Latest / Identity at the Center / #213 - Is PAM Dead? Part 2 with Ron Nissim of Entitle

Transcript

#213 - Is PAM Dead? Part 2 with Ron Nissim of Entitle · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:10
am this is the go-to podcast. Now your host Jim McDonald and
0:18
Jeff Steadman welcome to the identity of the sender podcast
0:22
I'm Jeff and that's Jim. Hey Jim hey Jeff, how are you?
0:26
Oh, not so bad yourself doing great.
0:28
It feels like all the The forces in the universe were driving us
0:32
to have this podcast session with this gas today.
0:36
You know, last session we had Howard and Jackie from 1414
0:40
Ventures. You know, one of the points that
0:43
I made for the time was that I thought Pam was ripe for
0:47
disruption last night. I was listening to a podcast
0:52
which is the Cooper Nicole podcast very good.
0:54
I recommend it for anybody, they had a friend of the show on the
0:58
podcast Paul Fisher. Talking about Pam really talking
1:02
about some of these underlying changes that are happening in
1:05
the Pam space. And, you know, it's, you know,
1:09
it's changing due to a lot of the changes that I believe are
1:13
happening with an it with in it, you know, automation of
1:19
deployment of infrastructure. So infrastructure as code
1:23
movement of it infrastructure out of the cloud Alta
1:27
applications in the cloud things like that.
1:29
And so, you know, we we've done an episode called is Pam dead,
1:34
maybe a year ago, right? And it just kind of feels like
1:38
the situation of like what Pam has to do.
1:42
Has changed so much and I wanted to get your thoughts on that.
1:45
Yeah, I mean it's definitely evolving space.
1:47
We are such identity nerds you and I were actually texting last
1:51
night around the idea of you know, how do we go about sort of
1:54
assessing and strategizing privileged access management
1:57
these days? We also like you know the old Is
2:00
a vow. I got a password Vault, so I've
2:01
got Pam. Well, okay, guess what?
2:04
I don't think that's good enough anymore and I think the world
2:06
has changed and now I'm starting to think more about like Ai and
2:09
Pam and you know, how is that going to affect privileged
2:13
access or entitlements, or whatever it may be.
2:15
So I think it's like anything else.
2:17
It's it will evolve there will be disruptions to the status quo
2:22
I think right now the disruption du jour is something AI related
2:27
because I feel like devops and sort of like Owners, it was kind
2:30
of like, okay, yeah, we knew about those five years ago, six
2:33
years ago, and tools and Technologies, and process kind
2:36
of sort of been identified. Now, whether or not you're
2:39
actually doing it is a totally different story.
2:41
But I feel like, at least those use cases, were aware of them.
2:45
What's next? Well, I think what I think was
2:49
cisos and what information security, our it departments
2:53
want to get their arms around, is they want to centralize the
2:56
management of the services and so, you talked about Devops you
3:00
talked about cloud and the engineers who were making those
3:05
things happen. We're going out and procuring
3:07
solutions to solve those particular situations.
3:11
And the other thing is that the old, you know, privileged access
3:16
management platforms are at some level, you know.
3:19
They're, they're trying to keep up with all the changes
3:22
happening and there's a lot of new entrants into the market.
3:26
You know, i-i've been, you know, you and I have been going back
3:28
and forth on You know, this privileged access management
3:32
strategy and what are the capabilities, how do we assess a
3:36
program? And whether or not it's keeping
3:38
up and I think, you know, kind of in the summary level, I think
3:43
there are a set of kind of proven tenants that, you know,
3:47
they were true. Five years ago, their true 10
3:49
years ago, Pam has to be run as a program.
3:52
You know, you've got to get by it.
3:54
People have to know what the roles and responsibilities are.
3:57
You have to have a good Paper trail, you have to strive toward
4:02
these privileged, but then there's all these new trends
4:06
Cloud infrastructure. I've been saying team forever,
4:10
you know, and one of our recent episodes called Hakeem, I got a
4:16
nice little funny text from one of our listeners Palms are
4:19
saying Jim, it's Kim call it Kim, you know, I know he was one
4:23
of the, he might have been the person that Garden who came up
4:26
with that term anyway. He corrected me, it's all called
4:29
A Kim. You know, so we got the Kim the
4:34
devops eicd pipeline. I mean all these new
4:39
technologies that you need to have a good, you need to get
4:43
your arms around and how do you do that?
4:45
And you know, what is your maturity around that today and
4:48
where does it need to be? Yeah, I like the concept.
4:51
The concept of dynamic privileging, right?
4:55
It's just in time and we're going to get into that with our
4:57
guest here in a minute. But I like that idea.
5:01
I think it's difficult to execute in the real world
5:03
sometimes because you may not have the technology investment
5:07
or the process or people investment to actually make it
5:10
real but I think that's where things are going.
5:12
Especially if you think about it from a machine perspective and
5:15
we're talk about workloads that are instantaneous.
5:18
They might we have only a few milliseconds but It might be
5:20
enough to do real damage, if you don't have good control over it
5:24
and if those you know processes, you know, those permissions, get
5:27
hijacked for any reason, be very difficult to recover from.
5:30
So I think that's where I'm most interested in is sort of like
5:34
this Dynamic, you know, just in time, zero standing privilege,
5:39
whatever the right terminology is for it.
5:41
I think that's I think that's next.
5:45
Realistically speaking for organizations because I think it
5:48
does take time for organizations to catch up.
5:50
Say, okay, here's what industry is going.
5:52
And two years later, based on budget political organizational
5:57
Cycles, whatever you want to call, it usually takes some time
6:00
right to move some of these move, these things along smaller
6:03
organization. Maybe they move quicker.
6:05
Maybe they don't, because they don't have as much funding a
6:07
bigger organization, maybe has more funding, but they're like a
6:09
freight train. It takes a little bit to slow
6:11
down or change directions. So, I think this is kind of
6:14
where things are going next because I think and Jim feel
6:17
free to disagree with me. But I think like yeah, everyone
6:19
gets password, vaulting, I think most people understand the you
6:23
know, the need of the concept for some sort of session
6:26
management or session recording or session monitoring.
6:29
I think that's probably where most organizations are now
6:31
that's like either their current or next step that they're on the
6:34
next step past that I feel like is okay.
6:36
How do we get a better handle on the actual entitlements
6:38
themselves, and making sure that those are adequate managed and
6:41
maybe to link up with other systems not necessarily
6:43
privileged access. But this is maybe where identity
6:45
governance comes into play linking the two systems together
6:48
and having you know, getting more value You from kind of both
6:51
both sides of things migrate. I agree with him.
6:54
No, no, you're not crazy. It's amazing how far we've come
6:57
though. I mean I remember you know,
7:01
building a strategy for an organization.
7:03
Someone mentioning that the admin passwords are in a
7:06
spreadsheet and they're on a shared drive, but only the
7:09
admins can get to the shared Drive course.
7:11
Okay? That's a pain.
7:12
We're good. So you called a compensating for
7:15
it. Alright, I'm happy to copy that
7:16
into a thumb drive and see you later.
7:18
Do you need me to email that to you?
7:21
Yeah, so be you know where they will be talking a lot about this
7:24
Chef, which is weird in Reverse. Yeah.
7:27
Where would that be the? I Denver's conference in Las
7:30
Vegas next week. Yeah, so time is running out.
7:34
I think this is, this is the last week, I think it's probably
7:37
realistic for people to expect to show up at Everest, but
7:40
hopefully, we'll see people there.
7:42
You're not going to be there. We're doing a sort of alive.
7:45
I do wives recording in front of a studio audience, I guess, I'll
7:48
help, but it's not a live broadcast, but We'll have a spot
7:51
there, Tuesday night, 7:00 p.m. just outside the expo hall.
7:53
That identifiers team has been kind enough to set us up with
7:56
some spots that we could do some recording Sarah.
7:58
But hopefully we'll see you there.
7:59
So, you can join the digital identity community at the Aria
8:02
Resort and Casino in Las Vegas, May 30th to June seconds.
8:06
It's the must attend annual event.
8:07
That brings together over 2500 Security Professionals for four
8:11
days of world, class, learning engagement entertainment as an
8:15
identity. The center listener, your get
8:16
20% off your identity verse 20, 23 tickets using Code idv, 23-0
8:24
icen 20. You can use that identity
8:27
first.com. We'll have a link in our show
8:29
notes. So makes it easy you don't have
8:31
to remember it just click on the link.
8:32
It will pre-populate for you. Make it super easy.
8:34
We hope to see people there but time is definitely running out.
8:38
That's probably the last time that I will read that and we
8:41
definitely want to take identifier of sort of partnering
8:42
up with us to hook, our Whispers up with a little bit of a
8:45
discount on their on their attendance.
8:47
Absolutely, I can't wait. I was going back.
8:50
With one of our favorite people, I'm not even going to say who we
8:56
have so many sheep. She works for an analyst firm.
9:01
They haven't been on the show in the past and the, well, if I
9:05
just happened to be walking by during the 7:00 hour, and you
9:09
happen to grab me and stick me on the live stage with you guys.
9:14
Probably not a whole lot. I can do to stop you.
9:17
Wink, wink. I kind of mentioned the same
9:19
thought I think We're talking about that.
9:21
You know, hey, if an ambient Mike happens to pick up a voice,
9:25
what are you gonna do? You're at a conference, right?
9:27
We'll see what happens, but definitely looking forward to
9:30
seeing new and old friends there.
9:32
And I think we've I think I've got a pretty good pretty good
9:34
lineup coming up for that, at least for that 7:00 show.
9:37
You've done a good job of putting together people for
9:39
that. Well, thanks.
9:41
I mean, I feel like if I remember feeling like, I had to
9:45
convince people to come on the show in the early days of the
9:49
show and Rightfully, so he we were just not very good and
9:53
deserve a karaoke. What are you and then?
9:56
I remember Eve mailer agreed to come on the show and it was
10:00
then, it was like, okay, well, everybody would email, by the
10:03
way, Eve mellors do on the show that was Jackson, straw.
10:06
And then Ian Glaser, and I was like, my emails became.
10:11
Hi. We've had guests such as eating
10:14
Glaser and, and Eve and Jackson and you know, felt Now, we're at
10:21
the point, I think with, as many listeners as we have, in such an
10:24
awesome fan base, it people know of the show and I don't really
10:29
even need to convince them whether or not they should be on
10:32
the show. They've already made up their
10:33
mind. Yeah.
10:34
It only took four years to get here.
10:35
It's a slow climb. But hey, we're a two-man out.
10:37
What you gonna do? Well, speaking of this team and
10:40
guess, why don't we get to ours for today?
10:43
We talked about privileged access management front.
10:45
We're going to get into that in a little more detail here.
10:47
We reference going you know is Pam dead around this time.
10:50
Last year that was episode 142, but why don't we welcome to the
10:53
show Ron Nasim? He's the co-founder and CEO at
10:57
and title. Welcome to the show.
10:58
Ron, thank you very much and super happy and honored to be
11:02
here. Yeah, so thanks for taking the
11:04
time for us and one of the things we like to do and we have
11:07
a new person on the show is to really kind of understand their
11:10
origin story when it comes to Identity and access management.
11:13
So why don't you tell us? You know, how did you get into?
11:15
I am. Is it something that you chose,
11:18
or did it Choose You? It's funny because I started my
11:22
journey in cybersecurity in the Army.
11:24
And we saw this like next gen stuff, right.
11:27
And we finish our service and we saw what companies we were we
11:31
were entrepreneurs and got a new.
11:32
We wanted to start a company. And we saw what people were
11:35
starting companies around with all this.
11:37
Like next gen, AI stuff, right. But we knew what companies were
11:40
getting compromised for was like, same old, boring crap,
11:44
sorry for this, the French but, you know, people and companies
11:48
their biggest risk continue to be Boring old permissions and
11:52
most recently Uber and doctors hacks just emphasized about like
11:55
you know end up getting compromised for some boring
11:58
privileged access and we knew there was something that needed
12:02
to be done there and we really drawn towards the challenge of
12:06
creating something new and old industry.
12:09
And I think kind of felt like we kept trying to go off of
12:13
different offshoots and different areas but we kept
12:15
getting drawn back taxes management mainly by Security
12:18
Professionals that we were talking to So now you're with an
12:21
organization called in title for people who aren't familiar with
12:24
the title. What do you guys do?
12:26
What's the problem? You're solving give us sort of
12:28
like the 32 sticky, 60 seconds elevator pitch.
12:31
Cool. So and what entitled does is
12:33
Autumn eights Cloud access management across the
12:36
organization. So whether that's in the self
12:38
service requests enabling employees to request access to
12:41
what they need through. Creating policies that enforce
12:44
automatically across your Cloud infrastructure infrastructure
12:47
and SAS applications be that everything from databases all
12:50
The way through Salesforce and the idea is to create a simple
12:53
to deploy simple to maintain Cloud.
12:56
Access manager solution that, you know, we're conservative
12:58
companies took forever to implement and C value from were
13:02
very quick to deploy and roll out throughout the organization.
13:06
Hey, Ron one thing we like to do on the show is not move too fast
13:10
and lose people. So I wanted to start with a
13:14
question of, how do you define Pam before free answer at the
13:18
follow-up is going to be? We recorded a show last year, I
13:22
referenced it earlier called is Pam dead.
13:25
So after you tell us what Pam is, I'd like you to go into, is
13:29
it dead? Good question.
13:30
Will, you know, to answer if it's that you have to Define
13:33
what Pam is and L. You know, you look at what
13:35
historically, privileged access Management Solutions provided, I
13:40
think it was three tiers of value.
13:42
The first was just the authentication to conservative
13:46
on-prem old systems there are you had an old system, had a
13:49
username password you want. It to enable logging in with
13:52
your asses. So you wrap that in a vault and
13:54
created some sort of jump service.
13:56
So that was kind of generally what that actually solved for
13:59
was just the authentication of an old username password system
14:03
to a new SSO. Could, you know, at the time it
14:06
was Kerberos, I'm active directory.
14:09
And now it's Samuel and knocked up.
14:11
The second part was creating a more intricate authorization
14:15
layer where you could, you know, someone writes the sudo command
14:18
and you can create a policy of who can write What commands
14:20
inside the application. And these more again,
14:23
conservative systems didn't often have intricate
14:26
authorization policies. And so, by being the middleman,
14:30
you could create these policies and by doing so.
14:33
And then third was session, recording and session.
14:35
Recording was kind of a byproduct of just, again, being
14:38
the middle, man, I knew exactly what people were doing.
14:41
And I think, the reason that Pam is definitely changing, I don't
14:45
know if it's that, but the definition of Pam is very much
14:47
changing. Is that when you look at that
14:49
first part, the authentication methods, those are changing
14:52
because the solutions themselves, the applications are
14:55
adopting, a more up-to-date method of authentication.
14:59
So, whether it's natively by companies integrating logging
15:04
in, because the so or with other companies, wrapping it like, you
15:08
know, teleport does for SSH Keys as an example.
15:11
And then the session, according to the third part is being
15:14
solved natively in the applications, right?
15:16
If you take the audit logs from the applications themselves,
15:20
It's exactly, who's doing what? I don't need a middleman, be
15:23
telling me what's going on. And he's doing what inside the
15:26
application. And so are the only part that's
15:29
left there is authorization, right?
15:32
Who can do what inside the application and I think
15:35
historically authorization is more of a IGA problem.
15:39
It's the actual administration of who gets access to what then
15:42
the actual provisioning. And so just in time access has
15:47
kind of become, I think a or, you know, as ephemeral access to
15:50
Sensitive resources while historically being called Pam
15:53
has become kind of a sub use case of General permission
15:56
management. Yeah, talk to us if you would
15:59
about the just-in-time access or jit access talk about what it
16:04
means, like, some of the details are we talking about?
16:07
There's an account there that, you know, eyes, an administrator
16:10
can kind of access that account when I need it just in time and
16:15
then not have the access or we talking about the account
16:19
actually Provisioned on the Fly. It's a good question.
16:23
I think that very much depends on the application.
16:25
Generally, the underlying idea behind just-in-time accesses,
16:30
it's making sure that people don't have access to things that
16:32
they need when they don't need it.
16:34
And especially when it comes to privileged accounts, the
16:38
sensitive resources. Those are the things that you
16:39
want to be really, really, really meticulous on who's
16:42
doing. What inside those applications.
16:45
Generally, you want to control, who has access to, what across
16:47
your whole organization, but you want to start off with With the
16:50
sensitive aspects naturally. And when looking at those
16:53
sensitive aspects, it's really hard to govern and control and
16:57
create policies and our back, you know, historically, it's
17:00
really hard to know exactly who needs access to what at any
17:03
given time. And so by creating a
17:05
self-service model, you're enabling people to elevate the
17:08
privileges when they need it. But not have the privileges when
17:12
they don't and by doing. So you get a lot of other
17:14
byproducts for that as well.you, get auditability in retrospect,
17:17
you know. Exactly.
17:18
Who elevated. What And back to your original
17:21
question of is it creating the user is elevated?
17:23
Privileges that very much, depends technologically, you
17:27
know, there are a lot of applications if I want to
17:29
elevate someone to an admin and OCTA.
17:32
You know, I'm probably not provisioning the user.
17:34
I'm just changing the his role inside of okhta if I want to
17:38
create privilege in size of it inside of a database.
17:41
I might actually have to create the connection string in order
17:43
to enable that and so very much depends on the application.
17:47
So I want to turn this in turn this This discussion around
17:51
about, you know, if I have invested in Pam over the years,
17:56
and I've got a, you know, one of the well-known privileged access
17:59
management platforms. You know, can I should I take
18:04
that platform and take on some of these new use cases in the
18:09
cloud. Are those tools getting there,
18:13
or are they there in terms of being able to do those things?
18:16
It was interesting. I was, I mentioned that podcast
18:19
with Paul. Sure, you talked about the
18:23
leadership compass that he wrote for for privileged access
18:27
management and they break down their Compass.
18:31
You know, they break down the vendors by leaders leaders,
18:37
Challengers and followers. And he said that a lot of a lot
18:41
of, you know, buyers they go right to the leaders, right?
18:44
They don't even want to consider somebody who wasn't good enough
18:48
to make it into the lead. Order filled but he said, what's
18:53
more interesting or The Challengers.
18:54
And even the followers, which is, you know, the the newest
18:58
entrance, who are, you know, taking on very specific use
19:02
cases. Want to get your thoughts on
19:04
that. But I also want to know like,
19:06
you know, is there a reason if you if you're invested in a
19:09
platform is it really, you know, sensible to think that platform
19:14
can take care of all my needs or does it need to be supplemented?
19:18
Or how do you, how do you want people to look at that?
19:21
Yeah, it's a it's a good question and I might want to tie
19:24
this back into General entrepreneurship.
19:26
Break the challenges of starting company in a well-defined space
19:31
means that you just has to be still much better.
19:34
You can't be a little better. You can't beat.
19:36
You just have to blow things out of the water, and I think that a
19:39
lot of companies when they look at their Cloud infrastructure
19:42
and their Cloud approach, you kind of owe, you always have two
19:45
options, right? You either migrate your existing
19:48
infrastructure and existing team.
19:50
Into working on that cloud environment or you start from
19:53
scratch. And I think that what we've
19:56
learned in a lot of different cycles of innovation is that
19:59
it's really hard to adapt an existing product and
20:03
infrastructure both as a vendor. But also as a buyer, right?
20:06
When you are building up a new part of the company that is
20:10
going to be relying on new infrastructure, you can be
20:13
adapting. Those current tools into kind of
20:16
that new world now, you know, will people be trying?
20:19
Absolutely and Ivan encourage them to do so because if you're
20:22
able to extract that value out of your current platform, you
20:25
should definitely do it. I think what we're saying is
20:28
that, it's just, it's very challenging.
20:30
It's very challenging to be able to build in a new
20:34
infrastructure, world use old tools and an old mindset.
20:39
All right, I really like how you approach that question from the
20:41
standpoint of an entrepreneur because I think as an
20:46
entrepreneur, you're starting up a business that's going You
20:50
know, not hit the, the full breadth of the market on day
20:55
one, right? You have a vision of where the
20:58
market is heading, whatever, five years, ten years down the
21:01
road, right? Absolutely.
21:02
And that's kind of the thesis that you start off with in a
21:05
company because I think our job as entrepreneurs and is better
21:10
is generally. It's the kind of for see what
21:12
the needs are guests in. Or that's not that we're
21:15
oracle's. But guess what the what the
21:19
needs of the market will. Five Years on the line, there's
21:21
always a dance, right? Providing the needs for the
21:24
needs of companies today, and being able to generate Revenue
21:27
while thinking more forward, five years down the line ten
21:30
years allowed, what will the needs of these companies?
21:33
The, and I think that in a lot of different industries that can
21:36
give a few examples. What you see is companies
21:40
targeting, you always start with targeting kind of the early
21:43
adopters out of the understanding that the larger
21:45
companies will end up. Migrating a lot of their old
21:48
infrastructure into kind of a news.
21:50
New approach and you see that with a lot of different cycles
21:53
of innovation. Yeah.
21:54
No I think what I hear you talking about is not kind of
21:58
this hybrid Cloud that a lot of folks are talking about today is
22:02
almost like you know I don't I don't hear you talking about
22:07
like future in the future, engineering your product to
22:11
handle the on-premise data center.
22:13
So is your theory that the on-premise data center is a is a
22:18
dinosaur's. The thing of the past, 10 years,
22:20
Years from now. The barely exist.
22:24
I'm going to be, I'm going to say something here, you know,
22:26
on-premise dead, and then people are gonna burn me at the stake.
22:32
What's a good hook to start off your podcast with?
22:36
I think that generally especially a lot of your
22:38
listeners, you know, it's always a dance between, what does
22:41
reality look like today? And what does what do companies
22:45
actually use? And a lot of companies have a
22:47
lot of on-prem infrastructure but again we're thinking about
22:50
how will the How will the future look?
22:52
Like what will companies the adopting?
22:54
I think that there is a very, very wide range of a wide
22:58
adoption of both SAS applications and kind of the
23:01
inversion of developing things internally and also the adoption
23:04
of cloud infrastructure. You know?
23:06
Aw CCP is your whatever Oracle whatever, on-prem whatever,
23:10
interest Cloud, infrastructure, provider, you use.
23:13
And so generally what we're doing is we're building a cloud
23:17
management, a permission management platform.
23:18
Excuse me, around the needs of cloud resources, As and one of
23:22
the things that that enables by the way, is I think, the
23:25
challenges of access management is that every company is a
23:28
special snowflake. It's so tight into the business
23:31
values and use cases, that it's hard to create a platform that
23:35
serves a wide range of companies and the beauty of the adoption
23:38
of SASS and infrastructure. Is that all of a sudden
23:41
companies are more similar in their, in their technology stack
23:45
and that enables companies vendors to build a product
23:48
that's fit for a wider audience and less reliant on.
23:51
Professional Services and long implementation times and so on
23:54
and so forth. Definitely a lot of benefits of
23:56
adopting a cloud infrastructure world.
23:58
Yeah. And there might be, people
24:00
sitting out there listening and thinking, Ron is crazy.
24:04
These data centers, aren't going to going away, whether or not
24:09
that's true, right? We're all looking into our own
24:12
crystal ball based on our experience and trying to figure
24:14
out, you know, where things are going to be.
24:17
And, you know, the only way we'll know who's right is to we
24:20
wait until that. That actually happens.
24:22
Right? But, you know, to turn this into
24:27
a question, I've listening to Paul talked about it, and he
24:32
said, well, there's a growing population of companies that
24:37
intentionally have multiple products that go fit under this
24:42
umbrella, Pam, they have a true, you know, and some of the Seas,
24:47
probably projecting because they did a survey and, you know, he's
24:50
analyzing The information coming from the survey.
24:54
You know, the way I took it was a lot of people have these
24:58
traditional pans, but to solve these use cases.
25:01
Like, what you're talking about. They'll intentionally have
25:05
multiple products while in the future might be that the most
25:08
important products are the ones that solve these particular.
25:12
Use case in the on-prem is the niche.
25:16
But I think there's also a scenario what we've seen in
25:18
access management, right was You know, there is this
25:23
heterogeneous support was the way of Computer Associates
25:27
within that Tegrity and, you know, oracle or I'll books they
25:31
had, you know, the sport for hey all these different ways that
25:36
you might want to do web access management, an OCTA came along
25:40
and said, well, all we do is Samuel support and you thought,
25:44
well, how can you win? If all you do is assemble
25:46
Square? Well, obviously it's pretty
25:49
clear who won now. But now, if you look Dr. A lot
25:52
of the things that they've done over the last five years or so,
25:56
is like put some of that backwards compatibility into the
25:58
product. All right, because they don't
26:00
want that old application that you haven't upgraded to be the
26:04
reason why you don't go with OCTA, whether you have to choose
26:08
one of the old Legacy players. Absolutely.
26:12
And that's always a balancing act.
26:13
By the way, as a buyer to, like, when you are sitting in front of
26:16
your infrastructure thinking, where do I want to focus my
26:19
efforts, if 90% of your Your infrastructure is on-prem and
26:23
your services are internally developed, then that's going to
26:26
be your top priority but if 90% or 80% of your infrastructure is
26:30
cloud then that's going to be your top writer and that's where
26:32
you're going to want to focus. So it comes down to every
26:34
company having to assess where their priorities are and then
26:38
going with the partner that can help them that is focused and
26:42
aligned on Focus. So we let's get into just the
26:46
litter design. You should hear a little bit
26:47
because I talked a bit about Justin time from a Entitlement
26:52
perspective and managing those things and zero setting
26:54
privilege and ephemeral, right? And all the fancy words that
26:56
basically say, how do we, make sure that the right thing or
27:01
person has the right Axis at the right time and I think the
27:05
separate part of that question is at only the right time which
27:08
I think is the harder part to achieve.
27:10
I guess. You know, what is your view
27:14
point on is that realistic as a goal to achieve today?
27:18
How can people start to think about privilege?
27:21
Village access management in terms of not just having the
27:24
access but only having it when it's needed and then taking it
27:28
away from everything everyone, you know, as part of their
27:32
organization, I'll answer that by taking a step back, if that's
27:36
okay. And starting about like how did
27:38
access management start initially and kind of the
27:40
biggest buzz word, at the beginning was our back, right?
27:43
Role-based Access Control in the idea that you create, these,
27:46
these clusters of permissions that you assigned based off of
27:50
what the jobs to be done. And I think the challenge of our
27:54
back over time. Is that you realize that the
27:56
organization is flexible and involving, it's a living
27:59
creature of sorts. And then it's really hard to
28:02
Define set concrete roles of people over time.
28:05
And then a lot of things have Cascade from there in different
28:09
different options of how to solve for R back.
28:11
And I think that one of the things that have have been born
28:16
out of that necessity is the idea of automating the request
28:20
process. Is creating a process where
28:23
employees can Self Service elevator access and change
28:26
privileges based off of what they need and the beauty of that
28:29
is all of a sudden you don't have to be as rigid and what you
28:32
define employees? Get as Birthright, privileges.
28:36
I think the reason that companies were focused so much
28:38
on creating these amazing roles is that they knew that the
28:42
business implications of an employee not having access to
28:45
things that they need is really high.
28:47
If I need access something, I don't have it.
28:49
I know I'm gonna be going through a two-week ticket Like
28:51
service now and that sucks. Frankly.
28:54
And so what companies and security teams felt they needed
28:57
to over privilege to make sure that the business was effective.
29:01
And so I think the whole idea behind self-service, is, how do
29:04
I reduce that barrier? How do I make sure that
29:07
employees can't get access when they need it?
29:09
So that I is a security team can feel comfortable removing that
29:12
access. And that's not to say that our
29:14
back is that right there are set permissions of things that you
29:17
feel comfortable giving away. But the more sensitive the role,
29:21
Is, and the more granular it is in terms of how many people need
29:25
that access, the more the request process comes in and
29:29
kicks in. And that's why I think just in
29:31
time access around sensitive resources, has become a very
29:35
strong, use case because it's really hard to Define who needs
29:38
that access. It's really hard to Define when
29:40
they need that access. And so instead of going through
29:43
the process of researching all these roles and defining and
29:47
creating this policy that frankly won't be relevant after
29:50
6 months. Create a policy around the
29:52
change management, you make sure no one has that access to begin
29:56
with but the change management needs to be flexible and
29:58
automated is that when people need that access, they can gain
30:01
it and now you have a lot of structure and rigidity and
30:05
auditability as to who's getting that access and we're and being
30:08
able to adopt the policy over time.
30:10
So, kind of the governance part which, which I feel like people
30:13
have been focused on as kind of the end goal.
30:16
Governance is a byproduct of a good process.
30:18
If you make the process good then, obviously you're going to
30:21
be Be good from a governance perspective.
30:23
So it sounds to me like in order for this to be effective in the
30:26
real world, you really do have to have self service sort of on
30:30
lockdown, right? It meaning you've got good
30:33
processes, you've got good governance over what that looks
30:36
like, because you don't want to get in the way and that's
30:39
typically write the main cook, make a point around, probably
30:42
something like this would be lets takes too long, it takes
30:45
two weeks to get access and I think that sometimes where the
30:47
knee-jerk reaction comes in and say, okay, well let's just
30:49
create that access Inside of a role that our exist because Jim
30:54
might need it as part of its role and now we start to get
30:57
into the world. Oh, well, are you at least
30:59
privilege or are you are back because they are counter Paulino
31:03
opposing forces sometimes, especially in the world of
31:06
privileged access management. So you know how do you typically
31:10
see it when you're talking with your customers or other folks in
31:12
the space? Is how do you make that
31:15
determination with the client and say, hey you know what?
31:18
I understand what you're trying to do, but maybe you should take
31:21
it. Out in different terms.
31:22
Maybe it's not our back, maybe it is policy-based or
31:25
attribute-based as a basis for things, but doesn't need to be,
31:30
you know, the the one rule, one rule to rule them all sort of
31:33
approach. Definitely.
31:35
I think I think that the end of the day, a lot of companies all
31:38
are already getting a lot of access request because our back
31:42
always fails at the end, right? You always have and like every
31:45
law, right? We have our lawmakers creating
31:47
laws and then, you know, have people and thieves by passing
31:50
these laws. And you fix the laws.
31:52
And, and it's kind of a vicious cycle.
31:54
And the same goes with any axis macro policy, create a policy
31:58
around who needs access and then you still get a ton of tickets
32:01
in service now, saying, hey, I need access to this or that
32:03
because I wasn't included in that policy and so I think that
32:07
the understanding of the need is there because companies are
32:11
already feeling the entropies, are already feeling that you
32:13
need for change management. I think the beauty of creating
32:16
an automated change management. Policy is that you'll notice all
32:20
of a sudden that the amount of request goes up, does it go
32:22
down? Because all of a sudden people
32:24
feel like they can gain access and so you feel more comfortable
32:27
to remove access and that cycle works well in both directions.
32:31
The employees feel like they can work and they have access to
32:34
what they need. And security teams has taken a
32:36
strong step towards least privilege because then yell can
32:39
take that access away. Okay, so my last question is,
32:42
how do I take this and do something in the real world
32:46
world with it? Is it, do I start working on my
32:49
self-service? To be able to request sort of
32:52
these, you know, dynamic privileges.
32:54
That earliest privileges that I want to be dynamic, I would
32:57
assume there needs to be some definition, maybe around.
33:00
Well, what do you consider privileges, probably, maybe a
33:02
first step. Do I start with attribute based
33:05
access control or policy-based, like, give me like the first two
33:09
or three steps that you say, okay, we're going to put in, you
33:13
know, just just in time method for privileged access what can
33:17
people listening around the world so no pressure.
33:21
Take back to their daily lives and say, hey, here's how we can
33:24
get started. Well, I'm humbled to be asked
33:27
that from you, because you two are kind of the Kings on how to
33:31
implement access Management Solutions.
33:32
But I can give my two cents in terms of, you know, generally
33:37
when without a security team and I'm looking to prioritize now my
33:41
projects and access management. Obviously, I start with my most
33:45
sensitive aspects, those, you know, the crown jewels, that's
33:47
where my security is most important to me.
33:50
And then I, Apogee from there maybe that's my socks.
33:53
Regulated resources. Maybe that's my cloud
33:55
infrastructure. Maybe that's my databases.
33:57
Maybe that's why Salesforce every company it's a different
33:59
answer and that's not something that, you know, we from the side
34:02
can Define. So I think the first step is
34:05
identifying what are your priorities?
34:08
Because again, access management.
34:09
I think after the management projects that are notorious for
34:12
failure because they dragged out forever and never see success.
34:16
And so by defining a set priority of resources or able to
34:20
see success. Around that.
34:21
And then expand your project from there.
34:23
And so I think first of all you start with identifying your
34:26
priorities in terms of resources and applications and then create
34:29
a least privilege and self-service model around that
34:32
you want to call it Pam, you want to call it IGA, whatever it
34:36
doesn't really matter, but you start with those sensitive
34:38
resources, create a self-service model, or at least privilege
34:41
model around that and then start adding an expanding across the
34:44
business units and applications from there.
34:46
I think self-service and just in time, axis easy is a way.
34:51
See success quickly and simply in access management world where
34:54
things drag out, and then it also creates a feedback loop
34:58
that enables you to create better policies.
35:00
If you have structured data around who's requesting, what
35:03
you now can create better policies because you know what
35:05
people are needing. And now you can create maybe
35:08
onboarding processes that are better for that same reason.
35:11
It's almost like you're conducting like a symphony.
35:15
You need a bunch of different parts kind of working in concert
35:17
together and what it works. It's great.
35:20
What It doesn't. Oh boy, does not sound good.
35:24
I think what I'm hearing from Ron is something that confirms a
35:28
belief that I've had, which is, you know, getting to lose
35:32
privilege while it's hard, right?
35:34
And it's so it's probably beyond what we can calculate and come
35:40
up with, with our human brain. So, we need, this is where
35:44
artificial intelligence could really plug in your giving the
35:47
people this access through these roles.
35:51
Are only using a micro scopic amount now.
35:54
We now we're in the world, where we can handle, you know, micro
35:58
roles, and we can assign micro rules based on the need because
36:03
the artificial intelligence can think of it.
36:05
You just give it the rules and, you know, I don't know.
36:09
I'm not saying we're there yet, but that's where I could see
36:12
artificial intelligence plugging into this because the human
36:15
brain just can't calculate it that level.
36:19
I think what Ron is saying, is like, okay, we use just in time
36:22
we can use roles and we can use Kim for example, to basically
36:30
almost like mitigating controls or compensating controls.
36:34
But that doesn't really answer your question of how we get down
36:37
to least privilege to get that least privilege.
36:39
You have to get down to defining.
36:41
Here's what access is actually needed to perform the function
36:45
and I don't I'm not aware of a technology that That can really
36:49
do that right now. Well, I think I think that's
36:51
again, one of the benefits of a self-service approach, right?
36:54
In a self-service world. Then employees can't be
36:57
requesting what they need. And sometimes, they don't know
37:00
what they need and that's kind of on us as the request engine
37:04
to be able to recommend to them. What are their ears requesting?
37:07
You know, what jobs to be done? Do they have to do?
37:10
And how does that time into their permission?
37:12
So taking that information, just like you said, you know, both
37:15
you need both an intricate understanding of the
37:17
organization 8. Our roles and on-call systems
37:20
and Training Systems, and all these sensors around who you are
37:24
and what you're doing and then taking all these senses around
37:27
the data itself. Like, what are you accessing is
37:30
this privileged access? Is this pii, you know what type
37:33
of information that's is and then being able to tie both
37:36
sides of those and someone needs to be that glue.
37:39
Now that's my, that's my cue to say, where that glue.
37:42
But obviously there are a lot of other companies in the station
37:45
and approaches to this. You know what?
37:47
I think you're saying they're running.
37:48
Is what I think you're talking about is like, what level of a I
37:53
quote unquote air quotes AI is available in.
37:57
I am IGA systems today which is oh Jim and Geoff do the same
38:01
job. Jeff does.
38:03
Jeff has these roles Jim you might enjoy having these roles.
38:07
Well that is not least privilege.
38:09
Now you know I'm trying to guess I kind of feel like the whole
38:14
idea. The whole reason we came up with
38:15
our back is because the limitations of the human I mean,
38:20
we can understand roles if we can group it and we can get it
38:23
down to the simple form. Then we can actually manage
38:29
access where we're actually making good decisions.
38:33
However, we're making good decisions with bad data.
38:36
The bad data being groups are just compilations of
38:40
entitlements that nobody needs all those entitlements.
38:44
So, I decided I disagree with what Jim because I think rolls
38:47
are born out of A desire for efficiency AKA laziness because
38:53
I think it's easier to request a roll and tell the business to do
38:57
that rather than make them jump through hoops as submitting.
38:59
What do you mean? I have to submit eight different
39:01
tickets to get the eight different things that my
39:03
employees. That's stupid.
39:05
Yeah, it's stupid, totally agree with you, but that might have
39:08
been the process 15, 20 years ago.
39:11
And so, we came up with the concept.
39:12
Well, how do we make it easier for the business?
39:14
Let's bundle those things up into a specific request.
39:18
And then push that and you know don't make the business jump
39:21
through that hoop, kind of figure it out beforehand and go
39:23
through their. Yes.
39:24
I think there's some other things probably that go behind
39:27
it but I take a slightly different view just having come
39:30
from the operation side. I was like, yeah, let's get
39:32
roles in there because my, my customers on the Enterprise side
39:36
where look at me, like I was nuts.
39:38
When I'd say, yeah, there's 14 different things that you need
39:42
to fill out to get your new employee, who's starting.
39:45
I'm really sorry, but I need that for audit purposes.
39:49
As the techie maybe I'll try to I want to add may be another
39:52
explanation for why that was born to be and I think that it
39:55
has a lot to do with just the protocols and rfc's that were
39:58
put into place Samuel and all these.
40:01
These authentication methods with the enabled was pushing
40:05
group attributes into the applications.
40:07
And so all of a sudden, you could create groups and your
40:10
identity provider that propagated into permissions
40:13
inside the applications and it was really hard to do the other
40:17
way around. It's really Really hard through
40:19
these protocols to create groups of resources that have to be
40:22
done in. You know, maybe manual tickets
40:25
in service now in your idea sin. Maybe it was dr.
40:27
Your IGA but there wasn't a natural and easy way to do that
40:31
to create groups of resources. And so what you had to do is you
40:35
had your HR System pushing into your identity, provider identity
40:39
provider already had built in groups or almost had built-in
40:42
groups based off of your HR attributes.
40:44
And then you had that pushing into the applications, you
40:46
didn't have anything pushing from the Stations back into some
40:50
sort of policy engine. And I think that may have
40:53
Blended its way towards a very role Centric approach that was
40:56
focused on HR attributes. It's also, if you don't mind me
41:00
on one more thing is that I think companies are slightly
41:02
changing their approaches. Well, it used to be that
41:05
companies were very structured and everyone had a goal and job
41:09
to be done. And as companies have evolved
41:11
and become more flexible and agile took place, it become
41:14
much, it became much more challenging to Define who
41:17
exactly does Inside the arc. I think that's a pretty good
41:20
final word on that so why don't we button it up there?
41:23
Before we go we like to end on a lighter note and I'm thinking
41:27
about you know Ron your co-founder of a co-worker
41:29
ization, your technology space, the question I've got for us
41:33
today is what is a non technology company that you
41:36
would like to start to be anything in the world but it has
41:39
to be as far away from Technologies, you can get it.
41:42
What do you thinking today, run? I have a funny one and I
41:45
semi-real one. Which one do you want?
41:47
What's here, both? Let's start with.
41:48
Let's start with the semi real one and then, and, and then your
41:51
second one to be the funny one. Okay.
41:53
So my semi real one is that especially with kind of the
41:56
whole bank system failing. Recently, I've started kind of
41:59
realizing that it's so, it feels really weird that real, that
42:02
weird that the custodians of your money are.
42:05
Also the ones that give customer service.
42:07
So, you know, banks on the one hand, to have these really smart
42:10
investors, but they also have branches that help my mom, get
42:13
mortgages and there are two very different jobs and it's weird
42:17
that they're saying person that does And I feel like there's
42:19
some sort of abstraction that needs to be done between the
42:21
two. That's my semi-real one kind of
42:23
boring. It's like I am in finance like
42:26
come on it's not that. I done some some you know not a
42:30
good not a good conversation starter parties.
42:32
The other one which I got really excited about it.
42:34
Been trying to find a Founder for is a shared economy so kind
42:39
of like the Uber or Airbnb for laundry.
42:42
So let's look at this like you don't want to do laundry today
42:45
you don't want to iron your shirts but your neighbor Is
42:48
doing laundry. It's laundry day for him.
42:50
What is he or care? That they take a few of your
42:52
underwear? A few of your shirts and throw
42:55
them into the laundry machine and so kind of just depends what
42:58
finger in a position if you get it in a bag.
43:03
It's, you know, you've been like are being beat up insurance for
43:05
their Apartments. You do insurance for people's
43:07
underwear and you get a guarantee of a few days gets
43:11
back to you. Clean becomes a easy Revenue
43:14
stream to think like, you know, New York, kind of bachelor
43:17
apartment buildings. There has to be that guy that,
43:20
you know, still willing to do everyone's laundry for a few
43:23
bucks at the end of the day. I like that.
43:24
I think that's pretty interesting.
43:25
It's kind of like, yeah, it is that you're renting, timeshare
43:28
within someone's washer and dryer and it's like, a package
43:32
shows up was like, all right. Well, here's the here's the
43:33
dirty package and then you pick up a new, you know, the clean
43:36
package or whatever. That looks like, I can see that
43:38
taken off. Thank you, thank you.
43:39
You're welcome to take it. I want to percent.
43:41
I don't know if I have the chops or the the washer or dryer space
43:45
to accommodate it. I just want to point out the
43:47
fact that Ron Is the first person to talk about dirty
43:50
underwear on the identity to Center podcast.
43:53
So hey we've been going for two hundred and fourteen episodes.
43:57
I mean there's a first for everything.
43:59
I'm happy that that's what I'll be known for there you go.
44:02
Like so many people. I went on vacation to Maui and
44:06
when I came back, I said I'm moving back to Maui.
44:08
I'm going to live in Maui and one of the things that as a with
44:13
malli, obviously, it's an island in the middle of the Pacific
44:16
Ocean. It's surrounded by these Beach.
44:18
Is all the way around the island and there's actually some of the
44:23
beaches where it's like a public beach.
44:26
They allow people to Camp so people will go and set up tents
44:30
and things like that. But can you imagine you're
44:33
flying to Maui and trying to bring a week's worth of supplies
44:38
and a backpack and all of that? You can't really glamp, you
44:42
know, glamorous camping is called glamping.
44:45
So my idea was moved to Maui and set up a A business basically
44:50
setting people up for camping in one of these public spaces, and
44:54
would be nice campsites or they had a little bit of extra money.
44:58
Might be like a VW Camper or you don't have to figure out what
45:02
the regulations were in sight in terms of the size of the camper
45:06
that you could do. But that was my idea was
45:08
basically to go in, you know, host people or help people get
45:12
set up so that they can come to Maui and rather than staying at
45:16
a resort. Staying in your camping set up
45:20
on the beach which I think would be super cool.
45:23
And by the way, since I brought this whole idea upright and I
45:27
said everybody goes to Maui their ideas.
45:31
When they come home I'm going to move back and then they never
45:33
do. And so I worked with a guy Mike
45:36
would burn, good friend, he listens to the show friend of
45:39
the show and he went to Maui and I'm like, dude, here's what
45:44
happens. Everybody has somebody they come
45:45
back, they said they're going to move there and then they never
45:47
do. So he goes to Maui comes back,
45:49
says he's going to move there, I'm like, yeah, like I told you
45:52
your step 2 and then he actually did it.
45:55
So he lives in Maui, he's listening to the show in Maui,
45:58
so good for him, good for you. Mike Mike's, got people really
46:02
smart so good for him. Little bit jealous.
46:06
It sounds a little bit like Air B&B but like on the beach or
46:11
sort of something like that. Yeah, I figured I probably never
46:15
have to own sneakers are just wear flip-flops all the Time to
46:18
be like a Paul Rudd character. Just kind of walking around the
46:21
beach, but hey, man. So what's your idea, Jeff?
46:25
You know, I came with the question and I don't know if I
46:27
have a really good answer, it's probably something in.
46:30
I don't really call it technology but it'll be
46:32
something like a radio show or something.
46:34
It's just like quickly. Like, not I am obviously, it
46:39
would be more like a talk. Show, funny, something like
46:42
that. Where, you know, me and a bunch
46:44
of friends, probably yourself, get together, right?
46:46
We just kind of talk, About what's going on in the world and
46:49
that's pretty much it and put the opinions out there and not
46:52
be afraid to, you know, be corrected or to change our
46:56
opinions like hey I think this is what I'm thinking have
46:58
someone on change my mind. All right.
46:59
Yeah, that makes sense. Maybe maybe in mind changes or
47:02
maybe it doesn't. But I think just, you know, I
47:04
think of some of the best memories I have is just kind of
47:06
sitting around in a room talking with friends goofing off and
47:09
just having a good time and being able to be free with each
47:12
other, right? And kind of just have a good
47:15
time with it so there might be no technology.
47:17
Biology involved. Maybe it's just a microphone
47:19
hanging from a from you know, from the ceiling or some like
47:22
that catching everybody. But yeah, you met on the show, I
47:25
think we'd wind up getting cancelled within five episodes.
47:28
Yeah, I would expect. So you're pretty opposites when
47:30
it comes to certain things, Jeff, some of the most popular
47:34
podcast these days are exactly like that.
47:36
Yeah, I don't have the time for the time for that, not the time
47:40
for this one, sometimes what we make it.
47:42
So speaking of time, why don't we go ahead and wrap it up for
47:44
this week so we can let Ron get on his day.
47:48
Ron really appreciate you taking the time with us for folks who
47:51
are interested in learning more about entitle.
47:53
You can visit them on the web and titled dot IO will have
47:56
links in the show notes to their website as well as two runs
47:58
LinkedIn profile. So that way you can connect with
48:00
him. That's where all the hate mail.
48:02
Goes when you'll you when you hear him, say on-prem is dead.
48:06
That's where we want to. Send that kind of stuff.
48:08
Feel free to correct them. I'm sure if you happy to engage
48:11
and with that, we'll go ahead and leave it.
48:12
You can visit us on the web where at idea.
48:14
See, podcast.com or on Twitter at idea?
48:17
See. Last run, Mastodon at idac
48:20
podcast at infosec data exchange.
48:21
You can always connect the Gemini and Linkedin.
48:24
We're hopefully going to see a whole bunch of friendly faces
48:26
and new faces at identify this here next week and don't forget
48:30
to subscribe and rate the show. That's the best way you can help
48:32
us here is get the word out. Share it with a friend, if you
48:35
hated it share with an enemy either way as long as you share
48:38
it, I'm cool with it. So we'll go ahead and leave it
48:40
there. Thanks everyone for listening
48:42
and we'll talk with you all in the next one.
48:45
You've been listening to Identity at the center.
48:49
We hope you've enjoyed the show, make sure to like rate and
48:53
review and we'll be back soon, but in the meantime, hit the
48:56
website at identity at the center.com and find us on
49:01
Twitter at ivac podcast. See you next time on identity at
49:08
the center,