Latest / Identity at the Center / #381 - Beyond Human: Taming the Wild West of Non-Human Identities with Steve Rennick

Transcript

#381 - Beyond Human: Taming the Wild West of Non-Human Identities with Steve Rennick · Identity at the Center

• 0:04
  This is identity at the center. Welcome to the Identity of the
• 0:11
  Center podcast. I'm Jeff, and that's Jim.
• 0:13
  Hey, Jim. Hey, Jeff, how are you?
• 0:15
  Oh, not so bad yourself. Good, I got my Triceratops hat
• 0:19
  on today in honor of the Triceratops dinosaur.
• 0:24
  OK. Does that have any significance?
• 0:27
  No, I just thought it was a cool hat, and that's kind of like my
• 0:31
  thing everywhere. If I'm going to wear a hat, I
• 0:33
  think I should change it up every once in a while.
• 0:35
  Like your jackets at conferences, you always have
• 0:37
  different jackets that you're wearing.
• 0:39
  Yeah, that's a that was a very expensive hobby and we're going
• 0:43
  to a lot of conferences, so I haven't switched it up as much
• 0:47
  lately. But I don't know, I'm getting
• 0:49
  the urge to get back in there with the jackets.
• 0:52
  Well, you've worn hats at conferences.
• 0:54
  You wore the cowboy hat and ideniverse or this year I feel
• 0:57
  like you've wore. Did you wear a hat at Gardner
• 1:00
  last year? Because I remember we were
• 1:01
  sitting around the table talking with Head from Silver for and I
• 1:04
  remarked that you looked like a Vegas dealer or like an old
• 1:07
  timey casino dealer at the table.
• 1:10
  Yeah, that's a good one. So yeah, other than than wearing
• 1:15
  a different hat all the time, I've been working on something
• 1:19
  with one of my clients and helping them get ready for
• 1:24
  vendor demos. And I wanted to kind of bounce
• 1:27
  this off of you. And then we have a guest who is
• 1:30
  a practitioner and I'm sure he's going to have an opinion.
• 1:33
  So after we introduce him, we'll want to get his opinion on this.
• 1:36
  But the topic is, you know, what is your approach with vendor
• 1:41
  demos? Because I like to tell them,
• 1:43
  hey, specifically these are the things I want to see.
• 1:47
  Hopefully there's enough buffer time at the end that they want
• 1:50
  to do whiz bang things. But I'd like to, you know,
• 1:55
  structure the demo so that there's very little time for
• 1:59
  like slide Ware. Like if I have to sit through an
• 2:01
  hour presentation before you even share like a, a screen of
• 2:06
  your application, I'm I've lost interest.
• 2:09
  So I want to get on like you've got 20 minutes for slides if you
• 2:14
  if you really want to do them. Otherwise you can jump right in
• 2:17
  if you want to use that. I like to give specific use
• 2:20
  cases and then I don't like to score on 100 different aspects.
• 2:26
  I want to score on those use cases and then I want to score
• 2:30
  to be a reference point. You know, Now, if one vendor is
• 2:35
  like 10 miles ahead of the others, sure.
• 2:38
  But if you've got a cluster and they're pretty close, I think
• 2:42
  you use that information as you talk about, talk about it
• 2:45
  amongst your group. But I don't feel like you should
• 2:49
  say, oh, this vendor was a, a 4.5 and this one was a 4.6.
• 2:55
  We're going to go with the 4.6. Yeah, you covered a lot of
• 3:00
  ground there. So I think the first is what
• 3:02
  kind of demo is this? And to me, what you're
• 3:04
  describing sounds like an RFP demo of some sort where you
• 3:09
  know, the client is looking to purchase software of some sort
• 3:13
  or service and they kind of want to see how that works, which I
• 3:16
  think is very different than a demo of, hey, let me just learn
• 3:20
  about your product or your service or offering, whatever
• 3:22
  may be as could have generalized so.
• 3:24
  Right. Yeah.
• 3:25
  So not necessarily RFP, but like RFP style and yes, with the
• 3:31
  interest of purchasing something.
• 3:33
  OK, So that's the first part right is what is the purpose of
• 3:36
  the demo? Is it just general education
• 3:37
  become aware of something or is it an intent to buy right as we
• 3:41
  would say so I'm with you. I hate slides in demos.
• 3:44
  I want to see product, I want to see specifics.
• 3:46
  How does, how does your thing handle this thing right?
• 3:50
  Whatever that use case looks like.
• 3:51
  So I think you're pretty generous at 20 minutes of
• 3:54
  slides, I would say no more than 5-10 minutes tops.
• 3:58
  And I would score negatively if it takes you more than 10
• 4:01
  minutes to explain what your product does in slides because
• 4:03
  I'm not buying your slides, I'm buying your product.
• 4:06
  So let's see it work. And I'm with you, be
• 4:08
  prescriptive. I think vendors actually like
• 4:10
  this as well. Tell me what you want to see
• 4:13
  because otherwise it's like, OK, well, tell me about yourself,
• 4:15
  Jim. And it's like, OK, well, you
• 4:17
  wouldn't know, right? It's like all this stuff going
• 4:19
  on. So if you can be prescriptive,
• 4:21
  especially work with the vendor and say, hey, here's the things
• 4:24
  that are important to me, you need to show me at least these
• 4:27
  things. If we have extra time, great.
• 4:29
  Show me all the gravy or bells and whistles that you got that
• 4:32
  we didn't talk about that you think makes you special right in
• 4:35
  the space. Cool.
• 4:36
  But I need to see these 510 things, right?
• 4:40
  And so I think scripting that out for the vendor is super
• 4:43
  helpful for really everybody's OK.
• 4:44
  Can it do this? And don't pick easy stuff
• 4:47
  either. I would.
• 4:48
  That's right. You know, that's right.
• 4:50
  Can, you know, can your product create an active virtual crowd?
• 4:52
  Well, yeah. So can hundreds of others.
• 4:54
  Like, who cares? Like everybody could do that.
• 4:55
  Show me, you know, things that are of concern to me.
• 4:59
  I think we're going to have trouble with this.
• 5:01
  Show me how you address that in your solution.
• 5:04
  That kind of scenario. That's right.
• 5:05
  Yeah, I mean the demo, you have to assume multiple vendors are
• 5:09
  doing demos and how are you going to say 1 is better than
• 5:12
  the other? There's got to be some kind of
• 5:14
  differentiation. I even like to suggest to the
• 5:19
  folks who are involved with the scoring, you know, you user,
• 5:24
  user experience, security, things like administrative
• 5:28
  experience, like factor those into your answer as you're
• 5:32
  developing a score. I don't like to get too
• 5:34
  prescriptive on that because, you know, you might think
• 5:37
  security is more important. I might think user experience is
• 5:40
  more important and that's OK. Maybe that's why we were both
• 5:43
  part of the selection team. Yeah, for sure.
• 5:47
  And there may be some things you can change and some things that
• 5:49
  you can't, right. User experience, especially for
• 5:52
  buying a SAS product, you're buying the user experience like
• 5:55
  that's the way it works. So if you don't like that,
• 5:58
  there's variable what you can do, unless you're buying a
• 6:00
  solution that has like, you know, a million different bells
• 6:03
  and cogs and switches and stuff that you can kind of adjust.
• 6:06
  So yeah, I'm with you on that. I think, you know, at the end of
• 6:09
  the day, you want to pick a product that meets your needs
• 6:12
  both now as well as what you're, you're skating towards to right
• 6:17
  from a hockey analogy, right, where the puck is going, but you
• 6:21
  need it. But what you don't want to do is
• 6:22
  buy a product on promises. Oh, yeah, we'll be able to do
• 6:25
  that next quarter. Or yeah, that's on our road map
• 6:28
  for next year. Like, I would never assume that
• 6:32
  the product will do what it is until it's in, you know, general
• 6:35
  lease, it's in production. And I don't bank on promises.
• 6:39
  Yeah, no, absolutely. I mean, I think there is
• 6:42
  something to be said for road map items, but yeah, you don't
• 6:47
  want to put too much weight in them.
• 6:48
  Yeah. But if all your stuff is, if all
• 6:50
  your key use cases are road map items, how is it helping you
• 6:54
  right now or in the next 6 months, right?
• 6:56
  Yeah, maybe if it's, hey, this is something we're releasing
• 6:58
  tomorrow that's a little bit different.
• 7:00
  But are they going to nail it on the first try or is there going
• 7:03
  to be a bunch of patches and bugs you need to work through?
• 7:05
  Like, are you, are you paying to be a Guinea pig, you know, a
• 7:08
  tester of new functionality that that always concerns me.
• 7:12
  I mean, I remember going through this a long time ago through an
• 7:14
  IGA selection. And I won't name the company,
• 7:17
  but they were literally doing development on the product at
• 7:20
  night after I had feedback during the day before to say,
• 7:23
  Hey, can it do this? What about this?
• 7:25
  And it would show up with a new build of this on premise IGA
• 7:28
  solution was like, oh, we added it in last night.
• 7:31
  I'm like OK, so. I don't think or a bad thing,
• 7:34
  I'm not sure. Yeah, I, I, it's probably a
• 7:36
  little bit of both, because if, you know, I shouldn't be
• 7:39
  special, you know, I'm buying a product for identity governance.
• 7:44
  It's like, OK, should be able to do onboarding and offboarding
• 7:47
  and accessory. It was like, that should be
• 7:49
  basic stuff if I'm able to. Yeah.
• 7:51
  If I'm designing the product and they're fixing it overnight, I
• 7:53
  guess that speaks to the agility with which they respond to their
• 7:56
  customers. But why wasn't it there in the
• 7:58
  1st place? This is the first time I've ever
• 8:00
  heard like basic things, you know, like that exceptionally
• 8:02
  agile methodology. Totally right, Steve, I, I agree
• 8:07
  with you guys too in, in terms, especially in terms of the
• 8:09
  market texture stuff, right? Nothing drives me more insane
• 8:12
  than when I show up to a demo call and we go through, you
• 8:16
  know, 20 slides of slide where what I typically do is I put
• 8:19
  them on the spot, right? I will, I will say I'm already
• 8:21
  aware of what your product does. Here are the use cases that I'm
• 8:24
  looking to to to implement by leveraging your product.
• 8:29
  Let's go through those use cases and then I usually tell them
• 8:33
  that I understand what your capabilities are and I
• 8:37
  understand what your competitors capabilities are.
• 8:39
  I want to hear from you what differentiates you from the
• 8:41
  competitors. We all know who they are sell me
• 8:44
  or where's. So usually that's a it's a, a
• 8:46
  good starting point. It kind of cuts through all that
• 8:48
  stuff and and, you know, gets us to a point where, you know, it's
• 8:51
  not necessarily a time waster for either side, which I, I
• 8:53
  think some do appreciate, right, that not everybody wants to go
• 8:57
  through all those slides. It's usually just a, you know, a
• 9:00
  standardized sales pitch that they have to do.
• 9:03
  Yeah, that's a great tip. I mean, because I think you can
• 9:05
  say, yeah, I don't need to be educated and I am.
• 9:09
  I already know what it is, right?
• 9:10
  If you're a salesperson coming in, you don't know what's your
• 9:14
  potential customer knows. So sometimes they started at the
• 9:17
  basics and it's like, yeah, yeah, yeah, I get it.
• 9:19
  I know, I know, I know. Like if you can tell them, it's
• 9:21
  like, hey, look, we're an experienced, I am group.
• 9:23
  You don't need to spend 20 minutes telling us the
• 9:26
  difference between authentication and
• 9:27
  authorization, right? Or whatever.
• 9:28
  Maybe. I love that, you know?
• 9:31
  Prescription. I have a shameless promotion for
• 9:33
  the Identity at the Center podcast sponsored sessions.
• 9:36
  If you are able to watch a sponsored session and educate
• 9:40
  yourself on that particular product, it does cut through
• 9:42
  most of those things. We were making a call, which I
• 9:44
  think I gave you guys that feedback early on.
• 9:46
  It's something that I really appreciated and enjoyed when I'm
• 9:48
  looking through those products. It it, it, you know, invaluable
• 9:52
  to me to to listen for 1/2 an hour, 45 minutes about what
• 9:55
  someone's product does. The elevator pitch gets done
• 9:57
  there and then by the time I'm getting to them, I'm educated
• 10:00
  about their product and we're having a relevant conversation.
• 10:03
  That's really kind of pushing us to the point where we can see is
• 10:05
  this viable for me or is this just, you know, something that's
• 10:09
  slide, right? Yeah.
• 10:12
  Thanks for that. Yeah.
• 10:14
  I think that's what's great about the sponsor sessions is
• 10:16
  that they actually some of them get more downloads than the
• 10:21
  regular sessions. And I think it's just for that
• 10:24
  reason that folks are out there in the market and they're always
• 10:28
  looking for solutions. If you can kind of filter things
• 10:32
  in or out based on a 45 minute podcast like that's awesome.
• 10:36
  That's a great use of time. Not not everyone has access to a
• 10:40
  gardener or a cooping or coal or a forester either, right?
• 10:43
  They don't have an analyst at hand that they can call and and
• 10:46
  that's not your financially available to a lot of people.
• 10:49
  So it's certainly something that could help them out and and
• 10:51
  definitely a tool I would suggest that the listeners or
• 10:54
  other practitioners would leverage.
• 10:57
  I'll disagree because you have access to Jim and me.
• 10:59
  So you know, you can, you can ping us on LinkedIn.
• 11:03
  For whatever reason, there's something in the water.
• 11:04
  I've got a bunch of like pings in the last week or so of like
• 11:07
  people who are in the product space and looking to develop
• 11:10
  something and they want like thoughts on kind of what they're
• 11:13
  thinking or validate market research or whatever it may be,
• 11:15
  right? Hey, I, if I have the time, I'm
• 11:17
  happy to, to share it with anybody out there.
• 11:19
  I will give you, you know, my two cents.
• 11:22
  It may not be valuable, but at least it'll be two cents.
• 11:25
  Well, with inflation, it's like hardly worth anything but.
• 11:28
  My $0.02 Canadian is worthless essentially, right?
• 11:33
  So you yourself are not worthless.
• 11:35
  You are. You are valued member of the
• 11:37
  team. And we really ought to get to
• 11:39
  introducing you, but I did want to pick on one thing that Jeff
• 11:42
  said, which was like, hey, what's it going to do for me in
• 11:45
  six months? And I kind of feel like
• 11:48
  especially in this day and age of software as a service, like
• 11:52
  you're paying for that service full price on day one, right?
• 11:57
  The day you sign the contract, the bills start coming and
• 12:01
  you've got to get something out in production quickly.
• 12:04
  And I think you put the vendor on the spot to say how do I get
• 12:07
  something up and get value from this product quickly like and
• 12:12
  and then you get an idea of what they think is quickly.
• 12:15
  Yeah, I mean time to time to market is not just for like
• 12:20
  products, it's also for your IAM program.
• 12:23
  You know, how do you get something out there?
• 12:24
  And not everything can have a three to five year program time
• 12:28
  to value, right? We're not talking about legacy
• 12:31
  IGA implementations anymore. Things have to.
• 12:33
  You have to be able to show value quickly.
• 12:36
  Yeah, here's a, you know, $1,000,000.
• 12:38
  I'll see you in three years. That doesn't cut it anymore.
• 12:41
  Yeah. Yeah.
• 12:43
  Why don't we go ahead and introduce you Steve formally
• 12:44
  since we've already got conversation going.
• 12:46
  So for people who don't know Steve, I'm not sure who who
• 12:49
  would that be because we see your covers all the time, but
• 12:51
  Steve Renick, he's a senior leader with for IM Architecture
• 12:54
  at CN. Not very easy for me to say.
• 12:56
  Steve, you've been with us a couple Times Now.
• 12:58
  I, I think we were counting before we hit record.
• 13:00
  I think it's your third and a half time on first time was way
• 13:05
  back at Gartner in 2023. So a couple years ago you were
• 13:08
  with us at identity squabble at Identiverse.
• 13:11
  Early this year you're, you're part of Jim's team.
• 13:14
  And then the and then today is 3 and then the half is a long time
• 13:17
  ago. We asked a bunch of people
• 13:18
  what's the difference between digital identity and identity
• 13:21
  and access management. So we played a clip that you
• 13:23
  graciously sent in and kind of had a conversation on that.
• 13:25
  So welcome back for the third and a half time, if that makes
• 13:30
  sense. Thank you.
• 13:31
  It's an absolute pleasure. I am the identity, the identity
• 13:34
  at the center fanboy. And so I'm I'm constantly
• 13:38
  listening and even when I found you guys, I think it was an
• 13:42
  interesting thing where I stumbled across it and I
• 13:46
  listened to an episode and I was immediately hooked.
• 13:48
  It really helped me to get a perspective of what other people
• 13:51
  were seeing and ask them questions about.
• 13:53
  And I was pretty early on in, in my identity journey, at least
• 13:57
  you know what I considered to be the identity journey at Siena.
• 14:00
  And I went back and I listened to every episode from the start
• 14:03
  to catch everything back up and then God level set and yeah, no,
• 14:07
  no, a lot of things have changed and adapted and adopted and, and
• 14:11
  you guys have done really well. So I'm proud to be here.
• 14:14
  I'm certainly proud to, to tell anybody I can about the value of
• 14:18
  the show. And I just appreciate everything
• 14:20
  you guys do. Well, I appreciate that.
• 14:23
  I always cringe when somebody says they went back and listened
• 14:26
  to early episodes 'cause, you know, they sound like crap.
• 14:29
  They sound like we didn't know what we're doing and that's the
• 14:31
  truth. The content I thought was good,
• 14:33
  but you know, the audio quality was definitely not there.
• 14:35
  And then we started doing video, I don't know, a year, year and a
• 14:38
  half ago at this point. So you've been early on with us.
• 14:41
  So definitely appreciate your support for the years we saw you
• 14:44
  at Adenoverse. You're part of the Adenos
• 14:46
  Squabble team. So that was your first time
• 14:48
  being part of, I think, you know, this kind of game show
• 14:51
  thing. And you know, we did one
• 14:53
  recently at Authenticate Fido Feud round two.
• 14:55
  Stay tuned. The video for that will be
• 14:57
  coming out hopefully by the end of the year.
• 15:00
  If you were there, you know how it ended.
• 15:02
  I won't spoil it any more than I already have and some other
• 15:04
  episodes that might be coming up, but it was a lot of fun.
• 15:07
  We've got other game shows that we're going to be pulling out
• 15:09
  for Ideniverse and DC later this year.
• 15:12
  I think it's November 19th and 20th if I recall.
• 15:15
  And then Gartner going to do another one as well, which is in
• 15:18
  both of them are called majority rules.
• 15:20
  So I'd actually tested this out at sale point navigate a couple
• 15:22
  weeks ago. It went pretty well.
• 15:24
  The the audience really liked it.
• 15:26
  I've got to work on some of the, you know, specifics around the
• 15:29
  questions, how it works out. If you're going to be at
• 15:31
  Ideniverse DC or Gartner in Grapevine, TX in December,
• 15:35
  please come check out the session.
• 15:37
  We have a new game show. It is audience participation.
• 15:39
  Use your phone to play. It's called Majority Rules.
• 15:42
  So we have a good time with that.
• 15:44
  So with that, all that said, what was it like being part of
• 15:49
  the losing team again for, you know, Jim, you're, you're over 2
• 15:54
  at this point with Family Feud style games, but tell me, take
• 15:57
  me behind the scenes, what was the strategy going in?
• 16:00
  I, I, I still struggle with the losing team side there.
• 16:03
  I think there's some controversy around a couple of the answers,
• 16:07
  and I know Mr. David Mahdi would agree with me that I think maybe
• 16:11
  one of those things could have shifted the tide in our favor.
• 16:14
  So I definitely think that it was a wonderful experience.
• 16:20
  The trial participation was great.
• 16:21
  Everybody was having fun. And I guess that that's the
• 16:24
  whole point. I really enjoyed it and I was
• 16:27
  excited to be up there in front of everybody.
• 16:30
  And, and we're right beside the Nhi Pavilion too.
• 16:33
  So there was lots of activity happening around and lots of
• 16:35
  people standing around and, and watching too, not just the, the
• 16:37
  seated participants, but the yeah, it, it was, it was a fun
• 16:41
  experience. I still say that, you know, we
• 16:43
  should have had a a ruling around the machine identity
• 16:45
  versus, you know, service accounts or whatever it was.
• 16:50
  Yeah, I think that's the hard part is, you know, you put
• 16:53
  judges on the spot and you know, we had judges there as well.
• 16:55
  And it's, this is so far happened in every game that
• 16:58
  we've done that's been like that where you're trying to
• 17:01
  interpret, OK, is this answer close enough to that one or how
• 17:05
  specific do we need to be? So it is a lot of fun.
• 17:08
  I, I certainly enjoy it. And I get a kick out of some of
• 17:10
  the answers that we get, you know, from people and sort of
• 17:12
  the reactions and stuff like that.
• 17:13
  So it was definitely a good time past that.
• 17:16
  What have you been up to, I guess since what was that June
• 17:19
  of this year? So it's been what, 3-4 months
• 17:21
  since then? Yeah, yeah, I've, I've had a
• 17:23
  couple of panels and speaking engagements and webinars and
• 17:27
  things pretty much all related to non human identities, which I
• 17:30
  think we're, we're going to touch on a little bit today.
• 17:32
  The hot topic. And and you know, obviously
• 17:34
  it's, it's something that that touches most infrastructures and
• 17:38
  organizations and, you know, very few I think are, are
• 17:41
  handling it in a, in a way that the we would, we would think
• 17:44
  would be, you know, a good way to handle it, right.
• 17:46
  I think a lot of it gets ignored and there's a lot of tech debt
• 17:49
  there. So, you know, trying to spread
• 17:51
  the word and, you know, get some ideas about how we might solve
• 17:54
  for those things as practitioners.
• 17:56
  So, yeah, so I did identity week America, which was a good
• 17:59
  experience. And then most recently, I
• 18:02
  attended Sector, which is Black Hat, NI Guess Toronto.
• 18:07
  So that was an interesting perspective for me.
• 18:09
  I got humbled a few times in a few sessions.
• 18:11
  We're deeply technical on the cyber side, but definitely
• 18:15
  learned a lot and and felt like it was really a worthwhile time.
• 18:19
  Good to crossover. I think if you stick just to the
• 18:22
  identity conferences, typically you'll see a lot of repeated
• 18:25
  content. I'm sure you guys see the same
• 18:27
  thing. You travel to a lot of those as
• 18:29
  well. But sometimes flipping in a
• 18:31
  cyber conference gives you a different perspective.
• 18:34
  And I'm really big on perspective, so it's a it's a
• 18:36
  good thing for me. So Steve, you played a role in
• 18:41
  the in the Mr. NHI, they lose some NHI workshop at Identivers
• 18:48
  and I thought it was a great event and I thought you're 1 of
• 18:53
  the highlights. I just First off, it's just like
• 18:56
  you had like a very powerful practitioner based perspective.
• 19:02
  So I don't want to answer my question for you, but my
• 19:04
  question is like what is? What do you figure is like the
• 19:09
  unique piece that you bring to the conversation?
• 19:13
  I I think in, in that particular instance, there's been a lot of
• 19:17
  vendor focus, right? So it seems like the vendors
• 19:19
  are, are the ones that are driving what we're learning
• 19:21
  about non human identities, right.
• 19:23
  And one of the biggest things that I see is that many of the
• 19:27
  solutions that, that are available to us as practitioners
• 19:31
  are things that are helping us to not necessarily remediate the
• 19:38
  tech debt, but make it a little bit better, right?
• 19:41
  So, you know, I think I, I used the terminology in some cases
• 19:44
  it's, it's like putting lipstick on a pig, right?
• 19:46
  So you have a bad tech debt problem, you've got an issue
• 19:49
  with something and we're going to make it a little bit better.
• 19:51
  So I would give you an example in the instance of, of having a
• 19:56
  service account, right? You might discover the service
• 19:58
  account, you might see the credential hasn't been rotated
• 20:00
  in, in X number of years. And that might be a compliancy
• 20:03
  issue. And now you need to find an
• 20:05
  owner and have that owner rotate the credential.
• 20:08
  Doing that visibility wise through an NHI solution is
• 20:11
  relatively easy. It's a centralized location
• 20:13
  where you can plug into all your different ID, PS and and and
• 20:16
  pull all those things in there and then see them.
• 20:19
  But realistically, if you don't address the root of the problem,
• 20:23
  which is why do you have the service account?
• 20:26
  Why isn't the credential being rotated on a regular basis?
• 20:30
  Is there something else that you could be doing that wouldn't
• 20:33
  require you to have the service account and have the trend flow
• 20:35
  rotated on a regular basis, IE something that isn't a static
• 20:38
  secret. You don't go through that
• 20:40
  checklist. You are basically just going to
• 20:42
  have to keep going back over and over and over and over again to
• 20:46
  solve for those things. Now there are portions of your
• 20:49
  environment where it's just unavoidable tech debt, it's
• 20:51
  legacy. It's something where, you know,
• 20:53
  you kind of have a a tear and I don't want to get too deep into
• 20:56
  it because I'm sure we'll we'll talk about it later.
• 20:58
  But like I kind of look at it like an approach of a tiered
• 21:00
  approach. If I have an account of this
• 21:03
  type. So I'll use the example of a
• 21:04
  Windows based service account. Tier one for me might be that it
• 21:09
  is the credential is vaulted in an enterprise solution and it is
• 21:12
  rotated automatically. So ownership is purely to say,
• 21:16
  do you need this life cycle wise?
• 21:18
  It's never to go and say, hey, it's audit time again, time for
• 21:22
  you to change the password, do this thing right.
• 21:24
  So you'd have that tier and then you're probably gonna have
• 21:26
  things that that don't support the automatic rotation.
• 21:29
  So in that instance, you're kind of getting down to the idea of,
• 21:31
  well, we need to rotate it at least once every 365 days if
• 21:35
  that's your policy. And here's how we do it in a
• 21:38
  streamlined fashion. Here is where you're where
• 21:41
  you're going to have to change that password.
• 21:44
  Here is all that information to make it easy on you when it
• 21:47
  comes time to do that. And you can plan those things
• 21:50
  ahead of time. And then of course, the, the,
• 21:51
  the last part is just, you know, you don't have the choice of
• 21:54
  doing that or no one can't find an owner.
• 21:56
  And you know, we kind of have to leave it as an exception.
• 21:58
  And then you you probably would look at compensating controls to
• 22:01
  to try and restrict what that service can can do so.
• 22:05
  You know, I, I feel like I realized why MHI is getting so
• 22:09
  much spotlight. I think, you know, zero trust
• 22:13
  got a lot of spotlight and then it got turned into a marketing
• 22:18
  buzz or marketing term. Same thing with AI And look,
• 22:23
  zero trust is no joke. I mean, as far as I'm concerned,
• 22:26
  it's one of the most significant things like architectural
• 22:30
  frameworks we have in cybersecurity.
• 22:33
  I think that obviously AI is a joke ether, but I don't think
• 22:37
  NHI is a joke either and I do see it popping up more in like
• 22:42
  marketing literature. The reason I'm bringing all this
• 22:45
  up is I think there is a big difference between Nhis and
• 22:50
  human identities. I feel like we've got a set of
• 22:54
  best practices around managing human identities, especially on
• 22:58
  the workforce side. Right?
• 23:00
  It's like there should be a a source of truth that like an HR
• 23:06
  system, you should use multi factor authentication.
• 23:09
  Well, let's just take those two examples and then the HI land.
• 23:13
  There is no multi factor authentication for the most
• 23:16
  part, right? There is some, I've seen some
• 23:18
  point solutions out there and they're neat, but for broad
• 23:22
  scale adoption it's not really probably going to happen in my
• 23:26
  opinion. System of record, I mean, who
• 23:30
  creates all their NHS and system of record?
• 23:32
  It's, it's just not even even if you did have a set of best
• 23:35
  practices, that wouldn't be one of them.
• 23:38
  So how do we solve this? I mean, I feel like there's a
• 23:44
  lot of smart people working on the problem, but it's such a
• 23:47
  hard problem. Yeah, well, I would say this.
• 23:52
  If you're walking around with a hammer for long enough,
• 23:54
  everything starts looking like a nail, right?
• 23:57
  And I think the issue is as identity practitioners, we are
• 24:00
  looking at all of these NHI issues with an identity lens on.
• 24:06
  And, and that identity lens has been primarily focused on
• 24:09
  workforce and human identities for a very long time.
• 24:13
  And, and I kind of want to go back to something else that you
• 24:15
  said in that too, is like, we feel like we have a pretty good
• 24:17
  grasp on, on human identities. I think most organizations still
• 24:21
  struggle with some of those things, right?
• 24:23
  They, they still struggle And, and it, it's been many, many
• 24:26
  years where we supposedly had the check box on those things,
• 24:29
  MFA everywhere And, and to your point, streamlined life cycle
• 24:33
  across your entire organization. The problem with NHIS is that
• 24:39
  they are so different in so many different ways.
• 24:41
  And I also want to say the NHI term is kind of really, really
• 24:46
  broad. And you know, we're, we're,
• 24:48
  we're kind of just throwing a bunch of stuff into that term
• 24:51
  when realistically the ones that we're probably talking about
• 24:54
  are, are, are kind of like the machine identities.
• 24:56
  And we also include personal access tokens and API keys and
• 25:00
  all those other things. And they're all going to be
• 25:01
  treated differently. And I think that's, that's one
• 25:03
  of the bigger differentiators for me is human identities are
• 25:05
  relatively easy to, to classify and keep in, in a category.
• 25:09
  But you're going to have sub categorizations of NHIS that are
• 25:13
  going to be treated entirely different in your, in your
• 25:15
  environment, not just from a life cycle perspective, but as
• 25:17
  you mentioned, an authentication and authorization perspective.
• 25:20
  So, you know, it's, it's vast and it's bigger than human
• 25:24
  identities or workforce identities.
• 25:26
  And we still haven't done all the things we need to do on, on
• 25:30
  that side. And now we're faced with, with
• 25:33
  all these things. And I, I think that's why we see
• 25:35
  it kind of tailing back a little bit.
• 25:37
  You're bang on. No system of truth, no source of
• 25:39
  record, no way to really do life cycle.
• 25:41
  How do you maintain ownership? How do we do the notion of least
• 25:45
  privilege for these things? And and, you know, make sure
• 25:48
  that that's somehow maintained over time.
• 25:50
  Life cycle for non human identities, you could argue in
• 25:54
  certain cases should not be directly tied to a human.
• 25:58
  There may be a human in a loop, but in the instance of an
• 26:01
  application or a container, why wouldn't you want to try and and
• 26:05
  and join those together? And that way when the life cycle
• 26:08
  of the application is over, IE you're sunsetting this
• 26:11
  application, all the non human identities that are associated
• 26:14
  with that application would subsequently be be sunsetted as
• 26:18
  well or, or decommissioned in that sense, right?
• 26:20
  Rather than this idea of, Oh yeah, well, we didn't use that
• 26:23
  app for the last two or three years, It's gone now.
• 26:27
  And I've pulled in an NHI solution and now I see that
• 26:30
  there's still 5 service accounts and three API keys and a bunch
• 26:33
  of other things that were associated with that.
• 26:35
  And they've just been sitting there for that that like the
• 26:37
  time, right? So.
• 26:39
  Yeah, I want to follow up on a point you made there, the term
• 26:43
  NHI. I also like this like become
• 26:46
  controversial, right? We had Felix on the show few
• 26:49
  months ago and he doesn't like the term.
• 26:52
  I almost kind of think it's like just a bucket, almost like, you
• 26:58
  know, for to help the human brain organize things.
• 27:02
  OK, you have humans and then you have not humans, just like you
• 27:05
  have employees and non employees.
• 27:08
  It's a non employee population. That means a lot of different
• 27:12
  things. But generally speaking, it does
• 27:14
  mean human beings. But when you get into the non
• 27:19
  human identities, you've got devices, you've got generally
• 27:24
  speaking, workloads, but even within workloads you've got
• 27:27
  service accounts and not service accounts.
• 27:30
  And the not service accounts have always been hard to manage.
• 27:34
  And now with like Terraform and things like that, it's just a
• 27:38
  whole new ball game. But I don't even think like
• 27:41
  machine identities. Maybe that's too general of the
• 27:43
  term. You're talking about devices
• 27:45
  because device and I here I am, Jeff Troy, I can't believe you
• 27:50
  using the term device identity, but here I am.
• 27:54
  I'm saying device identity because it's part of the Zero
• 27:57
  Trust framework, right? Like if I can match Steve up to
• 28:01
  the device I know Steve uses and they can pat, I can pat.
• 28:06
  Either it's a managed device or it's passed some kind of health
• 28:09
  check. I'm going to let Steve move
• 28:12
  forward and have access to this resource.
• 28:16
  And then also on machines I've got like thermostats and other
• 28:20
  things that you know, those are the ones I really don't think
• 28:23
  have identities. I think they just have accounts,
• 28:26
  they authenticate, they report data, etcetera.
• 28:29
  All right, I'm not going to go down that road, but let me.
• 28:33
  Jim, how can you have an account without an identity?
• 28:38
  Oh my gosh, we're not going to go into the chef because
• 28:42
  otherwise we will never get back to Steve and there's.
• 28:45
  A thought on the nomenclature though, right?
• 28:47
  Like so, so this, this idea, I don't think it matters, right?
• 28:50
  And this is just my opinion. I, I only bring up the NHI thing
• 28:54
  because it's a hot topic. Some people like it, some people
• 28:56
  don't. I'm kind of of the mindset as
• 28:58
  long as we're talking about it and it's bringing awareness to
• 29:02
  what that might mean in organizations from a
• 29:04
  practitioner's perspective, I don't care what you call it
• 29:07
  because the notion of sub classification is going to have
• 29:10
  to happen regardless. Further to what I was just
• 29:12
  saying before, right? You've got 10/20/30 fifty
• 29:17
  different types of non human identities and you know, your
• 29:20
  standards and and compliancy metrics for each one of those
• 29:26
  are going to be vastly different.
• 29:28
  So you're going to have to sub categorize all them.
• 29:30
  So call it all NHI if you want, and then sub categorize the, you
• 29:34
  know, the type of non human identity and then go from there.
• 29:37
  Because let's face it, when we get to the point where we're
• 29:39
  developing policy against these things, nomenclature does
• 29:43
  matter, right? So calling it an NHI is fine.
• 29:46
  But then, you know, a sub categorization explicitly
• 29:50
  calling out the type of non human identity is going to be
• 29:52
  critical because there's going to be differences in policy and
• 29:55
  and and compliancy requirements against each and everyone,
• 29:58
  right? So I'm going to just say
• 30:00
  something rare. I agree with Jim somewhat in
• 30:04
  that there is, I think the human brain likes to put things in
• 30:08
  buckets. So you get humans and you get
• 30:10
  non humans and then under humans you've got employees,
• 30:14
  contractors, partners, customers, citizens, blah blah
• 30:16
  blah, right? And on the non human side you've
• 30:19
  got machines, devices, agents, service accounts, like all that
• 30:24
  kind of stuff. So I want to try and simplify
• 30:27
  this for the people who are like, I don't know what the heck
• 30:30
  these guys are talking about anymore.
• 30:32
  So when we talk about Nhis, like what should people know about
• 30:37
  that? Are they just a alternative form
• 30:41
  of like a human identity? It's still an account.
• 30:43
  It still has a secret assigned to it, either a password or
• 30:47
  certificate or something. You still need to create them.
• 30:50
  You still need to remove them. You still need to change their
• 30:53
  authorizations. Is that too simple of a way of
• 30:56
  looking NHI or are there other things that as a practitioner I
• 31:01
  should know about NHI from your perspective Steve?
• 31:04
  I think it, I think that's OK, honestly, I think it's OK to
• 31:08
  simplify things and and then kind of dig deeper as you, as
• 31:11
  you get into it. You know, I would say that there
• 31:14
  are some instances where we're kind of talking about secrets
• 31:17
  and not necessarily identities when it comes to NHI.
• 31:20
  They, they just get blown together and we end up solving
• 31:23
  for it in one way because no one really wants to own secrets
• 31:26
  match, but overall in organizations anyway, right.
• 31:29
  So this is kind of bringing awareness to it and a lot of the
• 31:32
  NHI solutions are starting to focus heavily on secrets
• 31:34
  managers because they know that's where the information
• 31:37
  they need is, right? That's where the visibility is.
• 31:39
  And then subsequently being able to transition potentially
• 31:41
  between secrets managers where you need to is an added benefit
• 31:45
  to organizations. So like that's one thing I, I
• 31:48
  know it's kind of branching off of what you were asking, but it
• 31:50
  is one benefit that I'm seeing from some NHI solutions where
• 31:55
  historically it would be challenging to have a single
• 31:57
  pane of glass. I hate that I just said that
• 32:00
  related to secrets management, right?
• 32:02
  There used to be in the old days a notion that we would build it
• 32:07
  and they would come. So I am going to put an
• 32:10
  enterprise secrets manager in our company and everybody is
• 32:13
  going to come to it. And that's where they're going
• 32:15
  to get their secrets and that's where you're going to do their
• 32:16
  vaulting and everybody's going to come to it.
• 32:18
  We're all going to be happy and there's only one place to look
• 32:20
  there. They'll be nowhere else.
• 32:22
  That didn't last very long, right?
• 32:24
  Cloud came, SAS came, the expansion came, and even when it
• 32:28
  was located in OMCRAM, all kinds of shadow organizations that
• 32:33
  were doing secrets management in their own ways.
• 32:35
  So I think one of the things that inadvertently NHI solutions
• 32:38
  are looking to solve is that ability to just meet you where
• 32:42
  you are and as a practitioner or stakeholder related to that is
• 32:45
  incredibly important, right? So if I go to a developer and I
• 32:49
  say, Hey, guess what, you're operating in AWS right now and I
• 32:52
  know that you have a lot of features and functionalities
• 32:54
  that you like with with key manager, but I need you to come
• 32:58
  and use X solution. They're going to say no.
• 33:02
  And if they did say yes, they'd say yes for one or two things.
• 33:04
  And then they'd go around me and do it some other way.
• 33:07
  So the the the thing that it's solving for is a centralized
• 33:11
  location where you can have visibility into multiple secrets
• 33:14
  managers across your clouds, across your on Prem
• 33:16
  environments, and then being able to actually have visibility
• 33:20
  and and actually actually ability into each one of those
• 33:23
  things. So it's kind of an added benefit
• 33:25
  that that could be a selling feature for folks, you know, if
• 33:27
  they're looking to solve for that.
• 33:29
  But I think the the meeting and where they are really important
• 33:32
  and and again, it it the the point gets even further when
• 33:35
  you're talking about how to control non human identities or,
• 33:38
  you know, kind of rain them in which I assume we'll we'll chat
• 33:41
  about at some point here too. So.
• 33:43
  Well, I like that tenant of meeting people where they are
• 33:46
  because you're absolutely right. People are like water.
• 33:48
  They will float around the rock. The rock in this case is like an
• 33:51
  enterprise vault that nobody wants to use because it just
• 33:53
  sucks. What are some other things that
• 33:56
  you can think of? So what I'm thinking here is
• 33:58
  like, OK, if you could go back in time knowing what you know
• 34:01
  now and say, OK, we need to get a handle around NHI for our
• 34:05
  organization. What are like the first two or
• 34:07
  three steps that you would take that someone out there is
• 34:10
  listening today? And they're like, man, I don't
• 34:12
  even know where to start. Like how would I get through
• 34:14
  this? Like what are the first two or
• 34:15
  three things to think about to kind of get them started on
• 34:18
  their path? Yeah, I think, I think, you
• 34:21
  know, if, if you already have an environment that you've
• 34:23
  inherited and you can't start net new, that's the question,
• 34:27
  right. We're we're not talking about a
• 34:28
  net new Greenfield, we're talking about I have an
• 34:30
  environment that I need to address.
• 34:32
  I think visibility is key, right.
• 34:34
  You have to know what you're dealing with.
• 34:36
  And if you don't, you can't really address it in in the way
• 34:39
  that you'd need to. So getting something that can
• 34:41
  provide you visibility into what non human identities or service
• 34:46
  accounts that you have in your organization is, is, is a really
• 34:49
  good starting point. I would say the next one is tied
• 34:53
  to Jim's idea or the thing that he said earlier about there's no
• 34:56
  system or true source of record. So that's a real problematic
• 35:00
  thing. And we saw it early on with
• 35:02
  service accounts where they were just being created ad hoc.
• 35:05
  I need a service account. Great.
• 35:07
  You created a ticket. It came to the account
• 35:09
  management team and somebody provisioned that service account
• 35:13
  in an ad hoc way. So they did it this way for this
• 35:15
  account and the next one that came in, they did it a different
• 35:17
  way. There was no standardization or
• 35:19
  automation in place to say these are the attributes and things
• 35:22
  that I need to have for these service accounts to make them
• 35:25
  manageable over time. A reasonable description, an
• 35:28
  owner, absolutely classification within your directory, services
• 35:33
  like those would all be important things.
• 35:35
  If you don't do that, we hear this term all the time, your
• 35:39
  data is not clean, your identity gaze not clean.
• 35:41
  That one drives me a little bit crazy because I haven't met
• 35:44
  anyone yet who can tell me what clean identity data looks like.
• 35:47
  And, and that I can just take that and just make my data clean
• 35:50
  and then kind of walk away and retire, right?
• 35:53
  I love the idea of that, but I would love if someone could
• 35:57
  steer me in the right direction to even some documentation or
• 36:00
  something that says this is what it should look like.
• 36:03
  So it's, it's that, right? You're creating tech debt by
• 36:06
  doing things ad hoc. So that would be the second
• 36:08
  thing thing I would say is make sure that you have a
• 36:10
  standardized process for each type of non human identity that
• 36:13
  you're creating. Don't create things ad hoc.
• 36:16
  It may be in different locations, right?
• 36:18
  Because there are a lot of cooks in the kitchen.
• 36:20
  This is another issue with with non human identity creation is
• 36:24
  it's not just the identity team that's creating them.
• 36:26
  For service accounts in Active Directory, you kind of have an
• 36:28
  advantage because you could say this is how all accounts get
• 36:31
  created here and these are the people that can do it.
• 36:34
  Now you have cloud, now you have SAS, now you have local accounts
• 36:36
  on on various things and you know, it's it's very unwieldy.
• 36:41
  So the visibility will help with that.
• 36:42
  The classification would be something that you would have to
• 36:45
  address and then standardization of what it should look like in
• 36:49
  an ideal state for each one of those non human identity types.
• 36:53
  Steve, I love the way you talk about these things.
• 36:57
  You said you, you dropped the term agile like when you jumped
• 37:01
  into the the fray here, you dropped the term agile.
• 37:05
  And I think agile is great. I think scrum is great if it
• 37:09
  follows the scrum process, if it's just like, hey, we're just
• 37:14
  going to do 15 minute stand ups and then we're just going to go
• 37:18
  off and work on what we want. And it's just a way to not do
• 37:22
  project planning. I think it's crap.
• 37:25
  So why am I bringing that up? I also think this term source of
• 37:30
  record gets abused sometimes where people they'll say, OK,
• 37:34
  what's your source of record for your contractors?
• 37:37
  And some somebody will tell me Active Directory or you know,
• 37:42
  I'm sure I'll head, I'm like, that's not a system of record.
• 37:45
  You're just trying to bypass the process and not really manage
• 37:50
  the contractors and just put them into Active Directory.
• 37:53
  So I know it's kind of off topic, but because you brought
• 37:58
  up the system of record topic and all that, I wanted to get
• 38:01
  your opinion. Can Active Directory be a system
• 38:04
  of record? Can Active Directory be a system
• 38:08
  of record for non human identities?
• 38:12
  You know, it kind of lends me to the idea of that there would be
• 38:15
  something that would be providing it with information
• 38:20
  that we could build life cycle off of.
• 38:22
  I think it's a challenge to have it in Active Directory.
• 38:24
  I'm not sure Active Directory is the right place for that.
• 38:27
  I guess it could be if you had a streamlined automated process
• 38:31
  that said, here is our intake for these type of of accounts
• 38:35
  and that was followed to AT right.
• 38:38
  So this idea of, you know, we could even create a do it
• 38:41
  through your ITSM. I'm requesting a service account
• 38:44
  here, all the things that I need.
• 38:46
  Once that's once that's approved by whoever needs to approve it,
• 38:49
  and you'll have that chain as well.
• 38:51
  Then the provisioning happens at that point and subsequently
• 38:54
  there's a record that gets associated with that, that, you
• 38:58
  know, describes why it was requested and all that.
• 39:01
  It's great to have that system of record, but then like, how do
• 39:04
  you do it with updates, right? So if, if, if let's just say
• 39:07
  work day was my system of truth or source of record for human
• 39:10
  identities. If I change something in in work
• 39:13
  day, that's going to propagate out into everything else.
• 39:16
  If your if your source of record is the intake process would
• 39:20
  almost have to make the ITSM that right, So that if change
• 39:24
  happened there be reflected, that could be catastrophic if
• 39:27
  you're not careful with which attributes that you're changing,
• 39:30
  right. So let's just say it changed an
• 39:31
  attribute that you were doing automation with related to that
• 39:34
  account somewhere in your directory, IE and OU structure A
• 39:38
  tag or, or or whatever, and you would build things around that.
• 39:41
  And someone in the ITSM system said, oh, well, now we're going
• 39:45
  to update this attribute on these things.
• 39:46
  It could break a lot of stuff, so you really would have to keep
• 39:49
  track of dependencies, but I think it's doable.
• 39:51
  Would I recommend it? Probably not.
• 39:55
  Yeah, I think this is where and not all NH is are created equal.
• 39:59
  King account kind of come up right I think for service
• 40:02
  accounts. You should put it where you
• 40:05
  requested first, say what you want, it goes through some kind
• 40:09
  of quality check and then it gets provisioned service
• 40:13
  accounts. That makes sense, but there are
• 40:15
  other environments that need to spin up accounts more quickly or
• 40:19
  the account is already kind of preloaded major changing the
• 40:22
  password or something and it needs to be discovered.
• 40:26
  And I kind of feel like that's a large part of the NHI technology
• 40:32
  model is like start with discovery, see what what NHI or
• 40:38
  machine identities are out there already.
• 40:42
  It's do you agree with that? Is it like a discover first?
• 40:45
  Or does it just is it a not all NH is are built the same and
• 40:50
  different different folks? Is the question related to like
• 40:54
  what would you recommend companies start with?
• 40:56
  Like is, is kind of like, here's the first thing you do,
• 40:59
  visibility is the first thing you do and then kind of move on?
• 41:01
  Is that is that yeah, I, I feel like education is the first
• 41:06
  step, right? So I, I think you have to
• 41:09
  educate your stakeholders in terms of what you're doing,
• 41:12
  right? You have to define what a non
• 41:14
  human identity is and why it's important to you and them,
• 41:17
  right, because they may not understand that they know the
• 41:19
  things that they need to do in their environments.
• 41:21
  And and you know, you kind of know from your identity lens
• 41:24
  what you need to accomplish from an NHI perspective.
• 41:27
  So I think, you know, having those discussions and getting
• 41:29
  everybody on the same page in terms of what it all means is
• 41:32
  probably step one. Step 2 is 100% visibility,
• 41:36
  right? Like, well, there's a people
• 41:39
  part of that too, right? So I think you get the idea of
• 41:42
  here's what we're going to call it across the board, but then
• 41:45
  you have stakeholders and I really like what Felix had said
• 41:49
  previously about this. So I'm, I'm going to, to not
• 41:52
  steal his Thunder, but you know, kind of leverage what he had
• 41:56
  said previously. And that is creating a working
• 41:58
  group of the, the people that are going to be involved in this
• 42:02
  is critical. I don't think you want to do it
• 42:04
  if you, if you don't have all of your stakeholders at the table.
• 42:08
  And it shouldn't be in the notion of we are doing this.
• 42:12
  And here's what your piece of it is.
• 42:13
  It should be tell us what you're doing.
• 42:16
  You have to come into that with open eyes and open ears and
• 42:20
  listen, listen to them about what they need or why they're
• 42:23
  doing the thing they're doing right now.
• 42:25
  It can't be you're doing a bad thing.
• 42:27
  We need to fix the bad thing. You know that that's never well
• 42:30
  received. But what is well received is
• 42:32
  when you walk into the room, you say, you know, it looks like you
• 42:35
  guys are spending a lot of extra time provisioning these non
• 42:38
  human identities and rotating secrets.
• 42:40
  Look, I'd love to help. Can you talk me through why
• 42:43
  you're doing the things that you are right now?
• 42:45
  And then maybe we can come up with something better.
• 42:46
  I'm looking at an NHI solution that, you know, may have
• 42:49
  something that would benefit you.
• 42:51
  Let's talk right? It's, it's a, it's a far more
• 42:54
  effective way of getting people on board with what you're doing
• 42:57
  when you're listening and not telling, right.
• 43:01
  So, you know, I would say that that's the people part
• 43:04
  visibility. We talked about, you know, you
• 43:06
  got to connect everything in otherwise you're, you know,
• 43:08
  you're, you're you're going to miss parts of your environment.
• 43:10
  And you know, we kind of got into the idea of the
• 43:13
  classification, different types of non human identities.
• 43:16
  And then you have the idea of posture management around those
• 43:18
  two, right? So I've discovered them all.
• 43:21
  What's bad about them? What's good about them?
• 43:23
  You know what, what, what are the immediate problems, right?
• 43:26
  You're going to have to level aside on that once you see
• 43:29
  everything, because you can't Unsee it, right?
• 43:31
  Like you're going to be looking at something and there's going
• 43:34
  to be a lot of critical issues that are going to come up.
• 43:36
  This hasn't been rotated in five years.
• 43:38
  This has admin access to this thing or that thing.
• 43:41
  And like, once you know that you can't unknown it and you were
• 43:45
  going to have to address it. And if that is at a large scale,
• 43:48
  you're going to have to eat the elephant in consumable chunks
• 43:51
  because it's not going to be reasonable for you to say, well,
• 43:53
  we're going to remediate everything because you really
• 43:55
  don't even know what you're dealing with.
• 43:57
  So that visibility side and then that categorization, the idea of
• 44:00
  doing some kind of detection response related to it would
• 44:03
  also be good. And then, you know, your your
• 44:05
  table stakes like credential rotation, vaulting, certificate
• 44:10
  management, you know, fill in the blank.
• 44:12
  And then, of course, the last part, which would be like, how
• 44:15
  do I get rid of them when I don't need them?
• 44:16
  How do I know when I don't need them?
• 44:17
  How do I know when they're dormant?
• 44:19
  What metrics do I use? Because it's not necessarily
• 44:21
  like a service account where you can just go to Active Directory
• 44:24
  and say 1 was the not that this is, you know, a die hard thing
• 44:28
  that you should base all your metrics off of, but it's a
• 44:30
  reasonable metric. When was the last time it logged
• 44:32
  in? When did it log on
• 44:33
  interactively? What can I see in the logs that
• 44:35
  tell me that it might be dormant?
• 44:37
  Right? It's a bigger challenge when you
• 44:40
  kind of get things that are spread out into now you're
• 44:42
  talking about potentially local accounts in the SAS environment,
• 44:45
  not just the Federated ones that you have and stuff that an
• 44:48
  administrator corrected or a local account on a server
• 44:50
  somewhere, right? These are all difficult things
• 44:52
  to to to deal with. So figuring out life cycle from
• 44:55
  those based on what you see in a centralized location at least
• 44:59
  gives you a head start. Sorry, I kind of rambled on
• 45:02
  there. No, it's a lot of good stuff
• 45:04
  going on. I feel like there's so much we
• 45:06
  can cover here. And it, I have to take a step
• 45:08
  back sometimes because it's like, OK, how do we, you know,
• 45:10
  how are we going to address this?
• 45:12
  And I, I keep thinking about urgency and speed and fear and,
• 45:20
  you know, and, and some, and some more of that is why do you
• 45:23
  think NHI is so hot right now? Because every conference has had
• 45:28
  a thing about it. It seems like there is a new
• 45:30
  product every 20 minutes coming out that is like going to solve
• 45:33
  our NHA problems. And my thought process is, look,
• 45:37
  this is not a new new problem. This has been around forever.
• 45:39
  We've we've had non human identities forever, right?
• 45:43
  Even service accounts and probably mainframe accounts and
• 45:46
  punch cards before that, right? All kinds of stuff.
• 45:49
  But I think what's driving it for me, and I'm curious if you
• 45:51
  agree or have a different perspective, is this explosion
• 45:55
  of AI and AI doing everything and all these agentic AIS and
• 46:03
  things, not people, things that are going to need accounts to do
• 46:08
  things on behalf of other things or people.
• 46:12
  And the fear of, Oh my gosh, this, this scenario where we're,
• 46:17
  yeah, we have a good handle on our service accounts.
• 46:18
  It's these 150 in our organization all of a sudden
• 46:22
  becomes exponential because there's so many things that are
• 46:26
  going to start talking to each other, especially from that
• 46:28
  agentic perspective. And I'm curious if that fear you
• 46:31
  think is what's driving, you know, the, the hotness of HI
• 46:35
  right now or if it's something else.
• 46:36
  I think it's a couple of things. I think, I don't think it's a
• 46:40
  pat on the back for us, but I think when you think about how
• 46:44
  threat actors typically attack companies now, they don't break
• 46:49
  in, they log in, right? And we've done a much better job
• 46:52
  because of awareness over the last 567 years in terms of
• 46:57
  getting MFA in front of things of all different types, like
• 47:01
  some FAS better than no MFA, you know, argue amongst yourselves.
• 47:06
  But because we've done a decent job with that, it's kind of
• 47:09
  forced people into the shadows. And by people, I mean the people
• 47:11
  that want to do bad things, right?
• 47:13
  If you can't easily log into an account, well, then, you know,
• 47:18
  move on to the next easiest thing and it's ripe for the
• 47:22
  picking. When we think about non human
• 47:24
  identities, right? They're they don't have MFA
• 47:27
  against them as, as, as Jim mentioned earlier, it's, it's,
• 47:30
  you know, there are some solutions that can do things
• 47:32
  like that, but for the most part they don't have it because it,
• 47:34
  it, it would be really impossible to implement because
• 47:37
  there's nobody to, to attest to, you know, that or, or answer to
• 47:40
  the, the multi factor authentication.
• 47:42
  So you have that portion of it and then you have the fact that
• 47:44
  they're over, they're, they're over privileged in most cases,
• 47:48
  right. When you think about it, when
• 47:50
  someone installed an application and they set a service account
• 47:52
  in the old days, what did they tell you they needed because
• 47:55
  they didn't know what they needed?
• 47:56
  Just give it domain admin and we'll figure it out from there.
• 48:00
  So traditionally, and it still happens today, we give more
• 48:04
  permission than we need because we don't want to go through the
• 48:07
  effort of understanding what, what that is.
• 48:09
  So my point here is if it's not easy for threat actors to to, to
• 48:14
  get through human accounts, it's going to be really easy there
• 48:17
  for them to do these things because there's no MFA.
• 48:20
  So they don't have that hurdle. And often times these have the
• 48:23
  privilege that they need to either create other identities
• 48:27
  or tokens or things like that in your environment.
• 48:30
  We're seeing more breaches happen that way.
• 48:32
  So I think it's a combination of the two.
• 48:33
  I think AI has improved their ability to do things from a
• 48:39
  nefarious perspective. It's made it much easier to find
• 48:41
  those things. It's made it much easier to
• 48:43
  exploit those things, not just fishing campaigns and things
• 48:46
  like that, although they've improved significantly as well.
• 48:49
  But I think the fact that Nhis are typically right for the
• 48:53
  picking because of the way that they're configured and managed
• 48:56
  and, you know, there is no real life cycle against them.
• 48:58
  It's easy for them to find one of those to exploit.
• 49:01
  And then again, the privilege helps them just to to to move
• 49:04
  laterally and do more things that they need to do an
• 49:07
  environment. So I don't think we see quite we
• 49:10
  see a lot of breaches being tied to non human identities.
• 49:14
  There's probably, you know, a couple new ones every day.
• 49:16
  There's probably hundreds that we don't see, right.
• 49:18
  It's just that same old story where it's happening.
• 49:20
  But we're, you know, we're not talking about it.
• 49:23
  So, yeah, that that that would be, you know, kind of why I
• 49:26
  think it's, it's a hot topic right now And, and you know why
• 49:29
  it needs to be addressed. The problem existed, but it used
• 49:31
  to be super easy to get credentials.
• 49:33
  Now it's harder to get credentials from humans,
• 49:35
  arguably, but it's easy to get these and, and they're not
• 49:39
  within your four walls anymore, right?
• 49:41
  We don't have the castle and Moat anymore.
• 49:44
  We've opened that up and now identity is at the center.
• 49:48
  Shameless plug. And, and, and so we're able to
• 49:52
  exploit that in any number of ways.
• 49:53
  And it's not just a human identity, it's not human
• 49:55
  identities and machine identities through every
• 49:57
  infrastructure. Well, thanks for the plug.
• 50:02
  You know, I'm just kind of thinking about the the whole
• 50:06
  topic of, you know, kind of that escalation to the service
• 50:12
  accounts. And This is why, I mean, I think
• 50:14
  it's just so critical what you're talking about.
• 50:17
  And probably, you know, I'd like to always have within our show
• 50:20
  kind of things that are actionable that people can take
• 50:24
  away. If you're not thinking about
• 50:25
  those service accounts that have been around for a long time that
• 50:29
  are probably over provision, like you got to get those under
• 50:34
  control. Like that's got to be one of
• 50:36
  your high priority items for this year.
• 50:38
  Doesn't really take generally doesn't take a lot of budget,
• 50:41
  something that you can do without budget.
• 50:44
  The hard part is your starting point.
• 50:48
  Your starting point is someone created that account back in the
• 50:51
  90s and nobody showed it off since.
• 50:53
  SO. Yeah.
• 50:56
  Jeff and I were preparing for a resilience and recovery show
• 51:00
  today where this, you know, it's the standard escalation path
• 51:03
  that starts with what you talked about.
• 51:06
  The bad guys don't break in, they log in and then they tried
• 51:10
  to take over an account with weak credentials, no MFA or get
• 51:14
  a help desk account and just reset the password.
• 51:16
  So, you know, you almost have to think about that.
• 51:20
  It it's, it's, it's a challenge to as a practitioner in an
• 51:23
  organization because it's not glamorous, right?
• 51:25
  When you go back to your management and you say, hey,
• 51:27
  listen, I got to assign three people to go through all these
• 51:31
  non human identities and find owners and remediate them and
• 51:35
  change the passwords and find where they are and not break the
• 51:37
  business. And that's going to take me 6
• 51:39
  months to a year to do that for the, you know, 1000 NHIS that we
• 51:43
  have that we're dealing with. That's not something that that
• 51:47
  people typically are like, yeah, OK, great.
• 51:49
  Here's a pat on the back and here's the money to do that.
• 51:51
  It's, it's more like, why do we need that?
• 51:54
  Like, why, why can't we just have AI do that or, you know,
• 51:57
  fill in the blank, right? It's not glamorous.
• 51:59
  And so I think that because it's hard work and it's not something
• 52:03
  that's that's shiny and, and showcasing it gets ignored a
• 52:06
  lot. Well, we won't worry about that.
• 52:09
  But you know, it's, it's OK. We, we, we don't want to take
• 52:11
  the risk of breaking the business versus the risk of, of,
• 52:15
  you know, the potential security breach for your password.
• 52:17
  That's 8 characters and reused 20 different times for 20
• 52:21
  different accounts in the organization, and no one's
• 52:23
  changed it for 12 years, right? Yeah, it's unfortunate that even
• 52:27
  comes back to passwords that don't everyone say the word
• 52:29
  password again, but. Yeah, we're not there yet.
• 52:32
  Yeah, we're getting there though, right.
• 52:34
  It's there's a, there's a lot of improvement.
• 52:36
  You said something earlier too, and I wanted to circle back on
• 52:40
  it because it was a really good point.
• 52:43
  And and it's it's basically this notion of like, how do we
• 52:47
  provision these things or, or or create them in a way that's
• 52:51
  that's, you know, standardized for us.
• 52:53
  And again, here's the lens, the the the traditional I am lens
• 52:57
  were like, bring it into one place and have everybody come to
• 52:59
  us and we'll take care of provisioning.
• 53:00
  And then we know what's going to be done, right.
• 53:03
  You're essentially crippling the business in productivity at that
• 53:06
  point too, right. So the challenge with non human
• 53:08
  identities is like you're going to have to allow them to be
• 53:11
  created in all of those different places in order for
• 53:15
  you to to to maintain your level of efficiency, effectiveness in
• 53:20
  those organizations. Allowing your engineers, your
• 53:22
  users or whomever to do things at the speed in which they need
• 53:25
  to do them. So, you know, tailing off
• 53:28
  something where you can talk to them about what you're
• 53:30
  provisioning them this way. Now standardize that or create
• 53:34
  in an automated fashion, but do that in your area, like a
• 53:36
  governance model for those things in each one of those
• 53:39
  areas is is a challenge, but it's something that needs to be
• 53:42
  done. And, and Jim, when you were at
• 53:45
  the non human identity workshop, I said something in one of
• 53:49
  those, those sessions and it was the term NHI, whack a mole.
• 53:55
  And that's what ends up being happening here, right?
• 53:57
  Is you, you fix the problem or you see the problem, you
• 54:01
  identify it and you remediate it.
• 54:02
  And then it just comes back again or a new one pops up
• 54:05
  because it's being created ad hoc in these environments,
• 54:07
  right? So you'll get a grasp on that
• 54:09
  idea of how can we meet them where they are?
• 54:12
  How can we not impede the, the speed of business, but create
• 54:17
  things in an automated fashion so that we're not playing NHL
• 54:20
  whack A mole forever? I think is, is, is part of the,
• 54:24
  the thing that that is a challenge to solve for now,
• 54:27
  clouds, maybe you have a cloud team and maybe that cloud team
• 54:30
  has a governance model. Talk to them, tell them that you
• 54:33
  know this is an issue for they should be a stakeholder.
• 54:35
  They should have a seat at the table.
• 54:36
  They should describe to you why they're creating those.
• 54:39
  You're developers, CICD, you, you have to know what they're
• 54:42
  doing 'cause the problem is, I think Felix brought it up.
• 54:45
  Half the time people come to the identity teams and say, here's a
• 54:49
  problem that I have and we say, yeah, let's create you a service
• 54:51
  account and, and, and move you on your way when there are
• 54:55
  better ways of doing it. So, you know, educating
• 54:57
  yourselves, we'll learn a lot by talking to them.
• 54:59
  And, you know, I think we should all, you know, be humbled once
• 55:02
  in a while, once in a while. And, and, you know, listen and
• 55:06
  look and learn about what you're ultimately hopeful to support
• 55:10
  and help with 'cause we're, we're all in this together.
• 55:12
  If you know, if, if we can help them out and make their lives
• 55:15
  easier, there's your, your KPI and your win that everybody
• 55:19
  wants to see. I made it such that developers,
• 55:22
  you know, I didn't impede them at all.
• 55:23
  And now they're doing things in a secure way.
• 55:25
  It's a win, right? I think those things are things
• 55:27
  that you need to address and and hopefully solve for
• 55:30
  collaboratively rather than thou shalt do it the way I say you
• 55:33
  should do it. Yeah, I mean, that doesn't work.
• 55:37
  This is a very similar challenge to what we saw when cloud
• 55:41
  platforms started showing up in the enterprise.
• 55:44
  It was like, Oh yeah, they've got a couple of EC2 instances.
• 55:48
  They use them for dev. A year later was like, Oh yeah,
• 55:52
  it's production and there's 100 servers.
• 55:55
  And it's like, oh, I better do something about this.
• 55:58
  I'm the identity practitioner. But if you just went in and
• 56:01
  kicked down the walls and said, hey, all, all accounts that you
• 56:06
  need have to go through service now and then they'll get
• 56:09
  provision. We have a 48 hour SLA.
• 56:12
  You're going to impede the business.
• 56:15
  You're going to be the become the most unpopular person in the
• 56:18
  department. So don't do that.
• 56:21
  But at the same time, you can't just say, OK, well, I got here
• 56:26
  too late. I'm not going to do anything.
• 56:28
  I think what you have to do is kind of what you're talking
• 56:30
  about this why I say, you know, there's an element of being
• 56:35
  political. You know, that sounds like such
• 56:37
  a dirty word these days. But, you know, shaking hands,
• 56:41
  kissing babies, but also just working with other people,
• 56:44
  seeing them as important peers. And you have to arrive at a
• 56:49
  solution together. Hey, we need to have visibility
• 56:52
  over the entire enterprise environment.
• 56:54
  We need to do XY and Z and then get them on board with what
• 56:59
  you're trying to accomplish and see if you can find a way to
• 57:02
  accomplish that. I think the same thing applies
• 57:05
  with NH is kind of we're getting to the table late because I
• 57:09
  think NH is started 20 years ago, 30 years ago, but they're
• 57:14
  they're much more prevalent now. So it is a bigger issue and we
• 57:18
  just can't go in and kick down the walls.
• 57:23
  The point I wanted to make also, I think earlier when we were
• 57:25
  talking about AI is we're talking about like this AI
• 57:29
  versus AII. Think of it as like spy versus
• 57:32
  spy. You know, we defend ourselves
• 57:34
  with AI. You know, it's, it is a foregone
• 57:39
  conclusion. Some people are going to get
• 57:41
  through the wall and hopefully AI can help prevent that as much
• 57:46
  as possible by identifying these like headless browsers or
• 57:50
  whatever it is about their contacts makes them look fishy
• 57:54
  or after they get in the door and they start doing weird
• 57:56
  things, shutting them off. That's AI for I am really, I
• 58:02
  want to ask you about I am for AI.
• 58:05
  So in other words, I've got these new business applications
• 58:08
  that are leveraging chat or Gemini, maybe it's a copilot.
• 58:13
  You know, I feel like copilot, it's kind of a Microsoft centric
• 58:17
  solution. So if you're on Ontra ID, it's
• 58:21
  like you just leverage that. But I don't think that's going
• 58:24
  to be enough for the business for most businesses.
• 58:27
  And I think they're going to build their own recipe on an in
• 58:32
  house AI platform. So it's going to get even
• 58:35
  trickier. Have you given this topic much
• 58:39
  thought? Do you have in your mind a a
• 58:41
  framework or an approach to doing IM for AII?
• 58:47
  Have a lot of opinions about this.
• 58:48
  It's probably not surprising. I think there's a lot of really
• 58:53
  good thought going out for this right now.
• 58:56
  One of the things that I, I kind of stick to here is the idea
• 58:59
  that that we're, we're new on all these things, right?
• 59:02
  Specifically related to a gentic AI in, in AI in general.
• 59:06
  And we're moving faster than we did with anything else, right?
• 59:09
  It's the worst it's going to be right now and it's only going to
• 59:12
  get better and it's only going to get more complex and more
• 59:14
  complicated. I hate to keep going back and
• 59:16
  playing the repeater, but you know, we talked a little bit
• 59:19
  earlier about like looking things through a traditional IM
• 59:22
  lens and maybe not looking at things as we should because this
• 59:26
  is not a use case that we've seen before.
• 59:28
  It's going to be vastly different than than what we've
• 59:31
  seen before. To your point, you know, there's
• 59:34
  a lot of underlying requirements and dependencies that we're
• 59:38
  going to see for a gentic AI specifically around data
• 59:42
  modelling, data classification, data loss, provincially data,
• 59:45
  data, data, data, data, right? If you don't have an
• 59:47
  understanding of what your data is and where it is, you're going
• 59:51
  to be in real trouble when you unleash an AI of any kind
• 59:55
  against it, right? Specifically around the
• 59:58
  authorization piece, because I think that we haven't solved for
• 1:00:01
  that one. That's one where.
• 1:00:05
  As an industry, we've focused primarily on authentication and
• 1:00:08
  we've kind of left authorization on its own right.
• 1:00:11
  We do it individually on an, on an application by application
• 1:00:13
  basis. In most cases.
• 1:00:15
  You know, it's really difficult to decouple that.
• 1:00:18
  You know, we, we, we, we don't spend much time focusing on
• 1:00:21
  that, although there are folks that are trying to do that now
• 1:00:24
  like Austin is a great example of, of people who are taking us
• 1:00:28
  the right way and, and trying to drive us forward.
• 1:00:30
  I bring this up because it's going to get much worse with a
• 1:00:33
  Gentic AI. Right now we have MCP, now we
• 1:00:36
  have a 2A. It's not just agents that have
• 1:00:38
  access to things, it's agents that have access to agents that
• 1:00:40
  have access to agents that have access to things and stuff.
• 1:00:44
  And they are going to do what they need to do to get their job
• 1:00:49
  done by whatever means they have, right.
• 1:00:52
  So it's not going to, it's not going to say, well, hang on a
• 1:00:54
  minute, you're asking for something that I probably
• 1:00:56
  shouldn't give you. It's going to say, Oh yeah, I
• 1:00:58
  have this information over there if you haven't put the correct
• 1:01:00
  guardrails on it. So where I was going with the
• 1:01:03
  idea of like using the, the IAM traditional IAM focus lens on a
• 1:01:08
  Gentek AI is we still haven't really gone down the road of
• 1:01:12
  developing protocols and standards specific to this
• 1:01:15
  because it's so new. We're trying to make it work
• 1:01:18
  with what we have, right? And we've gone through this
• 1:01:20
  exercise before, right? So we're trying to use Oauth,
• 1:01:23
  right? Awesome.
• 1:01:23
  So we've, we've appended Oauth. Now you know that we can do some
• 1:01:26
  extra things in it that we couldn't do before.
• 1:01:28
  And that's helping us with this use case of I'm going to operate
• 1:01:31
  on behalf of Steve to do this thing.
• 1:01:33
  So please use what Steve has access to as your guardrail for,
• 1:01:39
  for for what you need. But it's not fine grained
• 1:01:41
  enough. It's not control.
• 1:01:42
  It doesn't provide enough control for us to do the things
• 1:01:45
  that we need to do with the Genta Ki.
• 1:01:47
  So I think honestly, there are lots of really smart people
• 1:01:51
  creating a lot of really cool frameworks.
• 1:01:53
  Right before Identiverse Patrick Parker released, you know, a
• 1:01:57
  thought of his just like, you know, framework of, of what we
• 1:02:01
  could talk about. I don't know if you saw it, but
• 1:02:03
  you should check it out. And he called it area.
• 1:02:05
  I don't know if it's because that's where the conference was
• 1:02:08
  and he was being, you know, I don't know well enough to know
• 1:02:11
  if he made that correlation. I have to assume he did.
• 1:02:13
  But ARIAI don't know what the acronyms stand for.
• 1:02:16
  Somebody will be able to look it up.
• 1:02:17
  But it was this framework basically talking about just
• 1:02:20
  that, right? We're going to have to be able
• 1:02:22
  to identify these things with a with a very unique identifier
• 1:02:25
  that it says it's an agent. We're going to have to be able
• 1:02:28
  to do an authorization model that happens at at runtime.
• 1:02:31
  We can't do things that have been time with these things
• 1:02:33
  because we need them in the moment.
• 1:02:35
  We also have to have it be contextual, right?
• 1:02:38
  We can't have something change in the environment.
• 1:02:40
  And you say you have access to do all these things and now
• 1:02:43
  there's a vulnerability or a patch or, or, or something
• 1:02:46
  that's not available. We still allow you to access
• 1:02:48
  those things. So all of these things.
• 1:02:49
  And then for the agents themselves, you're going to have
• 1:02:52
  to have zero knowledge proofs and be able to do know that that
• 1:02:56
  whole who you are, who you say you are, that verification is
• 1:02:59
  going to have to happen between the agents.
• 1:03:00
  So there's a lot of moving parts in this and I think in pockets
• 1:03:04
  we're solving for it. But I suspect when, you know,
• 1:03:07
  talking to a few people in the industry who are much closer and
• 1:03:10
  much smarter than I am in in these spaces, they're telling me
• 1:03:14
  that it's coming relatively soon in terms of some some standards
• 1:03:17
  that we may be able to use to, to help build this out in a
• 1:03:19
  better way. So I don't really have like an
• 1:03:23
  exact framework that you should use for it.
• 1:03:26
  You know, I just really feel like the authorization pieces is
• 1:03:29
  is going to have to be a big part of whatever we solve for.
• 1:03:33
  And that Aria is agent relationship based identity and
• 1:03:38
  authorization. Thank you.
• 1:03:40
  I'll I'll find a link to it. It was a a LinkedIn post I think
• 1:03:43
  that I saw a while back, so I'll look for that and put that in
• 1:03:45
  our show notes here. I feel like we're just hitting
• 1:03:49
  the tip of the iceberg when it comes to authorization.
• 1:03:54
  That has been sort of like the shadow, you know, in the room
• 1:03:57
  for so long. And now there's finally some
• 1:04:00
  traction around trying to figure out.
• 1:04:02
  But I have a feeling we're in for decades of pain.
• 1:04:04
  And I, and I don't mean that like, you know, I literally
• 1:04:08
  decades of pain because think of how many applications you're
• 1:04:12
  using today and how many of them have, you know, long life
• 1:04:15
  cycles, ERP systems, Active Directory still around, right?
• 1:04:20
  Things like that. SAP, they're not going to go off
• 1:04:22
  and change their authorization model, which means we're going
• 1:04:25
  to be in this weird spot for the next probably few decades while
• 1:04:29
  we're figuring out what does a standard authorization model
• 1:04:33
  look like? Will we even get there?
• 1:04:34
  I have no idea, but I'm, I'm encouraged by folks that are
• 1:04:37
  working on things like off Zen, OPA, cedar, right, stuff like
• 1:04:41
  that. You know, if Aria takes off,
• 1:04:43
  right, that kind of thing. So definitely would want to get
• 1:04:46
  to that some point. I think one thing that gets
• 1:04:48
  slept on in that too is the audit side of it, right?
• 1:04:51
  The technology exists to be able to do policy based access
• 1:04:54
  control and, and you know, it's, it's pretty well documented.
• 1:04:57
  There's a lot of solutions out there that can do that for you.
• 1:04:59
  But when you have an auditor coming in that doesn't
• 1:05:02
  understand maybe how that works, it's going to take a lot of time
• 1:05:05
  for them to come around on, you know, that that actually makes
• 1:05:09
  sense, right? Like that.
• 1:05:10
  It's, it's, it's at the the at runtime, not at min time.
• 1:05:14
  So you're not looking for what role the person had or what
• 1:05:16
  permission they had. They have permission to do it,
• 1:05:18
  but they have to meet the criteria of the policy to be
• 1:05:20
  able to access the resource on set date and set time.
• 1:05:23
  So I, I really feel like, yeah, I mean, I get excited about it
• 1:05:27
  because I think that that's the way of the future.
• 1:05:30
  And let's face it, if we can do something that eliminates the
• 1:05:33
  idea of having to do campaigns, certifications or, or anything
• 1:05:37
  else, the rubber stamping that, you know, we all adore so much
• 1:05:41
  and and everyone loves doing, you know, I'm all for it.
• 1:05:46
  But I think to your point earlier, Jim, too, like if we're
• 1:05:50
  really going to adopt A zero trust methodology in our
• 1:05:53
  environments, we can't, we can't do things that have been time.
• 1:05:57
  We can't, we can't go back to this notion of you just have
• 1:06:00
  standing privilege everywhere. I don't think the notion of 0
• 1:06:03
  standing privilege is achievable.
• 1:06:05
  But I think where you can, you should do things like just in
• 1:06:08
  time provisioning or you should do policy based access control
• 1:06:12
  of some kind so that there is some kind of context or
• 1:06:15
  something that says you can't access it now and something's
• 1:06:17
  changed and now you can't, right?
• 1:06:19
  Versus this always on permission.
• 1:06:22
  So I will disagree slightly in that I do think 0 standing
• 1:06:27
  privilege is achievable, but not yet because it requires, you
• 1:06:32
  know, data and it requires automation for it to be there.
• 1:06:36
  And frankly, most companies aren't even there yet.
• 1:06:38
  So I think it's kind of like this continuous identity thing
• 1:06:41
  is part of 0 standing privileges, is part of zero
• 1:06:44
  trust. All these things require good
• 1:06:47
  data, clean data, right? Sparkly clean.
• 1:06:50
  It requires timely data and it requires orchestration and
• 1:06:54
  automation for it to work. Are we going to get there?
• 1:06:57
  I think so. I think we don't.
• 1:06:58
  I don't think we have a choice. I think we have to go there.
• 1:07:01
  But I live in the now and I know that there are still companies
• 1:07:04
  out there still taking fax requests right, to onboard, you
• 1:07:08
  know, a dockworker somewhere, right?
• 1:07:11
  Not that that's a, you know, which if I think it's happened,
• 1:07:14
  right. So I think there's a lot of that
• 1:07:16
  that that's still out there. Yeah, the only thing I was
• 1:07:19
  thinking on the zero sending privilege piece is that it feels
• 1:07:23
  like it's a striving for excellence or striving for
• 1:07:26
  perfection. I think it's OK to strive for
• 1:07:29
  that. You may never get there, but you
• 1:07:33
  certainly probably start with like if you're trying to strive
• 1:07:36
  for fitness excellence and you have to lose 30 lbs, you start
• 1:07:41
  with losing 30 lbs, right? And if you don't lose all 30 lbs
• 1:07:45
  and you only lose 20 lbs, man, you've made a huge difference.
• 1:07:49
  So that's that's kind of the only thing I really have to say
• 1:07:53
  about it because I do believe it's where we want to be.
• 1:07:57
  I think it solves a lot of the problems.
• 1:07:59
  But I also kind of agree with Steve that like if you aren't
• 1:08:05
  going to be happy until you're 100% there, or like if you
• 1:08:09
  really think you're going to get 100% there, you're probably
• 1:08:13
  going to be retired before hopefully.
• 1:08:16
  What do people typically do when they want to get to 100% of
• 1:08:19
  anything? They hide things, right?
• 1:08:22
  Oh, well, that's got that wasn't in scope for this particular
• 1:08:24
  thing, right? I mean, we see that just to kind
• 1:08:27
  of get past audits and things like that.
• 1:08:29
  It happens all the time. Not, I'm not saying that I agree
• 1:08:32
  with it, I'm just saying that it does happen.
• 1:08:34
  So and then the other part too is, is the, the frictionless
• 1:08:37
  part, right? So it's great to say we're going
• 1:08:40
  to have a 0 standing privilege. You must go through this to be
• 1:08:42
  able to get that privilege. If that privilege takes a week
• 1:08:45
  to to the you're, you're done, right.
• 1:08:47
  You're from a UX perspective, people aren't going to tolerate
• 1:08:50
  that. They may have to tolerate it,
• 1:08:52
  but your feedback from your constituents is going to be just
• 1:08:55
  awful. Now this identity program
• 1:08:57
  implemented this thing and now it takes me a week to get access
• 1:08:59
  to things. Whereas, you know, like I said,
• 1:09:01
  mentioned that the policy based stuff that's done at runtime, if
• 1:09:05
  you meet the criteria of the policy to get access to the
• 1:09:08
  resource, you get it. If you don't meet the criteria
• 1:09:09
  or the context, you don't, you know it, it, it sounds simple,
• 1:09:14
  but the prerequisites to get to that point are exactly the same.
• 1:09:17
  And this is, I'm, I'm circling back again, but the same issues
• 1:09:20
  that we run into for authorization historically
• 1:09:23
  related to IGA programs, IE Jeff's favorite role based
• 1:09:28
  access control that everybody wants to have.
• 1:09:30
  The prerequisites are the same. You still need the same data.
• 1:09:33
  You still need to do all the same heavy lifting in order to
• 1:09:36
  be able to implement the runtime or policy based access control
• 1:09:40
  as you need as you did before. There's still no mechanism for
• 1:09:43
  us to go in and say, I understand what every role,
• 1:09:47
  permission and entitlement means in all 500 of my applications
• 1:09:51
  that are vastly different because different administrators
• 1:09:53
  created them in different models in every every single one.
• 1:09:56
  That still has to be business readable for it to be something
• 1:09:58
  that we can even put into a policy and there has to be
• 1:10:01
  change control around it. So if we're building a policy
• 1:10:04
  after something that's an authorization model that exists
• 1:10:06
  in applications, ABCD and E, and someone makes a change in those
• 1:10:11
  and it breaks the policy, well then you're in trouble too.
• 1:10:14
  So there's a lot of prerequisites that I don't make
• 1:10:16
  it. I don't want to make it seem to
• 1:10:17
  folks like we're saying, hey, just go ahead and do policy
• 1:10:20
  based access control. It's a wonderful miracle thing
• 1:10:23
  that you just wave a magic wand and it solves your role based
• 1:10:25
  access control problem because it's not.
• 1:10:27
  You still have to do the heavy lifting and the hard work.
• 1:10:30
  Well, to do a policy, you have to have data to support those
• 1:10:33
  policies. So, and I'll always get clean
• 1:10:35
  data back to the data, Clean data, sparkling data.
• 1:10:39
  All right, we're well over an hour, so she'll probably start
• 1:10:41
  to wrap things up. Steve, what's your favorite
• 1:10:45
  dinosaur? I'll go, yeah, I can see you by
• 1:10:51
  Jim's hat, what his might be. I don't want to give anything
• 1:10:53
  away here, but that's that's pretty fancy.
• 1:10:55
  I'm going to just take the easy route and say Tyrannosaurus Rex
• 1:10:59
  'cause it was the, you know, the, the, the bad ass of the
• 1:11:02
  dinosaur world. So I'll take that one.
• 1:11:05
  The bad ass with the short arms. Yeah, yeah.
• 1:11:09
  Jim, is is the Triceratops your favorite or is that just the hat
• 1:11:13
  you wear because that's a team you like?
• 1:11:15
  No, it's actually just a golfing hat.
• 1:11:17
  It's not a team that I like. So I knew you're going to ask
• 1:11:21
  this question, right? So I kind of had some time to
• 1:11:23
  come up with an answer. I really just picked the hat
• 1:11:26
  because I thought it was cool looking.
• 1:11:28
  But then I was thinking, OK, going to the gym and I had this
• 1:11:33
  whole story. So I would never pick T Rex.
• 1:11:35
  His arms are so small. Like, you got to work your arms,
• 1:11:38
  bro. The triceratops I got a lot of
• 1:11:42
  respect for. He's like this short fire plug
• 1:11:45
  guy who puts like £500 on his back and squats it 10 times.
• 1:11:51
  So yeah, I'm all about the Triceratops.
• 1:11:55
  All right, well, I'm going to go with the chicken.
• 1:11:57
  Chickens are delicious and they are a dinosaur.
• 1:12:01
  They're actually from the same family of a try of a
• 1:12:04
  Tyrannosaurus Rex. Really, I I, I feel like I want
• 1:12:08
  to change my answer now to something, some dinosaur that
• 1:12:11
  could fly too, because I think that would be a pretty cool
• 1:12:13
  thing. So, you know, maybe or
• 1:12:15
  something. Yeah, Pterodactyl, something
• 1:12:16
  like that too. So they put chicken out and
• 1:12:18
  chicken. Are delicious.
• 1:12:19
  I love wings so, you know, crack me off some of those whenever
• 1:12:23
  you feel like it. Pterodactyl.
• 1:12:25
  Wings. Yeah, so if you didn't learn
• 1:12:26
  anything today at all, just take away that chickens are part of
• 1:12:29
  the theropod family, which is part of the Tyrannosaurus Rex
• 1:12:32
  family to kind of lineage and descendancy.
• 1:12:34
  So, you know, Steve, we're on the same page for the most part.
• 1:12:38
  Everyone should have AI. Everyone should have AI
• 1:12:41
  dinosaurs. All right, let's go ahead and
• 1:12:44
  wrap it up for this week. Steve, thank you so much for
• 1:12:46
  spending the time with us. I feel like we could have gone
• 1:12:48
  in so many different directions and hopefully people are still
• 1:12:51
  listening to this because I think we had a lot of really
• 1:12:54
  good conversation towards the end there too as well.
• 1:12:55
  So I'll put a link in our show notes to your LinkedIn
• 1:12:59
  connection information so people can reach out.
• 1:13:02
  I'll put a link for Patrick Parker's thing around Aria and
• 1:13:05
  that whole thing so people can kind of check that out.
• 1:13:08
  Let's see what else. We're on the web, IDC
• 1:13:10
  podcast.com, we're on YouTube, IDC, podcast.tv.
• 1:13:14
  We'll take it right to it. We are almost at 1000
• 1:13:16
  subscribers, which is pretty amazing considering because we
• 1:13:18
  don't, we don't advertise. It's all word of mouth and
• 1:13:21
  hopefully people continue to check that out.
• 1:13:23
  And yeah, do all that stuff, fun stuff for us, like, like and
• 1:13:26
  subscribe. We've got a bunch of conferences
• 1:13:27
  that will be up coming up soon. So Infosec World in Orlando is
• 1:13:31
  next week. So by the time people are
• 1:13:33
  listening to this, we will be in Orlando.
• 1:13:35
  So if you're hearing this and you're in Orlando, stop by at
• 1:13:37
  Infosec World. And then we've got a done averse
• 1:13:40
  in I guess Washington, DC, but it's really more like Maryland
• 1:13:44
  National Harbor, whatever that is.
• 1:13:46
  We'll be there. And then Gartner in Grapevine,
• 1:13:48
  TX for the year. So lots of discounts for
• 1:13:50
  everything. So go to
• 1:13:50
  ourwebpageidcpodcast.com. You'll see all the current
• 1:13:54
  discounts there. And I just did put up the
• 1:13:56
  Gartner one, which was released last week, so people can check
• 1:13:58
  that out. So all right, with that, we'll
• 1:14:00
  go ahead and leave it for this week.
• 1:14:02
  Thanks everyone for watching and or listening and we'll talk with
• 1:14:05
  you all the next one. You've been listening to
• 1:14:09
  Identity at the Center. We hope you've enjoyed the show.
• 1:14:14
  Make sure to like, rate and review, and we'll be back soon.
• 1:14:18
  But in the meantime, hit the website at
• 1:14:20
  identity@thecenter.com. See you next time on Identity at
• 1:14:27
  the Center.