Latest / Identity at the Center / #309 - IDAC Sponsor Spotlight - Token Security

Transcript

#309 - IDAC Sponsor Spotlight - Token Security · Identity at the Center

• 0:00
  I think that the best security products.
• 0:02
  Give you a Peace of Mind. I think that when I installed I
• 0:06
  don't know like for example any Dr. in my company.
• 0:09
  I had Peace of Mind that I think that my work.
• 0:12
  Workstations are secure, so I think.
• 0:14
  That a good security product? Not necessarily.
• 0:16
  Authorizing the background, but authorizing a way that's not by
• 0:19
  the Lawson for the organization. So you do have a measure that
• 0:23
  you can look in, but I see like that we attach ourselves to your
• 0:26
  organizational. Workflows.
• 0:29
  Whether it's a ticketing system messing also our solution, I'll
• 0:33
  just send you all notifications via select, but.
• 0:36
  First thing that we. Do is when we build an
• 0:38
  inventory, you can see in one place all of the non human
• 0:41
  identity that you have, all of their entitlements, all of the
• 0:44
  authentication methods, the owners of those identities and
• 0:47
  the usage that you do it. On top of that inventory, we
• 0:52
  provide multiple. Applications.
• 0:54
  Most popular application to start with.
• 0:56
  Is Toledo SIS you want to identify the top ten and most
• 0:59
  critical identities. You like it to call it the most
• 1:02
  wanted like the ideally sheriff is coming to town and trying to
• 1:05
  like like to catch the the biggest seminar.
• 1:10
  So that's like the most. Wanted Bob and Dennis share.
• 1:13
  Because that domain name taken because that might be 1 you want
• 1:15
  to jump on next. We have we have something here.
• 1:18
  I'll follow up like right after. This recording and check that if
• 1:22
  that domain is available. I think that Jim is doing it
• 1:26
  right now, but. Not the point seeing us.
• 1:33
  This is identity at the center if it has anything to do with
• 1:38
  IAM. This is the go to podcast now
• 1:43
  your hosts Jim McDonald and Jeff Stedman.
• 1:53
  Welcome to the Identity Center Podcast.
• 1:55
  I'm Jeff, and that's Jim. Hey, Jim.
• 1:57
  Hey, Jeff, how are you? Oh, not so bad yourself.
• 2:00
  Great. I'm excited for this episode.
• 2:03
  We're we've got a guest on to talk about machine identities.
• 2:07
  I think this is one of the areas of digital identity or I'll even
• 2:12
  call it identity and access management.
• 2:14
  We've been in it long enough we can call it that.
• 2:17
  And this has been a problem since day one.
• 2:19
  So I'm glad to see the industry is taking us seriously and folks
• 2:26
  like we're going to talk to today are building solutions.
• 2:30
  Yeah, I. Feel like this is like the
• 2:32
  Zoolander meme with the will ferry character, you know, non
• 2:35
  human identity. So hot right now, you know, so
• 2:39
  we're going to get into that. Today is a sponsored episode.
• 2:41
  So sponsor spotlights. These are things that we create
• 2:44
  with our sponsors to help understand the points of view
• 2:47
  that they bring to the identity space.
• 2:49
  So make it crystal clear. They have sponsored this episode
• 2:51
  in full. We're going to hear today from
• 2:54
  Token Security. You can visit them on the web
• 2:56
  with a very easy to remember Token dot Security website.
• 2:59
  It is a very cool website, one of the best that I've seen.
• 3:01
  So I would definitely encourage people go check it out.
• 3:04
  We're really well done on the web design, but we're not here
• 3:06
  to talk web design. We're here to talk about non
• 3:08
  human identity, machine identity.
• 3:10
  They have a tagline to go machine first.
• 3:13
  We're going to find out what that means.
• 3:14
  So I'd like to welcome to the show Ito Shlomo.
• 3:16
  He's the Co founder and CTO of Token Security.
• 3:19
  Welcome Ito. Thank you, Jess.
• 3:22
  Thank you Jim for hosting me. Definitely one of the.
• 3:26
  Highlights of my life. Well, you know, that's fair and
• 3:29
  flattery will actually get you everywhere on this podcast, so I
• 3:32
  appreciate that. But we like to understand a
• 3:34
  little bit more about yourself. How did you get into the space
• 3:36
  of identity? Is it something that you chose
• 3:39
  or did it choose you? I know, like I think that I have
• 3:45
  a classical nerf story that took a very, very interesting twist.
• 3:50
  And so in Zelzer Short I am. As a teenager, I I mastered.
• 3:56
  Online gaming, that was like something that I like to.
• 3:58
  Do one of the things. That I like to do the most.
• 4:01
  Actually happened until today. I started a gaming server.
• 4:06
  On my personal computer at home built my registration panel and
• 4:11
  hair care, which was probably one of my high school
• 4:14
  competitors. I'm headed by by passing the.
• 4:17
  Authentication. And then I was like, OK, there
• 4:19
  is something here with this authentication.
• 4:23
  I I was bursting into the army. When I was 18.
• 4:28
  And from there. I started my test, like my
• 4:30
  career test, in terms of that operations vulnerability
• 4:35
  research. Implant development and they
• 4:37
  learned exactly that that like the exact like the.
• 4:41
  Exact other side of how? Do you exploit identity?
• 4:44
  And while a lot of my friends had amazing talent in
• 4:48
  vulnerability research, I used to like just find the kid that
• 4:52
  was the line, get out somewhere and use it.
• 4:55
  And it was something that I thought it was like a cheat code
• 4:59
  and eventually ended up serving a short.
• 5:02
  Term of 13 years in in the Israeli army inside operations
• 5:07
  and decided that the. Military life.
• 5:10
  Was most of me and when I finished, my son said.
• 5:13
  I wanted to to do something like that would that might change the
• 5:18
  world, but also something that I'm good at.
• 5:20
  And I remember like all of those cadets that we found lying
• 5:23
  around. And like, then I thought that.
• 5:26
  A machine identity security is. A very, very important and
• 5:30
  decided to go and start. A company on around that
• 5:32
  concept. So that's how I got.
• 5:34
  Into into this. Space eventually, like lately
• 5:38
  we've seen so many breaches like the snowflake hack of
• 5:41
  Ticketmaster and so on that. Well, machined identity LED that
• 5:45
  that. Also, Make Realities is showing
• 5:48
  that it's a very very problem right now.
• 5:51
  Yeah, it seems to be everywhere and it's just going to
• 5:53
  proliferate, right, as more things come into the into the
• 5:56
  world that are doing other things, right.
• 5:58
  Bots, AI, right, servers, IoT, right.
• 6:03
  There's a whole bunch of stuff that's supposed to be out there.
• 6:04
  I'd like to learn more about token security because people
• 6:07
  may not be familiar with company itself.
• 6:08
  So tell us about token security. What is the problem that you
• 6:12
  guys are looking to solve and what do you bring to the market?
• 6:17
  So I think that like building software is super hard.
• 6:22
  And then? You want to find the.
• 6:23
  Right tool for for your task and you pick a certain menu of
• 6:28
  technology that is. Super wide like you have.
• 6:31
  Fast services you have database. Technologies.
• 6:33
  You have workloads technologies. Like containers function and
• 6:36
  server and what not. You are multi cloud, you work
• 6:39
  with Kubernetes and each one of the technologies.
• 6:42
  That I just said. Is.
• 6:44
  Implementing it's own identity mechanism.
• 6:47
  At least authorization but. Also a lot of times like also
• 6:50
  authentication and. Then what happens is that you
• 6:53
  have thousands of different identities that was caused by a
• 6:59
  huge fragmentation of that space.
• 7:01
  So like everybody creates it's own.
• 7:03
  Identical either and then. When in human.
• 7:05
  Identity you add. One single source of.
• 7:07
  Tools. So which is your SSO provider in
• 7:10
  machine? Identity every.
• 7:14
  Every asset manages its own identity.
• 7:16
  And that's how we we. Came up with go machine sales
• 7:19
  like. We want to attach the identity
• 7:21
  problem but. Like with the machine sales
• 7:23
  approach that look at the asset. That you want to protect.
• 7:26
  And not necessarily your identity.
• 7:27
  Profile And so we got into this. Space and try to understand.
• 7:32
  Like what's the problem here? Like why is this so?
• 7:35
  Problematic for organizations to.
• 7:36
  To solve and we saw that on top of the.
• 7:39
  Fermentation. That created the big scale issue
• 7:41
  of identities. There were two.
• 7:43
  Main. Problems that organizations were
• 7:45
  facing. One is the ability.
• 7:47
  To find the human owner of each identity and second one.
• 7:51
  Was the quiz that owner with the alternator?
• 7:54
  That they need and identity. Both the static.
• 7:57
  Parameters, but also the dynamic.
• 7:58
  Usage in order to solve. For example a key rotation
• 8:02
  problem, or a stain identity or an over permissive service
• 8:05
  account and so. So that's in a.
• 8:09
  Nuts and the problem that we're solving.
• 8:11
  OK, you pert my ears up here now, because when you say try to
• 8:13
  find the owner of a machine or a non human identity, I mean every
• 8:17
  every organization I've talked to struggles with that.
• 8:20
  Who owns this account? It was created 5/10/15 thirty
• 8:24
  years ago and you know who's responsible for that?
• 8:27
  So I'm definitely interested to learn more about this.
• 8:29
  I think that kind of speaks to the importance too of this area
• 8:32
  of who owns these accounts, because if you don't know who is
• 8:35
  responsible for the account, how are you supposed to secure it?
• 8:37
  Doesn't have the right permissions.
• 8:38
  Is it doing what it was intended to do?
• 8:40
  Has it been hijacked to be used for something else?
• 8:43
  That could be benign, right? Happens a lot.
• 8:45
  Service account might get used for something else.
• 8:47
  Or it could be, hey, maybe an attacker is, is piggybacking on
• 8:52
  a service account that they probably shouldn't be doing
• 8:54
  that, right? Is that make sense from a kind
• 8:58
  of trying to define why this is so important?
• 8:59
  Are there other things you want to add to that?
• 9:02
  Yeah, I think that it's related to two, but like, yeah, I think
• 9:06
  that identifying the. Internal order is super
• 9:08
  important for. For example, sometimes we see
• 9:11
  that the most critical accounts in.
• 9:13
  Organization were traded by individuals that already left
• 9:17
  the company, for example, so the ownership.
• 9:19
  Data is really cushion to identify which part of the
• 9:22
  organization is responsible. How do I assign like the the
• 9:26
  handling and the life cycle management process of that
• 9:29
  identity? Second part is really the usage
• 9:31
  as you said so. When an identity is spread
• 9:35
  across thousands of containers with one.
• 9:38
  Database user and password that all of those containers are.
• 9:40
  Using you want to expose this this level of dependencies and
• 9:44
  usage to find out what is the real use of.
• 9:48
  That service account I think that visibility in not even
• 9:51
  identity is one of the key. Key problems.
• 9:55
  So it's not only. Cause a results like.
• 9:58
  Integrating with all types of products, but also identifying
• 10:01
  the usage. Patterns of the identities
• 10:03
  themselves. So I want to make sure that
• 10:06
  we're speaking the same language when you say non human identity
• 10:11
  or machine identity, can you define that for me?
• 10:13
  Like what is your your definition of what that means?
• 10:16
  Yeah, there's so, so many terms. Right now like machine identity
• 10:20
  machine. Account service Account API key,
• 10:22
  everybody likes to call it. A bit differently, so let's.
• 10:25
  Scope where we're at, What I'm most, what I worry for the most
• 10:33
  is the identities that could lead to your core.
• 10:35
  Technology and yeah and to affect your medical resources
• 10:39
  and. What?
• 10:39
  What's not in token? Security scope.
• 10:42
  It's not endpoint identity. It's not your employees
• 10:44
  workstations or laptops. It's not IoT.
• 10:46
  It's not the. Voice over IP device that you
• 10:50
  have or the camera that you have installed, even those, those,
• 10:53
  even though those are machines, it's not what we're handling and
• 10:57
  also we are not handling public key infrastructure.
• 11:00
  It's not. The.
• 11:01
  Client to server encryption part.
• 11:04
  What we worry about? Is the identities that are.
• 11:07
  Mainly you are all. Well intended for programmatic
• 11:10
  use inside your core technology, inside your core assets.
• 11:14
  And could affect that could. Be a sense force.
• 11:16
  Integration API that could be. A service.
• 11:19
  Account in your. AWS.
• 11:21
  That could be an SSHT that opens all of your EC2 instances.
• 11:25
  Or other servers. It could be a snowflake service
• 11:28
  account, but that's the area and the attic that that we are
• 11:31
  working with. So I am always interested in how
• 11:34
  you come up with names for companies these days.
• 11:36
  How'd you come up with the name Token Security?
• 11:38
  What was the the driver? Behind that, OK, so let me tell
• 11:43
  you. A bit of a funny story.
• 11:45
  So we know how a lot of. Fathers in cyber security come
• 11:48
  from Israel. What we're known for in Israel
• 11:50
  is that we have extreme. Self-confidence.
• 11:53
  We like to really be stubborn that we lied at what we're
• 11:57
  doing. So my partner and I, we chose
• 11:59
  the name for the company. We chose a name.
• 12:01
  We. Already registered the domain.
• 12:04
  And the name was like something that was supposed to bring light
• 12:07
  into a doubt problem in the cloud.
• 12:09
  And we chose the name Moonlight Security.
• 12:12
  And we were certain that we it was a fantastic.
• 12:14
  Name we sent. Our friend and intro request.
• 12:17
  To one of his investors. And he asked for us like send me
• 12:21
  your e-mail address. And I sent him it.
• 12:23
  It at Moonlight security and he told me, did you look that up in
• 12:26
  the dictionary before you signed the domain?
• 12:28
  Like, what is your, why did you pick that name?
• 12:31
  And then I understand that moonlight has a very, very
• 12:34
  different meaning. That's why I and so we went back
• 12:39
  to the drawing board and we understood that everything.
• 12:42
  About machine identity and. The fact that like what happened
• 12:46
  in reality is that what people are looking in non even identity
• 12:50
  is to regain trust token is the. Symbol and basically the essence
• 12:54
  of trust. It's something.
• 12:56
  That also is the core. Of the problem that we're.
• 12:59
  Solving token compromise, and in very, very different ways is.
• 13:05
  Probably the main attack vector that attackers are using.
• 13:07
  Today and so it it's both. It both symbolizes the space.
• 13:13
  And the problem that we're looking to solve, and so that's
• 13:16
  how we pick the name token. And the URL token dot security
• 13:19
  was available, so that's even like a bonus, right?
• 13:22
  Yeah, everybody thinks that we're in a.
• 13:24
  Crypto, cryptocurrency, but you know we're building a not even
• 13:28
  space to take over that. So let me put my jaded CSO hat
• 13:33
  on. I see a lot of products out
• 13:34
  there. What sets you apart from others
• 13:36
  in the space that you're operating in?
• 13:38
  Like what makes you different? Yeah.
• 13:42
  So we another vendor that exists today in.
• 13:47
  NHI and they cannot even identity.
• 13:49
  It's important to explain. What do you need?
• 13:52
  In order to solve the not even identity problem and.
• 13:54
  Eventually that leads for. Very, very different
• 13:57
  applications, so I won't talk about the applications for a.
• 14:00
  Moment I will just. Explain like how you should.
• 14:02
  Look and attend NHI. Vendor What makes token special?
• 14:06
  So I think that we invest in in call of three main.
• 14:10
  Value proposition. 1 is that we want to be the only vendor that
• 14:15
  you need. For non human identity.
• 14:17
  I don't. I think.
• 14:19
  That too many companies are trying to.
• 14:21
  Nail down. They're offering to look at a
• 14:23
  specific technology, like only cloud providers or only SAS to
• 14:26
  SAS integration and so on. I want to be your non.
• 14:29
  Human identity providers so on Prem for self force and
• 14:32
  workloads for database that you can't access easily.
• 14:36
  I want to. Cover your cloud native
• 14:38
  identities. I want to cover your.
• 14:39
  SAS, SAS services and also eventually or casual customer.
• 14:46
  Integration that are done problematically.
• 14:47
  Which is also a type. Of non human identity.
• 14:52
  And are we there? It might not be there yet, but
• 14:54
  we are aiming to give you as full coverage as possible
• 14:58
  Second. Part is.
• 15:01
  Basically trying to solve or or starting to solve.
• 15:04
  Your operational efficiency problems so a lot of people can
• 15:07
  handle one service account handling.
• 15:09
  Multiple or handling the entire. Service account value that you
• 15:13
  have is very very hard. What you need to do is to
• 15:18
  harness the entire organization for that in.
• 15:20
  Order to harness the organization you need to
• 15:22
  identify internal owner or to provide ownership for service
• 15:26
  account connecting the non human identity.
• 15:28
  To a human identity, their part is to acquit those internal
• 15:33
  owners. With the data that.
• 15:34
  They need. We want to give you all of the.
• 15:38
  Data that you need. In order to remediate or in
• 15:42
  order to improve your. Security posture in non human
• 15:44
  identity. Because the thing that most.
• 15:48
  Engineer that that like is shared between engineering,
• 15:50
  DevOps, SRE and security is that we feel to break stuff.
• 15:54
  I want you to have complete. Certainty that you can take
• 15:58
  action. And have all of the.
• 16:00
  Data that you need in order to take that action and so the
• 16:02
  dynamic usage layer that. We put on top of our inventory
• 16:07
  is. One of the most crucial parts of
• 16:09
  anonymous identity. Solution.
• 16:11
  With that data layer you can do everything.
• 16:14
  You can reduce risk you. Can operate very very.
• 16:18
  Efficiently you can stand to. Compliance frameworks you can
• 16:21
  do. Everything that you want to, you
• 16:23
  can do life cycle management. Key to have coverage ownership.
• 16:27
  And usage. So either this is a solution
• 16:33
  focused on the enterprise, right?
• 16:36
  So it's going to be enterprise identity leaders that are going
• 16:40
  to look at the product, right? And I, I kind of feel like as a
• 16:45
  enterprise identity practitioner, they're used to
• 16:49
  certain lanes. So you got your IGA lane, you've
• 16:53
  got your access management lane, you've got your privilege access
• 16:57
  management lane. ITDRS certainly kind of like
• 17:02
  becoming a lane and I don't know that it's established itself as
• 17:06
  a lane yet. Is token security in one of
• 17:10
  those lanes or is it different? Is it Is machine identity
• 17:14
  becoming its own lane? That's a good question.
• 17:21
  I think that I don't. Like solving the same problem in
• 17:25
  a better way a lot of times like that's that's a part of my
• 17:28
  personality and what I believe when I started a company that we
• 17:32
  need to find a new problem. And then non of an identity
• 17:34
  problem. It had certain that make
• 17:38
  solutions that were operational on to it, for example, power
• 17:40
  solutions such as cyber alcohol or the linear beyond trust and
• 17:43
  solve them. They manage credentials right?
• 17:47
  Like they take service accounts and they allow you to access
• 17:49
  them securely. But they were mainly.
• 17:51
  For human beings and also they were born on plan.
• 17:54
  They were born. For a limited amount of server,
• 17:56
  they were not born for the state of the.
• 17:58
  Cloud and so when people ask me if I would ever if I.
• 18:03
  Imagine that non even identity would be in one of.
• 18:07
  Those lands I would. Say that it's like.
• 18:10
  This starting. A cloud as a very fast host, I
• 18:15
  don't think that like. I think that.
• 18:17
  It's an entirely new area that is here to.
• 18:20
  To last as long as people are bending software as.
• 18:24
  Long as they are utilizing the Internet and AB is, I think that
• 18:29
  not even identity would be separated from human identity
• 18:33
  solutions. Yeah, I, you know, I, I kind of
• 18:37
  feel like with non juvenile identities, they require a lot
• 18:41
  of the same technology or processes as human identities,
• 18:46
  right. But they're not always, you
• 18:49
  know, one for one or they don't work the same.
• 18:51
  So you still need to have a life cycle, you know, the creation of
• 18:56
  the account, the destruction of the account when it's no longer
• 19:00
  needed. You need to have some kind of
• 19:02
  governance. So there has to be some kind of
• 19:04
  human who is accountable for that account and needs to
• 19:09
  determine, yes, it has the right permissions, things like that.
• 19:12
  So that's kind of the identity. And then also from an excess
• 19:16
  measurement standpoint is authentication.
• 19:19
  It probably needs some kind of rotation of the credentials and
• 19:23
  things like that. So the first part I think of is
• 19:27
  like the IGA duties. The second part I think of is
• 19:31
  privileged access management duties.
• 19:33
  But all those things breakdown like, you know, we have best
• 19:36
  practices when it comes to dealing with humans.
• 19:40
  Like the humans come from the HR system and for a user, a human
• 19:46
  perspective, you can do multi factor authentication and you
• 19:50
  can have a human being change the password ever so often.
• 19:54
  Well, machines don't work that way, right?
• 19:57
  Non human accounts don't work that way so.
• 20:00
  I guess maybe you're rambling a little bit, but what I wanted to
• 20:05
  get to was, so how does token security work?
• 20:08
  How do you address those different areas or which of
• 20:11
  those areas do you address? That's a great question.
• 20:16
  So in order to not be. Attentive.
• 20:19
  I want to share an interesting story.
• 20:21
  I want to share something that's like the tall.
• 20:24
  Essence of Why not when identity?
• 20:26
  Is such a hard problem and it's an.
• 20:30
  Anonymous, anonymous case study. That we did with one of our
• 20:34
  customers around. About a real nice events.
• 20:37
  That happens for them. Luckily, that event ended up in
• 20:43
  a with a good result. Because we were there.
• 20:46
  But let's try to to visualize like the problem.
• 20:50
  In a very, very real story, kind of.
• 20:52
  So you have for example. Some kind of a service that hold
• 20:57
  very sensitive data. It could be one pass all, it
• 21:01
  could be all Google Drive what we identified.
• 21:05
  That on a certain. Day one of the.
• 21:08
  Service accounts that came from an identity provider was
• 21:13
  compromised, and that service account had a password and an
• 21:19
  MSA. It was perfectly safe.
• 21:23
  For human access, but it also had an API key.
• 21:25
  And that API key was compromised by a third party that we
• 21:29
  identified later and we started. Digging into the problem.
• 21:33
  Because like. The the people in that company
• 21:37
  really took care. Of that service account.
• 21:38
  But API key is just like a Latex credentials that you put
• 21:42
  somewhere and use it in order to consume a service.
• 21:44
  Well, when did we hear about that problem in human identity?
• 21:48
  15 years ago maybe. So we start.
• 21:50
  Taking it down, we observed all of the compute.
• 21:53
  Environment of that organization started to analyse the
• 21:57
  infrastructure. You see, we started.
• 21:59
  Segregating like OK, that API key usually comes on this NAV
• 22:03
  gateway, it comes on this account.
• 22:05
  OK, so we narrow it. Down to like 2. 105 hundred
• 22:08
  machines Saturday and we start scanning the the snapshot.
• 22:13
  Of all those of the. All, all of those machines, we
• 22:15
  identify a certain machine that we spent that, that was the
• 22:20
  machine that. Was called promised also a very
• 22:22
  very hard test that is nothing alike.
• 22:24
  In our human identity. We took the code from that.
• 22:28
  Machine and identified the Gita report that it comes from.
• 22:31
  We scanned the Gita. Report and we signed the API key
• 22:33
  there it rotated. The event is over.
• 22:36
  Everybody's happy. Nobody got.
• 22:38
  Fired. Great success for everyone.
• 22:41
  But you can. See a scenario like that in
• 22:45
  human identity? It just doesn't happen because
• 22:47
  like you don't have 500 much 500 humans using the same account
• 22:50
  sound as you have but like. It's very, very.
• 22:53
  In non human identity it happens all the time and.
• 22:56
  I can keep on and on of how the. Technology is different, but I
• 22:59
  think that this case study. Proves that like.
• 23:02
  It's a entirely bypassing attack sector that is not covered by
• 23:07
  ITDL, not covered by IGA, not covered by IDP, not covered by
• 23:11
  PUMP. Yeah, no, that, that's a really
• 23:14
  smart approach. Yeah, I'm always very much wired
• 23:19
  to think about, OK, what is it going to take to get this
• 23:22
  solution in place? So I'd like to talk about like,
• 23:25
  you know, what does a project look like?
• 23:27
  But also if you've got, if somebody who's listening right
• 23:31
  now is interested and wants to give it a try, you know, where
• 23:36
  did they start? And then what does this look
• 23:39
  like from a full implementation project effort?
• 23:44
  Yeah. So we have an entire.
• 23:47
  Philosophy for that which I will say is our the right listeners
• 23:50
  for my listening. Tool to me talking 3 hours about
• 23:53
  software. Development.
• 23:54
  So I'll say it very, very plainly.
• 23:56
  Building software is the best. Thing in the world.
• 23:58
  You need to do it quickly and you need to use any technology.
• 24:01
  That you want. And I even want to.
• 24:03
  Encourage everyone. To build the test there to use
• 24:07
  the most. Cutting edge technology that
• 24:09
  they that they want. What my purpose is, is.
• 24:13
  To allow them a framework to do it safely and safely doesn't
• 24:17
  mean slowly. We aim for.
• 24:19
  Speed. We aim for a quick deployment.
• 24:21
  To see the value as quick as as you can, but also to present
• 24:25
  ourselves for. As being in the middle, we're an
• 24:28
  integration based folder, so that means there are no clients,
• 24:31
  no agent, no central dashboard that you need to document any
• 24:34
  identity that you created. We operate.
• 24:37
  From the side and just allow your Peace of Mind that you
• 24:40
  could go. Sleep well, wake up tomorrow.
• 24:43
  And be in the best of store that you can.
• 24:45
  And so if you have, if you can use multiple clouds, use
• 24:49
  Kubernetes. They certainly use the vault.
• 24:51
  Because let's face it, it's. Like we're not going to.
• 24:54
  Have a machine identity provider anytime soon, so use the.
• 24:58
  Vault to vault your credentials and use database and Google
• 25:05
  Cloud query and. Everything that you can.
• 25:08
  In order to make your. Software as best as it can, and
• 25:11
  I'll take care of their security, at least from the
• 25:14
  identity path. That's really makes a lot of
• 25:18
  sense. Go.
• 25:19
  I'm sorry, Jeff. Well, I was just going to ask,
• 25:22
  so you've got this set up, like what's the information that
• 25:24
  comes out of this? Like how do I use this to do all
• 25:27
  those things with the speed that I need to?
• 25:33
  So first of all, I think. That the best security products
• 25:36
  give you Peace of Mind. I think that when I installed I
• 25:41
  don't know like for example any Dr. in my company I.
• 25:43
  Had Peace of Mind that I think that my work.
• 25:46
  Workstations are secure, so I think that.
• 25:48
  A good security product? Not necessarily.
• 25:51
  Authorizing the background, but authorizing in a way that's not
• 25:54
  by Lawson for the organization. So you do have a natural that
• 25:57
  you can look in, but I see like that we attach ourselves to your
• 26:01
  organizational. Workflows.
• 26:03
  Whether it's a ticketing system messing also our solution, I'll
• 26:07
  just send you all notifications via.
• 26:09
  Select but first thing that. We do is when we build an
• 26:12
  inventory, you can see in one place all of the non human
• 26:15
  identity that you have, all of their entitlements, all of the
• 26:18
  authentication methods, the owners of those identities and
• 26:22
  the usage that. You do it on top of that
• 26:24
  inventory we provide. Multiple applications.
• 26:28
  Most popular application to start.
• 26:30
  With is to widow 6, you want to identify the top ten and most
• 26:34
  critical identities. We like it to call it the most
• 26:36
  wanted like the ideally sheriff is coming to town and trying to
• 26:40
  like like to catch the the biggest seminar.
• 26:44
  So that's like the most. Wanted Bob and Dennis.
• 26:47
  Share 'cause that domain name taken 'cause that might be 1 you
• 26:49
  want to jump on next. We have we have something here.
• 26:53
  I'll follow up like right after. This recording and check that if
• 26:56
  that domain is available, I think that Jim is doing.
• 27:00
  It right now, but. You know, not the point seeing
• 27:02
  us. So first of all, you want to
• 27:04
  reduce. Risk You want to identify the
• 27:06
  top 10 identities. That you have and delegate the
• 27:10
  the management. Of those problems to the teams
• 27:13
  that are responsible for them. Second part.
• 27:16
  Is to start going into a life cycle.
• 27:17
  Process. You want to be sustainable.
• 27:19
  It's impossible to or only like us, do fireside.
• 27:24
  You want to have a place. That you can track the recently
• 27:27
  created identities. They use that I that.
• 27:31
  Machines and people. Do with not even identities?
• 27:35
  To track misuse. To identify compromise and the.
• 27:39
  Point that you need to rotate a credential or reduce.
• 27:41
  The. Permissions and eventually every
• 27:44
  software project become. Deprecated.
• 27:45
  You have tons of story state identities.
• 27:50
  And you could remove them just like by.
• 27:52
  Filtering out on our inventory. And start to deactivate those
• 27:57
  that are no longer in use, which is a big.
• 27:59
  Part. Of the non identify like in
• 28:02
  organizations. So I'm curious, I just want to
• 28:05
  ask a little more detail around the attribution part.
• 28:08
  How do you, how do you determine that responsibility or that
• 28:13
  ownership over an account? Are you, I guess how do you
• 28:16
  infer that? Is that secret sauce or is there
• 28:18
  something that that you can maybe explain how that works?
• 28:22
  Jeff, when you go to a. Magic show as the magician.
• 28:24
  How we got. The I do, but I should not be at
• 28:27
  a magic show for that very reason, yeah.
• 28:30
  So security should be we like like a lot of the the the.
• 28:38
  Companies, people and the people that I work with are people are
• 28:41
  coming from backgrounds such as myself but are other times more
• 28:45
  talented and what we. Did is that we gathered a lot.
• 28:48
  Of know how from both detection response phase from people that
• 28:52
  are well in cybersecurity start-ups in Israel and try to
• 28:56
  create a team like the Power Rangers of not even identity
• 28:59
  security. And then use that method in
• 29:03
  order. To collect data from different
• 29:05
  sources, it could be infrastructures.
• 29:07
  Called repositories it could. Be MDM and SSO activity.
• 29:11
  Logs. It could be the audit trail of
• 29:15
  the the services that you use. And network data and what not.
• 29:22
  Compile all of that. Data and use it into one model.
• 29:25
  That is the use the usage that is on top of the.
• 29:29
  Of the inventories and then use that that like identity timeline
• 29:34
  in order to. Identify.
• 29:35
  Both changes in the identity. And who was the originator of
• 29:39
  them? Like so who did that commit that
• 29:42
  eventually provisioned the telephone?
• 29:44
  Or example or who? Click the button of getting an
• 29:47
  access key and then second part is the day-to-day use of
• 29:51
  accessing resources and identifying like the data
• 29:55
  attribution piece of what do you access, Why did you access that?
• 29:59
  From which workload or device did you do that?
• 30:03
  So how do I, so I'm interested, right?
• 30:06
  I want to learn more about this. Is this something that are there
• 30:10
  videos or labs or something like that?
• 30:12
  Is it best kind of described in person?
• 30:14
  Like, what's the best way for people to actually see this in
• 30:17
  action? Yeah, I I think that most of
• 30:21
  that identity like the non human identity start today in
• 30:25
  organization. It's even from a lot of people.
• 30:27
  I think that we as a company should provide more resources
• 30:33
  for people to see like even open source and stuff like that to
• 30:36
  start to see they're not in my identity.
• 30:38
  Fabric, but eventually it's best.
• 30:41
  To like to book a demo and to say it with on data that you
• 30:46
  that you want to check out and like.
• 30:48
  Pick a sandbox environment and now we would show you that
• 30:50
  there's. 50 times the amount, it's not an identity that you
• 30:53
  thought by just like scanning and integrating into iPad.
• 30:57
  So I think that like, that's the best way to go.
• 31:01
  That sounds like a challenge, so I would encourage people go and
• 31:04
  go and take, take it up on that challenge.
• 31:06
  We'll put a link in our show notes so people can get to it
• 31:08
  again, easy website token dot security.
• 31:11
  Last question for you around this topic is, is the, is the
• 31:15
  idea of ROI right? People are investing money into
• 31:18
  security tools and they want to be able to show the ROI in it.
• 31:22
  How do your customers measure success with your product?
• 31:30
  Yeah, that's a great question. I see that we found 3 metrics
• 31:36
  that empirically proved that the customer has succeeded.
• 31:40
  And that we agreed upon, but it's still.
• 31:42
  Like an area that we learn. So what are the those 3 metrics
• 31:46
  first of all? You want to be.
• 31:48
  Smart. Being smart is not putting
• 31:52
  yourself in trouble that you don't need to and just cutting
• 31:55
  all of the low hanging fruits and bringing them back home.
• 31:58
  So for example when we see a customer.
• 32:03
  Deactivate all of its identities after 90 days of being stained.
• 32:07
  That's a very, very good. Sign of succeeding, of
• 32:10
  identifying like what's the biggest portion that I can take
• 32:13
  with the least? Amount of effort.
• 32:15
  So that's. One thought, second part.
• 32:18
  Our second metric is modernization.
• 32:20
  We like. To help our customers upgrade
• 32:22
  their non even identity stack we identify unser rated local
• 32:26
  identities. That said that like an anti
• 32:29
  pattern that has been. Around 4 years local.
• 32:32
  Database. Users API kids that are.
• 32:35
  Maintained like only locally and so on.
• 32:38
  And we like to help our customers move from.
• 32:41
  An unser rated identity. To a Federated identity.
• 32:44
  Because I do think socialization is is key.
• 32:47
  It's not. Possible for?
• 32:48
  All the of the technologies because a lot of vendors didn't
• 32:51
  build the ability to. Use Federated.
• 32:53
  Access, but when we see the amount of fun Federated
• 32:56
  identities. Decline and the the identity.
• 33:00
  Start getting. More and more modern.
• 33:02
  That's a very, very good sign for success.
• 33:05
  Last part. Is to take in a problem that
• 33:07
  everybody bashes the head in the wall.
• 33:10
  In order to to succeed in rotating a key, I think that the
• 33:14
  rotation period for keys in organization is much too long.
• 33:17
  I think that sense for example, public infrastructure, so
• 33:20
  between expiry dates. So we created a lot of efficient
• 33:25
  processes to make that work. And in non numenate entity you.
• 33:28
  Don't have that because you don't want to crush production
• 33:30
  because you didn't change a certificate also.
• 33:34
  And So what I measure success with is whether I help my
• 33:38
  customers improve between 60 to 80 to 90%.
• 33:43
  Of the the median time. To otate a key.
• 33:47
  Did you like? Did you?
• 33:48
  Identify the owner that created that.
• 33:50
  Key, did that owner get all of? The data that they needed.
• 33:53
  About who is using that key and was the.
• 33:56
  Process operationally efficient. That's like evolved key metric
• 34:00
  that we measure I think. That's gonna be very helpful for
• 34:03
  a lot of people trying to trying to figure things out for them.
• 34:07
  This has been very helpful, at least at least for me.
• 34:10
  I hope others got, you know, entertainment as well as
• 34:14
  education about this. Definitely visit the website
• 34:16
  token dot security. It's I mean, it looks and sounds
• 34:21
  like such a cool product. I'm I'm interested to learn more
• 34:24
  as we go along with conversations, but we want to
• 34:27
  pivot the conversation here a little bit to something that's
• 34:30
  near and dear to my heart. And you mentioned it earlier in
• 34:32
  the show about online video games.
• 34:34
  So I'm a big online gamer. World of Warcraft is my current
• 34:39
  poison, if you want to call it that.
• 34:41
  I understand you also play online.
• 34:44
  What's what are you up to these days when it comes to online
• 34:46
  gaming? So I think that I moved in so
• 34:52
  many. Different games because I think.
• 34:54
  That every game is good in its own way, but I think that I
• 34:58
  discovered. That my persona in online
• 35:01
  gaming. Has changed very, very
• 35:02
  dramatically. So I'll give an example.
• 35:05
  When I was much younger, I used to be very cautious.
• 35:08
  I also as a kid. And so I used to.
• 35:11
  Build this character of like. Majors.
• 35:13
  That are extremely powerful majors, but I took a lot.
• 35:17
  Of time to train that. Character and to build and so.
• 35:23
  Eventually. I used to spend a lot of time
• 35:26
  building and then like. Going to to fight then.
• 35:29
  I reached the point in my life that I had so much.
• 35:33
  Like. So much things to do, but I just
• 35:36
  became the ultimate speedrunner. I'm just starting the game and
• 35:40
  like heading on all the way like to the.
• 35:43
  Harvest LA to the artist parties.
• 35:45
  And just trying to like die at the least that I can, but like
• 35:49
  do it as quickly as I can and just became a just a plain.
• 35:52
  Barbarian just running into. Into the battlefield, and today
• 35:56
  I'm in the perfect. Zen condition.
• 35:58
  I became a bald, so bald is something that's like it's just
• 36:03
  like a comical relief of the RPG role that like is there doing
• 36:08
  baths and healing and what not, Because I just want to see
• 36:12
  people playing to be part of the the experience, but also like to
• 36:17
  know that there are people that would take in the monster and I
• 36:20
  would be there cheering them. So you're playing?
• 36:22
  This. That's how my yeah.
• 36:24
  Exactly that's how my online. Gaming persona change over
• 36:28
  there. So it's interesting you
• 36:29
  mentioned the the Bard character.
• 36:31
  Not many games have a Bard character.
• 36:34
  My first EverQuest character was a Bard and it was fantastic.
• 36:39
  It was the whole idea of like the support character and it
• 36:41
  kind of, you know, moved along over time.
• 36:43
  And it was very different from me in real life because I was
• 36:46
  not very outgoing and I was very kind of an introvert.
• 36:49
  But here I am playing this barge on, you know, EverQuest.
• 36:52
  I'm in raids. And if you're an old
• 36:54
  Everquester, you know, plane of fear and stuff like that, corpse
• 36:57
  runs that lasted like 48 hours. So I, it's similar.
• 37:01
  It's I, I've kind of gone backwards from there.
• 37:03
  And now I am, you know, more of a Jack of all trades.
• 37:06
  So I'm basically mainly play a druid in World of Warcraft.
• 37:09
  I can kind of do everything. I'm into the paladin right now.
• 37:12
  So I'm getting into that, but I, I mix and I mix and match a
• 37:15
  little bit. I'm sure that we have lost Jim
• 37:18
  completely here 'cause Jim is not a gamer whatsoever.
• 37:21
  I'm curious, Jim, when you hear when you hear me say, oh, Jeff
• 37:25
  was a barge or Edo was a Bard in this game, what do you think of
• 37:30
  what comes to your head? Leroy Jenkins.
• 37:34
  Yes. That's Will.
• 37:36
  Roll that for you, yeah. And I always say the easier than
• 37:40
  charge it into that Whelper room.
• 37:42
  I I know exactly where that took place and it it is absolutely
• 37:45
  what it was. Yep.
• 37:46
  Leon. Jenkins was.
• 37:48
  That's funny. Yeah, what was that?
• 37:51
  Leon Jenkins was Persona 2 for me.
• 37:54
  Like the like the middle online used to speed on things all the
• 37:57
  time, Yeah. So Jeff, you're right, not a
• 38:01
  gamer, but I do appreciate the fact that, you know, you need to
• 38:07
  have some kind of escape. You know, you just can't like
• 38:11
  just work all the time or deal with like the stresses of life.
• 38:15
  You have to have something that takes you out of that for a
• 38:19
  little bit of time and provides some relaxation, show some
• 38:23
  entertainment. So hopefully the Identity Center
• 38:26
  podcast can be that for some people.
• 38:30
  But if not then gaming I think is a pretty cool thing.
• 38:34
  So Jim, what kind of character would you want to play in a sort
• 38:38
  of an online role-playing game? Like what let's you know, let's
• 38:41
  help him out. Let's try to figure out what
• 38:42
  kind of class he might be like. What would you want to do?
• 38:46
  Look at him like this man is pure strength and power, like
• 38:49
  he's a classic. Billion all the way, right?
• 38:51
  Yeah. And they might have a soft sword
• 38:54
  inside, I don't know. Jim, what do you want to do you
• 38:58
  want a tank? Do you want to be like the guy
• 39:00
  in front with the shield and the sword and sort of taking the
• 39:03
  brother damage? Do you want to be damaged?
• 39:06
  I'm I'm so I'm going to get the Holy Trinity here of of
• 39:08
  character glasses. But you've got the tank, the
• 39:11
  healer, the DPS, and you might say crowd control is a force out
• 39:14
  there, but we'll just call it that.
• 39:16
  What's your What do you have an affinity towards to?
• 39:20
  So I, I did play Dungeons and Dragons when I was a kid, right?
• 39:23
  And that has you have your character with all the different
• 39:28
  strengths, like you could be charisma level 2 or strength
• 39:32
  level 5 or speed. And I always like to be like a
• 39:37
  good, yeah, right. But I always like to be like a,
• 39:41
  well, charisma, it's like a 2 out of 10, believe me.
• 39:44
  But as far as like, I wanted to have a character that was well
• 39:49
  balanced. And then the other one that was
• 39:54
  kind of like as far as I would go from a fantasy perspective
• 39:57
  was sorcerer. So you could like throw spells
• 40:00
  on people that seemed like totally unrealistic.
• 40:03
  So. You mean that's not real magic?
• 40:06
  Throwing fireballs and frost bolts and all that.
• 40:08
  And stuff. I'm sure some people believe
• 40:10
  it's real. Ito, I'm thinking.
• 40:13
  He sounds to me an awful lot like a ranged caster type of
• 40:17
  sort of role. A magician, a mage, a sorcerer,
• 40:20
  a warlock, maybe something like that.
• 40:22
  Look, as as long as everybody's playing and like getting their
• 40:26
  energy and they're into the right place, like do whatever
• 40:29
  you want. That's it, I'm down with that.
• 40:34
  All right, why don't we go ahead and wrap it up there.
• 40:36
  We've solved so many problems today.
• 40:37
  We got into the machine identity and then we also figured out
• 40:40
  Jim's class when it comes to playing a a role-playing game.
• 40:43
  So mission accomplished as far as I'm concerned.
• 40:46
  Definitely want to encourage people go visit token dot
• 40:49
  security. It's first of all hats off
• 40:51
  Congrats. It's such a good website, so
• 40:54
  definitely encourage people to go check it out.
• 40:56
  Loving the animations and stuff that you got on there.
• 40:58
  So good stuff. We'll have a link in our show
• 41:00
  notes to make it easy for people to find Ito.
• 41:02
  We'll also put a link to your LinkedIn profile.
• 41:04
  People have questions they want to reach out, you know,
• 41:07
  definitely take advantage of that.
• 41:09
  And then as far as Jim and I concerned, yeah.
• 41:12
  Visit us on the web, idacpodcast.com.
• 41:14
  We're on YouTube, idacpodcast.tv.
• 41:17
  And thanks, Token, for sponsoring this episode.
• 41:20
  Thanks, Ito, for joining us. And we'll talk with everyone
• 41:23
  else and the next time. Thank you for hosting me, I had
• 41:26
  the best time. You've been listening to
• 41:32
  Identity at the Center. We hope you've enjoyed the show.
• 41:36
  Make sure to like, rate and review, and we'll be back soon.
• 41:40
  But in the meantime, hit the website at
• 41:42
  identity@thecenter.com. See you next time on Identity at
• 41:49
  the Center.