's like who thought that was a
7:34
good idea, But it exists in these clouds and so there's
7:37
certain permissions that are super sensitive and how do you
7:40
put those in that deny state? The other thing we did to kind
7:44
of prove that this was a real benefit in doing it was we
7:48
measured like out of everything that has these sensitive
7:50
permissions in cloud, how many of them actually used them that
7:54
were granted them. And this is what got to be super
7:57
interesting, Found out that only like between 5 and 10% of the
8:01
identities that had them ever used them across all of our
8:05
customers. You know, you're just talking, I
8:06
don't know, millions, hundreds of millions of identities,
8:09
whatever it is, don't use these. So why is it that we're giving
8:13
them to everybody but no one's using them?
8:15
And so said, look, there's a way to do this where we can flip the
8:18
model on its head. We can make this like a firewall
8:21
with a default deny state. But the again, so now the
8:25
problems start. If we do that and then someone
8:28
needs the permission building a brand new workload that's never
8:31
existed before, how are we going to give it to them and not screw
8:33
up their work day? And so it's interesting, we used
8:37
all cloud native stuff for this. There's no in the firewall
8:40
itself, There's no like proxy, There's no, you know, jump box.
8:44
There's none of those things. It's all cloud native and it's
8:46
programmed cloud natively. But it puts this deny at the top
8:49
for the really sensitive permissions.
8:52
Everything that needed them from the previous history has access
8:55
to them, however, and that's only 5% of the things that were
8:59
granted them. And on day two, what happens is
9:02
as soon as somebody trips the wire and tries to use one that
9:06
never, you know, they never did it before.
9:08
But today it happened. And maybe it's a Terraform
9:09
script, you know, deploying some infrastructure, maybe it's a
9:12
Jeff just trying to, you know, build a crypto miner in the
9:15
cloud. Whatever it is, it happens.
9:17
They trip this wire and immediately in whatever they use
9:20
for chat OPS could be Slack, could be teams, whatever it is
9:23
they get in the team that's responsible for that area gets a
9:26
notification saying this just happened.
9:27
We want to give Jeff access to go and do that sensitive thing.
9:31
They hit approve. Jeff gets notified and literally
9:34
within one minute they now have access to that sensitive
9:36
permission. But it leaves that 95% space
9:41
basically never used and never granted and it.
9:44
So it's a completely different model.
9:45
And So what happens is, is that you kind of learn the history.
9:49
You put these firewall controls. They're not actually firewall
9:52
controls. They're using, you know, in
9:54
Amazon, it's SCP and Google, it's the deny bindings.
9:56
There's these other ways of doing it.
9:58
It puts these controls in place to create this default deny
10:01
scenario. And then immediately after that
10:03
goes into this permissions on demand model.
10:05
And so you have this immediate contraction of this risk value.
10:10
And so now you think about the summary platform measuring risk.
10:13
You all of a sudden go from the 75 risk to A50 risk literally in
10:17
five days and you want to talk about success.
10:19
You know, people can measure that and say, wow, I actually
10:21
made a difference in a few days. So again, triggering word again,
10:26
love to hear your guys's opinion on it, right.
10:27
You know, is firewall the right word for this or not?
10:30
You know, we, we said one time, you know, firewalls weren't
10:34
embedded for networks. We think of them that way
10:35
because we came from that world. But there was a firewall in my
10:37
PAN. There was one in an apartment
10:39
building between 2:00. You know what I mean?
10:40
Like firewalls are not unique to networks, but we as
10:43
technologists think about them as a network thing, right?
10:46
So again, it's it is this bit of a triggering word.
10:48
Love to hear your opinions, what you think, good or bad?
10:50
The last point was was spot on. So point number one, you may
10:54
know Jeff better than he knows himself.
10:58
You know, building a crypto miner.
10:59
If he was a hacker, I could totally see him doing that.
11:02
All right. Second thing is I'd love that
11:05
default deny as a starting point because even when you were
11:09
asking like is firewall the right term.
11:11
I've seen you back to my networking days and it was the
11:15
the death rule on a firewall was allow any to any right.
11:20
You remember that does that trigger something And then it
11:24
was like the smart firewall people knew that it was the
11:27
default rule had to be deny any to any you know and then you
11:33
start allowing things rather than working in reverse of allow
11:37
any to any and start blocking from there.
11:39
So to me it, yeah, it it's sensical.
11:44
I like the word firewall. I don't, I don't have a problem
11:47
with it. Jeff, do you have anything on
11:48
that? No, I think it's, I think it's
11:51
appropriate. You know if you're asking me,
11:52
I'm in a marketing meeting. I'm always trying to find with
11:54
funny names I would think of like you know the cloud
11:57
permission ban hammer or something like that.
12:00
You know, I'm looking, I'm looking at like Reddit or things
12:02
like that to have fun with it and that's why they don't look
12:05
at me to to name things. That's they don't.
12:07
I don't get the name stuff either.
12:08
You know we had a code name of it called Purple for the whole
12:11
time it was. It's still really hard to get
12:12
that on my head. I may call it Purple sometime
12:14
today during this call. But it, you know, it's it's good
12:17
to have code names. It's good to have unnames.
12:19
Too. That's a good little tidbit for
12:20
people who are listening. Right.
12:21
Hey, show me, show me your purple.
12:23
Oh, Sandy's going to know what that means.
12:25
I don't know anyone else. So maybe it might be weird if
12:26
you take something else. But that could be a way to
12:29
approach it. I do want to get into this a
12:31
little bit. I know that you we're going to
12:32
try something a little bit different here and look at it on
12:35
an audio podcast and we're going to try our best to kind of step
12:38
through it. But the goal here is to see it
12:42
in action so that Jim and I can ask some questions but also
12:46
encourage people. You know go to the website and
12:48
if you want to check out this and other things you can go to
12:51
sunri.co slash IDACSONRA, i.co/IDAC and you can actually
12:58
see the demo there and try it out and and so forth.
13:01
We'll talk about that a little bit, but I think maybe the talk
13:03
track of us and you showing it to us for the first time would
13:07
be helpful for us to ask questions and hopefully people
13:10
find it valuable out there. See Internet First, an audio
13:13
only demo. Of a of a visual.
13:16
Concept yeah we're we're all about first you know we were the
13:19
first sponsor Pocket. Now we're going to try the first
13:22
you know visual, audio only demos and we'll we'll see how
13:26
this works out. I think we're we're going to try
13:28
to be somewhat descriptive if all has worked well in the audio
13:31
world. You can see my stuff, though
13:34
Jeff and Jim correct. You can actually see a screen.
13:36
Yes, can. So I see a let's.
13:38
See a dashboard. Yeah, I see the interface.
13:40
I see. Let's see a few different
13:42
metrics here. So talking about sort of like
13:43
how you measure success, right? 3.1000 IM users and roles with
13:47
excessive privilege, that sounds bad.
13:49
How do we fix that? Over 1100 zombies?
13:53
That sounds even worse. So yeah, walk us through what
13:56
we're looking at here. Look we're we're going to do it.
13:58
So you kind of getting it right at the top of the interface.
14:01
There are these great statistics in four areas that you know
14:04
we're we're going to, we're going to look at and you know
14:07
the most complex one is kind of that first one you you talked
14:10
about where you have some number of identities that have been
14:14
granted these really sensitive permissions and then you know
14:17
they're not using them. So we should take it away.
14:19
And there's, there's these great buttons underneath of them that
14:22
people can't see, but you guys can see called like protect
14:25
identities or quarantined zombies.
14:28
And you know, those ones are actually quite useful.
14:31
But we even do things, simple things like regions.
14:34
And so if you come all the way over to this side of the
14:35
interface, you know, if you're not using certain regions, you
14:39
can actually just come in, click one or click disable these
14:42
regions and we will actually disable those regions.
14:45
Or if you have unused services, we can show you the services
14:49
that you're not using and you know you can disable those.
14:53
This is the thing that's really interesting with these cloud
14:55
providers though. Like every one of them has 300
14:59
unique services, but any given account or project that you're
15:03
working on probably only uses 20 or 30 of them.
15:07
And there's a whole bunch of dormant permissions in them that
15:10
are not being used that are latent that if when Jeff breaks
15:13
into uses crypto miner, you know, maybe you've never used
15:16
Lambda before, but Jeff can use Lambda to prank that thing,
15:19
right? And so we want to try to reduce
15:21
that attack surface, you know, as we can through some of these.
15:25
And there's there's obvious Security benefits to that.
15:29
But is it the potential cost savings to say, OK, we have all
15:34
these unused services, let's make sure we're not paying for
15:36
them? I I think there is now.
15:39
I always I always remind myself, you know you have to solve the
15:42
use cases you build stuff for and not try to make it too wide,
15:45
because then things get complicated for a while.
15:47
Do you solve this use case for cost and you solve this one, But
15:50
there's no doubt that, and this is the regions and the services
15:54
are exactly as you're saying, Jim, are the ones that
15:57
accidental things happen in, right?
15:58
Like, I think AWS intentionally makes it so that if you
16:02
accidentally spin something up in a region that you don't use,
16:05
you never see it again. And.
16:06
But it shows up on the bill every month at the end of the
16:08
month, right. And you know, the same thing
16:11
with services. Oh, I was experimenting using, I
16:13
remember this very well from our own sales engineering team.
16:17
You know some customer wanted to test something with that.
16:19
It was called a hyperscaler in Azure.
16:22
So they dropped one into the account and of course it ran the
16:24
demo account for a couple of other.
16:25
And I think the thing started at like $1000 a month, right.
16:29
And you know, until we caught it on the bill much later, you
16:32
know, no one even knew that was happening.
16:34
So absolutely there's a cost benefit there, Not our main
16:36
target market by any means, but certainly it's going to help in
16:39
those, in those areas so. So as I look at the interface
16:45
here, yeah, so I look at the interface here, I'm, I'm seeing
16:48
a list of services, right? So EC2 and this, these look like
16:51
AWS type things, right? EC2, Cognito, Alexa for
16:54
Business. And you've got different
16:57
categories across the type, account usage things say like 4
17:01
out of 10, a sensitive access of 15, the sensitive permissions of
17:04
eight. And then you've got a status
17:07
column that says, well, there's a couple of them, but
17:09
unprotected, partially protected, disabled, pending,
17:13
and then protected. And then there's like a little
17:15
button over the right that says protect, which looks like it's
17:18
for things that have not yet been protected maybe or
17:20
disabled. Can you walk me through kind of
17:23
left to right what we're seeing and what those figures and data
17:27
mean? Yeah, we wanted to make sure
17:30
that we could break these kind of default denies up in a way
17:34
where when you enable things, groups of things came back
17:38
'cause if you're, and I use the example, if you're going to
17:41
update security group rules, you're probably going to do
17:44
something with subnets as well, right?
17:46
There's, there's, there's these things that go together kind of
17:49
when you start to do them. And so it wanted to group them.
17:50
So you have the service as an example, you may have EC2 or the
17:53
IM service and it will have a group of these sensitive
17:56
permissions associated with it. And so you probably want to
18:00
protect all of those at once because the types of identities
18:02
that accidentally get granted EC2 star have all of the
18:06
permissions, but again, very few of them need them.
18:09
But the ones that need them probably need more than one,
18:11
right. And so we kind of group those up
18:14
the the sensitive, you know, you've got this kind of, you
18:17
know, sensitive permissions call and kind of tells you how many
18:19
in that service, you know, have sensitive or how many sensitive
18:24
permissions are in that service. And we did a lot of work on
18:27
this. This is where you know, we spent
18:29
time. Again, if you know enough about
18:32
AWS, as an example, an SCP space, it's limited.
18:35
You can't write SCPS that are massive.
18:37
There's all these limits you run into in terms of the size of the
18:39
SCP and how many you can have and all these things.
18:42
And so we had to be pretty selective about what we are
18:44
putting into those sensitive permissions.
18:46
And so we did all this work on, you know is this thing really
18:50
sensitive or not. And I, you know we got lots of
18:52
examples that way. And so again each one of those,
18:56
that's how many sensitive services you have and then you
18:57
have how many identities have access to that in those
19:01
sensitive services. And we can drill in.
19:03
We may do that in a minute. We'll drill in a little bit
19:05
deeper in a few of these, but that will tell you you know out
19:08
of the 75 that have access how many really use it 234 you may
19:13
we'll drill into that in a minute and then when you hit
19:15
that protect button, it doesn't actually protect instantly.
19:19
What happens is you click protect and it stages the
19:22
changes into like a pending changes state and that's why you
19:25
see that disabled pending, right.
19:27
So if somebody's made a a change, they put it into that
19:30
mode. What we actually do is we build
19:33
up this piece of infrastructure as code that actually deploys
19:36
all the cloud native mechanisms for you that actually implement
19:40
this firewall. And I think that's so important
19:42
because it's not like we wanted to be in the middle of you know
19:46
the the cloud intercepting every API call.
19:49
We actually wanted to use the cloud native mechanisms that
19:52
they've given you for putting these things in place and
19:55
utilizing those. So what we've done is
19:56
programmatically created that piece of infrastructure as code,
20:00
you as the customer then go and deploy that and so.
20:04
It's a way that you can kind of test this in one area of the
20:06
network, should call it a network.
20:09
We're now right into the firewall world, one area of the
20:11
cloud and account, you know, a project that you're working on,
20:13
you can protect it there and do that.
20:15
And so that's kind of all the calls we may drill into one in a
20:18
minute, you know, and then you know, we can go from there.
20:22
Again, I love those zombies and I I wanted to show you guys this
20:26
thing on zombies 'cause I think it's pretty neat.
20:29
Just like the services we can find every identity that's
20:34
basically unused, We use 90 days to start, you know?
20:37
Again, some people may want it to be longer.
20:40
We can have a big long discussion about how long
20:42
something has to be unused for before you think it's unused.
20:45
But what's neat about this is we can take every account, every
20:48
project, every subscription, and we can tell you in there like
20:50
what identities are unused. And when you actually click the
20:54
quarantine button, we don't actually delete those identities
20:59
at all. What we do is we basically short
21:02
circuit their permissions so that they can't use any of them
21:04
anymore. And why we do that is is again
21:08
back to history after years of doing this with customers.
21:10
What we discovered was people were scared to delete this stuff
21:14
because what happens is, is that maybe they have a a process that
21:17
runs every year and it does something or they have a
21:20
infrequently used device and they've used something in their
21:23
cloud to configure it. But if you delete that identity
21:27
and then you have to put it back, you don't know what
21:29
permissions it needs. You don't need what the don't
21:31
know what the identity was called.
21:32
Maybe that's connected to a resource policy so you can't put
21:35
it back the way it was. Maybe it had an access access
21:38
key, and I hope you didn't do this, but you hard coded the
21:42
access key in your code and now if you've deleted that key
21:45
material, you're going to have to generate a new one and then
21:47
you know, have somebody fix the code before the thing would work
21:49
yet. And so we had this scenario with
21:51
zombies where people just wouldn't delete them.
21:53
And you know, this is a a great demo environment.
21:56
We look at this, but we had customers that have 10s of
22:00
thousands of unused identities sitting in their cloud and they
22:03
won't delete any of them because of the sphere.
22:06
And we think this is a better way.
22:07
We can basically clamp them down and say you cannot do anything
22:11
with this identity. But if you do come to the point
22:14
that you need to and we see it try to wake up, it gets a deny
22:18
for the first time in seven months, send the team a message
22:21
saying do you want to reanimate the zombie?
22:24
You can reanimate it and the thing comes back to life with
22:26
exactly the same permissions it had, exactly the same access key
22:30
it had. All of those things are still in
22:31
town. So you know, I love the zombie
22:33
story. Again, curious what you guys
22:35
think about that. But it it really is a way to
22:37
kind of clamp down a lot of this risk pretty fast.
22:40
It's. In these environments, it's
22:42
super cool. I hope that instead of
22:44
reactivate, it just says reanimate zombie.
22:47
There's there's a there's my marketing for you on that.
22:50
I want to go back to a couple things.
22:51
You you you pointed out, you mentioned, and I wanna make sure
22:54
I heard it right. If I click protect to do
22:58
something, you're not actually do anything.
22:59
You you mentioned you're staging a change and that you're using
23:02
native infrastructure basically as code to stage that change.
23:08
Does that mean I can as an engineer look at that code and
23:11
inspect it and make sure everything looks OK?
23:13
The way I can double check it and have that level of
23:16
transparency it it's exactly true and we.
23:20
We did it this way again, we had a bunch of design part.
23:23
We've been working on this for, I don't know, nine months, maybe
23:26
a year now. And we've had all these design
23:28
partners all on the path with us that have been kind of helping
23:30
us with this. And what we found was the
23:33
editing. These parts of the cloud are
23:36
super sensitive, like SCPS at Amazon are a great way to break
23:39
something. You know if you deny everything,
23:40
all of a sudden you can't do anything in your whole cloud,
23:42
right? Or if you create a deny by any
23:44
GCP, it, it overrides everything.
23:45
So basically the customers are like, you know this is a super
23:49
sensitive thing for us. We don't want a third party
23:51
vendor like Sundry having direct access to going to change these
23:54
things. And some of them had really
23:57
strict policies that said, OK, all of our changes to this part
24:01
of the cloud must be checked into GitHub, they must be PR Ed
24:04
and then they must be deployed using some mechanism they had.
24:08
And so we set it up this way so that when you do that, you know,
24:12
set of pending changes, you can actually get this template, you
24:16
can check it into GitHub if you want, you can, you know have APR
24:18
on it, somebody can inspect every line of that code and then
24:22
go and deploy it into the cloud and make it active.
24:24
And so we separated the permissions of the product being
24:27
able to actually go in and make the changes versus automating
24:30
how that gets done for the customer to go do it.
24:33
And it was it was where all the design partners settled with a
24:37
good experience, right. You know, there's a few of them.
24:39
That said, I just want a button to press.
24:40
OK, well, you can automate the button and make it pressable if
24:43
you want. But for the people that wanted
24:45
those checks and balances, it was a great intermediary for
24:48
doing that. So, yeah, all right, let me show
24:54
you guys a couple other things. I'm going to, I'm going to skip
24:56
ahead here a little bit and I'm going to, I'm going to show what
25:00
it looks like when you get into one of those individual
25:03
services. And it's the first time, by the
25:05
way, we have light mode and dark.
25:06
Mode, which again you guys are. Thank you, thank you, thank you.
25:09
Dark mode should be the default everywhere.
25:12
And that is a hill. I will Zion.
25:14
You know Zion, Yeah, we had, we definitely have developers that
25:16
are in the same hill as you and then we have a few of our
25:18
support guys that like Light Mode, so it's a weird, you know.
25:21
So much easier on your eyes, especially at night.
25:23
You have this, you know nobody likes just layering light
25:25
screen. At least you know a dark.
25:27
Ray, can you notice? We can talk about this on this
25:30
podcast. You notice we snuck the purple
25:32
color into the cloud, which is Firewall.
25:34
Yeah, yeah, yeah. Yeah.
25:35
It's all about branding name somehow.
25:36
Yeah, exactly like so. Everybody uses.
25:41
There's certain services you can't turn off, right?
25:43
So it's nice to talk about unused services.
25:44
But then like if we go into EC2 as an example, every account's
25:49
probably going to use those and you know you'll have some set of
25:51
sensitive permissions with it. But when you look at an
25:54
individual account, we could actually find automatically the
25:58
identities that are using that. And so this is an exam.
26:03
This happens to be an AWS reserved SSO role that's using,
26:06
you know, in this particular case, one of those those
26:08
sensitive permissions. But you can actually look at
26:12
every service individually and see everything that is using
26:15
them versus you know what you know has access to it.
26:18
And so I think it's an interesting way you think about
26:19
that first screen with like 75 identities and then you come in
26:22
and you find out there's really only 5 using it or 10 using it.
26:26
You really are compressing that open space of of permissions
26:30
that you have very, very quickly.
26:32
So anyway, just another neat part of the product in in that
26:37
side. I know we've been looking at a
26:39
lot of AWS resources. I guess from a capability
26:43
standpoint, is it similar for both Azure and for GCP?
26:46
Are there differences in functionality?
26:49
There, there we tried to make it as close to the same experience
26:54
as possible in all three clouds. I will say there's this, and I
26:59
think we may have talked about this on the first podcast we
27:02
did. AWS and GCP are deny first
27:07
models, so when you put a deny anywhere's on an identity, it's
27:12
denied to do whatever that permission is.
27:14
No matter how many allows you give it, you can never override
27:18
that. Deny Azure is not that case.
27:21
Azure is an allow first model which you can put as many denies
27:25
into Azure as you want. But if there's one thing that
27:28
says rather through an inherited entitlement or a direct
27:31
entitlement, if it says that you can do it, then you can do it.
27:34
And so we had to change the experience just slightly for
27:39
Azure because unlike AWS and GCP where truly it was a centralized
27:45
control at the top that we just said, you know, clamp this down
27:47
and deny it, in Azure we had to actually do some fiddling with
27:51
the real policies that people were using to change them from
27:54
and allow to deny in that scenario.
27:57
But we were able to actually, again, infrastructures code's
28:00
amazing, we were able to actually write the state into
28:02
the the RBAC assignments that we were doing to keep it a similar
28:07
experience. It looks the same when you're
28:09
doing it, It feels the same to the end user, but under the
28:13
covers it's quite different what it's actually doing.
28:15
So anyway, always the things that you run into in in these.
28:21
What is it? OK, I'm gonna.
28:22
I I I'm just curious what does it take to set this up?
28:25
I just connect it similar to I guess other services where I
28:29
feed it my an admin credential, I'm assuming of of each of
28:33
these. We we deploy it with
28:35
infrastructures code as well. So in AWS we use cloud
28:39
formation, in the other two we use Terraform.
28:42
Again there's there's different ways of doing it.
28:45
What's interesting is, is that it kind of goes in in monitor
28:48
mode by default. So when you when you deploy
28:50
this, it's going to learn all the things about your cloud, how
28:53
big that space is between what's been granted sensitive
28:56
permissions and what's used at how many zombies you have, what
28:59
services you've used. And it does that using really
29:03
light permissions. Think of like security auditor
29:06
style permissions that can list and describe things but don't
29:09
have any ability to change anything.
29:12
Once you actually go live with this and now you've deployed
29:15
that, you know you've gone from that pending state into the
29:17
protection state. At that point the thing becomes
29:21
live and there are slight different permissions that
29:24
happen in the cloud at that point where the system actually
29:27
needs to be able to change some resources and stuff.
29:28
But they're still really light permissions.
29:30
They're not, you know, control the whole organization and
29:33
control the SCPS. They're just the light things
29:35
that do the permissions on demand work.
29:37
We have to turn these permissions on and off on an
29:39
individual exception basis. So it's pretty, it's pretty
29:42
neat. I've actually got an example
29:44
here we can show in AWS where once this has been set up like
29:49
and it's in its live mode so again you you've onboarded, it's
29:54
all done with infrastructures code.
29:55
It's a bit like watching paint dry.
29:56
It takes you know some period of time to go and do this but
29:59
you've deployed these if a developer's in doing something.
30:03
So this is an example. Here you see an AWS console and
30:07
you know somebody's editing a security group, so go back on
30:09
that network theme again and they were to edit one of these
30:13
rules. So they're going in and they
30:14
say, look, I want to create an an inbound rule and they want to
30:17
open up port 80 and port 22 or something.
30:20
When they actually go and click this to do it, they will
30:23
immediately get this deny response if they're not in that
30:25
exemption list, right. And so the thing's been
30:27
deployed. Someone has gone and deployed a
30:30
bunch of controls using, you know, their Cloud OPS account.
30:33
So it's in the protection mode. They get a message that looks
30:36
like this the first time that they do it.
30:38
But what happens in our system is immediately after that is
30:41
there becomes a request and this.
30:43
Like I said, this can come in Slack can come in, teams come in
30:46
e-mail however you want. But fundamentally what happens
30:49
is we detect you see my example user here.
30:52
Sneaky. Jeff I was honored for a second
30:53
there. I had.
30:54
I saw Jeff contest and then I'm sneaky Jeff.
30:57
What? Now you're sneaky Jeff trying to
30:59
get those bitcoins. That's right, they said.
31:01
You know him better than he knows himself.
31:05
Exactly. I so you know Sneaky Jeff's in
31:08
here, Sneaky Jeff gets denied. This goes to that team that's
31:11
responsible to approve these. They click approve it.
31:15
They can, you know document why this is approved and all these
31:18
things. And at that point, you know,
31:20
Stinky Jeff gets a message back and they can save this and
31:23
immediately it works. And it's again, we, we play a
31:26
little bit here in the demo to make this faster and speed it up
31:28
so that we don't have to log into AWS.
31:30
But that the reality of the situation is you go from being
31:33
denied to being allowed to do something in minutes.
31:37
It's it's literally from the time change and the slack
31:40
messages and the people clicking one minute later you have
31:43
permission. And it's this is the thing that
31:45
the design partners were super excited about.
31:47
You know, it's one thing to be able to take all of this risk
31:50
out, but it's another thing not to basically block the teams
31:54
from doing their work when they needed to get it done.
31:57
And so again, that was one of the biggest kind of epiphanies
31:59
in building this thing was it's not actually about, you know,
32:03
the cloud permissions firewall that's so important in that
32:06
default tonight. It's about enabling all of the
32:08
teams to keep running at speed and not getting in their way so.
32:13
So Sandra, I can imagine like one of the initial objections
32:17
you might have from a cloud team is like, well, if they only have
32:23
a native US cloud or only have AGCP cloud, couldn't they get by
32:28
with the tools that are provided within that cloud to kind of
32:32
achieve like you hear this from Amazon customers where it's like
32:38
we can use Access Analyzer. Is that like such a poor man's
32:43
solution to this problem that it's not really a good question?
32:50
It's, it's interesting. I actually think and sometimes I
32:54
think about it this way, Jim and I get this a lot in like talking
32:57
to customers, especially customers that have not gone
33:02
through the pain of trying this with Access Analyzer yet.
33:05
So they've seen Access analyzers marketing material or they've
33:08
seen sundry securities marketing material from before this point
33:11
in time. There's a a perfectionist view
33:16
that I want everything to be perfectly least privileged.
33:19
So what Access analyzer's doing, it's going back to every
33:23
permission that's ever been used by every divinity and you know
33:26
AWS 14,000 permissions and Azure 10,000 permissions.
33:29
I don't know the numbers exact, but it's it's high and it's
33:32
creating that perfect policy to put on that, that identity and
33:37
then you need to test that, right.
33:39
So if it's a real workload, you now need to test it.
33:41
You test it, then you get it to prod and then you do it all over
33:44
again and tomorrow there's a new identity, but you got to wait 30
33:47
days or 90 days for Access Analyzer to get there.
33:51
But I think in that early stages, even myself when we when
33:55
we founded Sunray, that's what I wanted.
33:58
I wanted the perfect outcome for every identity.
34:02
And I think I just maybe have the scars on my back now from so
34:04
many years of saying we got to do something a lot faster to get
34:08
to a lower risk much quicker. And then go back and apply that
34:12
aspect at a much more granular level to the things that are
34:16
really important, right. The the things that are really
34:18
that are really exposed. But I think the question is
34:21
still very valid that you're asking, right?
34:23
Like Access analyzer, the Sun Ray solution that we talked
34:27
about on the last podcast, whichever that's trying to do
34:29
this perfection thing, I think people want to do that.
34:33
I don't think we actually give our development teams enough
34:35
time to actually do it. You know what I mean?
34:37
Like, they're not gold to get their app out the door because
34:41
it's at least privileged, right? That doesn't make the money,
34:43
right. And so, you know,
34:45
vulnerabilities are a great example, right?
34:47
You got to patch your vulnerabilities, but you have to
34:49
do that because there's an audit team coming behind you to say
34:51
are they patched, right. And we all know we probably
34:54
have, you know, some, you know, backlog of those that we have to
34:57
work at. So what's the chances you're
34:58
going to get to this privilege thing in that scenario?
35:02
And so I think, again, your point's valid.
35:05
I actually think there's a there's a a reason to do least
35:08
privilege. I just don't think people can
35:10
execute it and operationalize it fast enough.
35:12
So. Yeah, that that's a great
35:14
response. You know, I'm kind of trying to
35:18
picture this in my head. Like, OK, let's say we take this
35:21
permissions firewall and we want to have it work in our AWS cloud
35:28
as well as our GCP cloud. Do I kind of like, install
35:32
something? How?
35:33
How exactly does it work? Where does Where does it go?
35:38
Yeah, there's two. And again in both clouds,
35:41
slightly different deployment, but it's the same process.
35:44
Basically in the initial monitoring mode you're putting
35:46
in those security Otter permissions for the sun res, SAS
35:50
to look at your cloud. You know in AWS if you're
35:53
familiar with these things, you would actually be familiar with
35:55
like the the manage policy for security otters, pretty light.
35:59
In GCP it's a very similar scenario where it's just looking
36:03
at like list, describe permissions, list the service
36:06
accounts that are there, list the the roles that they've been
36:09
assigned like things like that and then what happens after
36:14
that. So that's the first deploy.
36:15
But we can see your whole cloud from that and IT and you know it
36:18
takes 10 minutes to deploy it maybe in a really big cloud with
36:23
like you know, 5 or 600 accounts.
36:25
It may take a day to to look backwards in time, 90 days.
36:29
So we can get history, but after that day we have that
36:31
visibility. Then you actually protect stuff
36:34
and you click deploy again. That's another piece of this
36:37
infrastructure's code that you're going to go run and put
36:39
those controls in place. So you know, you ask like where
36:42
does it go? Well, it kind of lives in the
36:45
cloud with the rest of your workloads, right.
36:46
You know, it becomes another identity with a bunch of
36:48
permissions on it, hopefully not too sensitive, right.
36:51
That's actually monitoring your cloud.
36:52
It's it's all cloud native. You know, there's no, as I say,
36:56
no man in the middle, no proxies, no weird boxes.
36:59
It's it's a great way to do it. So and no vulnerabilities to
37:02
patch 'cause there's no there's no running workloads there, so
37:05
even better for you. Yeah, You brought up the, the
37:07
point about like no proxy etcetera.
37:10
So this is just cloud, right? I mean there is no version for
37:17
the on Prem because I would love to have something like this for
37:20
on Prem. I'm sure I'm not the first one
37:22
who's ever wanted that. Assuming I'm right and it's not
37:27
for on Prem, why doesn't anybody built one for on Prem?
37:30
So on Prem I and we talked a little bit about this in the
37:34
prep call and we did this and I I had this you know whatever
37:38
vision like why did Sandy build a company in cloud?
37:41
Cloud was this interesting enabler for the first time that
37:45
allowed us to see all of the things that people were building
37:49
and it was like having a real time CMDB running all the time.
37:52
So why is it? Well, in order for Amazon or
37:55
Google to charge you for that Lambda function or that virtual
37:58
machine or that Bigquery table, they had to have an audit record
38:02
that it ran and it had to be on the bill at the end of the
38:04
month. And so Cloud gave us this first
38:07
time where we could truly see all of the workloads.
38:09
There was APIs to find them. We could see all of the activity
38:13
that they were doing. Over the last five years, I've
38:15
realized not everything is audited and there are some
38:17
exceptions to that rule. But the reality is most of it
38:20
is. And on Prem and I spent years in
38:25
the security information management, SIM space, you know,
38:28
doing these types of things, man, CMDS were always so out of
38:32
date. You know what I mean?
38:33
Like, it's like, yeah, this is what we believe it looks like.
38:35
And then tomorrow it was out of date.
38:36
And you know, you had the, the, the admin that had the extra
38:40
rack beside the rack that had his special gear in it.
38:42
And it was like it was so hard to find everything and even
38:47
capture the logs all in the central spot that people just
38:50
couldn't do it right. It was just too out of control.
38:53
The way that you built your VM was different than how the other
38:55
guy built his SAP. And you know, how does this
38:57
stuff all work? But when you deploy it all in
38:59
Amazon or GCP, you know those things are there, we can finally
39:03
get to them. And so again, I think there's a
39:06
huge benefit to possibly doing this on Prem.
39:09
I don't know that that's going to happen anytime soon because
39:12
it's just too much the Wild West, the cloud providers gave
39:15
us this centralized point with a centralized set of APIs that
39:18
could be predictable and allowed us to do this for the first
39:21
time. It's interesting.
39:22
In GCP, this deny function that we talked about, it was only
39:25
released like last year. They didn't even have that
39:27
functionality a year ago, so you couldn't have even built the
39:29
solution a year ago in GCP. Wow.
39:32
So it's it's interesting that they're they're accelerating
39:34
this way. Where you'd have to come up with
39:36
some kind of like Rube Goldberg type solution to kind of,
39:41
because it sounds like that's what you did in Azure.
39:45
It the the Azure one and you know somebody would get mad at
39:48
me if I said it was a Rube Goldberg machine that we built
39:51
for Azure. It's not, it's very it's
39:52
programmatic and it does it. But there is definitely there
39:56
were some struggles we had in the model in Azure because of
39:59
how it is where again up we don't have to demo up anymore.
40:02
I'm not showing you guys this, but when you go into the the
40:05
Azure and you're looking at a single subscription or single
40:08
management group. There's an extra line on it that
40:12
says these identities we can't control because at this point in
40:16
the tree, because above this point in the tree, they've been
40:19
granted permissions that we won't control At this point,
40:21
they're just inherited and because it's allow first, they
40:24
have access And so if you want to control them, you have to go
40:28
higher in the tree with Sunri to control those levels and there's
40:31
just no way around that. And it you know, it's because of
40:34
how their model works. So anyway, that's why as you
40:36
say, it's not a Rube Goldberg machine, but there's definitely
40:39
some differences in how that code executes compared to that
40:42
the AWS and GCP ones. Yeah, I was going to say I hope
40:44
it didn't come off that I said it that way, but I guess that's
40:47
exactly who's didn't mean to say it that way.
40:50
I just thought I should say, OK, so imagine the scenario, you got
40:56
a booth, you're at RSA or you're you're at AWS Reinforce or
41:03
you're at Identiverse. I'd love to see you guys go to
41:05
Identiverse, but you have a booth.
41:08
Now, who in the organization do you want to stop at that booth?
41:14
I mean, who buys? Who's going to buy this product?
41:18
Is it the person who says I need this to make my job easier?
41:23
Is it the Sisso who comes by and says I need this to make my
41:27
environment more secure? Is it the app developer who says
41:31
I need something so that I can have the security people get
41:35
what they want? Like who?
41:38
Who's the ideal person to come by and then who usually does
41:40
come by? Yeah, that's, yeah, those are
41:43
the great questions. You know the target for us is
41:47
and they have different names. It could be the Cloud OPS
41:51
engineer, Cloud infrastructure engineer, Cloud Operations
41:55
manager, It could be, it could be the cloud center of excellent
41:59
lead. I don't know.
42:00
It's the person that owns cloud for the whole company.
42:02
So if you have 50 teams building, somebody owns the GCP
42:06
infrastructure for those fifty teams and they're the ones that
42:08
set the golden rules for how everything rolls out.
42:11
They're the people that struggle with this and want to put the
42:13
controls in but are worried about breaking things, right.
42:16
They they want to put the SCP in to block it or they want to put
42:18
the deny binding in to block it. They're worried they're going to
42:20
break it. So we're they're our perfect
42:23
customer to talk to because they feel the pain.
42:25
They see how the sols look quick, they love it.
42:28
That said, they may not know our system exists and they certainly
42:30
may not go to Identiverse, right.
42:32
It's more likely at Identiverse you end up with the CISO or the
42:36
security lead for IM or something and they're trying to
42:39
get things to least privilege and they're talking that way.
42:41
We want to talk to those people too because we they may not even
42:44
know that much about how cloud works, but they know they have a
42:47
big problem, right. And so rather it's a CISO or the
42:51
head of Identity or whoever it is that knows they have a
42:53
problem around least privilege. We want to talk to them too,
42:55
because they're a big help. The you talked about the app
43:00
developer, it's interesting to tell them that, But they're not
43:03
the person that can procure and buy the solution.
43:06
They're they at best would be a sponsor to talk to the next
43:09
level. They may find it interesting,
43:11
but they don't even have enough power in their accounts to
43:13
deploy it. So they're probably not the
43:15
right target. Right.
43:15
So it's the the person responsible for the cloud or the
43:19
person, person or group responsible for security.
43:23
They see a demo. When, when does the epiphany
43:27
happen that, oh, I need, I need. There's there's there's two
43:34
epiphanies that happen which are super interesting right.
43:37
You know one is when they see the demo with the permissions on
43:40
demand thing, people love that it's like all my land we can we
43:43
can grab this stuff back very quickly.
43:44
The other one that I find so intriguing is the zombie one,
43:48
which is why I gravitate towards it, 'cause people just know that
43:50
they have these things and have no clue how they're gonna clean
43:53
them up. If they're scared to death to
43:54
leave them and they're like, seriously, we could turn those
43:56
all off and then turn them back on.
43:57
It's like, yeah, and people are like.
43:59
Wow, that's great. So those are the epiphanies for
44:02
the person walking up to the booth or that first call.
44:05
For customers that have been trying to do this, though for a
44:08
period of time, this is a relief for them.
44:11
They're like only land I I can focus on the right stuff.
44:13
I don't have to try to do this for 100,000 identities.
44:16
I can get this thing in place and and go about my my work and
44:19
those for those people. The epiphany comes more on that
44:22
sensitive permission clamp down that happens.
44:25
So I'm gonna make the first official feature request.
44:29
I want to see either on the website or maybe as part of like
44:32
the interface panel, some number in like a bloody font, this
44:37
number of zombies killed or something like that, right?
44:41
And it just increments up and up over time.
44:43
So yeah, some some free feature advice that I'm that I'm willing
44:47
to part with. I I love it.
44:50
I don't have a clue if I'll ever get that by our design team, but
44:52
I love the idea. Well, it's kind of purple 'ser
44:54
Egg. Yeah, that's right, purple.
44:56
An Easter egg for every time you, like kill a zombie account,
44:59
you get to go into a video game world and start killing a
45:02
zombie. Still a zombies, exactly.
45:06
So I think this sounds great. I love the demo.
45:11
You know, we got to see the demo.
45:13
Hopefully everybody else got to visualize it in their head.
45:17
But for people who want to try this out, Jeff gave a mention of
45:24
you know, where you can go to actually visually see the demo,
45:28
which I think was sundry.co/idac.
45:34
But if someone wants to actually try this out, what's the options
45:40
that are available for them? Yeah, there's this and this is
45:43
also a fairly large change for Sunroof Security, the company
45:48
we're doing basically 14 day kind of free trials of this
45:51
thing. You can just try it and if you
45:53
like it that's great and where you've actually put all of the
45:57
pricing for it on the website cause the concern with some of
46:00
these cloud tools are you go is like I don't even know if I can
46:02
afford this for my, you know my world and I don't want to try it
46:04
if I can't afford it, right. So we've we've opened all of
46:07
that up. So again bit of a different
46:09
world for us that we're trying but we think that kind of open
46:11
pricing model, 14 day free trials just go and try it, see
46:14
if it works for you. The great thing about this is,
46:17
is that you actually can figure out in 14 days if it works for
46:19
you. You know, you can get that
46:20
visibility, you can pick a development account, you can put
46:23
the controls in, you can try the PODO.
46:25
It rather works or it doesn't for you and your organization.
46:28
Our previous product was a large, you know, lots of
46:32
visibility, lots of things that you could fix.
46:35
But to get the full aspect of how you're going to
46:38
operationalize that took a lot longer.
46:40
And so it was a thing where it really was a bit of an
46:43
enterprise sale where this is a small team can run this.
46:45
You know, maybe you only have 10 AWS accounts, but it actually
46:47
makes perfect sense for. You so so Jim was talking
46:50
earlier about conferences, are you guys going to be at anything
46:53
coming up maybe like RSA or or AWS?
46:57
Yeah, we. So again a few of our people
46:59
will be at RSA. The big one for us is AWS
47:02
Reinforce, which is a fun AWS security only conference, right.
47:08
If you go to the the Reinvent Conference in Vegas, it has you
47:12
know everything under the sun from satellites to whatever the
47:15
security conference is. Just how do you secure a cloud?
47:18
Great sessions, great speakers. We got a booth there, couple
47:21
speaking slots which are which are pretty neat.
47:24
So that's a fun one for us. We love that conference.
47:26
It's a great conference. Few people at RSAI think we're
47:29
doing the Gartner. I am one at the end of the year
47:31
which I think you guys go to. So it's lots of places to see us
47:35
along the path. So I can come up to a booth and
47:37
you'll have people that can kind of walk through this demo, or I
47:39
can go online sundry.co Yep slash IDAC to to learn more
47:43
about. IDAC exactly, and I believe I'm
47:47
going to say if see if the website's ahead of me or not.
47:49
I believe there's a click through demo people can try to
47:51
which is not dissimilar for what I showed you guys.
47:54
So I I think there's a click through demo there that people
47:56
can click on and and see how it works.
47:58
It's really. Impressive.
47:59
Definitely. Want to encourage people, and
48:01
thank you for taking the time to kind of walk us through this.
48:03
It helped seeing anything, and hopefully people were able to
48:06
visualize and sort of their mind's eye as we walk through
48:09
it. But definitely encourage people
48:10
to go check it out. I love the idea of not only just
48:14
taking the day you're collecting, but doing something
48:16
with it. And I think this is an area that
48:18
a lot of people should be looking at.
48:19
It's OK, great. We've got visibility.
48:21
Guess what, No more excuses. Now you got to do something
48:23
about it. So here's an easy button,
48:26
literally right, to help with that.
48:28
So thank you for that. I want to wrap up with something
48:31
totally unrelated to identity. Or maybe it is, I don't know.
48:34
But we want to talk about fishing.
48:36
We were talking about you're going on a fishing trip soon and
48:39
I gave you kind of a a list of fishing related questions and
48:42
you were like everything except that one.
48:44
That's why I won't ask that one. So I'll ask and said if you
48:50
could go fishing in anybody of water in the world, where would
48:54
it be and why? Look, I've been, I've been
48:59
thinking about this question possibly for years.
49:04
And I if I was gonna do it, anybody in water anywhere in the
49:07
world, I would go, probably the fjords in Norway.
49:13
And I would spend some great time there.
49:15
And I would go because it would be beautiful, it would be
49:19
unique, and I would have a great time regardless if I caught a
49:23
fish or not. And so if I could go anywhere,
49:25
that's the one I would. Pick I'm with you right there.
49:27
I don't even think I would go fishing.
49:29
I would just sit in the boat and just stare up at the giant, you
49:32
know, the the scenery and stuff like that.
49:34
Yeah, I'm not much of A fisherman, so this is really out
49:36
of question for me. And to be fair, the question I
49:38
was that was in the original list was like a gadget related
49:41
question. So I could definitely come up
49:42
with some of that. Jim, if you could go fishing
49:46
anybody of water in the world, where would it be and why?
49:50
So much of A fisherman, but a couple thoughts came to my head.
49:54
So one was, if you haven't seen the show River Monsters, which I
49:58
think was on Netflix for a while.
50:01
Such a cool show, this guy, he's like, he's so entertaining and
50:05
then he goes fishing for these monster fish all over the world,
50:09
like he'll be in the the Amazon, like fishing for these fish and
50:14
they come out and they look like dinosaurs, right?
50:17
So great show. It's reminded me of a story that
50:21
I just heard. So Denise told me that one time
50:25
her, her father and his best friend went for a fishing
50:29
weekend. And instead of fishing, they got
50:32
so drunk and they never went fishing.
50:35
So what did they do? They went to the grocery store,
50:38
bought a bunch of fish, unwrapped it and brought it home
50:43
just so they didn't get in trouble that all they did was
50:46
spend the whole weekend drinking.
50:48
That's a great. I mean, I would do that.
50:50
That's totally legit. Very creative, yeah.
50:54
Unrelated, but I had a roommate when I was growing up, and I
50:57
think probably in the early 20s, late teens, and he was trying to
51:00
impress a girl. So he ordered Italian and
51:03
Italian got delivered, and they took everything out of boxes and
51:05
put it on plates and pretended that he had cooked it all.
51:07
Same kind of idea, Chad, if you're out there, you know who
51:12
I'm talking to. And she was probably like all
51:15
this kind of taste. This is this is just like Olive.
51:18
Garden. Yeah.
51:21
Look, you know, we're young, We're, you know, trying to
51:24
figure things out and whatever you got to do to get by, I
51:27
guess. All right.
51:29
This has been a great conversation.
51:30
Sandy, thank you so much for taking the time.
51:32
Thank you for coming back. Hopefully, you'll come back in
51:34
the future with other cool announcements you guys might
51:36
have. Definitely want to encourage
51:38
people, go check out the Cloud Permission Firewall.
51:41
It's at sunree.co slash IDACSONRA, i.co/IDAC.
51:48
We'll have links in our show notes so people could check it
51:51
out there, our website, etcetera, all that kind of good
51:54
stuff. And of course, you can follow
51:55
Jim and I on LinkedIn, We're on Twitter, Mastodon at IDAC
51:59
Podcast, we're on YouTube, we're on the web, idacpodcast.com.
52:04
And with that, we'll go ahead and leave it for this week.
52:07
Thanks again, Sandy, and we'll talk with everyone else in the
52:09
next one. Thank you guys.
52:13
You've been listening to Identity at the center.
52:16
We hope you've enjoyed the show. Make sure to like, rate and
52:20
review and we'll be back soon. But in the meantime, hit the
52:24
website at identity@thecenter.com.
52:28
See you next time on Identity at the center.