Latest / Identity at the Center / #272 - IDAC Sponsor Spotlight - Salto

Transcript

#272 - IDAC Sponsor Spotlight - Salto · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:26
Not so bad yourself. Doing great.
0:28
Really excited about the episode today.
0:31
Salto dot IO or Salto as the company is called.
0:34
I first got introduced to them at the Octane 2023 conference.
0:40
They had a booth near where I was sitting and I thought, you
0:43
know, I've got all these identity at the center stickers.
0:45
Obviously I can trade them. They're like currency.
0:48
Go around. You can trade them for whatever
0:50
booth giveaways they had. And they had these killer socks.
0:55
And so I still wear these socks, right?
0:57
But I I just had to find out what do they do.
1:01
And they solved a problem that became apparent to me, you know,
1:06
many years ago in one of my first Okta projects.
1:09
And as I was going through this project, my question was, OK,
1:13
well, how do we take the configurations from a lower
1:16
environment and move them into production?
1:19
And the answer was, well, basically just redo them in
1:23
production. And it was a blank stare and a
1:25
moment of silence because it was like, seriously, that's the
1:28
answer. And so I just for years and
1:31
years that was the answer. And these folks at the booth
1:35
explained to me like that's the problem we solved and they
1:37
showed it to me. I'm like, Oh my goodness, so
1:40
much better than the socks. And these were good socks.
1:43
But that was like it was like an eye opening experience.
1:46
So really kept these guys in mind, and I talked to many
1:50
clients about that over the years, and today we're gonna
1:54
have an episode about it. Yeah, why don't we go ahead and
1:56
talk about that episode? So today definitely is a fully
1:58
sponsored episode sponsor Spotlight as we call it.
2:01
We have collaborated with our friends over at Salto to create
2:04
this special discussion that we'll talk about get to learn
2:07
more about Salto. I'm not super familiar with it,
2:10
Jimmy. You're more familiar than I am
2:11
with it. But I think this is also maybe
2:13
the first time you've heard the term stare and compare.
2:15
Is that right? You've not heard that?
2:17
Before exactly. That's the origin of that.
2:19
And I've I've stolen that. Actually, people didn't know
2:23
that that wasn't mine, so now they know.
2:25
Well, to be fair, I've heard that one for years, at least 10
2:28
years ago, so I was a little bit shocked.
2:30
But hey, we always learned that they knew, right?
2:32
So today's sponsored episode is by Salto.
2:35
They specialize in DevOps for business apps.
2:37
You can find them on the web at salto dot IO.
2:40
We have a special web page salto dot IO slash idac and that's
2:43
where you can find out more information.
2:45
I'm excited to welcome Gil Hoffer.
2:47
He's the Co founder and CTO at Salto.
2:49
Welcome to the show, Gil. Thank you, Jeff, and thank you,
2:53
Jim. Thank you for having me.
2:55
Yeah. Thanks for taking the time.
2:56
And obviously Jim is has got a little more I think insight into
3:00
what you guys work on. But I always like to start with
3:03
the person, tell me a little bit about your identity origin
3:06
story. How did you get into the world
3:08
of identity? Is it something that you chose
3:10
or did it choose you? Great question.
3:13
So well obviously Identity is part of everyone, right, but in
3:18
the in the context of computers and and software.
3:21
So I think the first time that I started dealing with Identity
3:25
was in my previous company when we had to start building some
3:28
SSO solutions etcetera. So that's the first time that I
3:32
started learning about it. And then in salto our customers
3:38
all the time talks with us. Well, we understand what you're
3:41
doing, but can we do it with Octa?
3:44
Can we do it with Azure ID or Entra etcetera.
3:47
So they they pulled us back in. I thought I was out of the
3:51
Identity game, but they pulled us back in.
3:54
That's how the identity space works, right?
3:56
Just when you think you've escaped orbit.
3:58
Nope. There's some gravitational pull
3:59
that that brings you back in. Jim mentioned what he sees Salto
4:04
is doing. But I want to give you the
4:05
opportunity, right? You're the expert.
4:07
Tell us more about Salto. What do you do?
4:10
Of course so at Salto we're a DevOps platform for managing the
4:14
configurations of business and IT applications.
4:18
So as you all know, typically a modern company is using a few
4:23
10s if not hundreds of those applications SAS applications.
4:27
Typically to run their business, you would need to configure or
4:30
customize them in order to in order for them to fit your
4:34
business processes. Typically this is being done
4:37
very manually using UI, no low code kind of ways.
4:43
And at SALTO, we enable our customers to bring all of those
4:47
best practices and processes that are typically being used
4:50
for development and DevOps and rely on the fact that we're not
4:54
using AUI to do all of those, whether we have code and we
4:57
enable our customers to to use these kind of IDs when managing
5:01
those configurations. So instead of just clicking and
5:05
steering and comparing and having endless spreadsheets with
5:08
everything that we've done, we can use git, we can automate
5:11
changes, we can implement once in a sandbox and then deploy
5:15
those changes to production etcetera.
5:17
Everything becomes much more process oriented, automated,
5:21
repeatable, just like the way that we typically work with
5:25
DevOps and and code, but applied to the different business and IT
5:29
applications that we support. So what was the genesis for this
5:33
idea of Salto? How did this thing get started?
5:35
What was the the idea that I was like, oh, we need to do
5:38
something about this? Yeah.
5:40
So, well, for that, I need to go back to our previous company, so
5:43
before Salto with a company called Ravello, Ravello Systems
5:47
and a very different domain. And we were actually an
5:50
infrastructure virtualization company.
5:53
We're a virtual cloud provider. We develop our own hypervisor
5:56
and virtual networking, virtual storage etcetera.
5:58
And for the SAS company, I started around 2011 and as any
6:03
other company those days we're using all kind of different SAS
6:07
applications run our business, right.
6:09
So Salesforce and NetSuite and Zendesk and Girai and Mercado
6:13
etcetera. And frankly speaking, the way
6:16
we're managing those business applications, it was probably
6:19
the least professional thing that we did in that company.
6:23
It was like that host potato that we kept on bouncing between
6:26
departments and all kind of consultants helping us.
6:30
And really no one knew what's going on with those
6:32
applications. And luckily the business with
6:37
Ravel picked up very nicely and the company grew quite a lot.
6:41
And then at one point in time, I remember I was running
6:43
engineering back then we had a project to redo our pricing
6:48
scheme and I was sizing the project.
6:51
I said well, yeah, it will take us about two months to implement
6:54
this. And then I remember it as if it
6:57
was yesterday. I remember our VP of Product
6:58
Management coming into my room and asking me, well Gil, I
7:02
understand that you say that it will take two months in the
7:04
product, but what about the implication on on Salesforce and
7:08
and the NetSuite? And I was looking at him and I
7:11
told him, well, I don't know anything about those systems.
7:15
Let's let's look and obviously there were all kinds of
7:18
implications and we started pulling the responsibility over
7:22
those systems in house into engineering, started shifting
7:25
resources etcetera. Things got slightly better.
7:27
Then it was early 2016, we got acquired by Oracle.
7:32
Now one might imagine that Oracle great respectful company
7:38
knows how to manage these kind of systems, right.
7:43
So after we got acquired, everything became so much more
7:47
complicated in the way that we manage all of those systems
7:50
including identity by the way, where the interesting project
7:53
about integrating the different identity systems.
7:56
And we realized that things that typically when we manage in in
8:02
code, in a system the way that we're used to would take us a
8:06
few days, takes us many, many months to actually achieve and
8:09
implement. That's when we started looking
8:12
very deeply into the way that companies manage their business
8:15
and IT applications. And we realized that the way
8:19
that those systems are typically being managed, it feels very
8:22
similar to the way that IT infrastructure was managed about
8:26
20 years ago. About 20 years.
8:28
I was managing a large team that dealt a lot with data centers.
8:32
And a typical guy on my team would start his day with a box
8:35
in his hand, go down to the data center, put that server into a
8:38
rack, pull out one of those nifty foldable keyboards, and
8:42
start typing commands all day long.
8:44
Right. Installing stuff, obviously not
8:48
scalable, very error prone. And back then, well, the IT
8:54
organizations dealt with it like they know with red tape and
8:58
bureaucracy and you got an SLA of two months for a new server,
9:01
etcetera. Who remembers those days.
9:03
And the way that the industry dealt with that was by importing
9:08
best practices from the way that we used to manage software and
9:11
applied into the way that we manage infrastructure.
9:14
So all of a sudden it wasn't an IT person going into the data
9:19
centre. It was automation with, if you
9:23
remember Chef and Puppet and these kind of projects back then
9:26
and today, it's all about infrastructure is code.
9:28
So you Terraform for example, so you can manage everything in a
9:32
source control repository. But at the core of it is that we
9:36
enabled the industry, as an industry to manage
9:39
infrastructure the same way that we manage code.
9:42
Everything became very repeatable, well defined
9:45
etcetera. By the way that we manage the
9:48
configuration of our business and IT applications.
9:51
It still looks like 20 years ago, everything so manual done
9:54
directly in production or if you would like to do it in a in a in
9:57
a staging environment or development environment before
10:00
you would typically document it meticulously and then repeat
10:03
those changes again as Jim mentioned before.
10:05
So that was a realization that, well, we understand the problem.
10:09
It was already solved in a different domain, All right.
10:12
That feels like a good idea, good business to start.
10:15
And let's bring all those goodies to the way that
10:18
organizations manage their business and IT applications.
10:21
So that was around five years ago when we started a company.
10:25
And today it's really exciting because we have so many
10:29
customers using us to manage those critical systems.
10:32
And I just took it a few days ago.
10:34
So five different continents across all kind of different
10:39
applications, a different domain.
10:40
So that's a lot of fun that. Sounds pretty exciting and I
10:44
wanna we wanna ask definitely some questions about how this
10:47
works right and use cases and things like that.
10:48
But I think I am always interested to hear about company
10:52
names. How did you come up with the
10:55
name Salto? Why call it that?
10:57
Yeah well it's not the it's not the best story but so as I
11:03
mentioned before Salto with a company called Rovello Rovello
11:06
Systems and in Salto of two two Co founders and before Revelo
11:11
they had two other companies. One of the the one before Revelo
11:15
was called Kumarnet with AQ and the one before Kumarnet would
11:19
was called Pentagon with AP. So you might imagine it was PQR.
11:24
We needed something that starts with an S and then we needed it
11:29
to be short and the domain to be available.
11:32
And just as we're about to start, Salto Rami, my partner
11:36
and CEO, he was earning Italian, he he was earning Italian.
11:41
He went to Rome for a few months in order to brush his Italian,
11:44
and he suggested a saltare. A saltare in in Italian means to
11:52
jump to leap. And I told him, well Rami, it's
11:55
it's too long, no one will be able to actually pronounce it
11:58
correctly. And Salto, both in Italian and
12:03
in Spanish it means to leap. It's basically the the noun of
12:08
Philippe like somersault and and we thought that it is also a
12:13
nice metaphor because we're basically enabling the industry
12:18
to leap forward and take all of those IDs that I mentioned
12:22
before and apply them here. So connect all those.
12:25
The fact that it starts with an S that it is metaphorically
12:29
relevant to what we're doing and the domain was available that's
12:34
the company name and there are by the way there are endless
12:38
pans that we're using on Salto. We'll get to it as we talked
12:41
about the the technology. Yeah, having the domain
12:44
available is is very key, you know, right.
12:49
I thought of and realized that as I was doing that introduction
12:52
earlier and talking about my early experience with Okta may
12:56
have come off as like, Oh no, he's kind of criticizing the
13:01
Okta's approaches. But the reality of it is, is
13:04
they've opened the API to make it available for Salto to even
13:09
exist. If it wasn't for the API,
13:11
there's no way you could have the Salto product be able to do
13:15
what it does. Is that correct?
13:16
Yeah, it's 100% correct. And without API wouldn't be able
13:21
to do that. And the problems that we're
13:24
dealing with in SALTO, they're not specific to Octa.
13:27
So it's actually quite common. For example, support Zendesk and
13:31
Dura and Salesforce and NetSuite and and multiple different
13:34
applications. It is quite common that there is
13:37
no way to actually deploy changes from a lower environment
13:40
to a higher environment. And come to think of it, there
13:45
is a lot of investment that those vendors need to make in
13:49
order to to make it available to very easily have sandboxes that
13:54
are synced from production to be to make it easy to deploy those
13:57
changes and to understand what are the difference between
14:00
different environments etcetera. It's not surprising that those
14:04
features are missing in many cases, because for every vendor
14:07
to build them it's it's costly. No, it's good.
14:10
So it's kind of a tip of the cap to them.
14:13
One of the things that one of the things that I want to make
14:16
sure that we don't do is, you know leave anyone in the dust in
14:21
terms of explaining what Salto does.
14:23
So I was wondering if you could, thinking of it from the
14:26
perspective of an Oct administrator, what would they
14:30
use Salto for and how would they go about doing that?
14:33
Yeah, of course. Great question, Jim.
14:35
So typically an Octa administrator let's try and
14:40
portray a day in his life. OK, so let's say there's a
14:45
requirement to go and implement a certain change to the to the
14:48
configuration of Octa, let's say to some authentication policy.
14:54
So the first step for the for the admin to do is first of all
14:58
to analyze what would be the impact of that change.
15:01
So what are all the other configuration elements or parts
15:05
of the implementation that will be impacted by that change.
15:10
Then that admin would go and implement the change in a
15:15
development environment that should be very similar to the
15:18
production environment. And after testing, you should
15:21
eventually also be able to deploy those changes to
15:24
production while also being able to roll back if needed.
15:27
So that's what the admin needs to do.
15:29
Now let's describe how it does that with Salto.
15:31
So with Salto, the admin will have all of his environments,
15:35
all of his different tenants connected to Salto, and Salto
15:39
automatically reads the configuration of all of those
15:43
tenants on the background. We use those APIs.
15:45
We read all of the data all the time and we use a format which
15:49
we call NaCl Knuckle which stands for not in our
15:52
configuration language and just happens to be the chemical sign
15:55
formula of salt. So we read all of that
15:59
configuration into Salto and the first thing that we enabled that
16:02
admin is visibility. So you can very easily
16:06
understand what is that you have implemented.
16:08
You can very easily understand all of different dependencies.
16:12
So for example, looking at that specific policy, what is it
16:16
dependent on and what depends on it?
16:19
So we'll be able to know what we might break when we make that
16:23
change. Then that admin would go into
16:25
the lower environment that should be synced from
16:28
production. We can help with that as well.
16:30
Implement the relevant change in Octa using the UI doesn't need
16:34
to change the way that he works in his day-to-day.
16:37
And then Salter would automatically detect what was
16:39
changed in that environment, show it to the user, enable it,
16:45
enable him or her to also push those changes into Git.
16:49
So we'll have proper paper trail for everything that was changed
16:53
and deploy those changes to the higher environment.
16:56
So in alternative universe, what you should have done is develop
17:01
those changes in that in that lower environment in Octa test,
17:06
right, Typically and we see it with customers having like very
17:09
long spreadsheets which document everything that they changed and
17:13
then they would need to go and reimplement those changes in
17:15
production. And this is extremely risky
17:19
because there might be all kind of differences between a
17:22
different environment that he is not aware of.
17:25
And then the fact that it tested something on the lower
17:28
environment is almost meaningless because it typically
17:32
would have tested it on a different environment.
17:34
He's unaware of the differences between those different changes.
17:37
And then when deploying to production only production is
17:40
the environment which is representative in this case.
17:44
So that would be the alternative.
17:46
Obviously for a smaller Octa setup it might be OK because the
17:51
configuration might be in a scope that one can understand on
17:57
his own sound for customers. We're talking about teams of
18:01
10/15/20 Octa, administrators in a single organization, in a
18:05
single tenant, managing 100,150 thousand users.
18:11
That configuration is insane in most cases.
18:15
And going and implementing a change directly in production,
18:19
for example, or a massive change in a in a preview tenant and
18:23
then reimplementing it in production, that's a very risky
18:27
move. By the way, you didn't lose me
18:29
on that NaCl sodium chloride, which I mean, when you figured
18:35
that out or that came up, you must have just like that must
18:40
have been quite the moment. Yeah, I remember.
18:44
Yeah, I don't want to blame for the for that name because we're
18:49
sitting in a room and we're saying, well, we need to have a
18:52
name for our language. What are we going to call it?
18:56
And then I was just playing with with all kind of letters so well
18:59
and it's still that's that's clever.
19:02
Very clever, very clever. So I think he got into why it's
19:08
problematic or risky to do things manually.
19:12
Is that what most organizations are doing that don't use salto?
19:15
Are they doing it manually or are they kind of rolling their
19:18
own solution? So typically we're seeing one of
19:23
three alternatives. The organizations are really
19:26
unaware of the risk and they just go and make changes
19:29
directly in production and they don't care.
19:32
In many cases, the bulk of the organizations that we're seeing,
19:38
they're very much aware of the risk and then they would
19:41
typically deal with it in a process kind of solution,
19:46
meaning that they will have lots of documentation would go and
19:50
implement those changes typically three times.
19:52
Typically it will be in a development environment, then in
19:55
testing environment or UAT, then in production environment.
19:58
And the way that those changes would work would be manual with.
20:02
Very careful documentation in spreadsheets, in tickets,
20:06
etcetera for these for these organizations, we both reduce
20:12
risk but also reduce a lot of manual work.
20:16
Meaning we have, we've seen, we see with sound for customers
20:20
processes that used to take them many days if not weeks are
20:24
reduced to minutes because there's no need to create a
20:27
documentation. That documentation is basically
20:29
the state of the system that we look at and you don't need to
20:32
reimplement those changes because just click a button and
20:35
deploy etcetera. The third type of organizations
20:38
are the ones who these are the most advanced.
20:41
These are companies that typically adopt for example
20:45
Terraform as a way to manage their Octa tenants and that it
20:50
deals with the bulk of the issues that I mentioned.
20:53
But it creates other challenges because for those of you are
20:57
familiar with Terraform, Terraform is a very popular open
21:00
source project and infrastructure for managing
21:03
typically infrastructure like AWS tenants etcetera.
21:07
The main challenge there is that they would need to go and create
21:13
HCL files or Terraform files that describe the configuration
21:17
that they would like to deploy. So typically Octa admins are
21:23
experts in Octa, meaning they really know the way around Octa
21:27
and the Octa UI and creating policies and they're experts in
21:32
identity and access management, etcetera.
21:34
Creating those directly in Terra forms HCL can be very
21:39
challenging and time consuming. So yeah, yeah, just staring.
21:44
And compare, I mean I I think that's the most common, right,
21:47
especially for Octa organizations that are
21:50
organizations that are smaller kind of have a limited budget,
21:55
limited scope of Okta. That's what they're doing to me.
21:59
It's extremely dangerous because you can miss type A
22:03
configuration. Other words you brought it over
22:06
but you left out a letter or you know how many times do we
22:09
misspell things in our day-to-day lives where you know
22:13
fortunately we have spell check there to to save us, right.
22:16
We we think there's only 1L in in in a word and there's really
22:20
two that that kind of thing and it can take you hours to find
22:25
out. So not only do you have to stare
22:27
and compare it correctly, but if you do your push and it's not
22:31
working now you've got to unroll it.
22:34
Well, what makes you think you are going to unroll it correctly
22:37
if you didn't roll it correctly. So I think it's extremely
22:42
dangerous, extremely risky, especially for major deployments
22:47
that are customer facing. It's just and seems like you
22:50
know from my experience in in managing web applications like
22:55
it's just you don't even have to be at that high of the level of
22:58
maturity to be driving automation like you wouldn't,
23:02
you know when you roll a jar file to a Java server, right,
23:06
you just drop the jar file in and if you have to unroll it,
23:10
you take it out and put the other one in or the old one in,
23:13
right? You don't, you know, go through
23:16
line by line of code and try and figure out the problem or try to
23:19
roll things that way. And to me it's kind of like that
23:22
that's this alternative way, the manual way, or writing your own.
23:27
The problem with that is like usually when you write code,
23:30
it's fit for purpose, but your purpose may change over time.
23:33
So, you know, you might have a creep away from the standard
23:37
baseline and it's not picking up certain configurations that Okta
23:41
added and you've been using in your sandbox environment, for
23:45
example. So those are some of the risks
23:47
that really jump out to me. But I also think just for
23:54
organizations that aren't already doing kind of a DevOps
23:58
approach and a CICD approach, that's the future, right?
24:02
And this is just another part of doing that.
24:05
Yeah, I I. Agree.
24:06
That's the future. And that's the future by the
24:10
way, not just for Okta, but for all of the different IT and
24:14
business applications that run your your companies.
24:18
And I'll give you an example for something that our customers
24:23
typically love is the ability to create a share responsibility
24:27
within a team. Because share responsibility is
24:30
a concept which is very much known when you develop code,
24:33
right. You would like the entire team
24:34
to be able to collaborate on the same on the stuff that we're
24:38
building and the common language that they have for that is code.
24:42
So for example one of the things that SALTO enables just by the
24:46
fact that we translate everything into a textual
24:49
representation into that NaCl file files is that you can
24:53
review other team members changes and you can approve them
24:58
and you can exact understand exactly what changes Jeff did
25:02
two weeks ago and what changes Jim did a week ago and you can
25:07
go and in Git we call the blame or praise.
25:11
We can either blame or praise Jeff for the changes that that
25:15
he did back then and creating that kind of visibility.
25:21
It's mind blowing that it's not it's it's nonexistent in those
25:24
type of applications. The fact that I can't that you
25:28
can't open, typically it's called a pull request, right?
25:30
A change request to the config and someone else can approve it
25:35
and only then it can be deployed.
25:36
Sounds like basic table stakes in critical systems under high
25:42
compliance requirements and there's these things do not
25:46
exist now. Moreover, as I mentioned,
25:48
because your companies are using so many different solutions, it
25:53
makes no sense to build a different solution for managing
25:58
each and every one of those systems.
26:00
Typically you would see an IM team, it's managing multiple
26:04
different systems, right. It's not, it's not just Octa.
26:07
In many cases you will also deal with Cell Point or with Entra or
26:14
with Splunk or with many Jams or with many other relevant systems
26:20
or with a or HR system or to push users etcetera.
26:24
And having streamlined consistent processes for
26:30
understanding that configuration, collaborating on
26:33
it, deploying on it is it's not even the future, it's the
26:36
present and CICD and DevOps in order to enable that, well these
26:43
are the principles that enable the software development world
26:47
in the last 20 years to support that kind of innovation that
26:50
we're seeing in the world today, right.
26:52
So these are like battle tested, proven ways of doing things.
26:57
So I think that we're going to see that every company is going
27:02
to start using these IDs when managing their business and IT
27:06
applications and that's why Salto is there, right.
27:09
So what is it that sets? Salto, apart from others, I
27:12
guess, in this space, right? I think one of the things that a
27:15
lot of IT people probably suffer from, and myself included, as we
27:18
get jaded, right? There's a lot of options out
27:20
there, I guess. Tell us why Salto is unique in
27:23
this field. Yeah, of course.
27:25
So the unique part in Salto is that first of all we're we're a
27:31
platform, meaning that we cater for many different applications.
27:36
It's not just Octa, it's not just Salesforce, it's not just
27:39
Zendesk, not just JIRA, it's all of them and many others.
27:42
We're adding support for a very large number of applications
27:47
this year and that we put the user experience off the admin in
27:55
the center, meaning that in some cases you would find solutions
27:59
that are relatively very technical.
28:02
They might be a good fit for a developer or for a very
28:06
sophisticated IT person, but eventually an admin that for
28:12
example with Octa lives and breathes.
28:16
I am an Octa, not necessarily code.
28:20
I think that we're basically the only solution that enables that
28:23
both a very admin friendly way of things while not compromising
28:26
at all all the important traits of source control and automation
28:31
and CICD et cetera. We make it accessible to them as
28:34
well as cross across many different applications.
28:39
We're not aware of anyone else's who's doing it today.
28:42
Well, that definitely. Puts the unique into it, don't
28:45
also doing it. How about can you share any
28:48
customer stories over examples because they think that's
28:51
another way that people can kind of start to understand how they
28:54
might leverage this and maybe some other ideas that others can
28:57
get from this. Any customer use cases or things
29:00
and feel free to share names or not, that's fine.
29:02
But maybe you can walk us through that.
29:04
Yeah, of course. I can share a few a few
29:07
different use cases and I I think that I I can share also a
29:10
few names. The first one is a very large
29:14
retailer with 10s of production tenants in the 30s and they used
29:24
to manage everything manually with spreadsheets.
29:28
So think about it, you have a production tenant, you have your
29:32
sandbox or preview that is tied to it in a 1:00 to 1:00.
29:36
They also had like a gold tenant where the that should have been
29:41
the gold standard. Now obviously over time all of
29:45
those 60 something different tenants that I just mentioned,
29:48
they drifted away, drifted apart.
29:51
So the actual relation between the configuration in any of
29:55
those environments became almost random.
29:58
So for them both rolling changes from that, let's say they would
30:03
like to roll a change from that golden image to all different
30:06
instances as well as adding a new tenant.
30:09
It was all huge projects and that's when they started working
30:15
with us and they reduced a configuration change that would
30:19
typically take them about a week to less than an hour by
30:24
automating everything with Salto and creating that kind of
30:28
visibility. Another interesting that's a a
30:34
public at a company, a Udemy I we we can share their name.
30:39
So Udemy, they strip when they got to us, the CIO, which is
30:45
very forward thinking and was thinking about their OPS all the
30:48
time and he came to us with a problem of how can he eliminate
30:54
the silos that he has across his org because Salesforce was being
30:59
managed in a certain way and that's what was being managed in
31:02
a different way. And then this was being managed
31:04
in a different way. And it each one of those suffer
31:08
from the same challenges and same problems but found
31:12
different solutions or no solutions at all.
31:14
So over there it was how can they get to a way that all of
31:19
the different business and IT applications are basically being
31:22
managed in the same way and that's how they're using US and
31:26
they're very happy customer in that sense.
31:30
And the large example, which might might sound a little bit
31:34
silly, but a European retailer, a very big European retailer.
31:41
They made a. Mistake and deleted very large
31:43
parts of their production configuration by mistake like
31:47
fat finger kind of mistake and it happened once.
31:51
Then they realized well they have to take care of proper
31:54
processes for managing their configurations both.
31:57
So first of all they will develop on a development
32:01
instance and development tenant and not directly in production,
32:05
so reduce that risk of a fat finger.
32:08
But also when things go South. So they could very easily roll
32:12
back very selectively those changes.
32:14
So that's when they onboarded the salto.
32:16
Oddly enough, they made the same mistake again after they
32:18
onboarded Salto, but then that fall back was immediate and they
32:24
undo. Now we need to remember that
32:27
it's a retailer with north of 100,000 employees, so the
32:33
implication of a bad change can be huge from a financial
32:39
perspective. Think about all of those
32:42
salaries that you pay to your employees who cannot log in into
32:46
your network or if you're serving customers and this is
32:51
somehow customer facing, that's a huge risk and that's a huge
32:56
impact. And for them it's it's a no
32:59
brainer. I saw three different examples I
33:01
think of what customers are using us for.
33:04
I think those are really. Helpful.
33:05
And you know, I'm browsing the website and kind of following
33:08
along here as you're kind of explaining this.
33:10
But I guess from a use case perspective, I think mostly
33:12
we've been talking about configuration backup.
33:15
Is that the right way to phrase it or is it CICD DevOps is a
33:21
little bit of both. Are there other use cases maybe
33:23
that we haven't talked about that you guys can help with?
33:27
No, so, so. Typically the main use case that
33:29
most of our customers come to us is around configuration
33:32
management and deployment of changes.
33:34
We view backup as like a private case of it, because eventually
33:38
when you when you backup, when you restore, you deploy from a
33:41
previous version, you can be as selective as you'd like about
33:44
it. And because we automatically
33:46
fetch the configuration every hour or every day, you get back
33:50
up as as part of the solution. Two other interesting use cases.
33:55
One of them is around compliance and showing traceability for
34:00
every change that you make. Because when you think about it,
34:03
once you move everything to a stream and process which is
34:07
backed by git and source control etcetera, you can very easily
34:11
now connect those changes to let's say a ticketing ServiceNow
34:15
or in Jira and show the approval and show everything that you
34:19
need to show to your auditor in case those systems are under
34:23
scope. And another one is around
34:27
monitoring of configuration changes.
34:29
Because there are many companies who came to us tell us, well
34:33
these are some very sensitive areas of our configuration.
34:36
We need to get alerted whenever anyone changes them.
34:39
Think for example about, I know security settings in the
34:42
NetSuite, you wouldn't like anyone to play with your
34:45
financial systems security settings.
34:49
So we can also automatically alert on those these types of
34:52
changes. All of these use cases,
34:54
eventually they boil down to the fact that we have visibility to
34:59
the entire configuration of those systems and we actually
35:01
understand that configuration in a way that enables us to
35:04
understand what changes over time to deploy changes to
35:08
understand dependencies. So what will break if we change
35:11
something and to roll back to restore etcetera.
35:16
It all boils down to death to the fact that we we can
35:19
understand all of that config it seems to.
35:21
Me, like salto wouldn't be that hard to start using.
35:24
In other words, you should if you're doing manual stair and
35:28
compare something like that, you should be able to start using
35:33
salto and once you build up the confidence level, start using it
35:36
right away. Am I missing something obvious?
35:39
What does the typical implementation look like?
35:42
No, no, you're. Not missing anything Jim, we're
35:45
actually, we have a free trial. You can just go to our website
35:48
and connect Salto to your systems and start using it.
35:51
And we saw cases where during that first month of a free trial
35:57
where the prospects already running 10s if not hundreds of
36:00
deployments during that month using SALTO.
36:04
Obviously if you'd like to go to like automation and CICD
36:08
etcetera, then you need to build some of this also in your own
36:12
systems, in your own processes. But just to get started, you
36:16
just connect it using very standard way to your systems and
36:20
you start it's that easy. What about the pricing?
36:22
Is expensive. We don't.
36:24
Think so. But the way that salt is priced
36:28
is according to the complexity of your configuration, meaning
36:34
that we connect to different systems, for example, to Octa,
36:37
to JIRA. And with Octa, we look at the
36:41
number of applications, number of groups, number of policies
36:44
that we manage and there's a price table accordingly.
36:47
And the reason that we do that is because we believe this is
36:50
very tightly tied to the value that we provide to our customers
36:54
because if that configuration is very complicated, very complex,
36:58
you get a lot of value by using salto if it is very simple, less
37:02
volume. So you said they?
37:03
Can go to the the salto dot IO slash IDAC and you know, get a
37:11
copy, play with it. Then if they say OK, there's
37:16
something I want, can they figure out their own price or
37:20
how do they contact somebody on the on the sales side of Salto
37:24
and they contact them back and figure that out, how does that
37:27
work they? Can do either.
37:30
They can either reach out or we will reach out.
37:33
In many cases also and because especially with larger companies
37:38
might need to walk out some some legal or whatever, we need to
37:42
walk out with them. But we also have a self-serve
37:45
and you can just wipe your credit card and then go from
37:47
there if that's something that you're interested at.
37:50
OK, that sounds. Pretty easy.
37:52
So one question that we want to ask is if you're the customer
37:58
and you are using salto, how do you measure your success?
38:04
Great question. So I think it is very similar to
38:09
like Dora metrics, if you're familiar with the way that dev
38:12
OPS and metrics typically work. But most of our customers, they
38:16
would like to have more deployment to production and the
38:19
scope of those deployments should be smaller.
38:21
So that's like typically the way that you would like to to
38:25
measure it. We also measure the success rate
38:28
of those deployments, meaning if they were successful or if you
38:31
needed to roll back. So the theory in dev OPS
38:35
typically is that you would like to have very rapid deployments,
38:38
meaning as many deployments as possible per day and to reduce
38:43
to with a minimal error rate. So that's typically what our
38:47
customers would see and we have customers that we're talking
38:52
about hundreds of deployments to a single system in a month
38:55
because the rate of changes is that high.
38:57
And that really that's what enables them to to become agile,
39:00
which is that's really what everyone is looking to do,
39:02
right, in order for to provide value to the business faster
39:06
that eventually all goes to their right.
39:09
All of us work in a business when the business to be
39:11
successful. For that we need to deliver
39:13
value as fast as we can and DevOps and tools like Salto is
39:17
what enables you us to do that. I have one more question for
39:22
you. And I want to know what is next
39:24
for Salto. We've talked about Okta a lot.
39:27
I'm hoping there are more identity platforms in the near
39:30
future, but what's next for Salto?
39:33
Yeah. So in Salto we're adding many
39:37
different applications all of the time and there are a few on
39:43
the identity domain that we're planning to add later this year,
39:50
nothing which is like final in terms of date etcetera.
39:55
But I think that you might you might see support from Salto for
39:59
example the Microsoft ecosystem in the Google ecosystem as well
40:04
as maybe products like sale point etcetera.
40:09
So because we've seen such an. Overwhelming demand from the
40:15
Octa community that we believe that those problems that we're
40:19
solving are extremely important in the identity ecosystem and
40:25
that's why we're trying to prioritize identity solutions as
40:30
some of the applications that we're adding later this year I
40:33
want to make. One statement.
40:35
So if there are people who are listening, who are product
40:38
managers or in an influential role, and they build identity
40:44
systems, make the APIs available for configuration management,
40:49
please. Period.
40:50
No exclamation. Point I'd like to 2nd that,
40:53
yeah, that's well said, Jim. That's what it comes down to.
40:56
Right. Yeah.
40:57
I I. I.
40:58
Agree. I agree.
41:00
Those days of closed systems are should be over.
41:03
So we were. Talking before we hit record
41:05
here and just kind of get into each other a little bit and this
41:07
has been a fascinating conversation.
41:09
So I hope people will go out and visit salto dot IO slash idac
41:14
but I want to ask a non a non identity question.
41:19
Jim, do you have anything else you want to get to before I do
41:21
that or are you good to go? No.
41:22
No, we can't. We can take it out.
41:24
This is a fantastic conversation.
41:25
I really enjoyed it. Thank you.
41:27
Yeah. We were talking about basketball
41:29
and you mentioned that you like to play and coach and I have a
41:33
couple of questions, 'cause I used to play no longer anymore.
41:36
I'm, I'm old and short and round like a basketball at this point,
41:39
but I used to play when I was younger.
41:41
So two questions for you. First is a player's question,
41:44
What's your go to scoring move, gotta score, games on the line,
41:48
how you get in that bucket? So.
41:51
As a player, I was playing until the end of high school.
41:54
I was always very aggressive and that's also what I typically
41:58
teach my kids. So I would grind my way into the
42:01
basket and like typically power moves because especially at
42:07
younger ages and if you're also non professional players tend to
42:14
be a little bit soft. So use your shoulder and you'll
42:18
get that bucket shoulders and. Butt, right?
42:21
Yeah. Jim, what's your go to scoring
42:24
move? I don't have one.
42:27
Don't. I do not.
42:28
I don't know. I'm terrible at basketball.
42:30
I I go up and I do layups and they, well, they used to be
42:35
automatic for me. Used to be able to hit 9 out of
42:38
10 layups for sure. Now it'd be like if it got one
42:42
out of 10, you're too. Small.
42:44
You can't. You can't lift the basketball up
42:46
correctly. All that weightlifting, maybe?
42:48
It's just I think I'm going to be able to jump and get to a
42:51
certain height and I can only jump like 6 inches and that's
42:55
the problem, OK. I've got some good.
42:58
Basketball stories though. All right.
43:00
I got a good basketball story. So this is my grandfather who is
43:05
was shorter than me by an inch. So he is 6/1.
43:08
I'm 62. He's 6/1.
43:11
He went to South Catholic High School in Philadelphia.
43:15
It's now called Bishop Newman and he was the center.
43:20
Get this 61. So this was you know in like the
43:23
early 1940s because as a 18 year old, he's over in Germany in
43:29
1943, so early 40s. And the man was the Center for
43:35
his high school team at six one. And he is in that high school's
43:40
sports Hall of Fame. He was a Letterman in baseball,
43:45
basketball and swimming, and he was just a superstar basketball
43:48
player. I think he was in the All Star
43:50
team for the city in 1942 or whatever.
43:55
It's pretty cool. So you.
43:56
Guys are tall. I'm not.
43:57
I'm 5-6 now and you know, when I was younger I was probably a
44:01
good solid 5, two or five, three.
44:06
But I I I mean, I used to play basketball all day long.
44:10
I mean, it was not uncommon for me to be playing games of 21
44:14
down on the playground or my backyard.
44:15
We actually had two hoops on my backyard.
44:17
So I was like legit playing all the time.
44:20
And so my scoring, I had two moves.
44:23
I mean, I could drive the lane and do those acrobatic, you
44:26
know, lay UPS, reverse lay UPS, all that good stuff.
44:29
Or the fadeaway jumper, 'cause I grew up in the era of Michael
44:33
Jordan and you know, we're talking mid 90s, early, early to
44:38
mid to late 90s. And that was just the move,
44:40
right? Unstoppable, unblockable.
44:43
Didn't matter how tall you were. I was shooting over you and that
44:47
that was my go to move was the was was really the the the the
44:50
fadeaway turn around jumper. That was my jam right there.
44:55
All right. Second question for you and
44:57
revolves around coaching. You coach Youths today, what's a
45:02
brilliant coaching move that you've made recently, maybe in a
45:05
game or a match or tournament or something like that, that you're
45:08
like, Oh yeah, that. I'm glad I did that.
45:11
Yeah. So and unfair advantage in many
45:14
cases with young kids is turning on and off full cold press and
45:23
because kids can get confused when you press them or also when
45:29
you don't press them. So in one of the games last
45:33
season, we basically turn it on and off all the time because if
45:37
you press all the time they get it and then etcetera.
45:41
And then the other team got so confused and we just kept on
45:45
stealing and lots of easy lay UPS.
45:48
So that's one thing that works well in young ages and another
45:53
thing is that we woke up on this a lot in practices we try not to
45:58
dribble at all. So just moving the ball all the
46:02
time even if it doesn't feel like there is a great purpose
46:06
because there there's no shot clock right when with kids.
46:09
So the difference because it needs to move all the time then
46:13
it creates opportunities. So just teach the kids to move
46:16
the ball all the time. So just dribbling, that's what
46:20
we're walking on. That's a that's a great.
46:21
Drill and I totally agree with the full court press because I
46:25
gotta tell you, as AI played in I guess would have been middle
46:29
school which would have been grades like 6-7, eight I think
46:33
if I remember. And full court press is a lot of
46:37
fun if you are the one doing the full court press.
46:41
It is not fun at that age when you are being full court press
46:44
and you're totally right. Like there's confusion and it's,
46:47
it seems like such a, you know an easy way to play defense.
46:52
Here's a brilliant move that my coach, coach Byrd, I think was
46:56
his name. I was probably in fourth or
46:59
fifth grade and if you think I'm short now, why was I short then?
47:04
And we're playing and I won the Mr. Hustle award for our team.
47:10
I just basically was like a gnat on these giants around me and
47:14
annoying and you know just in between their legs and just a a
47:18
real nuisance. We were not very good, I'll tell
47:21
you that right now we sucked. I don't think we won a game all
47:24
year. We were playing another team and
47:27
they put me in at center. So here I am giving up probably
47:31
a an easy 2 feet to the mother Center.
47:34
But we were so well trained on the basics and This is why I
47:36
mentioned the butt before boxing out, boxing out, boxing out,
47:40
boxing out. And so I could do that really
47:42
well. And I kept getting over the back
47:44
fouls, called on whoever was whoever is boxing out their
47:48
center fouls out, their backup center falls out, power forward
47:51
falls out. We end up in the third quarter
47:53
they had fouled out so many people that they only had three
47:56
players on the court for the last three minutes of the game.
47:58
And yes, we still lost. So that's how bad we were.
48:03
But I always, I always think back as like and I didn't really
48:06
kind of get at the times too young to kind of figure that
48:08
out. But what a brilliant move.
48:10
Take your shortest person, good fundamentals and just box them
48:15
out you you know. Use that button.
48:19
I'll use that. Well, there you go, See.
48:22
We're helping each other here. I think that's a good way to
48:25
probably end this episode, this conversation.
48:27
I want to thank you again for being part of this and kind of
48:30
sharing your wisdom around this, Gil.
48:32
We'll have links in our show notes that we can have people go
48:36
out and visit and you know, if they've got questions, they can
48:39
certainly reach out and connect with you on LinkedIn.
48:42
We'll have, you know, your LinkedIn profile as well in our
48:44
show notes. So visit salto dot IO slash
48:48
IDAC. They'll learn more.
48:49
Jim and I, we're on the web, idacpodcast.com and you can
48:53
always connect with us on Litter on on LinkedIn, if I could talk
48:56
correctly. And with that, we'll go ahead
48:58
and leave it for this week. Thank you again, Gil.
49:00
Thank you, Jim. And we'll talk with everyone in
49:02
the next one you've been. Listening to Identity at the
49:07
Center. We hope you've enjoyed the show.
49:09
Make sure to like, rate and review and we'll be back soon.
49:14
But in the meantime, hit the website at
49:16
identity@thecenter.com and find us on Twitter at IDAC Podcast.
49:24
See you next time on Identity at the Center.