Latest / Identity at the Center / #420 - Sponsor Spotlight - GitGuardian

Transcript

#420 - Sponsor Spotlight - GitGuardian · Identity at the Center

• 0:04
  This is identity at the center. Welcome to the Identity at the
• 0:11
  Center podcast. I'm Jeff and I'm flying solo
• 0:13
  today. Jim's off.
• 0:14
  He's on assignment, as we say in the biz.
• 0:16
  But today we've got a great episode.
• 0:18
  Today's is sponsored by Git Guardian, so we're going to
• 0:21
  introduce Dwayne here in a second.
• 0:22
  But if you want to learn more about them, you can find them at
• 0:25
  gitguardian.com/LP's/IDAC. Just to make it clear, right?
• 0:31
  This is a sponsored episode. This is how we support the
• 0:33
  podcast. And we're very thankful that GIT
• 0:35
  Guardians, you know, one of those sponsors that have stepped
• 0:37
  forward to help us spread the gospel of identity and access
• 0:40
  management. So let me go ahead and introduce
• 0:42
  Dwayne McDaniel. He's a principal developer
• 0:44
  advocate at Git Guardian. Welcome to Identity at the
• 0:47
  Center, Dwayne. Thanks very much for having me,
• 0:49
  Jeff. I'm excited to be here.
• 0:50
  Yeah, thanks for joining us. And I don't know what it is
• 0:52
  about principal developer advocate that I just it seems
• 0:55
  like it just gets blocked up in my mouth and I don't say it no
• 0:58
  good. As Charlie Kelly of it's always
• 1:00
  any Philadelphia would say. Tell me a little bit about your
• 1:04
  kind of your role. How did you get into identity?
• 1:05
  Is it something that you chose or did it choose you?
• 1:09
  I actually agree with you. I trip over it all the time.
• 1:13
  I misspelled it the first time I ever put it, wrote it down in my
• 1:16
  signature, and thank goodness I have Grammarly.
• 1:20
  They told me, hey, that's not right.
• 1:22
  No, I've been a developer advocate for a little over a
• 1:26
  decade now. So my background comes from the
• 1:30
  world of Java middleware a long time back, platforming our
• 1:35
  platforms and tools, dev OPS focus for a good stretch of my
• 1:39
  life. And that's actually how I went
• 1:41
  from sales. I have a sales background to
• 1:44
  developer advocacy. Was working for a platform
• 1:48
  called Pantheon dot IO and I had AVP of sales who said, hey,
• 1:53
  you're not the sales guy I need, but you're really good at
• 1:55
  explaining stuff and I need you to help people figure stuff out.
• 1:59
  And that's literally I took that as a mission and it became kind
• 2:02
  of my advocacy, like for myself for what I do.
• 2:05
  Like that's how I describe what I generally do.
• 2:08
  So a few jobs later end up having a chance to work for
• 2:13
  someone who had worked for a previous company that I'd been
• 2:15
  at. And that's how I ended up here.
• 2:18
  And this is really my first job in the security realm, but I've
• 2:21
  been here almost four years now. It's hard to believe, but three,
• 2:26
  you know, three quarter or four years by the time this comes
• 2:28
  out. And yes, this is my first role
• 2:32
  where I've had the chance to look at identity and access
• 2:36
  management and the depth that I have.
• 2:38
  It's one of those things I just kind of always took for granted
• 2:40
  in previous roles that now it's somebody else's burden that's
• 2:42
  somebody else's problem or that's baked into the platform.
• 2:46
  I, I mentioned Pantheon a little bit ago.
• 2:49
  They were the company in 2013, 2014.
• 2:53
  They had environment variables like secret environment
• 2:56
  variables and told you do not hand configure your vars like do
• 3:01
  not hand configure these. Let us do this and then we can
• 3:03
  swap these out at intervals and we'll handle all that for you.
• 3:07
  So your database credentials, your Redis credentials, like we
• 3:11
  got that New Relic credentials. And at the time it was like, oh,
• 3:16
  OK, that's just how it works. And that was in 2014.
• 3:19
  And then it comes to find out I end up working for a company and
• 3:22
  our entire premises, people leak secrets, people hard code these
• 3:26
  things left and right and by the 1,000,000 per year.
• 3:30
  And it just left me scratching my head when I first joined,
• 3:33
  like, is this that bad of a problem?
• 3:34
  And yeah, turns out it actually is.
• 3:36
  It's amazing, you know, how far this industry has come in yet,
• 3:40
  you know, here we are in the year 2026 that we're still
• 3:44
  finding companies that have like hard coded secrets into
• 3:46
  applications, you know, they've left open, you know, different
• 3:49
  repositories or repos or whatever want to call like all
• 3:52
  these different resources we're pulling into, you know, with you
• 3:55
  kind of getting into this role here with your guardian and you
• 3:58
  know, really just starting into the identity spot, I guess
• 4:02
  officially. Is there anything that surprises
• 4:06
  you from your past background and kind of like, hey, this is
• 4:09
  kind of interesting, I didn't expect this.
• 4:12
  Oh man, there's a lot of things. The the first, like I said, it
• 4:15
  just people are doing this like you're hard coding credentials
• 4:17
  like you, you're trusting that these secrets are one, not going
• 4:22
  to be stolen and two, that you're going to be able to
• 4:25
  remember where they all are and you're going to be able to
• 4:26
  rotate them yourself. Like that was how we viewed it
• 4:29
  back in my old company Pantheon was, look, this is a burden and
• 4:34
  we're going to take that operational burden on and take
• 4:36
  that off of your hands so you can focus on doing what you
• 4:39
  actually want to do, which is deliver your actual applications
• 4:42
  out there. The bigger surprises have
• 4:47
  actually been more subtle than that.
• 4:49
  Like I've come to personally believe that we mixed up access
• 4:54
  or, I'm sorry, authentication and authorization and a really
• 4:58
  terrible way the way we've done it with passwords and API keys
• 5:02
  and standing privilege and everything associated with these
• 5:05
  hard coded secrets, everything associated with, you know, a key
• 5:09
  that anybody that holds that key can go through the door and then
• 5:12
  do whatever they want on the other side within a certain
• 5:15
  scoped level. Recently I've been actually
• 5:18
  having the conversations like do identity and access management.
• 5:22
  Is that one thing? These are, there's an and in
• 5:25
  there for a reason. Where are those lines?
• 5:28
  Where do we have those conversations?
• 5:29
  So that's where I'm at right now with it.
• 5:32
  But just the scope of how much we have gotten it wrong.
• 5:37
  And we're seeing the ramifications of that throughout
• 5:40
  the supply chain attacks these days and just story after story
• 5:44
  after breach after breach. We've been saying it for a while
• 5:48
  here at Gate Guardian, but the attackers aren't bothering to
• 5:51
  break in anymore. They're just logging in and
• 5:53
  that's the easiest path in, which is sad, but I was
• 5:57
  personally a little surprised by that when I first came to fully
• 6:00
  realize that's the extent of the damage.
• 6:03
  Preach on, brother. I think there's so many people
• 6:06
  who think of I am as just authentication, but it's so much
• 6:08
  more than that. You know, I've I've talked to
• 6:11
  hundreds of people, you know, on this podcast, been very
• 6:14
  fortunate, but very few what I would call, you know, your kind
• 6:17
  of role that principal developer advocate.
• 6:19
  I even said it right that time, what is, you know, kind of like
• 6:22
  the normal day look like for that type of role, just kind of
• 6:25
  maybe peel down the the 4th wall there and kind of take people
• 6:28
  behind the curtain. I wish there was a normal day.
• 6:32
  That's kind of the joy of the role.
• 6:34
  I see myself as one of the last generalists.
• 6:37
  In a world where we're moving, the pendulum is swinging back
• 6:40
  toward the generalist. I technically report to the CMO
• 6:44
  and other organizations. Devrel reports to operations or
• 6:49
  to engineering or to sales. It doesn't really matter where
• 6:54
  we report up in the chain. The matters how we interact with
• 6:59
  all of the departments. So I interact with product as
• 7:02
  much as I do with sales. I'm a function of marketing,
• 7:05
  interact with our customer support, interact with
• 7:07
  documentation, interact with basically all of the teams.
• 7:10
  I am the person in the room saying, wait a minute, a person
• 7:14
  who doesn't have this insider knowledge might not know that
• 7:17
  this is hard. I'm the person who breaks
• 7:20
  things. They will give me early access
• 7:23
  to things and I will be the loudest in the channel saying,
• 7:25
  hey, this doesn't work. Hey, this doesn't work.
• 7:27
  And like it was a beta preview with, of course we know it
• 7:29
  didn't work, but thanks for telling us.
• 7:32
  The person who was like, we're going to release the script.
• 7:34
  And I try to run it and I follow the structures letter and like,
• 7:37
  here's the errors I get. And I just assume that naivety,
• 7:42
  naivete that a new developer, I, I want to advocate for them that
• 7:46
  they're going to have the best possible experience.
• 7:48
  At the same time, I get to spend a lot of my time out in the
• 7:51
  field at conferences. I went to like 30-4 conferences
• 7:54
  last year alone. I've spoken to over 100 since I
• 7:58
  started a Pantheon. I'm sorry, since I started a git
• 8:00
  guardian, I got Pantheon on the brain.
• 8:02
  I was talking about it earlier. And I get to bring that
• 8:06
  knowledge back in house. So what are the latest trends?
• 8:10
  What did the person who actually wrote this report that we just
• 8:14
  read last week, what did they actually say about it in person?
• 8:16
  What did they present at their session?
• 8:18
  What are the trends going on out there?
• 8:21
  And try to bring that knowledge back and close that loop.
• 8:23
  So I'm advocating both ways internally.
• 8:25
  I'm advocating, hey, this is the actual situation on the ground
• 8:29
  and what people are facing out there and why they can't just
• 8:32
  jump to a better solution tomorrow and why they can't just
• 8:36
  adopt us like right the second based on their other priorities
• 8:40
  in their stack and the other way around.
• 8:42
  Like the community needs to know what the problems are, how we
• 8:46
  can address those. I try not to do it in a Selly
• 8:48
  way or salesy way. I mean, I'm old, old school
• 8:52
  sales, so it always shines through a little bit.
• 8:54
  But trying to explain the bigger broad strokes technologically,
• 8:57
  this is what we need to be addressing.
• 8:59
  This is where we need to be going as an industry.
• 9:01
  And yeah, of course the Guardian fits in there somewhere, but I
• 9:05
  also put us up on the same screens that I do.
• 9:08
  People would consider direct competitors or open source
• 9:10
  products that can do a fraction that handle part of the use case
• 9:14
  and try to explain like in the bigger sense, this isn't just a
• 9:17
  get guardian can save you issue. This is a we need some
• 9:21
  fundamental governance conversations at a higher level.
• 9:24
  And yeah, you need better tooling along the way.
• 9:26
  But the more important thing is process and people and how you
• 9:30
  put those plans together. So what is it about like the
• 9:33
  secret space that kind of pulled you in with all the different
• 9:35
  things that we have and identity going on?
• 9:38
  Like what is it about secrets? It's like, Oh yeah.
• 9:40
  Like that's that's where I want to be right now.
• 9:42
  This actually comes from a couple jobs ago.
• 9:45
  I was at a place called Git Kraken.
• 9:47
  I've worked for two companies with git in the name and a Git
• 9:49
  Kraken. I love Git I I absolutely adore
• 9:56
  teaching people git basics, explaining how it in turn works
• 10:00
  internally. I read the good the git book
• 10:02
  years ago. You can too.
• 10:03
  It's a little a little dated, but all the foundational stuff
• 10:06
  is still there. It's just the git-sem.com/book I
• 10:10
  think or just look up the git book and it's free and explains
• 10:14
  how this all works, the plumbing level versus the porcelain and
• 10:18
  the all those fun hidden commands and like what Lib git
• 10:21
  see is and like how we're implementing these things at
• 10:24
  scale across platforms without having to put the CLI in place.
• 10:28
  Anyway, Long story short, I'm looking at git.
• 10:32
  One of the most powerful things built into git is the hook
• 10:35
  system. Linus Torval needed a way to run
• 10:38
  a script when a thing executed, so they put 17 various hook
• 10:43
  points where an event happens inside of git and something
• 10:46
  executes. Whatever that script is, it
• 10:48
  could be in anything you want as long as you have a local
• 10:50
  executable environment. And I came across this idea
• 10:55
  literally after I left Pantheon of like, hey, people are hard
• 10:58
  coding secrets. That's nuts.
• 11:01
  What if, what if we just put hooks in there?
• 11:03
  So that I gave started giving a talk back in 2021, I believe
• 11:07
  first time I gave it was stop committing your secrets, get
• 11:10
  hooks to the rescue. So specifically what about
• 11:13
  secrets is it's one of those things, if you can nip it in the
• 11:17
  bud is they say you can stop it before it gets committed.
• 11:23
  You solve an entire class of problem if you put it into your
• 11:27
  source code and you push it and that source code gets public.
• 11:31
  Wow, now everyone in the world can log into whatever that thing
• 11:33
  is. You put it into your source code
• 11:35
  and it doesn't leak publicly, but somebody breaches.
• 11:39
  Well guess what? You just gave them an open door
• 11:42
  into anything. Like you can look at so many
• 11:45
  examples. The Uber breach from 2022 is one
• 11:48
  of the most egregious because after they got through Pam, they
• 11:52
  fished a super admin password, got through, flooded them with
• 11:57
  alerts, got through that, realized, hey, there's
• 12:01
  PowerShell scripts everywhere, chock full of all the
• 12:03
  credentials. Like they taunted hacker one
• 12:05
  from within their own interfaces because, well, they just had the
• 12:08
  keys. They just could just March in
• 12:10
  and say, all right, I'm here, I can do whatever I want.
• 12:13
  So it just seemed even back then before I worked for Gate
• 12:17
  Guardian, that was just this solves an entire class of issue.
• 12:21
  And I wasn't even thinking really from a pure security
• 12:23
  standpoint. And like I wasn't thinking in
• 12:26
  terms of IAM, I was thinking in terms of DevOps.
• 12:29
  Like DevOps has very aligned goals with security.
• 12:32
  We want uptime. We want no one to come in and
• 12:35
  mess with the integrity of our stuff.
• 12:37
  And at the end of the day, we do not want auditors or lawyers
• 12:39
  breathing down our necks saying, hey, you did this wrong.
• 12:43
  And that's kind of the same general goal that the CIA triad
• 12:46
  for security. So if we can align those, and I
• 12:49
  think identity is where they align perfectly.
• 12:53
  So that's how I got so passionate about this stuff.
• 12:56
  And then we're going to forget Guardian.
• 12:58
  Just seeing the amount of research and seeing what's out
• 13:02
  there and like the horror stories and paying attention to
• 13:04
  news cycles as close as I do, like I'm still, I am more
• 13:07
  convinced now than ever that if we dealt with this one aspect,
• 13:11
  we would, wow, we would solve so many problems around security.
• 13:16
  Like so many supply chain attacks right now are just get
• 13:20
  their credentials and pivot from there or get through an initial
• 13:25
  misconfiguration to get their credentials and move on from
• 13:27
  there. And you just see that time after
• 13:30
  time after time. I did a, an independent search
• 13:32
  the other day and it came by like 37% of all articles in the
• 13:37
  last year from Bleeping Computer were about credential abuse.
• 13:42
  Like, yeah, it's it's it's a problem.
• 13:46
  That puts the bleeping and bleeping computer.
• 13:48
  You think about it. Let's let me, let me learn more
• 13:52
  here about git guarding because you know, I, I'm, I will say I'm
• 13:54
  not as familiar with it as probably, you know, other
• 13:57
  developers might be. I'm not a developer and I'm sure
• 13:59
  we have lots of people listening who are not familiar with.
• 14:01
  So let's give me the overview. Like what is git guardian?
• 14:04
  You know, what is the mission? What are the problems that
• 14:07
  you're looking to solve? And and start start start with
• 14:10
  that. So our Co founders started in
• 14:12
  2017 looking at what can you glean off of the API from the
• 14:18
  public API for for GitHub, you can look at it today, it's still
• 14:23
  public. It's in the name of the product
• 14:24
  api.github.com/events. It's a firehose last year's 1.9
• 14:30
  billion commits across the thing and it's everything that happens
• 14:34
  in public. So you change the name of repo,
• 14:36
  you make something public, you push a commit, it's all there.
• 14:40
  And one of the things they immediately discovered on just
• 14:43
  doing some cursory grep and some regex looking through what's
• 14:47
  there is, hey, why are there all these production environment
• 14:50
  keys laying around? So they started making phone
• 14:53
  calls. And the story I've heard is most
• 14:57
  people hung up on them or got extremely mad or threatened to
• 15:00
  sue because, hey, why are you looking at a private repos?
• 15:03
  Like we're not like, this is how we got this.
• 15:05
  It's literally in public. Like you should do something
• 15:07
  about that. And it was one company said,
• 15:11
  hey, this is great how much we owe you.
• 15:13
  And they said, hey, there's something here.
• 15:17
  And that's kind of how it started with public monitoring.
• 15:19
  So we still to this day look at every new event that hits GitHub
• 15:23
  public. If it is a new commit or
• 15:25
  something that has become public that wasn't public before, we
• 15:29
  scan it for a secret. And we started with a handful
• 15:33
  like your common, most common patterns.
• 15:35
  And right now we have over 600 detectors that can pinpoint
• 15:39
  like, hey, this is a secret. So we do generic detection with
• 15:43
  contextual analysis. If we look at the long weird
• 15:48
  string, if it's in a header and the app fails, if nothing comes
• 15:53
  back from that call, we're pretty sure that's a secret.
• 15:55
  Like no matter what form that takes, we call those generic
• 15:59
  detectors. So that's how we started with
• 16:02
  public monitoring. We still do that.
• 16:04
  That's still probably our most popular thing that people talk
• 16:08
  about out there because it's tied to our report that we do.
• 16:11
  That's how we build our annual report, which we'll we'll talk
• 16:14
  about later. But then people started asking,
• 16:18
  can we hook this up to internal repos?
• 16:20
  And the answer to that is, well, gets Git if we can handle the
• 16:23
  scale of watching everything and get out public, sure.
• 16:27
  And that's what we started doing.
• 16:28
  So originally it was just your Git repos no matter where they
• 16:32
  were hosted. And then it became, well, we
• 16:34
  have ACLI, we can scan anything anywhere.
• 16:38
  Just give us a path, give us like Sol's point is at the repo
• 16:40
  no matter where it's hosted. But then it's quickly spread to
• 16:45
  secrets don't just leak in code, they leak in the entire
• 16:48
  ecosystem around the software development life cycle.
• 16:51
  So Slack, Jira, Teams, Confluence, S3 buckets, we're
• 16:57
  actually just about to release that and private beta right now.
• 17:01
  Let's scan all your buckets, see what's in there, Docker images,
• 17:06
  registries, and the list just goes on.
• 17:09
  And then we recently added the ability to bring your own
• 17:13
  source, which means if it's got text that's scannable, we can
• 17:17
  make it a source that you can scan on a regular repeated
• 17:19
  basis. Just a little bit of wiring and
• 17:21
  off you go to literally anything on your sun logs, your home
• 17:25
  grown seams or whatever. We can make it happen.
• 17:29
  And then about a year ago or a little over a year ago, we went
• 17:34
  down the path of NHI governance. So NHI governance is the
• 17:38
  outcome. Like if you have a plan of we
• 17:41
  need our non human identities, which is the vast majority of
• 17:46
  keys are associated with non human identities versus humans.
• 17:50
  Like it's 150 to 1 guesstimate right now across the industry
• 17:54
  for every one person that has a key, there's 150 non humans that
• 17:57
  have keys. So that's the way we leaned into
• 18:01
  this NHI side and not even identity governance is really
• 18:05
  what state are these things in? Who owns them?
• 18:08
  What policy breaches have occurred?
• 18:11
  Like is it, has it lived too long?
• 18:13
  That's by far the number one breach that people have with
• 18:16
  these entities. Is it over permissioned?
• 18:21
  Should you have? Do you know this as admin
• 18:23
  privileges? Like we can highlight and
• 18:26
  surface that in a coherent way across not just the secrets that
• 18:30
  you've leaked out there in public or in charge, your repos
• 18:34
  and like whatever they appear in plain text.
• 18:36
  But now we can hook into your vault systems and give you pure
• 18:40
  inventory view of all of your identities across the thing
• 18:44
  holding your keys. And as of the end of last year,
• 18:48
  we started hooking into identity providers.
• 18:51
  So Okta and A WSI AM and start being able to inventory so
• 18:57
  anthropic open AI, we can say, hey, these are all of the
• 19:02
  accounts that got made even they're even though they're not
• 19:04
  used, even if they're not in the wild quite yet, but they've been
• 19:09
  provisioned. We can give you that insight
• 19:11
  say, hey, this person provisioned this at this such
• 19:13
  such time and we don't see it used anywhere yet or hey, this
• 19:18
  same identity is being used by these like 15 endpoints and
• 19:24
  we've extended that just recently and this is just coming
• 19:27
  out now. We're happy to work with folks
• 19:29
  out there to move it to endpoint protection, to move all of this
• 19:33
  on to the developer machine as an MDM solution.
• 19:36
  So I think what you've kind of described there is not only like
• 19:39
  the secrets themselves are a problem, but you start getting
• 19:41
  into a lot of the secret sprawl, as it's typically called, right?
• 19:44
  You've got all these different spots that, you know, things can
• 19:48
  be stored in, kept in, and each of those are a vector that could
• 19:51
  be potentially misused. Talk to me a little bit about
• 19:54
  where do you typically see those things kind of manifest?
• 19:58
  Is there like a common area that you found where it's like, yeah,
• 20:01
  we know about this, but oh, by the way, people listening out
• 20:03
  there in the world, you really should be checking this thing
• 20:06
  because this is kind of like the common thing that we see a lot.
• 20:10
  One of the most common files we find out there as you can guess
• 20:15
  is EMB files. It's very easy with get to use
• 20:21
  get ignore. It's also very easy to mess up
• 20:23
  get ignore. You know 1 bad line, 1 bad
• 20:26
  comment and wow you blown out your get ignore or accidentally
• 20:31
  excluded to get ignore file. Actually recently somebody told
• 20:34
  me a story that they were using Claude code and multi agent
• 20:39
  setup and one of the agents decided that get ignore was in
• 20:42
  the way and it just simply removed it.
• 20:44
  And the next commit, they didn't notice that and then they pushed
• 20:47
  all of their environment various public.
• 20:49
  They know that because we sent them an e-mail.
• 20:51
  So I didn't talk about that. That is part of our service and
• 20:55
  that's something we've been doing the entire time is we find
• 20:59
  a secret and one of those commits publicly, we send an
• 21:02
  e-mail to the committer right then and there.
• 21:04
  It's an automated system. It's completely sealed off from
• 21:06
  the rest of our business. It's not a a marketing thing for
• 21:09
  us. It is literally like this is a
• 21:11
  public good. You did this publicly.
• 21:13
  Shouldn't do that before I worked for the company, I got
• 21:16
  one of those because I had tried to be clever and I was got a new
• 21:20
  laptop and I just tried to bounce my SSH key over through a
• 21:23
  public or a private GitHub repo like, yeah, that's that'll work.
• 21:26
  You'll save me a few minutes. And no, it actually cost me a
• 21:30
  lot of time because I got an e-mail immediately saying, hey,
• 21:33
  you leaked this private SSH key in public.
• 21:36
  And the first words out of my mouth were no, I didn't that's
• 21:38
  not public repo. And I went and looked like, Oh
• 21:40
  no, I have leaked to public in public.
• 21:42
  So right then and there I had to go through everything that was
• 21:45
  associated with with I was super lazy.
• 21:48
  I was reusing that SSH key in multiple platforms should not
• 21:52
  have done that. It's a bad practice.
• 21:53
  I know that now. But I nothing bad happened.
• 21:59
  I was able to catch it so fast and able to invalidate it so
• 22:02
  fast on like GitHub and the other platforms I was using.
• 22:04
  And on that, I never saw any negative effects because they
• 22:08
  saved me on that. So that's what we're hoping to
• 22:09
  do with everyone out there. If you see an e-mail from us,
• 22:12
  we're not picking on you. We're just trying to keep
• 22:14
  everybody safe. We call that our Good Samaritan
• 22:16
  program. Yeah, I was going to ask you
• 22:18
  about that a little bit later on, but let's talk about it
• 22:20
  right now. So what is he kind of talk about
• 22:23
  giving me an e-mail, but how does that effectively work?
• 22:25
  Is it something that well you described as something like you
• 22:28
  guys automatically do? But tell me more like is it can
• 22:32
  I opt in? Can I opt out?
• 22:33
  Like how does this program work? You can definitely opt out.
• 22:36
  We would not recommend it though.
• 22:39
  And if you are not signing your commits with an actual real
• 22:43
  e-mail, that's problematic in and of itself for a number of
• 22:46
  reasons, but also means we can't e-mail you, which we're starting
• 22:50
  to get into some weirdness there around cosign commits because
• 22:55
  who do we e-mail if there's like multiple commit committers?
• 22:57
  But if it's obviously clutter GPT, then yeah, it's pretty
• 23:03
  obvious what what happened. But no, we don't have it as an
• 23:07
  opt in. This is, again, we're looking at
• 23:10
  a public feed. This is public information.
• 23:13
  We know we're not the only people doing this out in the
• 23:15
  world. So the way Git works and the way
• 23:18
  it's worked for wow, it turned 21.
• 23:21
  I just realized that this month. Git just turned 21.
• 23:24
  It's old enough to drink now. April 2020, April 2005.
• 23:29
  It was the first time Linus subscribe get, I think this is
• 23:35
  the week it got named too, where we're recording this just weird
• 23:38
  fun fact. But the one of the ways it works
• 23:41
  is you have to sign your commits.
• 23:42
  There has to be an e-mail address so Linus can get in
• 23:44
  touch with you to figure out what the heck is going on with
• 23:46
  his patch if he needs to like that.
• 23:48
  That was the original idea. And we still benefit from that
• 23:51
  because, well, there's a way to contact the person who made that
• 23:54
  change, who made that commit. We know we're not the only
• 23:57
  people looking at that feed. We're the people who are trying
• 24:00
  to keep everyone safe. And we're doing it as a public
• 24:03
  good so we can alert you hopefully before the attackers
• 24:07
  get a hold of it. If you're a nation state actor
• 24:12
  out there, you have caches of everything that happens.
• 24:16
  It's not that hard to set up, just most people don't have the
• 24:19
  bandwidth or resources to try to deal with the almost 2 billion
• 24:22
  commits a year and then sort out what can they can do with it.
• 24:26
  The big nasties definitely do the cybercrime syndicates.
• 24:30
  I would not be surprised if there was a private server
• 24:33
  somewhere on the dark web that shiny hunters and the other
• 24:36
  threat actors like collectively just hey, I noticed the sun this
• 24:40
  part of the repo or so weird. The other danger to it is people
• 24:47
  have this misunderstanding of what GitHub is and isn't and
• 24:52
  what it can do and what it can't do.
• 24:56
  There is a belief and and it it is true for a certain class of a
• 25:00
  secret that they have this program.
• 25:02
  It's been going on for a few years now.
• 25:04
  And if you register your API key as a provider, if you make API
• 25:10
  keys and you register with GitHub, you can set up an
• 25:13
  automatic invalidation or attach policy to it.
• 25:17
  So the classic is AWS credentials your secret, Yeah,
• 25:24
  your AWS password in secret or API key in in secret combo.
• 25:31
  They will shoot off an e-mail immediately.
• 25:33
  When GitHub, it gets uploaded to GitHub, it will immediately
• 25:36
  shoot an e-mail to AWS and AWS will attach user policy.
• 25:40
  I think we're up to 3 or 4 now. And that policy is just disallow
• 25:45
  anything that would cost money. It's not a security policy.
• 25:48
  It's actually a cost savings measure from AWS if you actually
• 25:51
  look at the policy itself that gets attached.
• 25:54
  So that's what one of those misunderstands like, hey, well,
• 25:56
  GitHub will just take care of that, right?
• 25:57
  Because we pushed it on to GitHub.
• 25:59
  Well, not really. It works for some things, not
• 26:02
  everything. And then it doesn't always
• 26:04
  invalidate. It just attaches some kind of
• 26:06
  policy to it. The other part is the push
• 26:09
  protection. Push protection is awesome on
• 26:11
  GitHub for a certain set of things.
• 26:15
  And assuming that you use it, it's very easy to turn off.
• 26:20
  It's very easy to end around on a per push basis and just say,
• 26:24
  yeah, I know what I'm doing. I'll I'll do it later.
• 26:26
  And last time I checked, it wasn't free for a private repos
• 26:28
  that might have changed. Don't, don't hold, don't hold me
• 26:32
  on that one. But it's something that's very
• 26:34
  easy to get around that push protection.
• 26:36
  The other piece is we get a lot of feedback and I'm always
• 26:40
  surprised by this to this day. Like this happened to me this
• 26:44
  week. Someone said, oh, I've taken the
• 26:46
  commit down. It's all good now.
• 26:48
  It's like what they meant is they overwrote that commit with
• 26:52
  another commit or they added another commit onto the chain
• 26:55
  and Oh no, it's gone. It's like, no, that that other
• 26:59
  commit's still there in public. Like that's how Git works like
• 27:01
  that. Just because you put another
• 27:03
  commit in front of it doesn't make that commit not be there.
• 27:06
  And like the fact that Git is kind of forever.
• 27:09
  And even if you try to prune it, orphan commits still exist.
• 27:12
  There's a giant shadow cache that is GitHub.
• 27:15
  And if you do not access it, you have access to all of these
• 27:18
  commits that people thought, well, no, I deleted that commit
• 27:20
  like that. I cleaned that up.
• 27:21
  Like it's gone. It's like, well, if it ever,
• 27:23
  ever, ever made it to public, if we sent you an e-mail about it,
• 27:26
  assume it's forever. Assume that on a server that is
• 27:30
  somebody else's on another platform somewhere, that commit
• 27:33
  will live forever. And we've seen that in the wild.
• 27:37
  Like we've seen multiple attacks where it's like we see the repo
• 27:41
  get taken down immediately, like turned to private again, and
• 27:46
  then there's still a security incident related to that
• 27:48
  organization, you know, a few days or weeks later.
• 27:51
  Because it takes time for them to go back in and fix all the
• 27:54
  different underlying mechanisms that are associated with that.
• 27:58
  The hope is that they will. We have evidence that they
• 28:02
  don't. This is directly from the
• 28:05
  report. We haven't really talked about
• 28:06
  our state of secret sprawl report, but that is the big
• 28:09
  glaring number that bothers me personally the most out of it is
• 28:16
  so for a class of our secrets that we find that we can detect,
• 28:20
  we can do a validation stuff. Can't do it for everything under
• 28:23
  the sun, but we're working on that where we do a non of truth,
• 28:27
  non intrusive API call to the platform or some kind of call to
• 28:31
  the platform say hey, does this key work?
• 28:33
  Does it authenticate? And if it's valid, we tell you
• 28:36
  it's valid. If it's not valid, we say it's
• 28:38
  not valid. If we don't know, we tell you we
• 28:40
  couldn't find out. Whenever we're trying to mislead
• 28:42
  you. The vast majority of secrets are
• 28:45
  falling that generic camp and we can't do that.
• 28:48
  We took in 20 or for 2025 report looking at 2024 data.
• 28:53
  We took a sampling of secrets that we found to be valid back
• 28:57
  in 2022. You know, they're still on
• 28:59
  public, they're still there. We went back and checked like,
• 29:02
  yeah, these are still there. So 11,000 + 11,700 or something.
• 29:06
  The exact numbers in the report, the old report, and we tried to
• 29:10
  revalidate them, exact same process.
• 29:13
  And in January 20, 2570 percent came back as still valid.
• 29:19
  Years later. We did the exact same
• 29:22
  experiment, the exact same data set and it's dropped to 64%,
• 29:28
  which means only 6% of those have been dealt with in the last
• 29:33
  year or not then in the 2025 now dealt with could mean that
• 29:38
  service just went away or they finally did rotate that that
• 29:42
  secret or something. We don't know.
• 29:45
  So what we do know is that there's evidence that if it is a
• 29:49
  long lived secret that hits public and it's valid, it's has
• 29:55
  a tendency to stay valid and that's terrifying.
• 29:59
  Why do you think that is? Like why aren't if, if, If
• 30:01
  people are being made aware that they have a problem, why do you
• 30:05
  think they don't fix it? I think it's a combination of
• 30:08
  factors. The 1st is they don't have a
• 30:10
  good solid plan and governance. I, I used governance earlier,
• 30:14
  and that's what I really mean by governance, is there's no good
• 30:16
  governance in place to say here's what you do instead.
• 30:20
  If you just swap out secret one for secret 2 and it's both in
• 30:24
  plain text, you have done nothing.
• 30:25
  There is no point in doing that exercise and people logically
• 30:29
  know that. Well, if I don't have a better
• 30:31
  way to handle this, I'm just going to keep the old one there.
• 30:35
  There's also just the fact of inertia.
• 30:38
  The risk of something bad happening is the probability
• 30:43
  that an attacker will eventually do something nefarious.
• 30:47
  The danger of downtime is dollars and cents.
• 30:51
  It's plain as day. If this system goes down for an
• 30:55
  hour, we lose X amount of money. Let's leave the system run for
• 30:58
  as long as we can without making any changes, and there might not
• 31:03
  be any issues. And that's comes down to a
• 31:06
  business decision, not a technical decision, not a
• 31:08
  security decision. Like, yeah, let's see what
• 31:12
  happens. It hasn't happened so far.
• 31:15
  Nobody's knocked at these companies completely offline
• 31:18
  yet. Yeah.
• 31:20
  What's the worst that's going to happen?
• 31:23
  We'll take the risk and go for just keep the thing running.
• 31:28
  I think we are starting to see better governance out there,
• 31:31
  especially as supply chain attacks have ramped up a lot in
• 31:35
  the last year, the targeting developers and targeting
• 31:37
  credentials specifically. But we're still stuck in this
• 31:41
  paradigm of, well, what do we do instead?
• 31:45
  And if you're not focused on this, like I'll admit I'm hyper
• 31:48
  focused on this because where I work and what I, I read day in
• 31:51
  day out, most developers are not, most DevOps teams are not.
• 31:56
  They're gotten way other so many other things they need to pay
• 32:01
  attention to uptime, throughput, network bandwidth, so many
• 32:06
  issues that from the security side, it's easy to say, well,
• 32:09
  it's going to happen and we take those for granted.
• 32:11
  But dev OPS teams, developers are under pressure on all of
• 32:14
  this stuff all the time. And it's like, do I fix our
• 32:18
  throughput? Do I fix the number of customers
• 32:20
  that can check out in an hour? Or do I fix this hard coded
• 32:24
  secret that's been in there for a year that nothing bad's
• 32:27
  happened to yet? What do I do on my next Sprint?
• 32:29
  What am I going to get a bonus on?
• 32:30
  What am I going to get paid on? What am I going to get yelled at
• 32:34
  by my manager the loudest about? And they guarantee you it's not
• 32:37
  the secret most of the time, unless there is an active
• 32:41
  incident and then it's all drop out, what you're doing, all
• 32:45
  hands on deck. We lived through it and we're
• 32:46
  never going to do that again, right?
• 32:49
  And then everybody just go back to work, don't put anything
• 32:51
  better in place. But I think that's going to
• 32:55
  change. I think that is changing now.
• 32:56
  And the technology is evolving very quickly.
• 32:59
  And I think we're going to get to a point where hard coded
• 33:01
  secrets are going to be laughable in just a few years.
• 33:06
  Not overnight, maybe not tomorrow, maybe not next year,
• 33:08
  but there'll be a point in the not too distant future where
• 33:12
  we'll say what? You hard coded an API key?
• 33:14
  What were you thinking? It's like using Explorer,
• 33:18
  Windows Explorer 8. Like what?
• 33:20
  Why? Why would you do that?
• 33:22
  That's archaic. Well, that's why we do this
• 33:24
  podcast. It's a little bit of a time
• 33:26
  capsule. You know, the people in the
• 33:28
  future will be looking at these, at these cave people I am who
• 33:31
  are trying to figure out, you know, how to do things.
• 33:34
  I was going to ask you about that report that you mentioned.
• 33:36
  So the state of secrets for all 2026.
• 33:38
  I'm looking at the the cover of it right here and we'll have a
• 33:40
  link in our show notes for people to check out.
• 33:42
  It says 5th edition. So I'm assuming you've been
• 33:45
  doing this for at least five years.
• 33:48
  But it also has A tag line that says the year software changed
• 33:50
  forever. Take me behind that that tag
• 33:53
  line. So one of the things we great
• 33:57
  joys we have at Git Guardians, we get to watch technology in
• 34:00
  real time evolve that evolution. The way I like to phrase it is I
• 34:06
  can't tell you the exact traffic patterns and exactly what cars
• 34:09
  are on the road by the number of accidents, but I can get some
• 34:13
  pretty good information about makes and models and how people
• 34:16
  are generally behaving on the road.
• 34:18
  And that's kind of what we can extrapolate from this.
• 34:20
  So the, the, the elephant in the room always is AI.
• 34:26
  It has been for a couple years now, but 2025 is the year we
• 34:29
  watched or from the 2025 report to 2026 report.
• 34:34
  It became not a experiment, not a test or for companies.
• 34:42
  It became the mainstream how we develop and it goes well beyond
• 34:46
  the enterprise. This is just how developers in
• 34:48
  general are approaching the field now.
• 34:52
  Things that might have been done a few years ago with like, I've
• 34:55
  tied together these scripts and maybe got N8 N in there now is
• 34:59
  like, well, no, this is agenic from the ground up.
• 35:01
  This is just literally how we're doing it.
• 35:03
  And that's evidenced from the sheer number of services we're
• 35:08
  seeing with leaked keys was open router had the largest increase.
• 35:15
  Now to be fair, open router did not exist four years ago.
• 35:18
  They didn't exist three years ago, I'm pretty sure.
• 35:21
  I think they're they're fairly new though.
• 35:22
  The platform might have, but not with like the full breadth of
• 35:25
  them doing what they do where they get free tokens for certain
• 35:28
  things. And they're a really cool
• 35:30
  platform that allows you to do multiple LLM models.
• 35:34
  So you can have a fall back, a natural fall backs.
• 35:36
  Instead of calling directly to applaud your calling or
• 35:39
  Anthropic your calling, it will just fall back to the next thing
• 35:44
  you picked on the list. And yeah, that's not available.
• 35:46
  Not a big deal. We'll go down the next thing on.
• 35:48
  It's a really cool system, but we watched 48 X increase in the
• 35:51
  number of leaks secrets from 2025 to or from 2020 or to 2025.
• 35:57
  Like that's massive. And 12 of the top 15 most leaked
• 36:03
  secrets are the highest. Secrets with the highest change
• 36:07
  rate of leaks were AI platform services.
• 36:12
  So not the elements themselves. Deep seats definitely on there,
• 36:15
  but things like Brave Search, MCP, yeah, I've been running,
• 36:23
  not remembering all the names of all the things, but there's a
• 36:25
  lot of them. And if you look at the report,
• 36:27
  you can run down that list and say like, hey, this is a serious
• 36:32
  jump. And what kinds of curves were
• 36:34
  seeing, like Super Bass? Super Bass really showed up for
• 36:37
  the first time last year's report of the 2025 report in a
• 36:43
  significant way, and it's still showing up in a significant way
• 36:45
  on this report. It's not growing as massively
• 36:48
  and rapidly as it did the previous time.
• 36:51
  But Super Base we call out because it's how people do cheap
• 36:55
  vector databases like pretty quickly.
• 37:00
  Is that the only use case for Super Base?
• 37:01
  Absolutely not, but that's predominantly the one that you
• 37:04
  see people talk about in public. So again, we can't tell exactly,
• 37:08
  exactly what cars are on the road, but we can tell you the
• 37:10
  general shape of traffic and how people are behaving out there.
• 37:14
  And we didn't see the big number.
• 37:15
  The, the we, there's a big number at the beginning of this
• 37:18
  report that that's the thing that we always get the news
• 37:23
  about. And that's something, if you're
• 37:24
  listening to this, you probably have seen at least a mention of
• 37:27
  this out there because it gets picked up by a lot of sources.
• 37:31
  But the total number of secrets we saw added to GitHub in public
• 37:36
  in 2025 was 28,649,024. Yeah, but I'm just going to say
• 37:44
  28.65 million. I'm going to round up a little
• 37:47
  bit because I'm just take that liberty.
• 37:49
  But over 28.6 million secrets, that's a 34% increase year over
• 37:56
  year. And this is a continuing trend.
• 38:02
  We have seen it rise every year since we've started putting out
• 38:05
  this report. And really from before that,
• 38:07
  before we put out these numbers publicly, the first report, we
• 38:12
  went back and we looked at that data set and reran basically all
• 38:18
  the numbers. And we were very conservative in
• 38:22
  our first reports because there's a lot of, we want the
• 38:25
  highest precision and recall we can have, but we need to be
• 38:29
  sure, especially around generic secrets and contextual analysis.
• 38:32
  And we simply didn't have the capabilities around LLMS that we
• 38:36
  have today. So going back looking at all the
• 38:40
  numbers that first report, if we ran into the exact same tools we
• 38:45
  had today, it's 11,000,000. Secrets got added to GitHub in
• 38:47
  public in the year 2020, 2020, 2318 million, 21 million in
• 38:53
  2024, and then here we're almost 29 million in 2025 across 2025.
• 39:01
  The interesting trend on that isn't just that, hey, we're
• 39:04
  leaking more secrets, obviously there's more developers.
• 39:07
  But when we did the comparison, and this is one of the numbers
• 39:10
  that jumped out to me, GitHub reported growing 98% over that
• 39:16
  same time period and we're reporting 152% growth of leaked
• 39:22
  secrets. So this is not just a new person
• 39:26
  problem. This is not just a new developer
• 39:28
  is going to leak secrets. This is serious.
• 39:30
  Like we continue as an industry to keep leaking secrets at an
• 39:34
  alarming rate. And we've never done it faster
• 39:36
  and we've never done it with more lines of code than we did
• 39:38
  in 2025. So it's really is the year
• 39:41
  everything changed when you look at it from just a pure numbers
• 39:43
  perspective, just it's ramped up not an order of magnitude yet,
• 39:47
  but it feels like it's headed that way.
• 39:49
  Yeah, I feel like that yet is the keyword there because, you
• 39:52
  know, we, we, we went, we went almost 35 minutes, I think
• 39:55
  without mentioning AI, which I think might be a record for us,
• 39:58
  at least in our recent episodes. But I feel like we're on this,
• 40:02
  you know, exponentially upward trajectory of, of this problem
• 40:06
  because now it's, it is becoming mainstream.
• 40:08
  I mean, I'm vibe coding, you know, stuff on the weekends and
• 40:11
  I am definitely not a developer, which means I'm relying on other
• 40:14
  tools to help, you know? Help me think about security and
• 40:17
  I'm learning stuff, you know about that, especially when it
• 40:18
  comes to identity. But do you feel the same?
• 40:20
  Or it's like, OK, you know, AI really wasn't doing much
• 40:24
  development type stuff. But now we get into this world
• 40:27
  of NH is agentic identities, MCP servers, agent to agent, right?
• 40:32
  And it becomes this exponential, you know, increase in the
• 40:36
  developer footprint at large. Yeah, we actually have the
• 40:41
  numbers to back that up. The we we specifically looked
• 40:46
  and did a a very close up view of Claude code.
• 40:50
  And there's an interesting trend that happened where January of
• 40:53
  2025 there were no commit signed by Claude Code or cosigned by
• 40:57
  Claude Code or co-authored by Claude code is the proper way to
• 40:59
  say it. That's one of the notations in
• 41:02
  get you can add additional, additional signers to a commit.
• 41:06
  So Claude Code allows you to do that.
• 41:08
  They started in earnest and very early.
• 41:11
  So we see the first ones show up in February and like there's two
• 41:16
  and then by the middle of the year it is like 4X.
• 41:22
  You're 4 times more likely to have committed a secret if you
• 41:26
  Co signed or co-authored with odd code then if you didn't.
• 41:33
  And then around September they release a new model and that
• 41:37
  number starts ticking back down and never gets to parity and
• 41:40
  never gets back to that baseline.
• 41:42
  So for every thousand commits, we're seeing like 1.5 secrets
• 41:45
  and it's 2.4 I think for Claude across the entire year.
• 41:50
  So you're more than twice as likely across the entire year on
• 41:53
  average to have leaked a secret if you are letting Claude
• 41:58
  co-author. Now what we're inferring from
• 42:00
  that is you're more likely to have just let Claude do all the
• 42:06
  work if you're letting it co-author and that non
• 42:10
  scientific little surveys we have done always point back to
• 42:13
  that exact same thing. It's like, yes, I sign my own
• 42:16
  commits after Claude gives me the thing.
• 42:19
  Those are at least reviewed in some capacity, even though we're
• 42:22
  pushing thousands of lines of code per PR at this point, per
• 42:26
  per commit at this point versus hey, that looks good enough.
• 42:31
  Claude, go ahead and do the get thing for me and vibe code it
• 42:35
  all the way to production. Like that's what we're seeing.
• 42:38
  If you're not putting yourself in the loop, if you're not doing
• 42:41
  those reviews and you're not taking full responsibility of
• 42:44
  like this is on my shoulders completely and I'm not letting
• 42:48
  Claude say it co-authors, then you're less likely to have
• 42:52
  leaked a secret. So will we see the models get
• 42:57
  better? We are really hoping so.
• 42:58
  It's, it's strange to say I'm rooting for Claude here, but I
• 43:02
  really am seeing the improvement from September to the end of the
• 43:05
  year and now seeing what there will be coming out with this
• 43:07
  year. We might get to a point where it
• 43:09
  will be safer overall to commit with claw code to let it go
• 43:16
  ahead and handle these things for you.
• 43:18
  It's not today. We have the evidence.
• 43:20
  It's not in the new year 2025. But yeah, we're in April already
• 43:24
  of 2026. That's hopefully cross our
• 43:27
  fingers that will be something we'll we'll be able to help
• 43:30
  solve or new developers as the models get better, as the
• 43:33
  training gets better, as we realize, hey, we can't just keep
• 43:36
  training on templates and old data and old ways of doing it
• 43:41
  because that's all insecure and terrible.
• 43:43
  I feel like that's table stakes now for any of these, you know,
• 43:47
  AI coding agents, right? Either helpers or fully
• 43:49
  autonomous. It strikes me that they have to
• 43:53
  get the security right. They might get a little bit of a
• 43:56
  grace or a free pass here over the last couple of years while
• 43:58
  this has kind of been being built.
• 44:00
  But at some point security teams are going to come along and say,
• 44:03
  no, you cannot use that. It is not secure.
• 44:06
  And so I feel like it's in their best interest, right?
• 44:08
  Whatever company is developing, you know, any of these, you
• 44:11
  know, coding AEI agent tools that they have to get the
• 44:14
  security right. Am I, am I being fair with that,
• 44:17
  with that observation? I think you're being optimistic
• 44:19
  with that observation. That's fair.
• 44:22
  Putting security in a place where they can literally say no.
• 44:26
  I'm not sure that's reality anymore.
• 44:28
  We just saw this week the the news from Versal.
• 44:32
  It was 1 developer used a compromised agent and all of
• 44:41
  their internal secrets just got leaked.
• 44:43
  It's amazing. That's what it takes, right?
• 44:44
  You could do everything right by the book and then one person
• 44:47
  goes, you know, One Direction that maybe is or isn't
• 44:50
  sanctioned and there your your castle starts to crumble.
• 44:54
  And I don't know if it was their their report or someone else's
• 44:57
  report that I read this week. I read a lot of reports as part
• 45:00
  of the job of developer advocate is to stay up on what's going
• 45:03
  on. That said, when they brought
• 45:06
  that up to their internal developers, not a single
• 45:09
  developer knew that was even a possibility.
• 45:11
  They hadn't heard. They're not keeping up with the
• 45:14
  latest, greatest attacks. They're not keeping up with like
• 45:17
  the horrors that can be done through prompt injection.
• 45:21
  Like they know it exists. It's something out there that's
• 45:23
  going to affect someone else in the world.
• 45:27
  But you know what? I'm going to keep developing the
• 45:28
  way I've been developing because that has kept me employed and
• 45:31
  that has kept me active and happy and healthy all this time.
• 45:36
  And now we can't trust our tools.
• 45:38
  Like I'll give you an example of the the advice we're giving
• 45:41
  people now is local environment variables are no longer safe.
• 45:48
  That's if you'd have told me a year ago I would be giving that
• 45:52
  advice to developers now, I wouldn't have believed you move
• 45:56
  to local vaults. Key pass is free 1 password.
• 45:59
  Most companies provide some kind of password system and they all
• 46:02
  have documentation and guides on how to do this properly.
• 46:05
  But moving away from at any point, anything on your machine
• 46:09
  can reach that text file can reach that your, your history
• 46:13
  can reach your, your logs can reach.
• 46:16
  You know at this point there's no difference between the data
• 46:19
  plane and the control plane for most AI instances or for most
• 46:22
  agentic instances. So you can simply open up a file
• 46:27
  and them will arbitrarily execute this thing that will
• 46:30
  call open claw that will then run a scanner to look at all of
• 46:36
  your credentials, like dump all of your environment variables
• 46:40
  and then report those out to some kind of thing on the
• 46:43
  blockchain. Like that sounds sci-fi, but
• 46:45
  that's literally happening right now.
• 46:46
  That's canister worm from team PCP.
• 46:49
  Like there's these are real attacks that are happening in
• 46:52
  real time and we in security are like living by the seat of our
• 46:57
  pants moment to moment. What horrible, new terrible
• 47:00
  thing is going to emerge today in the news?
• 47:02
  Like I read multiple news sources a day that like are not
• 47:05
  mainstream news by the time it hits like your CNBC or your
• 47:10
  whatever news source you're reading out there, your ground
• 47:13
  news like, Oh no, no, this has been going on for a while.
• 47:15
  It's like it is already too late to do anything about that
• 47:19
  version of the attack. Just you hope you didn't get
• 47:21
  popped. You hope you weren't one of the
• 47:23
  people that downloaded the wrong version or opened the wrong file
• 47:26
  with the wrong tool. All right, well, shout out to
• 47:28
  ground news there. I also think it's a cool thing.
• 47:31
  I love ground news. Check it out for people who are
• 47:34
  interested. So we've spent the last 45
• 47:37
  minutes kind of talking about all these problems and stats and
• 47:40
  measures. And I'm sure we got a lot of
• 47:42
  people listening that are like, OK, So what do I do about it?
• 47:47
  And a lot of the people that are listening may or may not be,
• 47:49
  well, say they're probably not developers.
• 47:50
  They're probably more focused than I am just by the nature of
• 47:53
  this podcast. What are some of the things that
• 47:55
  people can take away and say, OK, these are the questions I
• 47:58
  need to start asking either my, my dev team or my dev SEC OPS or
• 48:02
  information security or whatever right groups might be in the
• 48:07
  role of application development organization.
• 48:09
  Like what are some initial questions for me as an I am
• 48:13
  practitioner out in the world to say, how do I get my arms around
• 48:16
  this problem? How do I, you know, get the
• 48:17
  scope and start to talk about it with those folks?
• 48:21
  I, I think for I am folks particularly asking, does this
• 48:28
  fall under my scope of what access means?
• 48:31
  If an auditor comes to your door and says unauthorized access
• 48:35
  happened and that's described under NIST and under NIST 2,
• 48:38
  like no matter what PCI unauthorized access happened and
• 48:41
  customer data got breached. Are you in the position to say,
• 48:47
  well, that was a machine credential?
• 48:49
  Like that's clearly not me or look, you're in charge of IAM
• 48:54
  and that's access and that machine has an identity.
• 48:57
  Like how do you align that? So if that's the first like
• 49:02
  actually come to Jesus moment here of is this something I can
• 49:06
  deal with? Is this something we can
• 49:07
  approach as an organization? The answer has to be yes.
• 49:10
  The answer has to be yes. But how do you do that?
• 49:13
  And that's where governance really comes into play.
• 49:15
  What is your plan around this? Are you so sealed off from dev
• 49:19
  OPS and from Devsec OPS that those conversations aren't
• 49:22
  happening? I don't know really what to tell
• 49:25
  you if that's they're closed door and you're siloed and you
• 49:28
  don't talk to each other. So have those conversations.
• 49:31
  What you can ask them for in practical terms are inventory is
• 49:37
  an inventory are a list of identities and just start there.
• 49:41
  Like, hey, what has access to what?
• 49:45
  In a perfect world, you'll be able to pull that up in a
• 49:47
  dashboard and say, OK, this key exists.
• 49:51
  It goes to this, it was issued here, this person owns it.
• 49:54
  It's being used in these places. Last time it was rotated was
• 49:58
  this time. That's kind of an ideal
• 50:00
  situation, and that's totally technically possible.
• 50:04
  I, I, I know this partly because I work at a company that makes
• 50:06
  this technically possible. We're not the only player in the
• 50:08
  world that can help with this, but we're the only ones that see
• 50:12
  it as a secret first problem. I've gotten some really
• 50:17
  interesting conversation the last couple years of my life of
• 50:19
  what identity means, and I've come to the conclusion that it
• 50:24
  doesn't actually matter. That sounds insane.
• 50:28
  I know saying that out loud. Because the attackers don't
• 50:32
  care. The attackers care about access.
• 50:36
  Whatever they can take to get access, assuming whatever
• 50:41
  identity means they're going to take.
• 50:43
  Can I get to that database? Not oh, who issued that?
• 50:46
  Attacker did not care. When was this last rotated?
• 50:49
  Does it work or not? That's the only thing they care
• 50:51
  about. So that's the pragmatic
• 50:53
  approach. What is the access mechanism
• 50:55
  itself we can hone in on? So that's first, do you have a
• 51:01
  list, an inventory of all of these?
• 51:05
  Do you have visibility into all of your secrets?
• 51:08
  And then start mapping from there.
• 51:11
  Like what state is it in? Like what does this go to?
• 51:13
  Where? Where was it issued?
• 51:15
  Who issued it? But also you can start turning
• 51:19
  on its head a bit too and say, like, look, what services do we
• 51:21
  have? What identity providers are even
• 51:24
  available across our organization?
• 51:27
  Maybe just start there. Like, hey, look, we have Okta
• 51:30
  and we depend on that day in, day out.
• 51:32
  How do our developers manage access for the stuff they're
• 51:38
  building? Is it just Willy nilly all over
• 51:40
  the map? They can make whatever API keys
• 51:42
  they can stamp and good luck. That's a much different
• 51:45
  situation than look, we have policy and procedure and
• 51:48
  governance in place that says developers need to go through
• 51:51
  this portal and give me a direct very specific answer on why does
• 51:57
  it get an issued, What's the like lifespan of it going to be?
• 52:01
  Who is in charge of it in case of contingency, like what that
• 52:05
  person goes away, who inherits that role, Who inherits the
• 52:10
  responsibility for this thing? But you can't do any of that
• 52:14
  without at least having that conversation first to like who
• 52:19
  owns this in the larger sense? What's the plan there and then
• 52:22
  working for an inventory on your way out?
• 52:24
  I think that's great advice. I think the other thing I'll add
• 52:26
  is don't ignore the e-mail that you got from Get Guardian saying
• 52:29
  hey, you've got something out in the public that shouldn't be
• 52:31
  there. And actually I'll, I'll put a
• 52:34
  quick plug for it here at the end.
• 52:36
  I spend a lot of my time out in the field talking about where
• 52:39
  we're going next. And it's not going to be long
• 52:42
  lived secrets standing privilege standing access is awful.
• 52:47
  It's the root cause of so many of our evils.
• 52:50
  And yeah, if we solved that magically tomorrow, we'd have a
• 52:52
  whole new world of evils to deal with in security.
• 52:55
  I understand that. I'm not saying it's a panacea
• 52:57
  for all of our problems. But like the crowd strikes 2026
• 53:02
  global threat report. It's like 89% of breaches were
• 53:07
  malware free, 82% used a abused A credential for something that
• 53:13
  wasn't a human. I I don't hold me to that one
• 53:16
  either. Like I.
• 53:17
  It seems like every report seems like around that 80% mark is
• 53:20
  it's an identity related breach of some sort.
• 53:23
  I think 82, that's the number I want to have my head.
• 53:25
  But, you know, read the report yourself, Tell me if I'm wrong.
• 53:29
  But it's still, yeah, it's a terrifying number.
• 53:31
  So everyone is kind of in general agreement that we need
• 53:35
  to move away from the piece of data should grant access.
• 53:40
  That's the EV from teleport defines the CEO Teleport defines
• 53:45
  secret. That way it's a single piece of
• 53:47
  data that by itself grants access.
• 53:50
  That's that's it. That's very simple.
• 53:51
  Like no matter what form it takes, you have it, you can get
• 53:53
  in and we need to move to a world of get to a trust boundary
• 53:57
  and say, Hey, who are you? Oh, I'm me.
• 54:01
  Can you prove that? Here's my certificate that
• 54:03
  proves my identity. Let me go check that against.
• 54:06
  Let me validate that against the issuer.
• 54:07
  I trust this issuer. They're already on my allow
• 54:09
  list. I trust this endpoint because I
• 54:12
  was expecting it. Hey, I have a secret here.
• 54:15
  Can we exchange that public PKI real quick?
• 54:17
  OK, now I trust you to to tell me that you trust them.
• 54:20
  That's them. Great.
• 54:21
  Cool. Cool, cool, cool.
• 54:23
  Then come back to the transaction boundary and say,
• 54:25
  all right, what do you want to do?
• 54:30
  Now I can check the list to see if you're on my allow list for
• 54:32
  like, you're even supposed to be here and you want to do what?
• 54:35
  Hey, that totally checks out. Your roles say that's totally
• 54:39
  cool. Go ahead and make that
• 54:40
  transaction happen. And then and only then grant
• 54:43
  access. Actually grant the key.
• 54:45
  The working model I have in my head is grant the key to the
• 54:48
  transaction, not any of the entities inside the transaction.
• 54:52
  So if the transaction is not happening, there is nothing to
• 54:54
  hold the key. So there's nothing to stand.
• 54:57
  And it sounds, again, like maybe I'm talking science fiction
• 55:01
  here. No, this is literally called
• 55:02
  Spiffy Inspire spiffiest secure production identity framework
• 55:06
  for everyone. It's a graduated project and the
• 55:10
  CNCF, it is just as mature and their world view as Kubernetes
• 55:13
  itself is. It's been around for over 8
• 55:16
  years now and it's been cloud native like how Kubernetes
• 55:20
  should have been working the entire time for a while.
• 55:23
  But the great hope is we're now seeing this adopted much wider
• 55:27
  across the industry and things like whimsy, the workload
• 55:31
  identity and multi system environments.
• 55:34
  It's a fun name for a really serious project.
• 55:36
  And there's a lot of Internet engineering task force IATF
• 55:41
  projects out there trying to deal with this right now.
• 55:43
  But let's make an operational standard that that transactional
• 55:46
  dance can happen automagically. Just that's how the protocol
• 55:51
  works. The same way you don't think
• 55:52
  when's the last time you actually sat down and thought
• 55:54
  about it, how MTLS actually works.
• 55:56
  You don't you just like that's, that's just a thing that
• 55:58
  literally MTLS is just a way to deal with transport layer
• 56:03
  security that we're going to get there sooner than later.
• 56:07
  I know this for a fact because we are seeing this widely being
• 56:11
  pushed by the platforms themselves.
• 56:13
  But this was just like a couple of little players, niche players
• 56:16
  here and there that were trying to solve this.
• 56:19
  Like I'll throw out a couple names.
• 56:19
  Ambit Teleport the hash core is working on something like this
• 56:25
  cyber arks working on something like this.
• 56:26
  That's why they bought venify. I would be like OK, that's
• 56:30
  that's still like a futuristic, but the platforms themselves
• 56:33
  have made some major, major advancements in 2025.
• 56:37
  And the biggest one I can point to is AWS security token service
• 56:40
  AWSSTS that that service has been around for a while.
• 56:44
  It lets you call the issuer of an identity certificate like
• 56:51
  just with an API call inside of AWS.
• 56:53
  So hey, I'm going to make this call as a entity, as an
• 56:57
  identity, give me this certificate I can take with me
• 57:01
  across platforms. And it always worked internally
• 57:04
  with AWS, but now it works across boundaries.
• 57:07
  So you can take it to Azure, you can take it across to Google
• 57:10
  Cloud, you can take it to data bricks, you can take it to a
• 57:12
  growing list of providers and say, no, we're expecting STS and
• 57:17
  the way they build the protocol is really, really cool.
• 57:18
  I'm not going to get into the meat of it.
• 57:20
  I don't work for AWS, but it makes it very simple to the
• 57:24
  verification process is very straightforward.
• 57:26
  It's very standardized feeling. And I think we're going to see
• 57:29
  more and more of that where the developer will say, look, I need
• 57:33
  to authenticate to this service. I think we're going to see it
• 57:36
  involved in the MCP ecosystem sooner than later as well.
• 57:41
  Like what is the thing calling? Why is it calling?
• 57:44
  What's it trying to do? And let's build all of that in
• 57:47
  together to like, let's verify that, verify it, and then issue
• 57:52
  a trust boundary agreement just for this transaction.
• 57:58
  Let it go away. It's not free.
• 58:00
  I mean, it's actually no STS itself is free for everything on
• 58:03
  AWS. This is the, the big
• 58:05
  announcement I made in November. That's why I'm so excited about
• 58:07
  and that's the one I talk about. It's like AWS believes in this
• 58:09
  so much that every developer on AWS could be doing it this way
• 58:12
  instead of API keys for everything they do.
• 58:14
  Well, at least for things they can work with those particular
• 58:18
  SAS providers. But like operationally, and
• 58:22
  that's where I'm a developer advocate.
• 58:25
  Yeah. If I'm doing a million
• 58:26
  transactions a day and you're telling me I need a 10 extra
• 58:29
  milliseconds for this handshake, 1,000,000 * 1010 million
• 58:33
  milliseconds, that's actual real time.
• 58:35
  That impacts bandwidth. That impacts a lot of things.
• 58:39
  Where is the line? Do we do it tinfoil hat mode
• 58:42
  where we do this for every transaction?
• 58:44
  Or do we allow like O off type? Like, hey, if as long as it's
• 58:49
  being the same identity, let's keep extending it.
• 58:51
  That's where the conversation should be and that's where I'm
• 58:54
  always happy to engage. It's like, well, let's figure
• 58:57
  out what you actually need. Let's figure out what the limits
• 58:59
  of that are. I mean, let's tune that.
• 59:00
  But wow, that is such a better plan than I'm just going to put
• 59:04
  a key and if an attacker gets it, they can just do whatever
• 59:06
  they want. It's really hard to take over a
• 59:09
  certificate authority. It's really hard to take over a
• 59:11
  platform. It is really hard to impersonate
• 59:14
  a specific stack and IP and make everything matched with that
• 59:17
  credential was expecting or what the certificate authority was
• 59:20
  expecting you to be. So if you come back, it's like,
• 59:23
  hey, is this them? Like, no, that's clearly not
• 59:25
  them. Don't, don't let them in.
• 59:27
  Do not do anything with that. That's a much safer world in my
• 59:30
  opinion. I love your passion and
• 59:32
  enthusiasm for this and I'm going to have your LinkedIn
• 59:35
  profile in our show notes so people can reach out debate
• 59:38
  respectfully of. Course.
• 59:40
  You know, I want to ask you a final question unrelated to
• 59:44
  identity and get and all that stuff, but if I want to learn
• 59:48
  more about everything you just talked about, right, Spiffy
• 59:50
  Spire whimsy. We've done a few episodes, but
• 59:52
  it's been a while on those. So people kind of listen back on
• 59:55
  on the podcast about that. But how do I get up to speed on
• 59:58
  this? Is there like a you have a
• 59:59
  couple of resources you just kind of share with the audience?
• 1:00:02
  The number one book I have told anyone to read in the last two
• 1:00:06
  years of my life has been the Spiffy book spiffy dot IO slash
• 1:00:10
  book. It's 198 page PDF and explains
• 1:00:14
  all of this. There's even a section about how
• 1:00:16
  much developer time you could potentially save a week and
• 1:00:19
  their estimate is on average about 5 hours per developer a
• 1:00:22
  week. Like just don't have them deal
• 1:00:25
  with any of the nonsense of permissions or API keys or
• 1:00:31
  secrets in general. Just like figure out this better
• 1:00:33
  way to deal with identity. Let the AP is take care of it
• 1:00:36
  automatically. I say automatically a lot, but
• 1:00:39
  it feels like that from the developer perspective.
• 1:00:41
  It's like, what do you mean? I don't have to manually set
• 1:00:43
  this. I just got to allow list it.
• 1:00:44
  What what are you talking about? Like that sounds magical.
• 1:00:47
  So I would start there. It's a it's a great read.
• 1:00:50
  There's a lot of great resources whimsy.
• 1:00:53
  I would read the standard. You can just look up WIMSE and
• 1:00:58
  i.e. TF there's a working drafts.
• 1:01:01
  I wouldn't tell you where to start on that, but start I guess
• 1:01:05
  on their front page and look at the mission statement and like
• 1:01:07
  what they're actually doing. It's always in debate what we're
• 1:01:10
  doing with that or tongue up around attestation and what
• 1:01:14
  falls it within and without the spec as far as, you know,
• 1:01:17
  certain things. But you know, that's that's the
• 1:01:19
  ITF in general. It's fun, fun to watch.
• 1:01:21
  I'm not a member. I just, you know, fanboy outside
• 1:01:23
  looking at all that. I've written about this a few
• 1:01:26
  times. If you want to get your hands on
• 1:01:28
  it and like actually get going, Spiffy is a set of ideas the
• 1:01:32
  same way Oauth is, but they're in their Spire, which is the
• 1:01:35
  Spiffy runtime environment. So if you want to download and
• 1:01:38
  just start actually testing and seeing what you can do with it,
• 1:01:41
  it's completely free and open source like everything else.
• 1:01:45
  Cloud native, like they made it open source for a reason, so we
• 1:01:48
  can all get our hands on it. Tons of other reading you can do
• 1:01:51
  out there on the subject, but that's where I would generally
• 1:01:53
  start. Oh, and check out a WSSTS.
• 1:01:57
  There's a really, really great blog announcement from November
• 1:02:01
  that explains everything, basically.
• 1:02:03
  I know about it. What I was saying came directly
• 1:02:07
  from that blog post and it explains the architecture a
• 1:02:10
  little bit better than I could articulate.
• 1:02:13
  Yeah, that's right. Those are the resources I would
• 1:02:15
  start with. Of course, we write about this
• 1:02:16
  on our blog as well, so you can always check out our blog
• 1:02:18
  blog.getguardian.com and happy to send people down that path.
• 1:02:24
  I appreciate that I'll have some of those links in our show notes
• 1:02:26
  for people to check out, but it's always good to have more
• 1:02:28
  resources we can learn from. So let's let's pivot to ending
• 1:02:33
  this on a lighter note because I feel like we have all these
• 1:02:35
  problems in the world. Let's, you know, figure out how
• 1:02:37
  we're going to get to 0 standing privilege that we've been
• 1:02:39
  talking about forever. It's like it feels like it's
• 1:02:40
  always on the horizon somewhere, but it's a mirage.
• 1:02:43
  Some What do you do for fun when you're not being a principal
• 1:02:49
  developer advocate? It is.
• 1:02:52
  It is springtime here in Chicago and I live fairly close to
• 1:02:55
  Wrigley Field. I live about a mile from Wrigley
• 1:02:57
  Field. So love the Cubs.
• 1:02:59
  Go, Cubs go. Just put on a winning streak
• 1:03:01
  right now and touch wood. It's the same gym as that here
• 1:03:03
  because he is a huge baseball fan and I am not, but I am
• 1:03:06
  definitely a Cubs fan. No worries, no worries.
• 1:03:08
  So that's how I spend right now. That's how I spent last evening.
• 1:03:11
  Spent the day before evening as enjoying the Cubs with some
• 1:03:14
  friends of mine. But outside of that, like I cook
• 1:03:18
  a lot. I been cooking for a number of
• 1:03:22
  years, but I got really into making hot sauces during the
• 1:03:24
  pandemic and that has evolved into other spices, dry rubs and
• 1:03:30
  tahines and whatnot, like spicy, sour, salt stuff.
• 1:03:37
  Started messing around with like really really hot Peppers at one
• 1:03:41
  point where it was a little too intense for actual sauces.
• 1:03:44
  For my friends, I do it all as a hobby.
• 1:03:46
  This is like not a side business or anything, it's just something
• 1:03:48
  I enjoy doing. But I, I love hot food and
• 1:03:54
  sharing food with people And it's a, it's pretty good way
• 1:03:57
  because if you're a hot sauce with someone and I like, I don't
• 1:04:00
  like hot sauce. I don't know, I don't know, what
• 1:04:01
  do you put this on? How do I store it?
• 1:04:03
  But if you start making like dry rubs, it's like, well, that's
• 1:04:05
  never going to go bad shelf stable forever.
• 1:04:07
  And if you don't like it, you can use a little tiny bit and a
• 1:04:09
  big thing and that's a little bit of a kick to it.
• 1:04:12
  That's what I was telling people.
• 1:04:13
  So I got a few that I have refined down that I'm really
• 1:04:16
  proud of, that I've shared around with my friends here and,
• 1:04:19
  you know, be carrying around with me.
• 1:04:20
  If you see me at future events, I might have some in my bag.
• 1:04:23
  All right, so if you're going to be at ideniverse, maybe where
• 1:04:26
  this year, that'll be a good spot to try it.
• 1:04:28
  I, I am not a spicy food person. I, I, I do not want to have an
• 1:04:33
  experience while I'm eating. That makes sense.
• 1:04:36
  I want to enjoy the food, but I do like a little bit of
• 1:04:39
  something, like if you were going to create something for
• 1:04:42
  me, you know, or recommend something, you know, that I
• 1:04:44
  should start with in this world, like what would be like, OK,
• 1:04:48
  start with just a pinch of this. Oh, Scotch bonnet, buy dried
• 1:04:53
  Scotch bonnet Peppers and just start there.
• 1:04:56
  It's the base heat of anything jerk like jerk chicken that that
• 1:05:02
  jerk spice from the Caribbean and it's just it's a really
• 1:05:05
  mellow spice. It's hot, but it's nowhere near
• 1:05:11
  like ghost pepper that level. It's it's a reasonable pepper.
• 1:05:15
  And if you put a little tiny bit in a dish, you'd be like, oh,
• 1:05:17
  that really perked that up. And it added a nice fruity
• 1:05:21
  flavor underneath it all that you can't really get any other
• 1:05:24
  way if you can get to this. Like part of the reason I love
• 1:05:27
  ghost pepper is it is the juiciest, fruitiest pepper on
• 1:05:31
  Earth. It is.
• 1:05:32
  There's no other pepper taste like that.
• 1:05:34
  Like, yeah, it's one of the hottest Peppers on Earth, but I
• 1:05:37
  don't know how else to get to that, to that taste.
• 1:05:39
  So I actually do want experiences.
• 1:05:41
  I do want to have AI. Don't know how I would
• 1:05:43
  experience this any other way. And yeah, I'm sweating a little
• 1:05:46
  bit. Sure, I'm turned bright red, but
• 1:05:48
  I'm alive, you know? I'm living it.
• 1:05:51
  What's the hottest thing you've ever eaten?
• 1:05:57
  Straight up scorpion. I did a bit of a scorpion pepper
• 1:06:01
  once and then I in my trophy case behind me, my you can't see
• 1:06:06
  it because it's way too small, but I have two coins from pepper
• 1:06:09
  con on there. Pepper Con happens every year at
• 1:06:12
  the Toxic BBQ at Defcon, which is badly named.
• 1:06:17
  Badly named on purpose because like everything else is a joke.
• 1:06:19
  It's the friendliest, nicest part of Defcon.
• 1:06:22
  It's like we gather at a City Park in Vegas in blazing heat
• 1:06:25
  and it's free food for everyone and we make donations and people
• 1:06:28
  bring craft beer and then pepper Con happens.
• 1:06:31
  So spice enthusiasts bring they're Peppers that they have
• 1:06:35
  grown throughout the year or a spice blend they have.
• 1:06:38
  There's always a challenge coin from the people organize it that
• 1:06:41
  if you take, you know, lick the back of your hand and put a
• 1:06:44
  bunch of their spice on it, if you can survive that, then you
• 1:06:47
  get a coin for the year. But other years people have
• 1:06:49
  brought straight up pepper. They're like little slivers of
• 1:06:51
  pepper. Yeah.
• 1:06:53
  But the only one that I can remember eating and it was like,
• 1:06:56
  I do not like any part of this experience was straight
• 1:06:59
  scorpion. There's crossbreeds of scorpion
• 1:07:02
  which are way better tasting like chocolate.
• 1:07:05
  Scorpions are delicious but straight old school original
• 1:07:08
  like when they made scorpion Peppers.
• 1:07:10
  Like that's a little too bitter and it's one of the hottest
• 1:07:13
  Peppers like known to man. Take me through that scorpion
• 1:07:16
  experience. Like when did you know?
• 1:07:17
  Was it immediate or is it one of those that, like sneaks up on
• 1:07:20
  you and after a few seconds it's like, oh, oh, I'm in trouble?
• 1:07:23
  It was pretty immediate. Well, because it was a fresh
• 1:07:27
  pepper. Like you get that juicy little
• 1:07:30
  like crunch and again, the first thing is like, that's a little
• 1:07:35
  bitter and then it hits and then it hits exact point on.
• 1:07:40
  For me anyway, it hit the exact point on my tongue that first
• 1:07:43
  countered it and then like exploded out to the rest of my
• 1:07:48
  mouth. And from that point on, I can't
• 1:07:50
  accurately describe what happened other than I started
• 1:07:53
  like crying, nose running and then a few seconds I was
• 1:07:57
  coughing. But where the spice hit, like I
• 1:08:00
  can describe most spices I I eat like how they hit the tongue,
• 1:08:04
  like where it rolls over the palate like a wine connoisseur
• 1:08:06
  might. I'm not a wine person, but it's,
• 1:08:09
  it's kind of like that. I can say, oh, that's very
• 1:08:10
  forward on the tongue or that hits the very back of the the
• 1:08:13
  the sides of the tongue and then like spreads out to the back of
• 1:08:15
  your throat. This was just everywhere all at
• 1:08:17
  once. But yeah, I'm not planning on
• 1:08:21
  doing that again. Some Peppers are really good to
• 1:08:23
  add to something. I actually have a scorpion mash
• 1:08:28
  and I use in chili, like not much like an eighth of a
• 1:08:32
  teaspoon and a giant pot of chili will do you.
• 1:08:34
  But it adds like that subtle warm heat.
• 1:08:38
  And if it bounces out with, you know, the rest of the sweetness
• 1:08:40
  of the dish, then it works really well.
• 1:08:42
  But on its own, I wouldn't recommend just going out and
• 1:08:44
  biting into a raw pepper like that's what banana Peppers are
• 1:08:48
  for. That's what you know, jalapenos
• 1:08:50
  are for. I eat jalapenos like they're
• 1:08:53
  good. They're not hot freak some some
• 1:08:54
  of my friends out, but like love going to the restaurant and
• 1:08:57
  like, oh, they got jalapenos on. It's got a giant side of
• 1:08:59
  jalapenos eating like potato chips.
• 1:09:01
  I find jalapenos hot. So I'm not one of those people.
• 1:09:04
  I like a little bit like, you know, maybe like a 1/4 of a
• 1:09:07
  jalapeno in in the environment. But more than that, it's like,
• 1:09:11
  all right, we got problems. Just scoop out the the inside.
• 1:09:14
  Next time you get out, buy a jalapeno.
• 1:09:16
  Just make sure you carefully scoop out the inside seeds and
• 1:09:21
  that cartilage in there and you'll be fine.
• 1:09:24
  Like that's where all the heat lies is in in the seeds and in
• 1:09:28
  the that internal internal oils if you cut.
• 1:09:32
  Half a seed that's that's about my tolerance.
• 1:09:35
  If you cut a pepper in half and it ever looks oily, avoid.
• 1:09:38
  I would avoid that if I were you.
• 1:09:40
  I look for that like you cut a pepper and it looks oily.
• 1:09:43
  Like there's a reason it looks oily, and there's that Inside
• 1:09:46
  that oil is where all the capsaicin is sitting, like ready
• 1:09:49
  to spring. All right, well, I don't know
• 1:09:50
  how we can, you know, top that. Look for the oil in a pepper.
• 1:09:54
  Dwayne, thank you so much for spending time with us and thanks
• 1:09:57
  again to Git Guard and for sponsoring us.
• 1:09:59
  I'll have links in our show notes again for everything, but
• 1:10:01
  go to gitguardian.com/LP's/IDAC. Reach out to Wayne with, you
• 1:10:07
  know, pepper fax or recommendations or git
• 1:10:12
  recommendations or, or things like that.
• 1:10:15
  Last words, Dwayne. I'll let you have them.
• 1:10:17
  I am always on the road. If you check out my website,
• 1:10:20
  dwayne-mcdaniel.com, you can see my upcoming events.
• 1:10:24
  You can see actually past conferences and my blog writings
• 1:10:27
  and my videos for certain things that have videos for them.
• 1:10:32
  The appearances I've made and the big encouragement out there
• 1:10:37
  is talk to your other teams. If you're in security out there
• 1:10:42
  and you've never sat down with the developer and talk through
• 1:10:44
  their workflow, that's a really good place to start.
• 1:10:48
  Like you can't defend what you don't understand.
• 1:10:50
  You can't defend what you can't see.
• 1:10:51
  So having that communication layer of, hey, we're just
• 1:10:56
  talking. I'm just trying to help you do
• 1:10:58
  your job. I don't want to get anybody
• 1:10:59
  fired. I don't want to get in trouble.
• 1:11:00
  There's no emergency right now. But hey, to spend 1/2 hour and
• 1:11:02
  you just walk me through how you push, walk me through like what
• 1:11:05
  tools you use, like maybe you can find better ways to improve.
• 1:11:09
  If you're I am folks and you've never talked dev SEC OPS, that's
• 1:11:12
  a problem. Go have those conversations.
• 1:11:15
  Organizationally, we have a tendency overall, I feel to kind
• 1:11:19
  of silo up like I'm going to get my work done and I'm going to
• 1:11:22
  let them worry about their work over there.
• 1:11:25
  And with the current threat landscape, with currently what
• 1:11:27
  we're going through with machine identity, especially with agenic
• 1:11:30
  AI and all the identity stuff there, like we can't live on
• 1:11:35
  islands anymore. And the better relationships you
• 1:11:38
  have with your other teams, with the organization as a whole,
• 1:11:44
  that's going to help you better position.
• 1:11:45
  Like if you're the lone voice out in the wilderness saying,
• 1:11:49
  look, we got to deal with this because massively bad things can
• 1:11:52
  happen and no one else saying that, well, you're probably
• 1:11:54
  going to listen to. But if the heads of development,
• 1:11:57
  your infrastructure team, your IM team and basically anyone
• 1:12:03
  else that will listen is like, yeah, this is a hair on fire
• 1:12:05
  situation. We need to put this fire out.
• 1:12:08
  That gets listened to, that gets board approval, that gets, you
• 1:12:11
  know, people want to be resilient.
• 1:12:12
  People want to be robust. So that that'd be the advice is
• 1:12:15
  like in a world where we're pushing more and more to build
• 1:12:19
  everything you can as fast as you can and then manage these
• 1:12:21
  robot armies. No, I think the opposite needs
• 1:12:24
  to be true right now. Like, connect with your teams,
• 1:12:26
  connect with them as people, like, understand what they're
• 1:12:28
  working on and how you can help them do stuff better.
• 1:12:32
  That's great advice, Dane. We'll we'll put that in the bank
• 1:12:34
  for sure. That'll do it for us this week.
• 1:12:38
  Thank you so much. For people who are watching and
• 1:12:40
  or listening, you can find us on the web, IDC, podcast.com, like
• 1:12:43
  share, you don't subscribe. All of that fun stuff helps us
• 1:12:46
  great guests get great guests like Dwayne and yeah, leave it
• 1:12:49
  there. We'll talk with everyone the
• 1:12:51
  next one. Thank you very much.
• 1:12:55
  You've been listening to Identity at the Center.
• 1:12:58
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:13:03
  review, and we'll be back soon. But in the meantime, hit the
• 1:13:06
  website at identity@thecenter.com.
• 1:13:10
  See you next time on Identity at the Center.