Latest / Identity at the Center / #278 - IDAC Sponsor Spotlight - Stack Identity

Transcript

#278 - IDAC Sponsor Spotlight - Stack Identity · Identity at the Center

0:00
You're only one misconfiguration away from a
0:02
breach. What are your thoughts when you
0:04
hear a quote like that? I think when I hear a quote
0:07
like that, it is absolutely true. It
0:09
is an asymmetric problem. Attackers
0:11
have to find just one weakness to get in.
0:14
Defenders, as a customer, have to
0:16
have their 100 % coverage. But
0:18
it's not that you got to do everything perfect.
0:21
That's going to be, you're never
0:22
going to stop attacks. You're
0:24
never going to, you know, if there's going to be
0:26
some challenges coming in, it's what is the risk of
0:28
inaction? What is the risk of this
0:31
access? So people are built identity
0:33
systems for the last two decades. But
0:35
the concept of risk of an identity, the fact if I'm
0:37
giving access to Jim means I'm taking on a risk. I'm
0:41
hoping Jim is a legitimate employee. He
0:43
does legitimate actions, but sometimes that's not the
0:45
case. Sometimes your account could be
0:46
compromised. So the solution threat vector
0:48
we are looking at right now means every account has
0:51
a risk. This is identity at the center.
1:01
If it has anything to do with
1:02
IAM, this is the go to podcast. Now
1:07
your hosts, Jim McDonald and Jeff Steadman. Welcome
1:18
to the identity at the center podcast. I'm
1:19
Jeff and that's Jim. Hey, Jim. Hey,
1:22
Jeff, how are you? Oh, and that's a bad yourself.
1:25
I'm doing great. I'm,
1:26
as always, very excited for this episode. I
1:30
discovered Venkat a while back at an event and Ian
1:35
Singh, who probably most people who are listening to
1:38
this podcast know Ian. He's very much a contributor to
1:42
our community on LinkedIn and various other formats
1:47
as well. He introduced me to Venkat. I
1:50
got to learn a little bit about the Stack Identity
1:53
product. And so I'm glad we're able to
1:55
bring their message to our community. Yeah,
1:59
we're looking forward to this one. And
2:01
definitely want to give a shout out to Ian for the
2:02
connection. He's also been a great supporter
2:03
for the show. So shout out to Ian. Today's
2:06
episode is a sponsored episode, something that we
2:09
developed these in collaboration with our
2:10
friends over today at Stack Identity. If
2:13
you don't know a Stack Identity, they are your co
2:15
-pilot to solve identity security problems. We're
2:17
going to find out what that means. You
2:18
can learn more about them at stackidentity .com. And
2:23
so we've got Venkat Raghavan, founder and CEO
2:26
at Stack Identity. Welcome to Identity at the Center.
2:29
Venkat. Thank you, Jeff. Thank
2:31
you, Jim. Good morning. So
2:33
thanks for taking the time. One
2:35
of the things we like to do is really find out
2:36
about the background and the origin stories of
2:38
people who appear on our show. So
2:40
let's start with that. How did you get into the IAM
2:43
industry? What set up your or ignited
2:46
maybe your passion for this sector of cybersecurity?
2:50
Gosh, I got to go back 25 years
2:51
back here. So my first start was I'm an
2:56
engineer by trade. So built early distributed
2:59
systems for companies. And I was working on a
3:04
specification called security assertions markup language,
3:08
or SAML, as it's very popular these days, which
3:13
is the kind of the rule break of identity today. I
3:16
got really excited about the opportunity to kind of
3:18
have a common language by which we can speak identity
3:21
to each other electronically. And
3:23
so that got me excited. Somebody's
3:25
in a dug in this a bit more and joined a startup
3:30
called Ascom, based for pioneers and using SAML to
3:33
build the first generation of identity management and
3:38
single sign on systems, which powered the lot of
3:41
Java applications back in the first days of Internet
3:44
era. So had a great experience in
3:47
this identity space. And never left, frankly, got to
3:51
know SAML, build products, was part of a start up on
3:55
BASCA, we got acquired by IBM. And
3:57
I am still head 25, we said, still doing this. So
4:03
you've got a long history in this space. So
4:04
let's talk about stack identity. What's
4:07
the core problem that stack identity looks to solve
4:09
for? And this is a very competitive
4:12
space. How do you set yourself apart
4:14
from others in such a crowded market? I
4:16
think it's useful to kind of go back and look at
4:18
how industries evolved in the last two decades,
4:20
right? I mean, then we first started
4:22
BASCOM and worked on the early generation of
4:25
activities technologies. The problem we were trying to
4:27
solve was simplifying granting of access. And
4:31
so that was very complicated. IT
4:33
was growing, leaps and bounds. And
4:35
people had a lot of applications and so on and
4:37
so single sign on, nothing a single password is a
4:40
big, big issue, big pain point. That
4:42
we saw that we saw successfully the last 25
4:44
years or so. But now the issue is granting
4:48
of access is the easy part. Removing
4:52
access is quite difficult, quite challenging. Why?
4:55
When you're able to access people's free mature, you
4:58
don't like it. And they feel like they've
5:00
taken something away. They were taken something away
5:02
from their daily work. What a reason becomes immortal,
5:06
cultural, sometimes political. And
5:10
so what happens is that if you don't remove the access
5:13
under whatever pressure you're in, in companies,
5:15
then what happens? There's some access for all. A
5:19
hordes of access lying around years and years. And
5:23
it's easy picking for attackers. The
5:25
last 100 breaches, attackers always compromised the same
5:30
pattern, a compromised identity, but with a
5:32
compromised or re -credential that should have been
5:35
removed, that wasn't removed. And
5:38
we only find out after the fact. So
5:40
the problem that Stake is solving is to kind of
5:41
figure out, how do I simplify and make it easy,
5:45
an easy button, but removing access? And
5:48
so that's, I think, the innovation we're applying.
5:50
And it's very difficult to
5:51
convince people to remove the access, but we got to
5:54
do that. And that's what we're empowering
5:56
teams to go do that. So I'd love to find out also
5:59
about the names of companies. How
6:01
did you come up with the name Stack Identity? Well,
6:04
I think if you look at at least even a decade ago,
6:06
we were operating just Active Directory WSU L
6:09
-BAPs. That's it. In
6:11
a today's world, companies, you know, there's 25, 30
6:13
different identity systems. You
6:15
have your AD, your L -BAPs, you have EntraID, you have
6:20
Aqta, your applications that have their own identities,
6:23
and it goes on and on. So the sprawl of identities
6:26
was massive. So now we're seeing identities
6:29
built into your operating systems and clouds and
6:32
applications and databases. So
6:34
we see stacks of identities. You
6:36
know, all over the place. And
6:38
so for customers, it's very difficult to manage all the
6:41
identity populations they have. And
6:43
so the stack is named to kind of reflect the fact
6:46
there's now a distributed identity system. And
6:48
it's going to be that way for the next several
6:50
decades. How do we still bring the
6:53
unified perspective of identities and what they're
6:55
doing in the environment? So
6:56
that's what we're trying to accomplish here with Stack.
6:59
You know, Venkata was thinking,
7:01
oh, stack could also mean the stacks and stacks of
7:05
entitlements that people accumulate over time.
7:08
Because that's really what it
7:09
sounds to me like, the problem that you're solving,
7:11
right, is that this entitlement creep scenario
7:15
where you keep getting more and more access, whether
7:19
it's, you know, I don't think it's intentional,
7:22
right? Nobody's out there trying to do the
7:24
wrong thing. But we, you know, as
7:26
consultants in our day -to -day lives, Jeff and I see
7:30
scenarios where companies are still doing what we
7:33
call model after. So Venkata joins the company
7:37
and he's, you know, backfilling for Jeff. Make
7:40
him like Jeff. Well, what they don't realize is
7:42
that Jeff has been working here for 15 years, and now
7:46
he has all this different access. So
7:48
that's one scenario. But kind of what I'm very
7:53
interested in is, where do you fit into that life
7:58
cycle or that workload of getting from the point
8:03
where it's like, you're provisioning these
8:06
entitlements to now you have them and you may or
8:08
may not be using them? Where
8:11
does stack solve the problem? Which
8:15
part of that workflow is it? Yeah,
8:19
great question. So you're right, it's all
8:21
about stacks of identities. And
8:24
we should be clear, it's both human as well as non
8:26
-human. Because most of the time we are
8:28
seeing a new era of machine identities coming in
8:30
workloads and whatnot, APIs, AI applications and so on
8:34
and so forth. So we have stacks of
8:35
identities, so stacks of permissions, stacks of
8:38
privileges, stacks of policies, right? So
8:41
that's a complete mess we have. So
8:45
granting access is easy, right? Many
8:48
tools do it effectively. So we're not solving that
8:49
problem. Once access is granted, what
8:54
happens on day two, day three, day five, day 10,
8:57
day 100? Are you using the access? Or
9:02
is some of, do you have more access than necessary?
9:06
And are you approving access
9:07
that's not required? And so we look into, how do
9:12
we understand and help customers understand where
9:15
are they over -permissioned in their environments? Where
9:18
are unusual access patterns, unusual behaviors of access?
9:22
Because anytime there's an access,
9:24
there's a risk of somebody doing an exfiltration or an
9:27
attack on your critical systems. So
9:29
we are always focused on continuing to understand the
9:31
access, attack surface, and always helping you to
9:35
automate the reduction of this. So
9:36
the primary goal that we're trying to solve is post
9:40
-grant of access for any identity, machine or human.
9:44
How do we make sure they only
9:45
get the right access for the right reasons, for the
9:47
right duration, for the right purpose, and that's
9:49
it. And help customers to continue
9:52
to operate in least -for -permission mode. That's
9:54
our goal, and that's our IP, but to the company.
9:58
Yeah, that's fantastic. You
10:00
know, one of the things that Jeff mentioned is, you
10:03
know, he asked a question of how did you come up
10:04
with the name of Stack? I'm
10:08
also interested to understand, so you've got
10:10
this tagline around co -pilot for identity security.
10:15
So what is that all about?
10:17
What was the mentality there?
10:20
Yeah, if you look at every CISO
10:22
you've talked to or an identity leader, they will
10:25
internally talk to themselves, and they know
10:27
they have to solve this problem. They
10:28
know they have a challenge with access of access,
10:30
access running a muck, whether it's employees,
10:34
contractors, third parties, whatever it is, they know
10:37
this. But they can put their arms
10:40
around this problem. And so, so why is that? They
10:45
know they have to do this, but they cannot do this,
10:47
because things are too complex right now, right?
10:49
They have to do many different
10:50
systems. They're dealing with, you know,
10:53
identity systems, access control systems,
10:56
applications, databases and whatnot. So
10:59
they're struggling to figure out, how do I get my arms
11:01
around this? And so the answer for customers
11:06
is to help them leverage automation. So
11:09
co -pilot is the ability for us to work and concert
11:12
with the customers, and be almost like a co -pilot to
11:16
the customers and environments. Watch
11:18
over their environments continuously, understand
11:20
where the problems are, and clearly, half of them are
11:24
children, seeing there's a problem here. So
11:26
co -pilot is all about the sort of AI world of
11:28
automated visibility, automated access control,
11:31
automated resolutions. So customers don't have to put
11:36
human labor and all those things. And
11:37
today, we've seen many, many companies that use
11:39
spreadsheets and screen charts and emails back and
11:42
forth just to just figure out, hey, this is actually
11:44
required for Jim. That's a back and forth that
11:47
happens for like a couple of weeks. So
11:49
co -pilot takes a different approach. It's
11:52
entirely automated. It's data driven. And
11:55
through that approach, customers are informed of
11:57
problems automatically in our console. So
12:01
they kind of get to see, okay, these are the areas
12:02
I'm focused on. These are my exposures. These
12:05
are my exploit, things I need to go look after,
12:08
right? And these are the ways I need
12:09
to resize the right side of my policies. That's
12:12
the whole idea of co -pilot is to give you the
12:14
automation layer so you can automatically detect these
12:17
unwanted access, unauthorized access, shadow access, and
12:22
help customers to kind of go through a process of
12:24
fixing these things as well automatically. Yeah,
12:28
I thought that was one of the points that you made
12:30
there was real interesting around not only the human
12:33
identities. It's so easy to fall into the
12:35
trap to think about identity as human beings,
12:39
but there's also all these non -human identities,
12:42
especially in your cloud environments. So
12:45
let's kind of like shift into stuck meat and
12:49
potatoes. So what are the environments,
12:53
the cloud platforms that you guys support? And
12:57
then if I'm wanting to use stack in that environment,
13:03
what is the implementation of that like? In
13:07
other words, how do I go about it at like a 10 ,000
13:11
foot level? Yeah, it's quite simple. We
13:14
support all the major cloud platforms today. We
13:17
are a multi -cloud and a multi -IDP, multi -cloud
13:20
mainly support AWS, Azure, GCP, and things like that.
13:27
We also support multiple
13:28
identity providers like Octa, Active Directory,
13:33
EntryID. We also support identities that
13:36
are built into databases, database identities, database
13:38
admins, and things like that. So
13:41
the platform is a SaaS platform. It's
13:44
easy to deploy and onboard. And
13:47
we take read -only access for a particular cloud
13:49
account. Customers create a couple of policies
13:51
for us and give a limited access scope. Through
13:54
APIs, we ingest this data. It
13:57
takes about five minutes to onboard a specific cloud
13:59
account or an identity account for us, like Octa,
14:02
for example. And then we do the analysis,
14:05
we do the detections, and the time to initial value
14:08
is about 60 minutes or less. So
14:10
very simple to use to product. We
14:11
have a nice dashboard that builds trust with our
14:14
customers to tell, we tell some where things are in
14:17
the global population space. What
14:19
are the various activities, behaviors, what are the
14:21
risks of identities, what are the over -informationed
14:23
access? And we go through a guide and
14:25
process to help customers to understand, agree,
14:28
acknowledge, and then take action from the platform.
14:31
So forgive me for sounding a
14:32
little bit incredulous, but I'm going to paraphrase
14:35
what you just said. If in about an hour you're
14:38
able to pull all this information together and
14:40
really start having actionable data across GCP,
14:45
Azure, AWS, various IDPs, etc., you're pulling that
14:49
data, that quickly, and really starting to be able
14:51
to get your hands around the cloud, right? Which
14:54
is kind of like this amorphous thing, right? How
14:55
do you grab a cloud, right? You're
14:57
kind of trying to get to it, but did I hear that
14:59
correctly? Absolutely. I mean, I wish I could
15:02
show you a demo right now, but maybe the next time,
15:04
or the next episode here. But
15:06
the point is, that's about all the cloud, right? API
15:09
-based applications. So, you know, we're going to
15:12
be assassins and API, we ingest this data, so it's
15:14
easy for us to grab data, put it together. The
15:17
power of our platform is not the ingestion, but the
15:20
correlation, the detection, the analysis that we do
15:23
automatically. And we're going to be throwing
15:25
very large accounts too. So,
15:27
we have customers who are kind of small, medium, or
15:28
large, extra -large kind of accounts. So,
15:31
you know, we are able to then, the IPU, the
15:34
Birtistic, and understand and the entire populations.
15:37
The challenge in this problem
15:38
is always going to be, am I going to miss an island
15:41
of identities lying around, which I'm not even touched,
15:43
right? That's a problem. And
15:44
that is an exposure, customers don't have the
15:46
visibility. The idea is getting a 100 %
15:48
visibility of all the identities across your
15:51
environments. And that's what we do. So,
15:53
that's an important statement. You
15:55
start doing for one cloud or one platform and calling
15:58
it a day, it's about looking at the entire
16:00
identity populations that we live in, your cloud
16:03
accounts, your identity providers, your databases,
16:06
on -prem, hybrid, cloud -native, and whatnot. So,
16:10
it's the comprehensiveness of our ingestion and the
16:13
correlation with the customers' complete trust
16:15
and visibility. It's their data. It's
16:18
their story. And we just help them to kind
16:21
of get to the quick conclusion and remember all
16:23
the toil of managing, you know, spreadsheets and
16:26
emails and back and forth and have them manage their
16:27
policies. And automatically, we have the
16:30
co -pilot, things that can take action quickly, right?
16:32
And so, the goal is to
16:33
continue to shrink this attack surface to lose
16:35
automation. And I believe this is the way
16:37
to go. At the end of the day, the
16:39
customers don't have time, the resources are
16:41
constrained. They're going to use technologists
16:44
like General Bay App, which we were brought on our
16:46
technology, to kind of bring this power of
16:48
automation to market and get them to take action to
16:51
kind of remove the access. That's
16:53
a really important goal. Not
16:55
to kind of show nice, pretty pictures, but to
16:57
have them take action. Hey, Venkat, I want to get your
17:00
thoughts on a statement or a quote that I've heard a
17:05
few times, which is that you're only one
17:07
misconfiguration or maybe is one over entitled account.
17:13
You're only one misconfiguration
17:15
away from a breach. To me, that puts a lot of
17:18
onus on the identity management practitioner. But
17:22
I kind of feel like that just means you have to
17:25
have the right tools. But what are your thoughts when
17:27
you hear a quote like that? I
17:30
think when I hear a quote like that, it is absolutely
17:32
true. It is an asymmetric problem.
17:34
Attackers have to find just one
17:36
weakness to get in. Defenders,
17:38
as a customer, have to have the 100 % coverage.
17:42
But it's not that you got to
17:43
do everything perfect. You are never going to stop
17:46
attacks. You're never going to, if there's
17:49
going to be some challenges coming in, it's what is
17:51
the risk of inaction? What is the risk of this
17:54
access? So people are built identity
17:56
systems for the last two decades. But
17:59
the concept of risk of an identity, the fact if I'm
18:01
giving access to Jim means I'm taking on a risk. I'm
18:04
hoping Jim is a legitimate employee. He
18:06
does legitimate actions, but sometimes that's not the
18:08
case. Sometimes your account could be
18:10
compromised. So the solution threat vector
18:12
we are looking at right now means every account has
18:14
a risk at that evening understand and take action.
18:18
So the focus is really not
18:20
about do the basis correct. For
18:23
example, if there's over permissioned access, clean
18:26
it out. If there are unused access,
18:28
clean it out. If there are excessive access,
18:30
clean it out. If you have poor posture,
18:31
clean it out. Doing the basics correct and
18:35
having complete visibility around these basic hygiene,
18:37
if you will, solves 80 % of the problem in this
18:41
market. Now you've got 20 % to go. The
18:44
remaining 10 % now we've got the hygiene done. It's
18:46
comfortable with that. Now look at the next 10%. How
18:51
do I look at the critical clown jewels? In
18:53
a data, in a databases, in a customer data, supply
18:56
chain, look at external actors who want to come
18:59
in, tighten those things up. That's
19:01
another 10%. Another 5 % is where are my policy
19:05
gaps? Where are my blind spots? Fix
19:08
that. Now you get a 95 % pretty
19:11
much. And the remaining 5 % is just
19:12
to excuse you to accept. So
19:14
by methodically looking at brass tacks, hygiene,
19:18
configuration practices, least -fruits practices,
19:23
better posture, improved posture, and tightening your
19:27
policies, tightening your guardrails, education, you
19:30
get to the 95 % mark and then the remaining 5 % is
19:33
the risk of doing business. That's
19:34
why I think about it. That way you can make progress.
19:38
It's never going to be about
19:39
100%. But it's always about having a
19:41
method in place. And tools currently don't have
19:44
this methodology. They built for 20 years ago for
19:47
compliance and audit and automation for productivity
19:49
purposes. Now I didn't even speak about
19:51
thread dimension. Access is a thread dimension. This
19:54
is the change the market is using in the last
19:56
decade. It's going to get worse with
19:58
the arrival of AI and machine identities and
20:01
things like that. So that's a new part here. So
20:05
I asked you earlier about lifecycle. We
20:10
have to now leverage thread as part of the identity
20:13
lifecycle, which we've never done before. So
20:15
the notion of thread as part of a lifecycle of
20:18
identity management has to be a front and center
20:21
thought. And that's the area where it
20:23
will be a part of the great innovation around. You
20:26
know, another thought that what you just said, they're
20:29
triggering another thought to me, which is a lot of
20:33
the cloud environments were spun up not with the
20:39
inclusion of informational security and the IAM
20:42
strategists and practitioners within an organization.
20:47
Application development teams were given
20:50
like, hey, make this happen. We
20:52
need to have this data lake and this great WISBANG
20:55
project. And they went out and they
20:58
built it. And a lot of times they're not
21:01
security minded. So they weren't trying to get
21:04
each account down to least privilege. Now
21:08
this is someone says to see so, hey, buddy, the
21:12
buck stops at your desk. You're
21:14
responsible for protecting our data. And
21:20
now the see so he or she has to figure out, oh,
21:23
we've got this. We've got those crown jewels out
21:26
there in this cloud. Now I need to figure out how
21:30
to make it more secure. And
21:32
I think one of the great places, sorry, it's not
21:35
going to give you everything, but a great
21:37
place to start would be to start looking at, especially
21:40
this machine accounts, but all accounts, which ones
21:43
are over provisioned? A great point. Yeah,
21:47
the power of the cloud, right, this automation, I
21:49
saw the cloud, we love the cloud so much, it's
21:51
tremendous amount of power, right. Things
21:53
like using, for example, you know, infrastructure is
21:56
code, like Tataform, for example, you can spin a
21:58
cloud in like five minutes, right. You
22:02
can imagine you can set up a database in 30 seconds,
22:04
you can put up a database, right, and have an upward
22:07
customer data and do it, right, and go away. So
22:10
the environment is quite difficult. So
22:12
by all accounts, most cloud environments are
22:16
automatically over provisioned because of
22:18
automation, you know, and developers are driven by,
22:21
that are their KPIs or productivity and velocity of
22:24
code, not examination privileges. That's
22:28
not their job. So they want to go where they
22:30
want to build cool applications and monetize
22:32
data, bring the latest AI, ML model, general AI, show
22:35
value, right, and run and create value for the
22:38
business. Security teams are pretty much on
22:40
the outside and looking at this cloud. It's
22:42
so fast and growing so fast. So
22:45
when the buck stops for the security teams, they
22:48
struggle, right. At the end of the day, they
22:50
didn't have any policy control over this
22:52
environment. And so what we're trying to do
22:55
is to kind of bridge the gap, is to kind of bridge,
22:57
help the security teams understand the risk of
23:00
already over permissioned access, all the over, you
23:04
know, exporters created. Coming
23:07
to data assets, because it's so easy to spin up a
23:09
data asset of the cloud and build an application to
23:12
share data. So data sharing is ubiquitous.
23:15
Like imagine how easy it is for
23:16
us to, you know, not to share, you know, a Google
23:19
sheet, right? Or, you know, it takes two
23:21
minutes for us to create a spreadsheet or doc and
23:23
share it with you. Done. Imagine now you're dead,
23:26
you're sharing the same terabytes of data. With
23:28
that, with that lot of simplicity, I can share my
23:31
Google Drive or my Stoflake instances to my third
23:34
parties and do interesting applications. So,
23:37
and I just in two minutes, you have changed the world
23:40
from, you know, kind of highly change control
23:43
environment to a completely, you know, sort of, you
23:47
know, ad hoc way to share data of our customers and
23:50
whatnot to various third parties using APIs. So
23:54
there's no visibility to these entire things. So
23:56
that's why I go back to the Copilot. Thought
23:58
is we need to bring the part of automation to work
24:02
to solve this problem. The very, this problem is going
24:04
to be automation in the first place in the cloud.
24:06
So let's leverage automation
24:07
and AI together to bring the early visibility, to
24:11
bring that, you know, continuous visibility to
24:12
practitioners of identity and security. So
24:15
they can kind of keep up with this thing and start
24:17
to figure out how they can speak about risk, right?
24:21
The job of the C -SOS is not
24:22
to talk about, you know, not to take on risk, but
24:24
to speak about risk. If this is where I'm exposed,
24:28
this is where the risk is, and this is where the
24:30
impact is going to be. You guys take a call on this.
24:32
So we're going to help C -SOS
24:33
and the board ultimately take a call, and these are
24:36
the exposures, but now we're going to make it
24:38
super simple, super easy. And
24:41
that's the reason why we so thrilled about, so
24:43
worked about AI and machine learning and data lakes and
24:47
whatnot. So this ability for us to
24:48
bring that continuous visibility as things happen,
24:52
you're able to respond to events and other shut it
24:55
down or take action. That's super compelling. And
24:59
go back in the day of, you know, change management,
25:01
and you have three months to do reactions reviews
25:02
today. And people don't even do
25:05
reactions reviews today, you know, three months, every
25:07
manager hates it. And when you want to review
25:09
actions for your employees or your reports, you go
25:12
find your favorite tool. I won't name these tools
25:14
today, but you can find select all button and bulk
25:19
approve. Done. It's a headache. I'm
25:20
done. So nobody's examining access
25:23
trivillators. It should be there. So
25:25
when it doesn't happen through either a fraud
25:28
process or a complex process, access accrues. So
25:33
we want to bring automation and simplicity, because
25:36
without simplicity and data, our customers will not take
25:39
action. That's the differentiating aspect
25:41
of what stack does. So how do you, how do you
25:45
use something like stack to measure the success of the
25:48
implementation or the data you're getting out of it?
25:51
Because you talked about risk,
25:52
right? And access permissions and
25:53
cleanup, etc. I have to imagine that you've
25:56
got, you know, customers right now that are using
25:59
the product. How do they measure success to
26:02
know that they've gotten a return on the investment
26:03
they've made? Yeah, let me give an example of
26:06
this, you know, you know, our customers and talk to
26:09
the security teams, even the CISO, right? Their
26:12
job is raise risks and awareness. And
26:14
so now let's say they have an environment in which
26:16
they found all the risks of AWS. They're
26:19
going to knock on their colleagues, VP of
26:21
engineering, who owns the cloud, hey, you got to go
26:23
fix this buddy. The VP of engineering says, you
26:26
know what, I don't have time for this. I'll
26:29
look at it when I can, right? So
26:31
now we have surface intelligence and the risk.
26:35
The CISO has told his peers
26:37
you got to go fix it, but nothing happens. So
26:40
what happens now? A month goes by, still
26:42
nothing happens. It's like, so now there's a
26:44
back and forth, right? So what we do is it can be
26:47
a bit SLAs out of the product. Now,
26:49
you know, if that risk you're generating, but it's
26:50
a high severity risk, it's got to be fixed within one
26:54
week, right? And now we become the broker.
26:58
So our ticketing mechanism
26:59
includes this SLA. So now the cloud engineering
27:03
VP has to respond to this. They
27:06
can say, look, I accept the risk, I'll fix it
27:08
within a week. I will accept the risk. I
27:12
will fix it in two weeks. I
27:15
will not accept the risk escalate. This
27:17
is the business. So our job is to kind of
27:19
make sure they come together, collaborate,
27:21
collaborate on the single platform, cost tag, identity
27:24
risks of high fidelity, high urgency has to be
27:28
taken care of. And at least everybody's on the
27:30
same page. That's the same data they're
27:32
looking at the CISO and the identity of looking at
27:36
the same data as the DevOps and security teams
27:39
are looking at. So we're able to bring this,
27:41
this collaborative platform through SLA. So
27:44
the end of the day, it's not, you know, I'll do it
27:46
when I can. Let's look at the risk. And
27:48
if you can resolve this at this level, we elevate this
27:51
to the, the head of operations or the business
27:54
unit data, whatever it is. Our
27:56
goal ultimately is to kind of keep on nudging, nudging
27:58
through SLA. So somebody can actually remove
28:00
the access. Until such point in time access
28:03
is not removed, you're not done a job. And
28:05
that's where it goes to kind of take that last
28:07
mile, help leaders and owners and stakeholders and
28:11
risk managers and teams understand the risk, agree
28:14
on the risk, and then I've delivered plans to fix
28:17
these problems. So measurement of what our
28:19
product is, how many of these tickets have we, have
28:22
we sold have actually removed the access? Is
28:25
it growing? Is it shrinking? How's
28:28
it happened on the last, you know, however, what is
28:29
the trending? So when they see the trend
28:30
lines coming down, they see value in the product that
28:33
we're able to now, you know, take a fairly chaotic
28:35
environment of unbroadened access and brought it down
28:39
to manageable sort of issues and risks and be
28:43
able to provide continuous visibility and operational
28:45
fidelity around this. So that's what customers
28:47
measure, right? And do it in a very automated
28:49
fashion, which means they're not repurposing their teams
28:52
to go to this, you know, co -pilot takes it further
28:53
automatically. You talked about those nudges
28:56
and I, and I see this as well as sort of in the
28:58
real world is people are always hesitant to take
29:00
away access because they're not sure what it does.
29:03
It's going to break something.
29:04
And so they just kind of leave
29:05
it, I guess, you know, is that fair where we're at
29:10
today where people just don't know what they're,
29:12
what they're, what they're human and sometimes non
29:14
-human accounts are doing. And
29:16
so that, that hesitancy is real. How
29:18
do you take something like that and say, okay, well,
29:20
here's a better way to do it. Maybe
29:22
there's more context around what this account does or
29:25
the continuous evaluation, right, of what the access
29:27
is doing and shrinking attack surfaces and things
29:30
like that. Can you talk a little bit
29:31
about why you see those nudges being needed still
29:35
and then how does that reduce the attack surface
29:38
once you get through the nudge factor? Yeah,
29:41
most of them, for example, you know, when you're
29:44
trying to remove access, you don't have the full
29:46
context, right? Because the removal that access
29:48
could impact other downstream applications,
29:50
legitimate reasons, right? Why
29:52
users could be disabled and not get access to the
29:54
system. So the worry is, am I going
29:55
to break something down the line? So
29:57
the first thing you do is give you the complete
29:59
picture. If you remove this access,
30:00
this is going to be the impact, right? Of
30:02
all these systems, we build that map and we show that
30:05
graph. So we build trust in our data
30:06
itself, number one. So the first thing is to
30:09
avoid confident, hey, nobody's access is the last
30:12
90 days. Okay. And you know, this access
30:15
is very risky. It's got a high degree of
30:17
impact. You know, I think of some of
30:19
the breaches that's happened over the last, you know,
30:21
massive breaches, right, you know, you've seen in a
30:24
time and again, and you got to take action on and
30:28
so that's one example is to kind of give visibility.
30:32
The second area we have helped
30:33
customers is look, even if I have to remove the
30:35
access, you know, some people call it the screen
30:38
test, right? You don't access on a screen.
30:41
Oh my God, I need access.
30:42
Okay. If you need screen, you
30:43
need to do screen test. You
30:45
go out to a URL and you'll request access again.
30:48
You'll access the store
30:49
immediately. So we remove the issue of,
30:53
you know, we remove the issue of, you know, if we,
30:57
if customers do need access, you know, and take
31:00
enough for some reason, you can now give them access
31:03
back, but now it's more just in time because you're
31:06
only using it once in 90 days. So
31:08
we're able to kind of bring in, bring this
31:09
process together to kind of institutionalize a behavioral
31:12
change. It's a behavioral change. And
31:14
behaviors won't change overnight. It
31:16
needs data. It needs impact to downstream
31:18
applications. And what happens if I do make
31:21
a mistake and I resort that this day quickly,
31:23
that's the third point, all three things are part of
31:25
the art platform. So customers are comfortable.
31:28
Hey, even if I remove the
31:29
access, you're going to scream at me, go to the
31:31
swing or request access within 30 seconds, we'll
31:33
reprovision the access. But now we can give you a
31:36
limited based access, right? Now
31:37
I've culturally removed the access and also kind of
31:41
give you more of a time -based approach. So
31:44
I've made, you know, great progress in the behavior
31:48
and sentiments of these problems. So
31:50
those are the couple of areas we really customers
31:52
like this. And again, all of this is
31:53
automated. So there's no kind of back
31:56
and forth around this to remove the human toil. And
32:00
that's a big issue. Now these things are more
32:02
complex in the machine editor days, right? And
32:04
there's nobody to tap in the verify access. You
32:07
know, so we see a lot of cases, for example, when
32:10
people are using machine editor days and abusing it,
32:12
human users, vice versa. So we kind of have all these
32:16
environments where, look, where there's a risk of
32:18
access or an abuse of access, but things are sort
32:22
of awry, we kind of bring it back. But
32:24
at the end of the day, we take a lot of pride in
32:26
operationally making sure customers are able to
32:28
manage this entire problem within their culture, within
32:32
their workflows, within their environments. Only
32:35
then we see, you know, a big adapt happening in our
32:37
customers. So you mentioned, we've been
32:42
talking awful a lot of the cloud, I think, early on
32:43
you mentioned that there were also some capabilities
32:45
around on -prem systems like Active Directory and
32:49
Database. Are there differences in how
32:52
that integration works? Is it relatively the same?
32:55
Talk a little bit about sort of
32:56
like the divide between cloud and then maybe on
32:58
-prem resources. Yeah, I think mostly for cloud
33:02
being such a modern platform, it's all API
33:05
based. So most of the times we have
33:06
very good APIs to integrate. So
33:08
you don't have to have agents deployed on any
33:11
systems. We can just use APIs. I
33:14
use the cloud control plane to look at our data when
33:17
it's really on -prem. Then there's no, you know,
33:20
native cloud, there's no cloud native way to kind
33:22
of talk to the resources, right? We
33:23
need some sort of a connector or an agent where
33:25
you deploy on the premise itself, which acts like a
33:28
broker, right, to kind of to look at this. So,
33:34
so, you know, so those are the ways that I think, you
33:37
know, for on -prem environments, we do need
33:40
some agents deployed, but that's really a consequence
33:42
of where the technology is for the end of the day.
33:46
It's all about the universal
33:47
visibility, right? The single layer that aggregates
33:50
all the information together at a single place. And
33:52
so we kind of build this abstraction where whether
33:54
it's cloud, whether it's on -prem, whether it's hybrid,
33:57
whether it's cloud native or, you know, customer
33:59
managed, doesn't really matter. Good
34:01
identities or where they are. And
34:04
so we are job is to go pick up these identities
34:06
and give, you know, give this focus. I'm
34:10
also going to address one other issue, right, in
34:12
terms of, I think, I think Jimmy brought this up early
34:14
on around this access issue and we talk about stacks
34:19
of identities and stacks of access, right? Now,
34:23
stacks of access was always a problem given the
34:26
complexity. Now with the stacks of
34:29
identities coming in, you know, all these platforms
34:31
in the cloud, enterprise, in database or whatnot,
34:35
many cases, for example, right, a user is called
34:38
multiple accounts. You might have five, six, seven
34:41
accounts in your system and they cross cloud platforms
34:46
and on -prem. And the idea that everything is
34:49
going to be on a single identity or a single IM is
34:52
almost impossible. That's the end of the station.
34:55
For the last 20 years, we
34:56
built a system with the premise that I can manage
34:59
gyms out of any one single place. And
35:02
that promise is gone. So now we're living in a
35:05
world where you're going to have multiple identities,
35:07
multiple personas, and multiple access. So
35:11
for example, if you were to log in to a system and
35:15
you've, you've, you've failed your passwords three
35:16
times, today, what is the typical response for a
35:19
company? They would automatically research
35:21
a password, good practice, and they would do an
35:24
Auduband MFA challenge, again, good practice. But
35:28
nobody was going to look at whether or not these
35:30
three password failures was really Jim forgetting the
35:33
password or illegitimate attempt by an attacker
35:36
trying to pawn Jim's account or do an account
35:38
takeover. Because the fourth signal doesn't
35:41
happen right away. So you have a process that's
35:45
dear to password users when you move on. As
35:47
a co -pilot, we watch you go at these things, say,
35:49
what happened? Wait a minute, there's now a
35:50
fifth attempt happened two days later. They
35:53
put the three together, two together. Wait
35:54
a minute, this is now early patterns of ransomware
35:57
attack on a particular account. So
35:59
these are the things we're doing is really, you know,
36:01
this is difficult for humans to figure out. They,
36:03
they're going to watch every event every time. So
36:05
this automation that we've built helps us understand
36:08
what are really legitimate access patterns, what are
36:11
illegitimate and unauthorized, but I'm going
36:13
to indicate attacks and whatnot. So
36:14
I just want to kind of add the bit of a color as
36:16
well as to what we do really at a product
36:19
platform level. You know, it's just what I
36:22
wanted to say there, Venkat, was early on with
36:24
what you just said, you talked about, well, you
36:29
know, primarily the, the on -prem infrastructure doesn't
36:33
have all the connectors. I know if I was building a
36:36
product right now, I'd focus on the cloud because
36:39
my perspective is you've already seen cloud take a
36:43
big bite out of on -prem infrastructure. And
36:47
I think that five years down the road, 10 years
36:50
down the road, I mean, it's going to be smaller
36:52
and smaller. It's just like the same
36:53
progression we saw with mainframes. I'm
36:55
not saying that I think it'll ever go away.
36:57
Mainframes are still around. They'll
36:59
probably still be around when I retire, but you
37:03
know, it's becoming a less significant piece over time.
37:07
So that was where I would
37:08
focus. But I think there's another
37:10
thing at play here, which is that the cloud
37:13
environments were built in a way that tools like
37:19
Stack Identity have what they need in order to do
37:24
the type of analysis, right? You
37:26
need to know what the accounts are, what access
37:28
they have, but then you also need to know what
37:31
access they're actually using, right? Because
37:34
it's the bumping up of those two things to say,
37:37
hey, here's all this access this account has, that's
37:40
not at use. Why is that important? So
37:42
to me, and I'm hoping you can either validate or
37:46
correct me, but why is that important? Okay,
37:49
so this account has these seven roles that it's not
37:53
using. Who cares? Well,
37:55
it's about a tax surface, right? It's
37:58
about, hey, if I have an account out there that has
38:02
its over provisioned with entitlements and somebody
38:06
gets control of that account, now they have all
38:09
those entitlements. Even though those entitlements
38:11
haven't been getting used, well, now they just open
38:14
up a whole new door. Now that account could be taken
38:19
over regardless, right? That's
38:21
a totally separate control. But
38:24
do you want that account to be least privileged? Or
38:27
do you want it to have least privilege plus who
38:31
knows how many additional privileges? So
38:33
am I, and like I said, the cloud environment, the
38:37
cloud platforms have the pieces and parts to make
38:41
that determination. If it was, if the on -prem
38:45
environment had all those things, this would have
38:48
been getting done 10, 15 years ago because the
38:50
problem existed then, and people wanted to solve it
38:54
then, but they just, they didn't have visibility to
38:59
where all the accounts were being used. And
39:01
we had SIM and we tried to pull all this
39:03
information together, but everyone knew it wasn't
39:05
complete. So if you just started taking
39:07
access away, that's that part that you started off
39:11
the conversation with is like, that's scary. You
39:14
start taking away roles just because you think
39:16
they're not being used, but they actually are being
39:18
used problem, right? But in the cloud environment,
39:22
you have a higher level of confidence, maybe 100 %
39:25
confidence that that role is actually not being used.
39:29
Yeah, absolutely. And
39:30
that's it. Do you put the nail on the
39:32
head? You know, if you look at the
39:36
pattern of ransomware attacks, you know, the big
39:38
one or another health group and all those, it's all
39:40
the same pattern, a compromise identity. And
39:43
then that's not enough. You need privileges and
39:46
permissions to elevate yourself and laterally move
39:49
across the organization. It's
39:50
all about lateral movement, right? What
39:53
any worse lateral movement? It's
39:54
access and privileges. So if you can cut off these
39:57
links by removing access, right? And,
40:02
and, you know, then you can, you can limit the
40:04
damage you can contain the, the attack, you know, and
40:06
so, so understanding how our leaders can move within
40:11
the enterprise, how can they flow and what actions
40:14
they can use to get from a to V to C to D to go
40:16
to the target, that's crucial, which means that
40:20
in cloud, even in regular environments, we need to
40:22
look at not just the provisioned access, but how
40:26
is Jim using this access or a service to condensing
40:28
this access? That means you got to look at,
40:31
for example, what's happening over a period of
40:33
time? And on the time could be in a
40:36
90 days, for example, or 120 days. Okay.
40:40
What's happening with this time boundary? Now,
40:43
the user, if it regularly, if there's a regular role,
40:46
you'll be using this account to, you know, to
40:49
do things, right? There'll be some activity on this
40:51
account. There'll be some actions on the
40:53
target resource. There could be some, you know,
40:56
some behaviors. But if none of them are
40:59
present, then the problem is you just under our
41:03
necessary access. So the access or type surface
41:06
is really by product of you, if you're not using
41:08
the access, you got to give up the access. That
41:11
should be the very simple process. If
41:12
you're not using the access, you should just
41:14
give up the access automatically. Now,
41:16
today, we don't have these tools for doing some cloud
41:19
is very easy, right? But you also need two data
41:22
points. One is, what's your access and
41:24
are you using it? So we automate that, that the
41:28
time based analysis that we can easily give you without
41:33
a without any false positive, right? We
41:34
clearly really you're not using this access. There's
41:37
proof. And so you don't need access.
41:39
Okay. So I'm going to remove the
41:41
access. Let's say Jim says, you know,
41:43
I'm going to use it once in 90 days, because it's a
41:45
quarterly report, great. Then
41:47
I'm going to give you a just in time access or one
41:49
time access, you can just use it. So
41:52
the number of ways we can look at data, and we can
41:55
analyze activities and behaviors and actions to
41:58
then compare with your intended goal of giving
42:01
access and to solve this problem. In
42:04
cloud, by the way, many cases because of automation,
42:08
nobody even knows why an access was granted. Let
42:10
me show our dashboard on our product. The
42:13
first thing customers ask us is, I don't know why
42:15
this happened. It's a very common refrain. I
42:18
don't know why this access was given, which means
42:20
there was no way for them to contemplate why somebody
42:24
would give an access. Maybe it's an emergency access
42:27
and just state permanent. So
42:29
there are a lot of scenarios where at the end
42:31
of the day, it's about are you using the access
42:33
yourself for what purpose? You
42:35
search behavior is going to be important for us. And
42:38
I figure them along in a window, then we remove all
42:41
the false positives, we remove all the problems,
42:42
you remove access with 30 days, that's not a good
42:44
practice. You might still need the
42:46
access, but they will be for us to use automation
42:49
and to provide the visibility and show evidence
42:52
and compare with their policies to remove the
42:55
attack surface. And those are the things I
42:57
think we can get tremendous ROI. You
42:59
can do this because these are all early signals that
43:02
we're going to stop. By the way, every leader in
43:06
the identity practice agrees with this. There's
43:08
a survey done by one of the security group, one of
43:10
the top identity groups and 96 % of the identity leader
43:13
survey said they could have stopped an attack, they
43:16
could have stopped an attack and they had signals
43:18
available to them. They didn't say, wait a minute,
43:21
this was a complex zero day, nothing about it. So
43:25
96 % of saying, look, in retrospect, and I had they
43:29
had a data evidence, I could have prevented this.
43:31
So that's great, great
43:33
opportunity for us startups to go look at, let's solve
43:36
the problem and get the last mile out, remove the
43:39
access somehow, and then all of a sudden, right?
43:41
That's why you're seeing this
43:42
broad moment to more just in time. And
43:44
don't even get into the problem of managing access.
43:46
If you need access anytime you
43:47
have access, you know, just come in, make a request,
43:51
you get access anymore one. Anyways.
43:54
No, no, it's a great point. And
43:56
I think so we've talked a lot about risk. And
44:02
I'm wondering, I want to get your perspective on
44:06
what is the biggest risk that CSOs face? Because
44:09
to me, here's what it is. It's
44:12
not the, it's not the mechanics of all this. It's
44:15
the ability to identify the risks, communicate the
44:19
risks, and assign the risks to somebody other than me.
44:23
And that look, I'm not just
44:24
trying to be Teflon Don here. But
44:27
reality is, is either it's something I need to fix.
44:30
And I probably need some money
44:33
to fix it. Now, if I have everything I
44:35
need, that I can go fix it, then I have nothing to
44:39
worry about. It's completely within my control
44:41
to go ahead and fix it. But
44:43
a lot of times, these risks that pop up are
44:45
things that other people need to do. Or
44:49
I need additional investment. And
44:51
so I need to be able to identify those risks,
44:54
communicate those risks. And then if I am fulfilled
44:57
with what I need, then I need to be able to go and
45:00
remediate those risks. But I'm wondering, maybe you
45:03
give a more insightful response on what is the
45:07
biggest risk that CSOs face? I
45:10
think if you look at all the ransomware attacks, you
45:14
know, all these customers have tremendous amount of
45:17
products, great technologies, right? And
45:18
they got 30, 40 plus tools. Yet
45:22
these things happen, right? Time
45:23
and again, it happens. You know, happens to great
45:25
companies. But there's something
45:28
fundamentally flawed here. That
45:29
is, how do we understand what is the biggest risk
45:32
is? And in our view, the biggest
45:33
risk is access. Access that could have been
45:36
prevented or revoked. And if you can have a truly,
45:40
you know, you know, we're not saying that's going to
45:42
be stopping all the attacks. But
45:43
I think what we are saying is that that's going to be
45:45
a number one priority in terms of investments going
45:48
forward. Because at the end of the day, an
45:50
attacker on adversary needs access to let me move and
45:53
get to where they want to go. So
45:55
by the way, every CSO will agree with this. There's
45:57
no dispute about this. Challenges,
46:00
you know, I have my on -prem projects. I
46:03
got my IGAs going. I got this and that going,
46:06
got Pam going. I'm looking at Pam for this.
46:08
I'm looking at X, Y for this.
46:10
So we are saying at the end
46:11
of the day, the environment is changing dramatically,
46:14
you know, and so it's time to relook at these
46:17
priorities. I mean, people are spending a
46:18
lot of money on identity projects today, even today.
46:21
It's one of the largest
46:21
investment categories in the budget. However,
46:25
this notion of risk is what is a new phenomena. I
46:29
mean, even analysts and gutters talk about this all
46:31
the time, like more and more continuous controls,
46:33
risk -based controls. So we are seeing this big
46:35
change happening. At the end of the day, you've
46:37
got to look at what the risk is, speak about the
46:39
risk. But you cannot speak about the
46:42
risk if you don't have visibility into what's
46:43
happening. You don't know how to explain
46:47
why something is happening. So
46:49
with our, you know, with our, you know, with our
46:52
automation and our approach to providing an easy way
46:56
to go look at this, everything in concert, we
46:58
are job is to provide evidence of the risk and
47:02
help to see so communicate the risk to the
47:04
stakeholders and to take action. So
47:07
that is the approach where we feel like, you know,
47:10
you know, that, you know, people cannot wait for
47:12
this, you know, process that they put up place 20
47:15
years ago, right? We have this quarterly order
47:17
process. But it will be actually done
47:19
for age of Sarbanes, Oxley and compliance, still
47:21
required. But now the landscape has
47:24
changed automatically. It's cloud first, data first,
47:27
API first, we live in. Speed
47:29
is not security's best friend. And
47:32
so at the end of the day, attackers know this, they
47:35
have these weaknesses. So our job is what if I can
47:37
come back and tell you within one hour, your
47:40
exposures, your exploiting, your bare pathways, which
47:43
are going to be exposed, your policy gaps, your
47:47
blind spots, your risky accounts and help you fix
47:50
it through automation, I can generate code and do
47:53
this. And now you can start to not
47:55
put this and say, wait a minute, I'm going to use
47:57
this product to figure out where do I need to product
47:58
as my investments in even ordinary in access
48:00
management, where do I invest in it? Rather
48:02
than going off and building a product, look at the
48:05
process. The world has changed now. So
48:08
do I have the right visibility into looking at
48:10
overall risks? Can I communicate these risks
48:13
to my peers and to the board? Now
48:15
based on the risks, can I not focus on actions in
48:18
these areas, particular on access and what not that I
48:21
can help you with? So this starts a different
48:23
paradigm. I think Jim, we're focused on
48:25
is that we're seeing the market go towards that. Is
48:28
that, you know, just look, you know, attackers are now
48:30
waiting for your quarterly audit reports. They're
48:32
finding a gap and zoom they're going in. And
48:35
so we're seeing that they're ready for us to
48:36
close the gap, give billboard assurance and more
48:40
confidence and data and help CISOs broker this
48:45
conversation. They're not, they cannot do it
48:46
alone. They're going to talk to their
48:48
colleagues, agree on what the risk is, agree on risk
48:52
types, agree on how they can remediate, time to
48:56
remediate. And these are all operational
48:58
things that we can go from findings to the operations.
49:01
That's the area where we feel
49:02
like we can really help optimize investments and get
49:06
on this treadmill of getting this more
49:08
continuous, continuous access management, continuous
49:11
verification, continuous detection, continuous tuning
49:16
of policies. These are the areas we believe
49:18
we can, we can, we can help customers get to the
49:21
95 % quickly and manage those risks. So
49:26
I think you made a lot of good points there. It's
49:30
kind of like I want to rewind one of the security
49:36
architectural principles is like this layers of
49:41
security, defense in depth, but it's the idea that you
49:45
try to stop the hacker here, you try to stop the
49:48
hacker here, you just keep going and adding layers of
49:51
security. It's almost like you hear this
49:54
paradigm all the time, which is if you haven't
49:58
been breached, that just means you don't know you've
50:00
been reached or it's not a matter of if, but when.
50:04
And the idea is that, I mean,
50:06
you still look at like what's the most common
50:08
pattern that attackers use. It's
50:11
phishing, social engineering, right? These
50:14
things have literally been around for more than 20
50:17
years. And they're still the top two
50:19
ways that people get access. So
50:21
you almost can look at your accounts, say they're
50:24
going to be breached, someone's going to be able
50:26
to get access to them. The question is what can they
50:29
do when they get to access? So
50:31
that's that paradigm of least privilege access and
50:35
why it's so important. So I think you've made an
50:38
excellent case here today for what you're doing with
50:40
Stack Identity. And what I'd like to know is
50:43
if our listeners are interested in playing or,
50:48
you know, getting more hands on with Stack
50:51
Identity, what's available to them? Yeah,
50:55
we have a very easy way to assess the current risks
50:58
using our Shadow Access Risk Assessment Tool, they
51:00
call it CERA. So you plug it in, you
51:03
connect your accounts, you connect your IDPs. And
51:05
again, within an hour, you get a report that shows
51:07
you all the code of code access for all issues you
51:11
have, right? And then you start the cleanup
51:14
process, you know, cleaning up our units and access is
51:17
an important thing. Because the environments are grown
51:19
so widely now, you know, on -prem and cloud and
51:23
whatnot, that singular dashboard and singular view
51:26
of single pane of glass, the command and control of
51:29
all the risks that you have currently in your
51:30
environment, having a quick view of that is a starting
51:33
point. Now you look at these risks
51:36
and you look at what do we do about tax, like I
51:38
started to dig into this and figure out where you
51:39
need to, where are you exposed, what are the
51:42
critical systems, your crown jewels, whether it's third
51:44
party, all those things. But
51:46
it starts with where am I today? What
51:50
is the where am I exposed? Tell
51:52
me that, that view. Let me start with that, that
51:56
assessment view. We call it shadow access risk
51:59
assessment. Generally speaking, all these problems
52:02
are really, you know, a gap in access, that should
52:05
be that of the first place, we call it shadow
52:07
access, kind of the shadow IT as a term. So
52:10
you start with the shadow access, you know, discovery
52:13
and assessment tool. Then that gives you the
52:15
foundation to clean up all the identities, tighten up
52:18
all the weak identities, make them strong, look at
52:22
all the over permission access, start to reduce
52:23
your tax service, you can start to put an action in
52:26
place based on the data. So
52:28
initial thing is data gathering, data visibility,
52:31
and you know, a report that gives you a way to
52:33
kind of action that starting your program. And
52:35
again, it takes about an hour. So
52:37
it's not that we can effort together, but it
52:39
gives you enormous value add. I
52:42
go back to look at the example the day before any
52:44
breach, imagine if you had a report of all these
52:47
exposures, and imagine tomorrow you're going to be
52:50
breached, you will run fast to fix those things. So
52:54
you'll drop everything and then go fix it, right?
52:57
Imagine it's always a small thing,
52:59
you know, an S3 bucket or a startup chart permission,
53:02
or some lateral moment permission. Hey,
53:04
I never thought nobody's going to use it. Oops,
53:06
yeah, somebody used it. So it's all these small, small
53:09
things that is very difficult to spot. And
53:12
it's lying around, you know, creating these
53:14
pathways. Let's just blow them off, you
53:16
know, in a systematic fashion. So
53:18
yeah, the shadow actually has some sort of a
53:20
starting point. And customers can use it, it's
53:23
free of charge, and they get immediate visibility,
53:27
and get to see what we can do. And
53:28
that gives confidence then. And
53:31
then, and then from there, we can start to starburst,
53:33
and then many different ways to for them to cannot
53:35
take workflows and take action. Yeah,
53:37
I think that it's really great that you've made that
53:39
available as a free resource to our listeners.
53:42
Just so folks know, the URL
53:44
stack identity .com slash IDAC is where you can go
53:50
to get right there and get that thing downloaded.
53:54
Wanted to ask you one more
53:55
question, Venkat, I know you guys are going to be
53:58
at RSA. Sounds like you have a booth.
54:01
What's going on at RSA? What's
54:03
your presence there? A great, great plan at RSA.
54:05
Being super busy with this. First
54:07
time here at RSA, so super excited to be there as
54:10
well. So we have a number of devos
54:13
planned, customer sessions and meetings. So
54:15
please stop by our booth. And
54:18
we'll be running, devos, Ian is going to be there.
54:21
So we have a lot of great
54:22
team at RSA. So super excited about this.
54:26
Again, at the end of the day,
54:29
what we are trying to look at is how do they give
54:31
customers time back? How do the customers capacity
54:34
back? Those are the two things
54:37
customers don't have. Already
54:38
having a lot of projects. And
54:40
again, this is again, complex problem. Let's
54:44
make their jobs a bit easier and get them the
54:47
help they need. And every CSA I talk to knows
54:51
this problem. They feel in their hearts, they
54:53
got to do something about it. But
54:54
they're constrained by ongoing projects, this and
54:57
that. But so we are coming in and
55:00
saying, wait a minute, let's give you the unified
55:02
layer, the visibility layer. Just
55:04
talk to look at taking some control back. And
55:08
for CSA, the particular cloud has gone to the
55:10
sprawl. I mean, they're going to pull
55:11
rain this rain this back and put some policies
55:13
around it. So we think with our
55:16
automation and our data platform, and we can cannot
55:21
really have customers get quick time to value. That's
55:24
our main focus with demo. This
55:25
is RSA. We also want our one session
55:27
for the customers at RSA. So
55:29
please TSM, if you want to show a demo or discuss
55:33
more, we have a great team at hand to support your
55:36
doors customers at RSA. Yeah.
55:39
So Ian Singh on the spot again, he's given us
55:41
specific location where to find you. It's
55:44
booth N6564. It's in the North Expo hall. So
55:49
RSA is huge, right? There's a North and I think it's
55:52
South Expo hall and there's the tunnel in between where
55:54
everybody has collected all their swag and they had
55:56
their bags sort of wind up there. So
56:00
definitely go check it out. You
56:01
know, I think this is an area where you kind of
56:03
mentioned this, Venkat. It's like, you know, it's a
56:05
problem. What are you going to do about
56:07
it? There are solutions out there.
56:09
Stack Identity is one of them.
56:10
You know, you can't claim that
56:12
they're, you know, you don't have the right tools
56:14
or the arrows in your quiver right to solve this
56:16
issue. So I would definitely encourage
56:17
folks go to stack identity .com slash IDAC. There's
56:21
a link on there for Sarah, which is that shadow access
56:23
risk assessment. I think you also do office
56:26
hours, Venkat. If I remember, there's like a
56:28
link where you actually people can book time and
56:29
yeah, absolutely. I mean, for example, we are
56:32
getting out of inquiries on the new SEC, it's coming
56:34
with new rules for disclosures. Now
56:36
you cannot just be silent about disclosure incident.
56:39
You got to report it within
56:40
five days and then you got to report your 8K filing.
56:43
So a lot of pressure is he's
56:45
putting on leaders to kind of report incidents and to
56:49
kind of drive these practices. So
56:50
let's help you stay ahead of these disclosures and
56:53
reports. Nobody wants to put their hand up
56:55
and say, I got a problem with the inverse more
56:57
scrutiny. So yeah, definitely office
56:59
hours is the way to kind of, you know, you know,
57:01
bring in our knowledge, you know, any topic you can
57:03
bring in and sort of time with us. And
57:06
again, one of the good things about being a
57:09
startup is, you know, we have extremely knowledgeable
57:10
people that are on the block a number of years,
57:13
you know, but first generation products, second
57:16
generation, not third generation. So
57:17
they can help customers to kind of get to the where
57:20
they want to go. And that's a unique value
57:21
beyond just the technology and platform that sort of
57:23
ring in as a huge amount of knowledge and approach
57:25
and practicality to solve very, very thorny issues
57:28
and then some deep technologies. So
57:32
we're going to wrap it up there, but we were talking
57:34
before we hit record that you play competitive tennis.
57:38
So I'm always curious about
57:40
sort of rituals or superstitions or things that
57:44
people do before they get into any sort of sporting
57:47
event, you know, where they're competing. Do
57:49
you have something like that that helps you kind
57:51
of get into the zone and mentally prepare or be
57:53
physically prepared for what's about to happen?
57:56
Yeah, absolutely. I
57:57
think, I think most tennis people, I would say they
58:00
are, you know, and for me, for example, certainly, you
58:04
know, warm up is an important aspect of ritual,
58:07
at least 30 minutes, a mental cadence of how
58:10
you're going to play out doing some, you know, some,
58:14
you know, very specific targeted drills for the
58:18
particular opponent in case. And
58:21
most importantly, kind of managed by my emotions,
58:24
because tennis is a very one on one sport. So
58:27
me, one of the things I do really well is the
58:28
alternate national breathing, which helps me calm down a
58:31
bit, about five minutes, just kind of research my
58:34
mind a bit. And it's just in the next 60
58:37
minutes is what a match. Because
58:39
as you know, we're getting a lot of messages and some
58:41
bad emails, all those things. So
58:42
at least being a place where you can kind of free
58:45
your mind, be calm, you know, you know, stable, you
58:50
know, focus on the likelihood and enjoy. So
58:53
there are a few things that I definitely go
58:55
through. And, and that's one of the
58:58
things I look forward to is the rituals as well.
59:00
Sometimes we can't control the
59:01
outcomes, or we certainly can control the rituals. I
59:07
love that reminder to enjoy, right? It's
59:09
supposed to be fun, right? I
59:10
mean, competition is competition. But
59:12
if you're, you know, playing a, you know, tennis
59:14
or basketball, or baseball, or football, whatever
59:18
version of football that you that you like, right,
59:20
you had this idea of like, this is still supposed to
59:22
be a game. It's supposed to have fun with
59:23
it. Jim, when it comes to yourself,
59:26
do you have any, you know, rituals or things that you
59:29
go through for if you're about to engage in
59:31
something? And maybe it's not even a
59:32
sport, maybe it's just getting in front of a
59:34
crowd and talking. We're doing a podcast. No,
59:36
it's definitely that. And it's also whatever sport,
59:42
you know, it's kind of become an unconscious thing.
59:44
And I think if you start to
59:46
incorporate those throughout your life, it'll happen
59:50
unconsciously, which is to visualize yourself doing the
59:54
activity in a successful way. And
59:57
you hear about it in almost every sport where
59:59
some people will play the entire match or the entire
1:00:03
game before they go out and play it. And
1:00:05
they do it very successfully. So
1:00:07
I mean, my fitness has really become going to the
1:00:11
gym and everything. And it's much more like a very
1:00:14
solitary sport. You're completely in control of
1:00:18
your results. Nobody else, you're not against
1:00:20
somebody else. So a lot of times, like
1:00:23
before I go and do a set of weightlifting, I'll
1:00:27
visualize that set. And I don't, like I said, I
1:00:31
don't even do it consciously anymore. I
1:00:33
just kind of wind up doing it. And
1:00:36
I think what you said for public speaking, that's one
1:00:39
of the things I do. I'd like sit there and
1:00:41
visualize myself presenting. And
1:00:44
the more I do that, I find the better results I
1:00:47
get. What about you, Jeff? I
1:00:51
know I'm probably a blend here of what Venkat said
1:00:54
in yourself. I subscribe to the
1:00:56
Littlefinger School of Thought, which is fight
1:00:59
every battle everywhere all at once. You'll
1:01:01
never be surprised. So to me, that's about
1:01:03
preparation. So, you know, for example, the
1:01:06
podcast, you know, I have meticulous detail that I
1:01:10
put into this to try to solve or anticipate every
1:01:13
single issue that can pop up. Now,
1:01:16
there's always something in the pops up, right? But
1:01:19
it's kind of like, okay, let me visualize how this
1:01:21
is going to work or, you know, in this case, listen
1:01:23
to how this might work or whatever it looks like.
1:01:28
And, you know, if I'm playing,
1:01:29
you know, basketball or something like that, sure,
1:01:32
research might point it, you know, do they tend to
1:01:34
break left, break right? Do they prefer a fadeaway
1:01:38
jumper versus a hookshot versus do they do a euro
1:01:40
step and want to cross you up, right? Things
1:01:43
like that. I think there's, there's
1:01:44
intelligence that you can gather and is part of the
1:01:47
reconnaissance. I say, okay, what am I, what
1:01:49
opponent am I facing? Now I sort of know what to
1:01:52
expect. Now, how am I going to counter
1:01:54
that? Okay. Whether it's basketball, you
1:01:57
know, speaking in front of a crowd or doing a
1:01:59
podcast, okay, well, I know that, you know, I want to
1:02:02
have good lighting because the camera is going to be
1:02:04
on or I want to have a good microphone because, you
1:02:06
know, this is going to happen or I want to have
1:02:08
my notes prepared because we're going to have
1:02:09
somebody really, really smart like Venkat on it. I
1:02:12
don't want to like an idiot, right? Things
1:02:13
like that. So I, again, it goes back
1:02:16
that little finger thought from Game of Thrones
1:02:17
preparation, you know, visualize, prepare for every
1:02:22
potential outcome and you can't, it's more difficult
1:02:24
to be surprised. So if you're playing basketball
1:02:26
against Karim Abdul -Jabbar, you know, he has killer
1:02:29
skyhook. Yep. What are you going to do?
1:02:31
Punch him in his knee? No,
1:02:33
I mean, well, there's obviously quite a high
1:02:35
advantage there that he would have over me, but
1:02:38
you know, he would, he had the skyhook and you know,
1:02:42
it was almost unblockable for people in the NBA. I
1:02:44
mean, it was, it was really down to his
1:02:47
execution and anything you can, you can put in front
1:02:51
of him to disrupt either the timing or the execution
1:02:53
was the important part. He was going to be able to
1:02:56
get over you. That's a good point, Jim. This
1:02:58
is a border risk management, right? You
1:02:59
give Karim his points, but he stopped the others,
1:03:01
right? You still win the game. That's
1:03:04
a good point. You hear that in sports a lot.
1:03:07
Don't let the superstar be the
1:03:09
one that beats you. Take the superstar out of the
1:03:11
game and let, let the rest of the team beat you. And
1:03:13
if that happens, that happens, but it's a
1:03:15
strategy. Exactly. That's a good spot. We'll
1:03:19
leave it for this week. If you want to learn more
1:03:21
about stack identity, you can find them on the web,
1:03:24
stack identity .com slash IDAC. It's
1:03:26
a nice little landing page where you've got a bunch
1:03:28
of different links to talk about everything or go to
1:03:30
everything that we talked about, including Sarah, the
1:03:32
shadow assist, a shadow access risk assessment,
1:03:37
Venkat's office hours and just getting more
1:03:39
information. And of course you guys will be
1:03:40
at RSA again, the North Expo Hall booth N6564. And
1:03:46
you can always connect with Venkat on LinkedIn. We'll
1:03:48
have a bunch of links in our show notes as well. So
1:03:50
make it easy for people to find and they'll also be
1:03:52
on our website. And then of course you could
1:03:54
always reach out to Jim and I. We're
1:03:55
all, we're both on LinkedIn. We're
1:03:57
always curious to see what people think if they have
1:03:59
ideas or, you know, direction on how they'd
1:04:03
like to see things go in the future. That's
1:04:05
something we're always open to. So
1:04:06
don't forget to visit us on the web, IDACpodcast
1:04:09
.com. Check out our still growing
1:04:12
YouTube channel. And the link to that will be
1:04:14
on our website as well. So with that, we'll leave it.
1:04:17
Thanks everyone for listening.
1:04:18
Venkat, thank you so much for
1:04:19
taking the time with us today. And
1:04:21
we'll talk with everyone in the next one. Thank
1:04:24
you, Jeff. Thank you, Jim. You've
1:04:29
been listening to Identity at the Center. We
1:04:32
hope you've enjoyed the show. Make
1:04:34
sure to like, rate and review. And
1:04:37
we'll be back soon. But in the meantime, hit the
1:04:39
website at identityatthesenter .com. See
1:04:44
you next time on Identity at the Center.