Latest / Identity at the Center / #339 - Sponsor Spotlight - Permiso

Transcript

#339 - Sponsor Spotlight - Permiso · Identity at the Center

0:00
When you're picking a security vendor, you have to trust that
0:02
they're going to help you sleep better at night and they're
0:04
going to continually be at the forefront battling the
0:06
adversaries, identifying their latest tools, their latest
0:09
techniques and what they're doing and being able to build
0:11
that into the product so that you can have those detection and
0:14
prevention capabilities so you don't have to worry about it.
0:17
And if you ask our customers, that's the number one thing they
0:19
say to us is like, I just sleep better at night knowing you guys
0:22
have our back and then you're monitoring all of our
0:24
identities. This is identity at the center
0:33
if it has anything to do with IAM.
0:36
This is the go to podcast now your hosts Jim McDonald and Jeff
0:43
Stedman. Welcome to the Identity at the
0:51
Center podcast. I'm Jeff, and that's Jim.
0:53
Hey, Jim. Hey, Jeff, how are you?
0:55
Oh, not so bad yourself. I'm doing great.
0:57
You know why I think identity is at the center?
1:00
Because I think it's at the center of information security.
1:05
One of the things that I find so fascinating is when you get into
1:10
kind of how exploits happen, and usually it's centered on some
1:14
kind of, you know, evil activity, if you will, when it
1:20
comes to identity. And we're going to talk a lot
1:22
about that today with our guests.
1:25
I just want to say I think it's going to be a really fascinating
1:27
episode. Yeah, this is going to be a fun
1:29
one. And yeah, just to make it clear,
1:31
this is a sponsored episode. We call these sponsor spotlights
1:34
and basically we create these in collaboration with our partners
1:38
out there and helps get their viewpoints on and we can get a
1:40
little more in depth into specific vendors and
1:43
technologies and their viewpoints, which is something
1:45
we actually try to stay away from on our normal episodes
1:48
where it's more vendor neutral. So that is not today.
1:50
Make it clear this is a fully sponsored episode and today's
1:54
sponsor is Permiso and you can find them at permiso dot IO
1:58
slash IDAC. We'll have link in our show
2:00
notes. People check it out.
2:02
Their website is I'm looking at it right now.
2:04
First of all, I love the design of it, but it has cool.
2:07
Yeah, it has a tagline of real time identity security for all
2:10
environments. That sounds like a mouthful.
2:13
I want to find out more about what that means.
2:14
So to help us with that, we've got the Co founder and Co CEO
2:18
from Permiso, Paul Wynn. Welcome to the show, Paul.
2:21
Thanks for having me. I'm honored to be a guest of
2:23
this. Well, the honor is all yours of
2:27
as as you just said, we like to find more out about the people
2:33
in this space. I know we're going to talk about
2:35
Permiso and you know what you guys bring to the table, but I'm
2:37
always curious, how did people get into this space of identity?
2:41
How did you get into IAM? Do you think you're an IAM or
2:45
maybe it's a something adjacent? I'm not sure.
2:47
Is it something that you chose or did it choose you?
2:52
I think I came into it late in my career because I started in
2:56
security. So I started as a snot nosed
2:59
hacker who broke into things 20 some odd years ago.
3:03
And I could tell you definitely I've been compromising
3:05
credentials for a very, very long time, all the way back to
3:07
like NTLM hashes and pass the hash on on Windows machines from
3:11
way back when. So I think I've always been
3:13
around identity, but I, I never really like focused on it until
3:16
the last five years. And I have a different
3:18
appreciation for folks that are dealing with it day in and day
3:21
out, especially as I am professionals.
3:24
So I'm, I can't say I am an expert at it.
3:26
I am learning it and I'm learning a lot from all these
3:28
folks as I talk to them and as I go to different shows and and
3:32
and try to school up as as much as I can.
3:35
I feel like identity is kind of having a moment in the sun here
3:38
for like the last, I don't know, five years or so.
3:41
I mean, it's always been important, but do you feel like,
3:44
hey, identity is so hot right now, right?
3:46
Like the meme are there, is there?
3:49
What like what is it that's coming out there?
3:51
Is it just as becoming more well known?
3:52
Is that people just recognizing it because it's not like we just
3:55
invented I this this idea of identity and identity security
3:59
right within the last couple years, I think for.
4:02
Us. I came from a different angle,
4:04
which was I felt like identity was being targeted more and more
4:08
by the, the adversaries. And so traditional security
4:11
controls were mostly focused on e-mail network endpoint.
4:15
And I think identity was always a, a part of it, but it was kind
4:19
of always a, a piece of all those different major focal
4:22
points. And I think in the last five
4:24
years, and the reason why I quit my nice cushy executive job at
4:28
fire, I running product there and working for Kevin Mandy was
4:31
like, I, I really felt like this is the area that needed to be
4:34
focused on because no one was really serving it well.
4:37
And so I said, you know what, let's take a leap of faith and
4:39
and focus on the cross section of identity and security and,
4:42
and let's see what we can find out.
4:45
And so then you went off and Co founded Permiso.
4:48
First of all, am I saying that correctly Permiso?
4:51
You are yes, yes. And then oddly enough, I think,
4:55
you know, it was definitely derived from us wanting to go
4:57
into identity and said, oh, you don't like permissions, You
4:59
know, that's cool. A funny aside, my my friend who
5:03
I'll speak Spanish, obviously, and I do have a vanity plate on
5:06
my car and and my friend said you, you do realize when you're
5:09
speeding past people, it also could stand for excuse me.
5:12
So I was like, oh, I guess I'm being kind of rude with this,
5:15
this vanity plate and it's not a sports car.
5:17
It's a minivan. So I can't even say like it's,
5:20
it's a cool, it's a cool like vanity plate on a cool car.
5:23
Well, you've got, I think it's, I think it's very polite, like,
5:26
excuse me, you're, you just got passed by a minivan.
5:29
I, you know, that's, that's one way to look at it for sure.
5:32
I guess now that we've mentioned sort of the, you know, the name,
5:35
tell us about Permisa. What is it that you guys are
5:38
bringing to the market? And then, you know, how do you
5:41
guys set yourself apart for maybe others that are in that
5:43
space? Give me some idea, because I
5:44
mentioned this tag line of, you know, identity, you know, for
5:48
all environments, identity security for all environments.
5:51
That's a lot, man. It, it is I, I actually asked
5:55
this provocative question to some of the, the folks on the,
5:59
on the customer side, Cisos in particular, are CIOs and I asked
6:02
them, can you tell me who your top 10 riskiest identities are
6:05
right now at this very minute? I think a lot of people try to
6:09
answer that question by, oh, well, the inherent risk is Paul
6:13
has a lot of permissions in the environment, therefore he must
6:15
be the most risky. And that is a part of the
6:17
equation. But I think what we realized was
6:19
if you bring in the real time aspect is the real time aspect
6:23
is behavior changes pretty quickly, especially let's as an
6:26
example, you get fished or there's a business e-mail
6:28
compromise. Well, that just changed from 5
6:30
minutes ago when you got phishing that, that credential
6:32
is now compromised and that, that identity is now acting
6:36
erratically and logging in from random places and accessing
6:39
resources never accessed. And I think this is what we were
6:42
observing the, the adversary side.
6:44
And so we've, we're, we're talking about real time security
6:48
for identities in cloud and on Prem, because it is a hard job
6:52
in our largest customer, we're monitoring close to 8 million
6:55
human or non human identities at any given moment.
6:58
And to be able to do that real time monitoring, you have to be
7:00
able to have a full understanding of what they're
7:02
doing at every second and be able to determine whether that
7:05
behavior is malicious or not. So I think that's really where
7:08
we've we've built our superpowers is coming from our
7:11
backgrounds, from Mandiant, which if you're familiar with
7:13
Mandiant, you know, there's, there's some of the best
7:15
responders in the world. We worked a lot of breaches with
7:19
identity as a core of the of the attack and we'll go into more
7:23
details around that. And that's really where I
7:25
believe the inflection point for us was three years ago was some
7:28
of these attacks that really brought to light the fact that
7:30
the identity infrastructure was under attack and you needed real
7:33
time monitoring to be able to detect that as fast as you can.
7:36
So how does this work? Is it pulling in data from all
7:40
of your different applications and your cloud environments and
7:43
saying, OK, let's throw this all together and then figure out who
7:46
is Paul and you know what is risky?
7:49
Like what? How does how does this work?
7:52
That's a great question. So you're, you're absolutely
7:54
right. The first thing we need to
7:56
understand is, well, what are all the identities operating in
7:59
the environment? So you need an accurate
8:01
inventory. So whether it is at the, let's
8:03
say cloud service provider level with AWS, Azure, GCP or it's at
8:07
the SAS level, which we believe SAS is probably one of the most
8:12
untouched areas right now in the middle of the wild, Wild West.
8:15
And then you need to integrate with any on Prem as well.
8:17
So Active Directory, your traditional authentication
8:19
sources. And so unless you have that
8:22
visibility of where those identities are living, what
8:24
permissions they have. And the third part, which you
8:27
mentioned as well, is we have to be able to pull all the activity
8:29
logs across all those different sources.
8:32
And one of the things we, we do is we, we're essentially like a
8:34
flight recorder for every identity.
8:36
So I could say, you know what, Jeff, I saw you log in at 10:03
8:39
AM yesterday. Here's how you logged in with
8:41
this device with this MFA factor.
8:43
Oh, and I saw you download these documents at 365 and then you
8:46
logged into Jira and you created some tickets, and then you went
8:49
into Slack and you sent some messages and you downloaded some
8:51
docs. Or I could record all of that
8:54
and then I could look at that activity and determine, was Jeff
8:57
acting normally or was he potentially a compromised
9:00
credential from an external threat actor?
9:02
Or is he ever acting normally? That's probably the first thing
9:05
right there. Well, you know, funny enough,
9:08
the, the, the one that's been really hot and especially at the
9:11
rippling deal, if you saw that lawsuit that's happening, it's
9:14
an insider threat case. And so I think insider threat
9:17
now is becoming a bigger one, especially with layoffs.
9:20
So that's that's been a big, big topic in the last couple.
9:22
Months for us, I mean, that's got to be just an enormous
9:26
amount of data to pull from all these sources, right?
9:28
And each source is its own complication, right to the to
9:32
the amount of data pulling in. Then you try to add a real time
9:34
on top of that. What does it take to run this
9:36
sort of thing? Is this something that I can set
9:39
up and run, you know, pretty easily?
9:41
Does it take a couple weeks? I imagine you've got to
9:43
establish baselines as far as you know, what is normal or at
9:46
least normal for that individual.
9:47
And then start to apply some of those heuristics to the the
9:52
access profile to say, OK, yeah, this is normal for Jeff.
9:55
Or maybe no, this is not normal because he's travelling.
9:58
Or maybe he's he is accessing different things that he
10:00
normally wouldn't be. Well, I'll tell you from past
10:04
experience of having to do this for 20 years and and running
10:06
the, the fire eye product business, I wanted the anti on
10:10
Prem software profile. So we had two principles when we
10:14
we built the platform 1 was it's completely SAS delivered.
10:17
So it's fast time to onboard was a big principle for us.
10:22
Super easy has to get on board within you know, 10 to 15
10:25
minutes depending upon the integration that can happen
10:27
pretty easily and it's all read only.
10:29
So we're not trying to be intrusive in terms of that.
10:32
The other principle was fast time to value because I always
10:36
struggled where customers had to plug it in, they had to wait
10:39
some time and then they said oh, OK, it's interesting.
10:41
Couple things lit up. Fantastic.
10:44
To answer your question, because we have come in from an instant
10:47
response standpoint in the past, we've had to go and ingest
10:50
historical logs. So if you have logs for the last
10:53
two to three years, I can ingest those and think of it as like a,
10:57
a, a replay button. I can replay every identity
10:59
session over the last two years if you had two years worth of
11:02
data. And I can reconstruct all of
11:04
that pretty quickly and allow you now to get visibility
11:07
around. Oh yeah, you know, just six
11:09
months ago, although I just plugged in premiso right now, I
11:11
could see six months ago Jim went and he ran these sets of
11:15
malicious operations and we know exactly which credential was
11:18
compromised first and all the subsequent credentials that were
11:20
created because of that. So I think that's that's
11:23
something that I learned in the past of doing this is like, I
11:25
can't have something that's going to take forever to deploy
11:27
and forever to get value. And so you get up and running
11:29
anywhere from 10 to 15 minutes, depending on how complex it is,
11:32
all the way to, you know, a couple hours and within a day.
11:35
I love that ability to show something sooner rather than
11:38
later because, you know, the world doesn't work on a, you
11:41
know, give me money and I'll show you something in two years.
11:43
Like, no, we need to see value sooner than that.
11:45
What is something that you think has really set you apart from,
11:49
you know, others that might be playing in the same space?
11:51
Like what is, what is the thing that you point in and say, yeah,
11:53
This is why we're different than so and so.
11:57
So you brought up one of them, right.
11:58
And this is something I, I purposely tried to focus on with
12:02
Jason early on was we need to be completely different from a
12:05
branding standpoint that we stood out.
12:07
So yes, that is a a Yeti with a towel around its rear end
12:11
because one of our monikers and campaigns that we ran was for me
12:15
for me. So covers your star AAS in the
12:17
cloud. So you know, I as SAS is a
12:19
little bit of a plan. So we do we are a little bit
12:22
tongue in cheek and we're pretty bold.
12:23
If you go to our website, there's actually Easter eggs on
12:25
there too. So pretty funny, I'd say
12:27
probably like 12 year old maturity level Easter eggs on
12:31
there definitely because of me. But I, I think just joking
12:35
aside, our branding definitely has been useful, but the number
12:38
one thing that we've tried to do, because I can actually feel
12:41
this from a customer standpoint, I used to be a, a CSO back in
12:44
the day as well. There's way too many vendors.
12:46
Like how do you know who you can trust?
12:48
And, and so one of these I did was let's go back to first
12:50
principles of if you share your, your Intel, your research, your
12:55
insights with the community, you build goodwill because at that
12:58
point you're trying to raise the whole community up, right?
13:00
It's not about me trying to keep proprietary information.
13:02
So if you look at our blog in particular, and if you go to
13:04
premiso dot IO slash blog, you'll see that we've open
13:08
sourced about 12 tools in the last 12 months.
13:10
We've shared a lot of our Intel, our insights.
13:13
And there's the the one thing that really sets us apart is, is
13:16
really that research that allows us to one, show that we are
13:19
experts in terms of identifying these identity based attacks,
13:22
but also it allows us to show that we're powering our product
13:26
with this type of expertise. And we're doing this every day.
13:29
And I tell a customer all the time you when you're picking a
13:32
security vendor, you have to trust that they're going to help
13:35
you sleep better at night. And they're going to continually
13:37
be at the forefront battling the adversaries, identifying their
13:40
latest tools, their latest techniques and what they're
13:42
doing and being able to build that into the product so that
13:44
you can have those detection and prevention capabilities so you
13:48
don't have to worry about it. And if you ask our customers,
13:50
that's the number one thing they say to us is like, I just sleep
13:52
better at night knowing you guys have our back and then you're
13:55
monitoring all of our identities.
13:57
I love the website. I I got to ask that the art
14:00
style is very unique and I I like who does the art for this
14:04
stuff because it's awesome. We, we had a little bit, I'd say
14:09
of a family advantage, which Jason's brother is actually a
14:12
world class creative person. He's done Super Bowl ads, done
14:15
stuff for Cameo Apple. And we said, hey, here's a
14:19
couple shares. Can you help us come up with
14:20
something crazy? And he came up with something
14:23
absolutely crazy and he gave us a whole bunch of different ones.
14:25
But this is definitely a unique styling that is more playful.
14:29
It's, it's different than the doom and gloom, the, you know,
14:31
guys in hoodies. It's, it's, it's like such
14:34
cliche. It's such a cliche over the last
14:36
27 years. I'm just frankly, I'm just kind
14:38
of tired of this over overused kind of style.
14:42
And, and I think the, the security market needs to have a
14:44
little more fun. And we don't take ourselves
14:46
seriously. And if you think, you look at
14:47
our campaigns, we kind of make fun of things, right?
14:49
And that's just my playful way of like, Hey, let's not take
14:52
things too seriously. Let's have some fun while we're
14:54
doing this. I totally agree on the the
14:57
hoodies and the you know the scream 2 mask like or the I
15:02
don't even know what you call that one where the the guy looks
15:05
like the. Guy Fox mask, right from
15:08
whatever it is, yeah. Yeah.
15:10
With data flying in the background, right?
15:13
Ones and zeros behind his head. So Paul, I'm wondering, I'm
15:21
thinking about some of the big hacks that have come out that
15:25
I'm sure all of our listeners have at least aware of in name
15:31
scatter Spider, LLM jacking, like these are the things that
15:35
are coming out and they're, you know, they're leveraging the
15:38
identity. And maybe that's the answer,
15:42
right? They're leveraging the identity
15:44
to my question, but I'm wondering why you would need a
15:47
new tool to catch these things and to stop these things.
15:51
Why can't the traditional security tools get in the way of
15:55
that? Well, I'll tell you one thing,
15:58
having been on the other side where I was breaking into
16:01
things. We're lazy.
16:03
We want to take the the path of least resistance.
16:05
So if you, you think about, I'll call prefederation of
16:09
identities, if I was trying to break into 20 systems, I'd have
16:13
to go break into one system and then try to move across and find
16:16
the right credential that would allow me to, to walk through
16:19
each of those doors. Now, the great side of identity
16:22
federation was, you know what, we're going to eliminate that,
16:26
that surface area for the number of credentials that are being
16:28
used. But the dark side of that is if
16:31
adversaries get a hold of those single sign on credentials,
16:34
guess what? That just makes their job a lot
16:36
easier. So the, the moniker today,
16:38
especially as you, you deconstruct the, the modern
16:41
architecture and, and by the way, this is, I'm gonna, this is
16:44
a little odd, but I actually started my career as an, as a
16:47
programmer out of mainframe. So if I look at the mainframe,
16:50
everything was centralized on the mainframe.
16:52
We're using RACF, you know, ACF two top secret for our access
16:56
controls. Back then, you know, I was
16:58
running my JCL jobs, I was programming in PO1 a little bit
17:01
different. So if you, if you look at it and
17:03
it's almost like food, right? You talk about these Michelin
17:05
star restaurants that deconstruct food into, I think
17:07
we've deconstructed the, the tech stack right now.
17:10
So it used to be data centers and we were standing up servers
17:13
and building our own data centers.
17:15
Now you're now you're breaking out the data center into cloud,
17:18
cloud service providers providing the infrastructure.
17:20
Then you have services that are being delivered by different SAS
17:23
vendors. So what's stitching that all
17:24
together now that we've deconstructed it?
17:26
AP is and credentials. That's really what's stitching
17:29
it together in a bunch of code. So I think that movement to
17:32
cloud and that deconstruction has created a greater emphasis
17:37
on identity. And I, I think also with
17:39
federation and, and we, we talk about bad guys don't hack in
17:42
anymore. It's not like they're using
17:44
malware to hack in, in this modern stack.
17:46
They log in. So they're buying credentials.
17:49
They're, you know, finding any, which way to get those.
17:51
They'll pay you for your credentials and they'll get,
17:54
they'll get access and they'll bypass MFA.
17:56
And once they're in, they're in, it's a little bit of a different
17:59
approach than it was 1015 years ago with malware and and
18:02
viruses. If you remember old school, if
18:04
you had Symantec and Norton Antivirus, like you're good,
18:07
right? That was security.
18:08
So I think it's evolved quite a bit since then.
18:10
And I do believe identity's at the center of it all.
18:13
Yeah, absolutely. So, OK, talk about some of those
18:17
monitor attacks, Scatter Spider, like I said, most people I think
18:22
have heard of it, but can you tell us a little bit more about
18:25
what it was and what the impact was for companies that
18:30
unfortunately got hammered by this thing?
18:33
Sure. And and by the way, this is
18:35
something that we we do all the time, which is we provide no
18:39
strings attached, no salespeople threat briefings.
18:42
So I'll give you a bit of a mini version of that threat briefing
18:45
because we've been doing it quite a bit for the last two
18:47
years. The probably the poster children
18:50
for, for that one was Caesar's MGM.
18:52
In terms of Scattered Spider in particular.
18:55
Now I, I could say that was a great event for us because I
18:58
think it really created a lot of education around the identity
19:01
infrastructure. But if you, you look back at
19:04
what they were trying to focus on, one, they were buying
19:07
credentials off a Russian marketplace and they were
19:09
focused on specific people that they believed had a lot of
19:12
privileges into the environment. And so they're going after Octo,
19:15
they're going after Entre, they're going after Ping.
19:17
So that was their, the IDP was a great source because you assume
19:21
if you get an IDP credential, you're going to have access to a
19:24
whole lot of things. I have to do less in terms of
19:26
lateral movement within the environment.
19:28
Perfect. So that's where it's starting.
19:30
Let's focus on compromising an IDP credential.
19:33
That group was also behind the T-Mobile breach as well.
19:36
And why does that matter? That matters because SIM
19:39
swapping makes it easy to bypass MFA.
19:41
And so it was a multi pronged approach in which they were,
19:45
they happened to be, you know, compromising T-Mobile
19:47
previously, one that gave them an opportunity now to bypass
19:51
MFA. They've also resorted to some
19:53
more heavy-handed tactics, I'd say swatting, you know, physical
19:57
threats, you know, they find out what your wife's name is, your
20:00
kids names and they say, hey, if you don't accept this, you know,
20:03
we're going to, we're going to do some harm to your children,
20:05
to your wife, and they'll follow it up with swatting.
20:07
So there's different ways of persuade people to, to give up
20:10
their credentials. So if you assume once you're
20:13
past that door, right, the authentication side of it, what
20:16
happens then while you're riding that identity highway into all
20:20
the SAS applications that are Federated into it like 365,
20:23
Jira, Confluence? And then you're also going into
20:26
the infrastructure, right? So AWS, Azure, even on Prem as
20:29
well if there's AVPN. So what was the what was the
20:31
major mission for them? The major mission for them was
20:34
actually to steal intellectual property and they would extort
20:37
you. So in some cases, some of the
20:38
largest extortions we saw were about $50 million.
20:41
He said. If you don't pay us $50 million,
20:44
we'll release your source code and there goes your competitive
20:47
advantage. And now your competitors have
20:48
your source code big impact, right?
20:51
Caesar's MGM was a little bit different where there was some
20:54
disruption, obviously to the, to the services that the, the
20:57
hospitality hospitality industry was providing.
21:00
So they had different outcomes. But at the end of the day, it
21:02
was still extortion, right? Pay me 10s of millions of
21:04
dollars. So why is that important?
21:07
I think it's important because that's one of the most high
21:10
profile cases where they, they really focus on the identity
21:13
infrastructure to get access. And the second was if you've
21:18
been following this Rippling Deal lawsuit, that's been
21:20
happening because it was an insider threat and it was
21:23
focused on essentially setting up honeypots where they would go
21:29
find out. OK, well, clearly Deal has an
21:31
insider somewhere at Rippling that's providing them
21:33
information and they're trying to ferret out who this insider
21:35
was. And the way that they detected
21:37
it actually was because they were monitoring the search terms
21:40
and they, they set a honeypot up with specific search specific
21:44
terms in a document. And so once they knew someone
21:46
was searching for those terms, they knew who the, who the
21:49
culprit was. And so if you look at Scattered
21:51
spider, one of the most interesting and novel things
21:54
that we saw in that and that we actually pioneered this
21:56
technique was, and you everyone uses Google or perplexity or
22:00
name your, your, your latest search right now, right?
22:02
Well, search actually gives you a sense of intent because I'm
22:06
searching for, let's say, a car. Well, I'm probably looking to
22:08
buy a car. The unique part of this
22:11
adversary group was they were using search for about 70 hours
22:14
to Recon the environment they're looking for, AKA they're looking
22:17
for others credentials, they're looking for secrets, they're
22:19
looking for other access keys, they're looking for
22:22
infrastructure deployment guides.
22:23
And that was an interesting new area that we saw in the SAS
22:25
world that was like, wow, this is a new technique that we're
22:28
that we're identifying right now right here on the front lines.
22:31
And that deal that does deal with exactly what we're seeing
22:33
now in the rippling deal effect as well on the insider threat
22:35
side. But yeah, I think that's it,
22:37
right? Use identity.
22:39
Let's go log into all the different applications that it
22:42
has access to. Let's steal information.
22:43
Let's get away with it. And these were not sophisticated
22:46
adversaries, by the way. These were keyboard jockeys that
22:48
didn't know how to script, and they were logging in into
22:51
websites. So this was not like some nation
22:53
state. These are a bunch of actually
22:54
teenagers that were doing this. Yeah, right.
22:57
And OK, you said they searched for a Kia.
23:02
What is that? It's actually a prefix for an
23:04
AWS Access key, so. Right, right, right.
23:07
Yeah. And they're, they're searching
23:10
for code signing certs. So dot PFX.
23:13
So because code signing certs are obviously an issue, right
23:16
for for tech companies, if they lose their code signing cert,
23:18
it's fascinating. When you look at their search
23:20
terms and we published it actually on our blog, it's clear
23:24
that they had no idea what the heck they were doing because
23:25
they're searching for everything.
23:28
Yeah. Well, that that kind of puts a
23:30
bull's eye on their on their back potentially, but they look
23:34
how much damage they did. There's another big incident
23:39
that hit the news, the LLM jacking incident.
23:42
Tell us about that one and kind of what was behind it and again,
23:46
impact too. So this one's going to be a
23:49
little bit, I'll cut a little more seedy just in terms of like
23:53
what they did. I mean compromised access keys
23:57
are not new by any means. We actually were observing some
24:01
abnormal behavior related to some AWS infrastructure or
24:05
clients and it was specific to Bedrock.
24:07
And if you're familiar with Bedrock, Bedrock is the, the AI
24:10
infrastructure service for, for hosting things like anthropic
24:13
models, etcetera. And we're like, what are they
24:15
doing with with Bedrock? Like this doesn't make any
24:17
sense. And once we started to pull the
24:18
thread on it, what we realized was they're actually using
24:23
access keys, like stolen access keys to, to then abuse Bedrock
24:27
to steal free Bedrock services. And then they were jailbreaking
24:30
anthropic models and other AI models.
24:32
What were they doing? They're creating role-playing
24:34
sex bots that they could go sell subscriptions to.
24:37
And and so of course this was an interesting one because this
24:40
involves essentially non human identity in the AWS access key.
24:44
Now you're looking at AI services and AI infrastructure.
24:48
So you have a cross section of NHI and AI.
24:51
And we, we were actually one of the first ones to disclose this
24:53
in Brian Krebs. If you're familiar with Brian
24:55
Krebs, he breaks a lot of the latest breaches, right?
24:57
So he had the exclusive on, on our story and he did the
25:01
investigation. He's like, wow, this was
25:02
fascinating. And subsequently we've been
25:04
referenced several times by a lot of other, other big vendors
25:07
like Wiz and other folks in their blogs.
25:09
And I think that's a cool thing about what we're trying to do is
25:12
we're, we're trying to be always at the forefront of fighting
25:15
these unique things like the LM jacking or some of the search
25:18
term indicators and ways of detection.
25:22
And that's I, I think that's going back to your question on
25:24
differentiation is if I continually show like we're at
25:26
the forefront of this and we're finding things that no one else
25:29
is finding. I think that just helps to
25:30
demonstrate that you're going to sleep better at night just
25:33
knowing that we're, we're going to be doing this for you instead
25:35
of you having to do this 24 by 7.
25:37
And I think the LM jacking 1 is interesting now that the advent
25:41
of Gen. AI and the adoption of AI is
25:43
going to increase significantly in the enterprise.
25:45
And then the genetic AI I. I have to admit I'm a little
25:49
worried about Skynet I and that's not something I ever
25:52
thought I'd worry about. But boy, I've watched all those
25:54
Terminator movies and I am scared.
25:57
So you talked about honeypots a little bit.
26:00
Is that something that you recommend people use?
26:05
So I, I think it depends for what purpose.
26:07
And we've set up our own honeypots as well, just because
26:10
we, we, as an example, tried to, in the vein of being in at the
26:15
forefront of identifying what the adversaries are doing.
26:17
We'll leak access keys, you know, we'll, we'll, we'll leak a
26:20
couple things just to see what the behavior is.
26:22
And actually in that LLM jacking, because some of our
26:25
customers didn't have the proper logging on, we couldn't actually
26:28
see what the prompts that they were submitting to the AI
26:30
models. So we end up sending a honeypot
26:32
up. And of course, we were able to,
26:34
to pull them in and we were able to observe well, what were the,
26:37
the prompts that were being submitted to the models.
26:39
And so we use honey pots all the time just for our own research
26:42
purposes. I think if it makes sense for a
26:44
customer, it's hard to maintain, right, because you have to
26:46
continually create new content and make sure that you're
26:48
observing and, and monitoring it.
26:50
Otherwise it's just. Not to do it.
26:52
Exactly, exactly. And, and that's a tough part is,
26:56
is just maintaining and keeping up and, and watching what
26:58
they're doing at all times. For us, it's a little bit easier
27:00
when you're doing it for research purposes and, and not
27:03
in a concern of losing anything per SE or understanding that
27:06
they're going to attack us. So that's, I, I, you know, I, if
27:09
you have the resources, go for it.
27:11
If not, I think a lot of other vendors do do it as well on your
27:14
behalf. Yeah, I think it's a good topic.
27:18
I think you just mentioned the point there, right?
27:21
If you have a honeypot out there and you're not monitoring
27:23
whether or not it's getting hit, then it's not doing you any
27:26
good. Kind of in the same vein, you
27:29
know, we've seen some ridiculous numbers in terms of how long
27:34
after breach it takes for an organization to realize they've
27:39
been breached. You had something, a statistic
27:42
on your website and I don't remember what it was, but how
27:44
long was that? So I, I think the, if you go
27:49
with the, the real big vendors who have, you know, the typical
27:53
Verizon reports or crowd strike reports, they'll probably say
27:56
anywhere between 10 to 15 days for dwell time, which is the
27:59
amount of time that an adversary sits in an environment and gets,
28:03
goes undetected. So I think what we're seeing
28:07
right now in the, in the most recent Scattered Spider incident
28:10
was about 74 hours from beginning to execution of the,
28:14
of the attack itself. And the 7070 of the 74 hours was
28:18
the, the Recon time. So they executed that mission in
28:21
about 3 days. So not very sophisticated,
28:23
right? You're able to go and to to pull
28:25
this off because 1, I don't think people have proper
28:29
visibility to be able to detect it in the first place.
28:30
So if you were, and this is, this is a part of the, the
28:34
formula, right? So over time, now let's think
28:36
about just passwords in general. Like what was the complexity of
28:39
the passwords? You started with?
28:40
There's like a couple characters, right?
28:41
And then you started getting into 16 characters because we
28:44
used to read about tables and password cracking back in the
28:47
day with, with different tools. And then then you added
28:50
complexity, you added characters.
28:52
So I, I think this is the same game that's, that's being played
28:54
with, with these folks is right now, I think the level of
28:57
maturity in terms of being able to monitor identities across all
29:02
these different layers is, is not quite unified right now.
29:05
And that allows you now to kind of hide in those gaps.
29:08
And you'll see shards of like, OK, we saw something happening
29:11
in, in GitHub, but OK, is that correlated to something else
29:14
that happened in, in Jira? I think it's hard to stitch that
29:17
picture together. And I think that's where we've
29:19
noticed in the breaches that we've worked where they hide,
29:22
right? It was in between those gaps.
29:24
I'm wondering, I mean you work with a lot of clients, you get
29:27
to see what team gets brought to the table, roles and
29:32
responsibilities within the organization.
29:34
I'm wondering most of our listeners are identity
29:37
practitioners. Are they the folks who are, you
29:40
know, just the buck stock with them for dealing with these or
29:44
getting ahead of these issues or is it somewhere else within the
29:47
organization? I would tell you probably the
29:51
most advance, I'll call it organizational behavioral
29:56
structure that I've seen is a customer of ours created an
30:00
identity security team, which is essentially a overlay cross
30:03
functional team that was working across the IAM teams as well as
30:06
the security teams to create more unified visibility for
30:10
identity. Because I don't think this is a,
30:13
an either or type of responsibility.
30:16
Because if you think about I am professionals, I didn't have a
30:19
full deep appreciation for how complex and how hard it is to,
30:23
to stand up and manage and maintain that infrastructure
30:26
and, and try to get everyone bought into the standards like
30:29
that. That's a hard job.
30:31
So I look at that as prevention, right?
30:33
So you're, you're, you're putting in place the proper
30:35
controls and the proper prevention to ensure you have
30:38
the right authentication, right authorization.
30:41
But guess what? Controls fail as we see in
30:43
breaches. So you do need the security team
30:45
to monitor that when all else fails.
30:47
Are we able to, to your question, Jim, are we able to
30:51
detect when that happens? Because you can't expect you're
30:53
100% secure at all times. That's just not reasonable.
30:57
So you need both sides to continually work with each other
31:00
because there might be things that are happening on the threat
31:02
environment that helps inform the IM team that, hey, you know
31:06
what, we need to put these types of controls in place because
31:08
we're starting to see emerging attacks around this area.
31:11
So let's say as an example, NHI is a big one, not human
31:15
identities, kind of a big one right now, right?
31:16
So we're seeing a rise in attacks around NHIS.
31:19
So what do we need to do better on NHISNHIS have been around for
31:22
a long time, service accounts, service principles been around
31:24
for a long time. But you don't have to worry
31:26
about the problem until it becomes a real, real pressing
31:29
issue. So I, I think it's a, it's a
31:32
joint effort, honestly. And if you look at our
31:34
engagements with our customers, yes, we might have come in from
31:37
an incident that happened and we helped them respond to that
31:40
incident. Then we helped build detection
31:42
capabilities to ensure that if the adversary comes back, we're
31:45
able to detect it. But our biggest engagement
31:47
actually has been IM teams. So we, we just launched a whole
31:51
prevention part of our platform. And was it because we wanted to
31:54
go into prevention? It was because the customer
31:56
said, I can't have this happen again.
31:58
So if you look at the symptoms of what happened, 1 is there's a
32:01
lot of orphaned and stale counts and unknown risks around access
32:07
keys that were exposed to our human and non human identities.
32:10
And then there's a lot of over permissioning.
32:11
So in the example of an Octa credential that gets
32:13
compromised, one thing we observed is this credential
32:16
never accessed GitHub for three years.
32:19
So you could argue at that point, if you had removed the
32:21
access would have completely stopped the attack.
32:23
Probably not. It probably would just create
32:25
enough friction where they're go, you know, this is kind of
32:27
annoying. They don't have access to
32:28
GitHub. I'll find another way around to
32:30
get to get access to GitHub. So I, I think it's a joint
32:32
effort. I, I do believe the construct
32:35
that I talked about, which is like an A unified identity
32:37
security team is a little bit of a lesser minority
32:41
implementation, but I do feel like there's a large convergence
32:44
happening with, with those, those teams.
32:46
Just it's just my gut. Yeah, no, it makes a lot of
32:49
sense. So as you're talking about all
32:50
these things, and again, the website is permiso dot IO, we
32:56
also say slash IDAC. If you go there, Paul's going to
33:00
put something there for you to get for free.
33:03
And hopefully, I'm hoping there's an Easter egg there.
33:07
I also wanted to go through the spelling is PERMISO like miso
33:12
soup, PERMISO dot IO. But I think at this point in the
33:19
conversation, Paul, people probably asking like, OK, you
33:23
sold us. There's all this that we need to
33:25
be worried about. How's permiso help?
33:29
How's permiso help me to solve this problem?
33:33
I, I will tell you this, the only way to, to kind of prove
33:37
out, are we really worth the time and effort?
33:39
Because I get it. And I think, you know what, it's
33:41
annoying talking to vendors. Vendors call you, they're,
33:44
they're nagging you with emails, LinkedIn messages, I mean, you
33:47
name it. I, I, I think the first thing I
33:49
would ask anyone that would want to talk to us is, is just look
33:52
at our research, right? Just just determine whether you
33:55
think we know what we're talking about or we just put a bunch of
33:57
words on our website and tried to say, Oh, you know, we do all
34:00
these things because guess what? There's a lot of people that go
34:02
out there and can easily put words out and say they do a
34:04
whole lot of things. I think the proof is in the
34:07
pudding in terms of what we've been able to do in the past.
34:11
You know, I, I, I think the best way that we, we try to prove
34:14
value is if I'm not giving you unique insights into your
34:17
environment and all that you didn't know about.
34:18
And I call that unknown risk, right?
34:20
So if you already know what risk you're managing, there's a,
34:24
there's a certain percentage, call it 10 to 15% of unknown
34:27
risks that you don't know about because you don't have the right
34:28
visibility or you don't have the right monitoring in place to
34:31
determine whether those things are happening.
34:33
So what is it that we're we're looking for on the detection
34:37
side, the response side, it's really 2 simple questions we're
34:39
trying to answer. 1 is, do we believe that there's any
34:42
compromised credentials in the environment, human or non human,
34:45
from an external threat actor? The other, which is a harder
34:48
problem to solve, is the insider threat issue.
34:51
So they have legitimate access into the environment.
34:53
So the pattern of detection is a little bit different because
34:56
they are going to come from a valid device, they're going to
34:58
come from a valid MFA factor, they're going to look normal.
35:01
So how do you start to determine when people are starting,
35:03
starting to act abnormally? I'll give you 2 examples.
35:07
So the actually compromised credential, that was the
35:09
scattered spider use case, right?
35:11
It was an outside threat actor that was compromising a valid
35:14
credential and then they gained access into the environment.
35:17
One of the more recent examples for us is let's say you had to
35:21
lay off 1000 people tomorrow. What are the things that you
35:26
need to worry about? 1 is did I remove all access
35:30
number one. The second is can I detect if
35:33
they're exhibiting any kind of destructive behavior that could
35:37
be impactful to the company? And I will tell you when you're,
35:41
you're trying to lay off people at that scale, things will fall
35:43
to the cracked. And then this is what we
35:45
observed is people downloading mass downloading documents from
35:49
SharePoint, right, downloading documents with Salesforce
35:52
hurrying up to, you know, to get until they got their access cut
35:54
off. That's a big problem right on
35:56
the inside or threat side. And then, of course, this
35:58
rippling deal lawsuit is an another indication of that
36:01
inside of threat. So that's on the detection side.
36:03
That's what we care about. So if you move left of that
36:05
problem, what precipitating those issues?
36:08
I think that's the hygiene side or the posture side, right?
36:10
You know, how do I start to prevent this from happening,
36:12
which is let's clean up all the attacks surface around the
36:15
identity. Any, any orphaned accounts, Dale
36:17
accounts, zombie accounts that may exist in your infrastructure
36:21
in SAS on Prem with your Active Directory, you name it, that's
36:25
number one. Second is you've got to deal
36:27
with authorization risks around least privilege and over
36:29
permissioning. So I gave you that example in
36:31
Scattered Spider where the credentials that were
36:33
compromised had access to resources that they hadn't
36:36
touched in a long time. So if you look at the, the, the
36:39
real root cause of all this, it's a, it's a multi pronged
36:42
issue, which is both you could do prevention, but you do need
36:44
monitoring together at the same time.
36:46
I think what we're noticing is a lot of vendors are focusing on
36:49
one or the other without bringing the two together.
36:52
I think that what's that's what makes us unique is that
36:53
visibility for both prevention and detection, for human and non
36:57
human identities, for your cloud and for your on Prem.
37:00
So we're actually trying to save our customers some money instead
37:03
of having to buy five different solutions, you know, we'll cover
37:06
all your identity security needs from one place as as best as we
37:09
can. Are we perfect?
37:11
No, I'm not going to sell you snake oil and say, you know,
37:13
we're the best at everything. But I I think the one area I can
37:16
claim we are the absolute best at is the the detection and the
37:19
response line given our background of of dealing with
37:22
frontline attacks against some of these adversaries.
37:26
And so, Paul, I mean, when you talk about Permiso, do you call
37:29
it a platform? Is it a couple different
37:33
solutions or products? How?
37:35
How do we think about it? Let let me approach it in a
37:38
little bit of a different way. I'll, and I'm going to use non
37:41
marketing words because I, I, I think actually the word identity
37:45
security is a little bit of a bastardized term right now
37:47
because what, what is security in the 1st place?
37:51
And I was a CSO, right? And I had a fixed amount of
37:53
budget and I can only spend so much.
37:55
And what, what's my job? My job is to buy down risk,
37:59
deploying that, that money into people process or technologies.
38:02
So security fundamentally is a risk management function.
38:05
So what is it that I care about? I care about helping our
38:09
customers manage the risks to their identities, which means I
38:13
need to enumerate all the things that I talked about, right?
38:15
So all the vulnerabilities of the potential gaps that could be
38:18
exploited by a threat actor that could turn into an incident.
38:22
So I, I, I think that's, it's, it's more about identity risk
38:26
management. Do I want to be an IGA solution?
38:28
No, I don't think that makes sense for us because I think we
38:32
need to end up being almost like an Equifax or, or Trans Trans
38:36
Union or, you know, an Experian around understanding, Oh, I need
38:39
to understand all the attributes of risk related to an identity
38:42
and be that that clearing house for understanding.
38:45
You know what Paul's the riskiest identity in the
38:47
environment. One, because he's over
38:48
permissioned, but two, he's logging in from Vietnam and he
38:52
just switched from an Android device for his MFA factor to an
38:56
iOS, which never happens, by the way, very rarely.
38:59
Or he downgraded from iOS 18.2 to, you know, iOS 16.1 rarely
39:03
happens. These are all signals and
39:05
symptoms. And all of a sudden he's
39:06
starting to create users and, and exhibit this weird behavior.
39:09
I think those are all signals you need to capture and be able
39:13
to understand what Paul is now the riskiest identity because
39:16
both inherently he has a lot of permissions, but his behavior is
39:19
quite erratic and now he's exhibiting symptoms of
39:21
potentially a compromised credential.
39:23
Jeff, I think we need to cut Paul off from our podcasting
39:26
platform once this podcast is recorded.
39:29
Like kill his credentials for life.
39:33
Why would we do that? Paul's our friend.
39:35
He's our friend, but he's so risky.
39:37
We're in the opposite market, right for podcast growth is we
39:40
want everybody to get out there. Absolutely.
39:43
It's true. It's true.
39:46
So Paul, one of the things that you talk about with Permiso is
39:49
the universal identity graph. And I wanted to be, is this like
39:53
front and center on your website?
39:57
Why is that? Why is that front and center?
39:59
Why is that the first thing you think about or read about?
40:02
When you go to permissive dot IO slash IDAC.
40:08
Well, I always, I, I think I talked about it a little bit
40:10
before, which was some of the core principles that I learned
40:14
in security is, is 1, you need to know what you're protecting.
40:18
So if you don't have an accurate inventory of the identity, a tax
40:23
surface, then it's hard for you to know, you know what I need to
40:25
protect this credential because Paul owns his credential.
40:28
But one of the harder problems that we're trying to solve is
40:31
let's say if you're going to get rid of me tomorrow, right, how
40:33
would you know which credentials that I've used or owned in the
40:36
environment? It's easy if you were saying
40:38
everything was Federated and if I just cut off my Federated
40:41
identity, all's good, right? The challenge is there's a lot
40:45
of non Federated identities that are operating in the right
40:47
because I may have local access to something that wasn't
40:49
Federated through to let's say Octa.
40:52
The the third problem is I may also own non human identity.
40:55
So I may have secrets or Oauth tokens that I've authorized or
41:00
you know, long lived access keys that belong to me.
41:03
So you need an accurate inventory of what is the
41:06
composite identity surface area for Paul, including all the
41:10
credentials he uses and all the permissions that he has.
41:12
So that graph is really about just maintaining that that a
41:15
proper state of who is Paul as a human entity and then all the
41:19
credentials and permissions that he owns.
41:22
And we also do this for non human identities as well.
41:25
Yeah. I mean, that's a really good
41:27
point. So I totally agree.
41:29
You had me solve right when you said you have to have an
41:32
inventory of your attack surface, which almost seems like
41:37
impossible. So is it that Permiso helps you
41:41
develop that? Because I doubt there's been the
41:43
clients that you go into and like they're like, here's our
41:46
spreadsheet, here's our attack surface.
41:49
No, I, I think it's a part of not just if they have, do you
41:54
have that information? So as an example, we've had a
41:56
lot of requests to integrate with work day.
41:59
So work day is a bit of their authoritative source for full
42:02
time employees and contractors. And we use that as a starting
42:04
point through that integration. So it, it, it's both
42:08
integrations into the IDP 1st and into HR systems like that to
42:12
give us a sense of what's the baseline inventory, because the
42:16
majority of the credentials, at least for mature customers that
42:19
have Federated access, that's the easy low hanging fruit.
42:22
The second ring around that would be you need direct access
42:26
and integration into all the sources that, that where there
42:29
are credentials, let's say local credentials.
42:31
So I'll have to integrate with every SAS application,
42:33
Salesforce, ServiceNow, Jira, GitHub, I'll have to integrate
42:37
with Amazon. So there's a bit of an
42:39
integration coverage you have to do as well because if you can't
42:42
enumerate the local credentials and even have access to the
42:45
activity logs and and where they're accessing those things,
42:48
it's hard for you to get that visibility.
42:49
So unfortunately I think it is very similar to to things in the
42:53
past where one we will use the let's say 80% roll.
42:57
Let's get as much as we can from the right sources like the IDP
43:00
or from HRIS systems and then let's fill in the rest by
43:04
enumerating the the local credentials from there.
43:07
So that enumeration I think is where I was thinking is when I
43:09
hear integration, I think of gaps because nobody knows where
43:15
that they might have identities is, is this one of the
43:17
challenges that we're that we need to try to solve for is OK,
43:20
we know what, we know what applications we have, but you
43:23
know, the business is going to go in business, they're going to
43:26
go out and sign up for a SAS app or some other thing, right?
43:29
And they're not being centrally managed.
43:32
Is there a way or an opportunity to use Permiso to maybe discover
43:35
some of that usage and say, hey, we've got some shadow IT
43:39
problems over here and oh, by the way, someone spun up their
43:41
own entire AWS environment or whatever it might be, right?
43:44
That is not being that. First of all, it's not even
43:47
being aware of that like a government standpoint from
43:49
security standpoint. But is are there opportunities
43:52
to leverage this information to do some of that discovery, to
43:55
find the things that we don't know about our environment?
43:58
That's a great point because you can only protect what you know,
44:02
right? Sometimes there's a lot of
44:03
unknowns and I, I always talk about the unknown risk because
44:07
you don't have 100% visibility into your environment.
44:09
And I think this is where we have that real time or runtime
44:13
monitoring because there are things you observe when you're
44:15
seeing a, a set of activity. Let's say for example, someone
44:19
signs up for some SAS application as an example, you
44:23
may not see the initial registration workflow, but
44:25
you'll see shards of activity where, where all of a sudden we
44:28
see people accessing certain websites that are abnormal for
44:31
what they, they normally go to, right.
44:33
So that then starts a signal to us, OK, maybe someone's signing
44:36
up for this particular SAS application.
44:38
We put that into what we consider an unknown state for,
44:42
for in our inventory that needs to be reconciled because now we
44:45
don't know if that's authorized or unauthorized and we don't
44:48
know if that's a, a potential user that we know about or not.
44:53
So that's, that's potentially some ways.
44:55
Are we perfect at like identifying shadow SAS?
44:58
No, I think there's, there's a lot of other solutions that are
45:00
more focused on the, the SAS security side or Casby or SAS E
45:04
that can detect it from a network standpoint.
45:07
That won't be our strongest suit per SE, but there are methods
45:10
that we use that again, like think of it as like, I hate to
45:13
call it Big Brother, but I am kind of like Big Brother in the
45:16
environment, right? Monitoring every user, every
45:18
identity, just watching what they're doing.
45:20
And there are signals that we pick up sometimes that are
45:22
saying, hey, this is unknown activity that we need to go
45:24
investigate. That could be indicative of
45:26
shadow SAS or or shadow IT as a as an example.
45:31
That's a very important concept. One other thing that came to
45:36
mind was I remember our gardener, I'm not sure if it's a
45:39
Venn diagram. If it's only two circles, we can
45:42
call it intersecting circles. It was SPM, security, posture
45:46
management and ITDR, and most products fell into one of the
45:52
other. I would say the SPM was kind of
45:54
more the network vendors of Palo Altos, things like that.
45:59
ITDR was kind of pureplay ITDRI don't remember if you guys were
46:04
on that specific diagram, but it feels like, you know, based on
46:09
the research I've done looking at the website, you kind of in
46:13
that section where those two overlap.
46:15
So you're SPM, but I'd say you're, it's like identity SPM,
46:21
which I think that I'd love to hear you clarify on that a
46:25
little bit and then talk about ITDR and what you bring to the
46:28
table in terms of ITDR. It's, it's a hot space, but what
46:34
I've seen like as have investigated different ITDRS is
46:38
it's almost like a, a major bucket containing a bunch of
46:43
different types of solutions. They don't all do the same
46:46
thing. So I'd like to understand what
46:48
you guys bring to the table in terms of the ITDR and then what
46:53
is this identity SPM piece and why do you call it that and and
46:58
why what does PERMISA bring to the table there?
47:01
That's a great question. In terms of the acronym soup of
47:05
ISPM&ITDRI could probably throw in a couple more IGA.
47:09
We don't do IGA, but might as well throw in all the acronyms.
47:12
But in terms of identity threat detection, what was it that the
47:16
outcomes that you really care about 1 is real time monitoring
47:19
of your identities to determine when they're compromised either
47:21
by an external threat actor like we talked about with Scanned
47:23
Spider or some of the insider threat use cases where you start
47:27
to see, you know, in mass layoffs or potentially in the,
47:31
the corporate espionage or the the rippling deal effect.
47:35
I think that's really what we care about is like we want to do
47:37
the real time monitoring of your identities so you can sleep
47:39
better knowing that no one's abusing those credentials.
47:43
And if you go to the left of that, that's really the quote of
47:45
quote ISPN or the posture I, I call that more prevention and
47:49
hygiene management, which is you're trying to reduce the
47:52
probability of an identity being compromised.
47:55
So what do you need to do there? 1 is of course, we're monitoring
47:59
for behaviors like people using weak MFA methods or I, I call
48:03
them weak authentication controls that allows it to be
48:07
easier to compromise a credential.
48:09
So we, we monitor for all those. We identify any cases where MFA
48:13
is not being enforced. As an example, we try to
48:15
identify any residual unknown accounts that may exist that
48:20
people forgot about because either, you know, people left or
48:22
whatever may be. So zombie accounts, Dale
48:24
accounts, that's surface area. That's pretty low hanging fruit
48:27
that you can go after and you could feel comfortable that you
48:30
can remove those. Because a part of what we do is
48:32
we also understand when that credential was last used and how
48:35
it was used. So I could replay that
48:36
credential and tell you it was last used a year ago and Paul
48:40
used it. And when he used it, he went
48:42
into 365 and he downloaded a bunch of documents.
48:45
So we give you a lot more context than I think a lot of
48:47
other folks would just say, oh, it's an unused account.
48:49
We could tell you it's an unused account, but it was used last
48:52
year On this date at this time. And here's what it did.
48:55
The the other piece too is the least privileged side, which
48:59
frankly like least privileged we've been chasing forever.
49:01
It's it, it seems like it's a never ending problem with people
49:04
moving jobs and roles. And I think what we see with
49:08
developers, especially in this new infrastructures code world,
49:11
they give permissions until it works.
49:13
So it's not about, I think, paring down permissions for
49:16
security purposes, like how do I make this stupid piece of code
49:19
work? And I will say I am guilty of it
49:21
myself because I am a hack developer compared to what I
49:24
used to be. And I'll write code and like,
49:26
what the heck, I don't know why isn't this working?
49:28
It says access denied or permission's not allowed.
49:31
I'm like, OK, I'm just going to keep loading up permissions
49:33
until it works. So I think that's really the
49:35
prevention side or the ISPM. And, and I think that's where
49:37
we're unique is you'll have other vendors that are doing
49:41
just posture but not detection. And some vendors are just doing
49:45
detection but not posture and some that are doing posture in
49:48
cloud only, but not on Prem. So you, I think the hardest part
49:52
for a customer's I, I think I, I put it together.
49:55
If you, if you think about the, the stack that I just talked
49:58
about ISPMITDR, I'll use the acronyms for descriptive
50:01
purposes for human and non human identities in cloud and on Prem.
50:06
That's probably 6 different solutions that you have to buy
50:08
and then you have to stitch those together to get the
50:10
visibility that you need. And I think that's where we try
50:13
to make it simpler for customers to get that unified visibility
50:16
for all your identities in one place, human, non human, cloud
50:20
and on Prem, so you can help manage that risk as effectively
50:23
as possible. Yeah, I think this is this
50:26
highlights, I think the importance of visibility and
50:29
observability and being able to understand who is your, who is
50:33
in your environment, what are they doing with it?
50:36
And then you can start to make intelligent decisions around,
50:38
OK, well, what do you want to do about the information that's
50:40
been presented to you? So I love this idea of, of
50:43
again, that this combining that visibility and observability and
50:46
then give me, give me data so that I can figure out, OK, is
50:51
Paul being weird again? Or is this just normal Paul
50:54
behavior And, you know, his six kids running around his house
50:57
and like, oh, that is normal for that, for that house.
50:59
So I love that idea of combining both of those things.
51:03
And it definitely want to encourage people, you know, go
51:04
off the website, check it out, permiso dot IO slash IGC.
51:09
We'll have a link in our show notes for people to check that
51:10
out. But definitely a, a powerful
51:13
message there. I know you've been very, you
51:15
know, generous with your time here today.
51:18
I did mention that you have 6 kids.
51:20
That is a lot of kids man. Tell me a little bit about your
51:24
environment there and and how much ISPN and ITDR and identity
51:28
graphing are you doing even just in your own home to try and
51:30
manage all this? I.
51:33
Constantly have to inventory that I have all my kids because
51:37
I have lost a couple of Disney World and the good thing is
51:41
Disney World's really good at tracking down kids.
51:43
But I, I was an only child and I guess what, I married an, an
51:47
Irish Catholic from Pittsburgh and I ended up with six kids.
51:50
So clearly I, I did not read that contract very well when I,
51:53
when I said I do, but I, they're, they're 16 to to 9 and
51:58
we jammed them in pretty tight and good Lord, sometimes I feel
52:02
like I'm a, I'm an Uber driver more than I am anything else.
52:05
So I I'm not sure what I'm Well, yeah.
52:07
You know, you talk about like ITDR.
52:09
Yes. I'm trying to detect nefarious
52:11
activity from my kids all the time, especially as they have
52:14
devices and I don't know what the heck they're doing on their
52:16
devices. That's the scary part of the the
52:18
Internet. Now that I have kids, it's like,
52:20
what the heck are they doing? So knowing what you know and
52:24
sort of your background in cybersecurity, do you think that
52:27
makes you a better dad or are you just an absolute nightmare
52:31
of a dad because it is harder to get things past you maybe?
52:36
I, I don't think I have enough time to be able to effectively
52:39
monitor them. So I, I use the old school fun
52:42
approach, which is I scare them and say, you know what your
52:45
father does. You know, your father monitors
52:47
people all the time and I know exactly what they're doing.
52:50
So if you think you're going to pull one on me, you can try.
52:52
I, I have had kids who try, who've tried so and they
52:55
probably didn't do it successfully.
52:57
And unfortunately that means that they think they can keep
52:59
doing it. But I told them eventually I'll
53:01
catch you. Don't.
53:02
Don't worry about it. Jim, you've got a couple kids.
53:05
How do how do you approach that your your identity threat
53:08
detection response and identity security posture management for
53:11
your kids? You, you keep your, you keep
53:17
your attack surface as small as possible.
53:19
So Paul didn't get that memo. You don't want to be
53:22
outnumbered, so you keep it small.
53:26
You still have to have fault tolerance for passing on your
53:29
genetics. So I got to didn't let them
53:32
outnumber me. So I, I, I feel like I set the
53:36
strategy. I stuck to the strategy.
53:38
Now we've been in operations for a while, but guess what?
53:42
Having kids operations isn't always the the funnest sport.
53:47
Did you just use fault tolerance with with the idea of your
53:50
children? Genetics.
53:53
Yeah, I know. It's it's actually, when you
53:55
think about it as it was not a good analogy, but we do.
53:59
We do this thing live, Jeff. So it's out there now.
54:01
Yeah. Oh, This is why we end on a
54:03
lighter note. Or also, you're going to hear a
54:05
fault tolerance in genetics. That's a good one.
54:07
Identity threat to text response all in one, One cohesive, nice
54:11
tiny little package of a of an. I love it.
54:14
I love. It Paul, you've been great.
54:16
Definitely interested in learning more about what you
54:18
guys have going on. Looking forward to seeing you
54:19
guys maybe at some conferences that will be probably at
54:22
together over the next year or so.
54:24
Definitely get people out there for the website permiso dot
54:27
IO/ID A/C that's PERMISO dot IO slash IDAC Speaking of letters
54:35
and acronyms and things like that.
54:36
Miso soup. So I guess final thoughts, Paul,
54:40
what is something that if somebody's listening to this,
54:43
what is your elevator pitch or your final thought that you want
54:46
people to take away from this conversation before we close
54:47
things out? Disclaimer, I'm sorry if you
54:50
lost 30 to 40 minutes of your life and like you can't get it
54:54
back, but I, like I said, I we just want to be good
54:59
contributing members of the community.
55:00
I think evaluate whether you, you feel like we can do that for
55:04
you. And just again, based upon our
55:05
research and, and what we've talked about, and if you feel
55:08
like you want to learn more, no strings attached, I promise
55:12
we're not super salesy people. We like to share what we do.
55:15
If you, if you just check out on social media and LinkedIn, I
55:17
think you'll see that a lot of people appreciate what we do in
55:20
the community. And we're happy to give you a
55:22
threat briefing, give you a demo, whatever you want.
55:24
If you want to learn more, I promise I'll keep my my sales
55:27
folks at Bay and I'll I'll be the ones.
55:29
To personally deliver it. OK, So that's that is a very
55:32
powerful message. I hope people take advantage of
55:34
that for sure. All right, we're going to go
55:36
ahead and wrap it up for this week.
55:38
Thanks, Paul, for joining us. I'll have links in our show
55:40
notes for people to check out, including your LinkedIn profile
55:42
as well as the permiso dot IO slash IDAC landing page.
55:47
And then of course, you can always visit us on the web at
55:49
idacpodcast.com, do all the cool things like subscribe, share
55:53
with your friends, share with your enemies.
55:55
And in the opposite of Paul, and we want everyone to get it to
55:58
our episodes. So it is a wide open door for
56:01
people to check out. So with that, thanks everybody
56:04
for watching and or listening and we'll talk with you all in
56:07
the next one. You've been listening to
56:11
Identity at the Center. We hope you've enjoyed the show.
56:15
Make sure to like, rate and review, and we'll be back soon.
56:19
But in the meantime, hit the website at
56:22
identity@thecenter.com. See you next time on Identity at
56:28
the Center.