Latest / Identity at the Center / #335 - Sponsor Spotlight - Beyond Identity

Transcript

#335 - Sponsor Spotlight - Beyond Identity · Identity at the Center

0:00
So people don't have to remember a password, which eliminates a
0:02
lot of identity attacks. Yeah, but everybody loves
0:05
passwords. I mean, we should just have more
0:06
of those, shouldn't we? Well, they were my bread and
0:09
butter. Like when I was a little
0:10
identity nerd like that was a lot of what I learned was how to
0:12
secure password based systems and how often do you force
0:15
people to rotate and what sorts of complexity do you require?
0:18
All this stuff that I was an expert in, like now I don't need
0:21
it all because we've gone past that.
0:23
What do you see as a different shader?
0:25
Because there's a there's a lot of players in this
0:26
authentication space, I guess. What makes you know?
0:28
Let me put my jaded CSO hat on. What makes Beyond Identity
0:32
special or unique in this area? Yeah.
0:35
So we were founded only five years ago.
0:37
So we're fairly new to the identity space, which helped us
0:40
kind of leapfrog a lot of the the legacy infrastructure.
0:43
So we never had passwords in our system.
0:45
There are no shared secrets anywhere in the beyond identity
0:48
architecture. So we're fundamentally built on
0:51
a on a foundation that is more secure and then we have that
0:54
integration with security tooling.
0:57
So we were actually not founded by identity nerds, we were
0:59
founded by security nerds who said, hey, we can solve this
1:01
identity problem better. And so it's a really different
1:06
way of approaching the identity problem than you'll see from
1:08
most legacy vendors. This is identity at the center
1:19
if it has anything to do with IAM.
1:22
This is the go to podcast now your hosts Jim McDonald and Jeff
1:28
Stedman. Welcome to the Identity of the
1:36
Center podcast. I'm Jeff, and that's Jim.
1:37
Hey, Jim. Hey, Jeff, how are you?
1:39
Oh. Not so bad yourself.
1:41
I'm good. You can see my sweatshirt on.
1:43
I'm beyond cold, beyond cold here in February in the South.
1:48
I see what you did there. This is in reference to our
1:50
sponsored episode we're doing today, right?
1:52
That's right, we were having a beyond kind of day.
1:56
All right, well, why don't we get to it?
1:58
We do have a sponsored episode today.
1:59
We've got Beyond Identity. They have been kind enough to
2:02
come on the show, and we'll have Sarah Cicchetti on here in a
2:05
minute. But just to make it clear,
2:06
right, this is a sponsored episode.
2:08
They have graciously donated to our nonprofit to help keep this
2:11
thing running. And everything you hear today is
2:13
going to be the truth as we see it from IDAC and Beyond
2:17
Identity. But let me go ahead and
2:18
introduce Beyond Identity, Beyond identity.com, Go there
2:21
For more information. Actually, Beyond
2:23
identity.com/idac, there'll be a special landing page for that.
2:26
And then they've also got Beyond Con coming up in a couple weeks.
2:29
By the time people hear this on March 20th, that'll be in Palo
2:32
Alto. So definitely go to the website
2:34
and check that out. I'll have links in our show
2:35
notes as well. But let's get to it.
2:37
We've got Sarah Cicchetti, she's been with us before.
2:39
She's the director of product strategy at Beyond Identity.
2:42
Sarah, welcome back to the show. Hey, great to see you guys
2:45
again. It's been a while.
2:47
I think I saw you in passing at Gartner's IM conference at the
2:51
end of 2024. You were with us for episodes
2:55
199 and one O 1, I believe, and now we're in the three hundreds.
2:59
So we got to catch up a little bit.
3:01
But I think the biggest changes, you've moved to a new
3:03
organization. Why don't you tell us a little
3:05
bit about Beyond Identity? And then you got to tell me,
3:08
what does a director of product strategy mean?
3:10
What does that mean to people in the real world?
3:13
It's a completely meaningless title.
3:16
Yeah. So I was at AWS for five years.
3:18
So that was where I was the last two times I was on the show and
3:24
being at AWSI, got the chance to talk to dozens of identity
3:29
startups, hundreds of identity teams all over the world.
3:32
And yeah, I was really floored by the technology that Beyond
3:36
Identity had and wanted to come over.
3:38
And little did I know that at the exact same time, my
3:42
colleague Dean Sacks, also from AWS, was talking to Beyond
3:45
Identity. So we both ended up moving over
3:46
at the same time. And basically what what they
3:52
needed me to do was do some product discovery and innovation
3:56
as well as facilitate Dean and Monty Weissman to do all of our
4:01
standards work. So we go to, we participate in
4:04
the Open ID Foundation, the Internet Engineering Task Force,
4:08
the Fido Alliance, all that work is done by my team.
4:11
And so we figure out where we want to influence standards and
4:14
how we want to move forward there.
4:16
So we're a team of innovators, standards nerds and developers
4:20
who are helping us bring new products to market.
4:23
So what does Beyond identity do? Placing authentication space and
4:27
to what degree and other things. We do.
4:30
So it's a, it's an SSO or it can be only an MFA.
4:35
So it's got kind of two different modes and it's sort of
4:39
sits in the middle where it, it straddles both human and non
4:44
human identity. So the way that we do SSO is not
4:49
typical. So typically you would have
4:52
multi factor authentication, you'd have a password and some
4:54
sort of device where you are verifying that it's actually
4:58
you. The way that Beyond Identity
5:00
does it is we put an endpoint directly on the device itself so
5:04
that we can look at the security posture of the device.
5:07
And then we also integrate signals from all of your
5:12
security tooling. So we can get signals from JF,
5:14
from Z Scaler, from Intune and use those as part of your
5:18
authentication policy to determine whether people get it
5:21
or not. And we can do it continuously as
5:24
people are working to say, hey, is this person still have the
5:27
security posture that they did when they logged in.
5:30
So it's a cool marriage of security and identity and data
5:36
that all comes together with authorization and authentication
5:39
and it's all in one very easy to use product.
5:43
So that's the that's the non human part.
5:45
And then the human part is just the local biometric on the
5:48
machine. That's how we do it.
5:49
So people do not have to remember a password, which
5:52
eliminates a lot of identity attacks.
5:54
But everybody loves passwords. I mean, we should just have more
5:56
of those, shouldn't we? Well, they were my bread and
5:58
butter. Like when I was a little
6:00
identity nerd, like that was a lot of what I learned was how to
6:02
secure a password based systems and how often do you force
6:05
people to rotate and what sorts of complexity do you require?
6:08
All this stuff that I was an expert in, like now I don't need
6:11
it all because we've gone past that.
6:13
What do you see as a different shader?
6:15
Because there's a there's a lot of players in this
6:16
authentication space, I guess. What makes you know?
6:18
Let me put my jaded CSO hat on. What makes Beyond Identity
6:22
special or unique in this area? Yeah.
6:24
So we were founded only five years ago.
6:27
So we're fairly new to the identity space, which helped us
6:30
kind of leapfrog a lot of the the legacy infrastructure.
6:33
So we never had passwords in our system.
6:35
There are no shared secrets anywhere in the Beyond identity
6:38
architecture. So we're fundamentally built on
6:41
a on a foundation that is more secure and then we have that
6:44
integration with security tooling.
6:47
So we were actually not founded by identity nerds, we were
6:49
founded by security nerds who said, hey, we can solve this
6:51
identity problem better. And so it's a really different
6:56
way of approaching the identity problem then you'll see from
6:58
most legacy vendors. So let's talk about the name
7:02
beyond identity. Is there any significance to it?
7:05
Is it just it's a cool name? First of all, the the the domain
7:08
name was available. Tell me about the history there.
7:11
So as I understand it, I was not at the company at the time, but
7:15
the Google Beyond Corp white paper had just come out.
7:18
There was a company called Beyond Trust and a company
7:19
called Beyond ID. And so we decided to just, we
7:22
wanted to add more confusion to the identity marketplace.
7:24
And so we decided to call ourselves Beyond Identity, and
7:27
that's kind of how it went. I love it.
7:30
It's simple and plus, you know, it's, it's, it's there's all the
7:32
vowels are there in the name. So you can actually spell out
7:34
beyond identity.com/IDAC. Go there, visit that For more
7:39
information. So it makes it easy for that.
7:41
I want to turn it over to Jim here in a second because I know
7:43
we want to get into more details kind of around how this works.
7:46
But one of the questions that I get asked a lot to ask vendors
7:50
when they come on is tell me how your customers measure success.
7:55
In this case, authentication. I'm assuming it's things like,
7:58
you know, MFA availability or risk reduction, but how do you
8:02
how do beyond identity customers measure success with your
8:05
product? Yeah.
8:07
So a lot of it has to do with risk mitigation.
8:09
So when they go to their board, their C-Suite, their
8:12
cybersecurity insurers, they can say with a completely straight
8:16
face that they have eliminated entire categories of attack
8:19
factors and that they can guarantee that because that that
8:23
infrastructure simply doesn't exist in their identity
8:26
solution. So that's a huge win.
8:28
And then on the on the usability side, we actually have the
8:34
customers of our customers. So employees of people who who
8:37
use Beyond Identity raving about the user experience.
8:40
They don't have to remember passwords.
8:42
They don't have to get out their phone.
8:44
They can just use the biometric that's right on their laptop or
8:47
right on their device. And we were just you, as you
8:51
said, we were down in Dallas for Gartner.
8:52
We presented with Inspire Brands.
8:54
So Inspire is Buffalo Wild Wings and Dunkin' Donuts.
9:02
So a whole bunch of restaurants and like, they don't have a
9:08
whole lot of attackers trying to get into Dunkin' Donuts, but
9:11
they do need their employees to get in quickly and easily.
9:14
And so after they implemented Beyond Identity, they actually
9:16
had employees coming to them and they're a Texas based company.
9:20
And so the employee said yeehaw, Hallelujah, because they love
9:24
the solutions so much. They loved how easy it was to
9:26
log in. Well, and I love the doughnuts,
9:29
so let's not forget, let's not forget about that.
9:31
But I think this this whole line of what you're talking about
9:36
there with it's kind of the balance between security and
9:40
user experience. It's kind of the classic
9:42
conundrum that we learned in our first days in information
9:46
security. As you ramp up the security of a
9:50
system or a process, the usability, there's more hurdles,
9:54
there's it's harder to use. How do you balance that?
9:58
How do you make sure that you're not going too far in One
10:03
Direction or you know, is that just kind of core built into the
10:08
platform? So it's different for every
10:11
customer, right. So some customers have a really
10:14
high amount of risk tolerance and they are willing to make the
10:18
system a little bit more open to more flexible in order to get
10:25
that usability and that that quick response.
10:27
And we have other customers who are very security conscious who
10:30
really want to lock down the system and say, no, we only want
10:34
these type of biometrics. We only want to get signals from
10:37
these security vendors. And we want to make sure that
10:39
every single authentication respect all these things.
10:41
We want to know these things about the machine that the
10:43
person is logging in on. And so it, it really varies.
10:47
We have a wide variety of customers ranging from high
10:50
usability to very high security use cases.
10:53
I like that a lot. So you kind of there is that
10:56
ability for the customer to kind of like move those levers back
11:00
and forth. But I from what I understand,
11:03
you know, you and I rubbed elbows at the Fido Authenticate
11:07
conference last year. I think you guys are pretty
11:10
heavy into the use of pass keys. Is that kind of part of what's
11:16
baked in? And you know what's different
11:20
about your solution of pass keys?
11:23
Yeah. So we use a, we use cryptography
11:28
that is based on the machine. So if you want to call that a
11:31
pass key, you absolutely can. Lots of people do.
11:34
You could also call that a form of a certificate.
11:36
You could call that a verifiable credential.
11:38
Like there's a whole bunch of ways to describe what we do, but
11:40
essentially we put down a key pair on the machine and that key
11:44
pair is locked into the secure enclave of that machine.
11:46
So unlike say, a Google or an Apple Pass key, it is not
11:50
syncable across multiple machines.
11:52
You can have multiple machines registered to one person and
11:56
that and you can change your settings so that that person can
11:59
add machines to their account. But there is no way to take the
12:03
key, the the cryptographic key pair that's on the machine
12:06
itself and move it somewhere else.
12:09
So that's a key security property.
12:11
That is a a big difference between the way that Fido
12:13
credentials work today and the way that Beyond Identity
12:16
credentials work. OK, so similar but different.
12:20
Similar but different and we're actually we're like we are Fido
12:24
member alliance, we are part of the technical committee there
12:28
and we would love it if Fido would adopt the way that we do
12:31
things and standardize it. We are not trying to make this a
12:34
proprietary protocol. We absolutely embrace standards
12:38
and we want to see this level of security within Fido.
12:40
So we are pushing. For that, that idea of the of
12:44
the key pair sitting on the device and not being able to
12:47
sync those to other devices is really what I'm hearing is kind
12:50
of like the differentiator here and where you'd like to see this
12:53
go is that, is that fair that I describe that accurately?
12:56
Absolutely. So the the problem with synced
12:57
passkeys is that the user can share them, and there's no
13:01
evidence that they've been shared.
13:02
There's no evidence that that wasn't the original user who had
13:05
that passkey. There's no chain of custody for
13:08
where that passkey came from or where it originated or how it
13:11
originated. And we would love for those
13:14
things to exist within the Fido standards.
13:17
They don't exist today, but for right now we have to do it in a
13:20
proprietary way. And that's also outside the
13:23
browser. So that has usability aspects to
13:25
it as well. Where if Google or Apple wants
13:28
to change something about the way that the interface works
13:31
with users for how they store their pass keys, how they
13:33
originate pass keys, that obviously if you're using those
13:37
pass keys for your enterprise, that'll change your whole user
13:40
experience out from under you where you don't have a chance to
13:43
have a say. And so because we're using a
13:46
proprietary mechanism for this, we can make that user experience
13:49
really consistent and secure. Yeah.
13:52
So with Beyond Identity, does it matter if you're coming in on a
13:57
corporate controlled device or bring your own device?
14:00
It does, but we have a lot of customers who use us
14:06
specifically for bring your own device.
14:08
So if it is a corporate controlled device, if it has an
14:12
MDM on it, we can query that MDM in real time and we can say,
14:18
sorry, not real time. We'll be able to query in real
14:20
time once everyone adopts shared signals, which everyone should
14:22
do, but we query it every 15 minutes.
14:26
So we will talk to your MDM and we will say, look, what's the
14:30
security posture supposed to be? Is it there?
14:32
What are the policy settings for this company?
14:35
And then if it's a bring your own device, obviously we can
14:37
look at different things on the device, but it won't have an MDM
14:39
that we can query. Typically though, if you're
14:42
doing BYOD for like a personal device into a work environment,
14:46
they're probably putting some policies or something on your on
14:49
your device. It's pretty rare that I see
14:50
these days a unmanaged personal device with access to company
14:54
resources. But I don't know is, is that an
14:56
accurate assessment, Sarah, of kind of my view of it or do you
15:00
see kind of the Wild West still out there for when it comes to
15:03
managing personal devices on a corporate network?
15:05
Well, when you say bring your own, like you think of someone's
15:08
like, oh, I've got my personal cell phone, right?
15:10
That is a use case we see where we can say, you know, we want to
15:13
make sure that that phone is not jailbroken.
15:15
We want to make sure that it's OS is up to date so we can see
15:18
certain security aspects of that phone that people bring
15:21
themselves. But often BYOD is just
15:24
contractors, right? So it is a managed device, it's
15:26
just not managed by your company.
15:28
And so there are different things we can query in that
15:31
case, but we can make sure that there is a security bar that's
15:34
met by all devices that access the access the systems in your
15:39
company. I want to get back to something
15:42
you mentioned earlier, because you mentioned two of my favorite
15:44
food groups of wings and doughnuts, the other being
15:48
chocolate and nachos. So don't you know, don't come at
15:51
me. That's that's the, that's the
15:52
real food square. Don't.
15:54
Judge. Yeah, that's right.
15:56
Do you have? You told me it was potatoes.
15:58
I thought it was potatoes. Come on.
16:00
There are, I'm sure, a lot of good stories, but do you have
16:04
any kind of stand out stories of how your customers are using
16:07
beyond it Any today that might be either unique or hey, that
16:11
was really cool or just like the yeehaw moment as you kind of put
16:15
before earlier? Yeah.
16:17
So just as just as an aside, because you mentioned Hot Wings,
16:21
both our CEO and our Principal Security engineer, Dean Sachs
16:25
are big Hot Wings fans. And so we did like a little Hot
16:29
Ones imitation episode while we were at Gardner that's going to
16:33
be coming out on our social media soon, where I kind of
16:37
quizzed them about different standards things and made them
16:39
eat increasingly hot hot sauces as we went.
16:41
So that'll be fun to lodge. But your question was about use
16:44
cases. So yeah, one of the primary use
16:49
cases we see is people who have multiple ID.
16:52
PS So either because of acquisition or because different
16:56
departments in in the company were allowed to do identity in
16:59
different ways, identity islands have formed.
17:02
And that's true of almost every company.
17:05
There's a great quote from Brian Poole.
17:07
He used to do identity at Microsoft that says there there
17:09
are two kinds of identity administrators.
17:11
There's the kinds that administer more than one systems
17:14
and the kinds that do not yet know that they administer more
17:16
than one system, right. And so one of the benefits of
17:19
using Beyond Identity just as an MFA level is to say, you know,
17:23
I've got two different ID PS here, or I've got three or five
17:26
different ID PS here. I want one consistent security
17:30
bar across them so that I as the CSO know that there is a
17:35
consistent level of security across my company without having
17:38
to dive into the config of each IDP and make sure that things
17:41
are are identical. So that's one use case we see
17:44
and then the other use case is just straight up SSO.
17:48
It's a really great user experience as a as a single sign
17:52
on. And obviously because we're
17:54
newer, because we have that more secure code base, we are in a
18:00
much better place than companies who have been building up their
18:04
code base for 10 or 20 years. And it's getting getting a
18:07
little rusty and a little creaky and who knows what's going to
18:10
happen? We didn't mean code.
18:14
That's right. Well, you mentioned too having
18:16
that, that, that user experience, right?
18:18
The consistency of the MFA experience is pretty important
18:21
because that's one of the areas that we see users tend to
18:24
struggle with the most of. OK, now we've got a new MFA.
18:27
If we have the similar experience across all of our
18:31
different authentication services, that goes a long way,
18:34
not only for just the use of it, but also support, right?
18:36
It's everybody's using the same thing.
18:39
Documentation can be streamlined to focus on one thing, so they
18:42
have like 8 different ways to do it.
18:44
I got to imagine that plays into the calculus as well, right?
18:47
Absolutely. And you can modify the SSO so
18:49
that different applications have different policies.
18:52
So you can say, look, if you're paying for lunch in the
18:54
cafeteria, if you're registering your car in the garage, like
18:58
that requires almost no policy whatsoever.
19:00
Like like anybody in the company can go do that.
19:03
But if you are touching the HR system, if you are touching the
19:06
production database, right, then we've got a whole boatload of
19:09
policies that you have to satisfy from all sorts of
19:13
different places where we're getting security signals.
19:15
So I have a follow up question, Sarah, with regard to the
19:19
devices. So let's say I'm using an
19:21
iPhone, that's one of the devices that has the Beyond
19:25
Identity Secure Enclave. So it's keeping my
19:29
authentication, my biometric data there locally.
19:33
Is it leveraging the the capability within the iPhone
19:39
platform or whatever device I'm using to, you know, in other
19:44
words, is it using Face ID from my iPhone?
19:49
Is it kind of operating the same way or is it a second interface
19:53
for, you know doing that that face match?
20:00
Yeah. So to be clear, it doesn't use
20:02
your Apple account at all, but it does use the biometrics that
20:06
are registered to the phone as well as the secure enclave, the
20:09
TPM in the phone. So Monty Weissman, who's the
20:13
father of the TPM is on my team, on our on our staff to help us
20:17
understand how we interface securely with the TPM for each
20:21
device. And then on our board is Taher
20:24
Agamal, who will be speaking at Beyond Con on March 20th coming
20:28
up and he's the father of SSL. And so we have a lot of people
20:32
who are well versed in crypto and those APIs to get into the,
20:37
the secure enclave of the iPhone actually didn't exist before
20:40
this company was founded. So like when Octo was founded,
20:43
when Ping was founded, this was not a way that people could do
20:47
identity. It just the, the technology
20:50
wasn't there yet. And so it's because we were
20:52
founded later that we are able to to utilize these technologies
20:56
and say, yes, we can lock those key pairs into the secure
20:59
enclave of the phone. And that's a much more secure
21:04
way to do it. And it's completely localized
21:06
along with the biometrics. So let me put a scenario out
21:09
there. So one of the things that always
21:11
happens with my phone is that if it doesn't recognize my face,
21:14
they'll say enter your PIN and so that I'm entering A6 digit
21:18
numeric value, which you know is knowledge based authentication
21:23
essentially. So does the beyond, did any
21:26
platform have the ability to say, well, it has to be the
21:30
biometric or is it going to fail back to the PIN or is that kind
21:33
of a configuration that your client gets to make?
21:39
Yeah, that can be configured by application actually.
21:41
So you can say look for the parking application, they can
21:45
fall back to a pin. We don't care if they're trying
21:47
to get into the HR database, they have to have a biometric
21:49
and they have to have a biometric that was registered
21:52
since the time, like before the time that the app was installed,
21:56
right? So if somebody gets their phone
21:58
and registers a new biometric because it's unlocked or
22:00
something, that biometric won't work for that application.
22:02
So there's a, there's a wide variety of policy that you can
22:05
put into the into the engine to do cool authentication and
22:08
authorization. Stuff that's awesome.
22:10
That's a neat trick of of screening and no pun intended I
22:14
guess biometrics that were created after a certain point
22:19
you can distinguish timestamp of the biometric itself.
22:22
Did I hear that right? Of the creation of the
22:24
biometric. Yeah.
22:25
OK, interesting. OK.
22:27
You mentioned shared signals earlier and I know we did an
22:29
episode recently with my friend Sean from Disney about this idea
22:33
of continuous identity and kind of threat detection etcetera.
22:36
You mentioned shared signals Cape is part of that continuous
22:41
access evaluation profile. I, I struggle to get that one
22:44
right sometimes. Where is beyond ID fitting in
22:47
with SSF and Cape and sort of this idea of, you know, being
22:52
able to communicate with other technologies in the security
22:55
apparatus or the organizational apparatus?
22:58
Yeah, we're huge investors in SSF and Cape.
23:00
So we'll be part of the Gartner Interop in, in London in March.
23:04
And basically we were doing this before it was cool, right?
23:09
So we, we have always exchanged events with security vendors.
23:14
So you have the ability in your beyond identity settings to say,
23:18
hey, if something changes on the machine, go tell this vendor,
23:21
the security vendor that I'm already invested in that that's
23:23
happening. And you can go the other way as
23:25
well and say, hey, after something happening in Zscaler,
23:28
I want to know about it. And I want to block
23:29
authentications based on that or I want to suspend users based on
23:32
that. And so we haven't kind of always
23:35
done this, but we have proprietary tool like we built
23:37
that all ourselves. That was all a build out between
23:39
US and Z Scaler. It's all proprietary and it only
23:43
pulls every 15 minutes. And so we love this idea of,
23:47
hey, we can actually make this a standard.
23:49
We don't have to make it proprietary.
23:51
You can hook up any security vendor you want just like that.
23:54
And it can be in real time because you have that Cape
23:58
Highway transferring stuff back and forth.
24:01
So we think that that's really valuable.
24:02
We're investing in it and we're really excited to see some some
24:07
relying parties get on board. So we would love to be able to
24:10
because we sit in the middle, right?
24:12
Because we're an SSO and an endpoint.
24:14
Like we have stuff to tell people we are a transmitter, but
24:17
we also like want to hear stuff from people.
24:19
We are also a receiver because we're the SSO and so we would
24:22
love to see like a GitHub or an AWS or something like that, get
24:26
on board with shared signals so that we can tell them, hey,
24:29
something about the posture of this device changed and we don't
24:33
know what your customer's policy is, but we can tell you what
24:36
changed so that your customer can write policy around that in
24:39
the RP itself. I think a lot of people are
24:42
still figuring out how to make this work.
24:46
What does this mean in the real world when we start talking
24:48
about shared signals and communication between apps?
24:52
You mentioned a couple of examples there, but for people
24:54
who just haven't kind of gotten their their heads around, can
24:57
you walk me through just a very basic scenario and kind of maybe
25:02
hopefully make this real for people to help them understand
25:04
kind of the art of the possible? Because I think we're still
25:06
heading that direction and we're not quite there yet.
25:10
Yeah, sure. So we might see a Crowd Strike
25:13
score that suddenly drops. And so we know that there's
25:18
something about that machine that may have been compromised.
25:21
And so we get that message from crowd Strike saying, hey, this
25:23
machine just went from a 99 to A50.
25:26
And you can write policy within Beyond Identity that says, hey,
25:30
if this score drops below 60, you know, they can park, they
25:35
can buy things in the cafeteria, but they can't get to the HR
25:37
systems. They can't get to the databases
25:40
or like, we don't want to see them at all.
25:42
We want to suspend them and have a, have someone from our SoC
25:45
actually look at what's going on with that machine before we
25:48
reinstate this account, right? So that those are the kinds of
25:51
use cases that Shared Signals enables between security vendors
25:56
and ID PS and then between ID PS and relying parties.
26:02
We would love to see something like, so GitHub today has like
26:05
pseudo actions of like, hey, I want to delete this production
26:08
repo or I want to add an admin to this production repo.
26:12
And they can do step up authentication for those things.
26:16
But that's a very course tool, right?
26:20
So you as all you as a, as a customer can say is, yes, I want
26:24
to step up when this happens, but there's no more fine grained
26:27
policy you can write around that.
26:30
Whereas if we had shared signals in place, we could send all
26:33
sorts of signals about what's happening with that machine,
26:35
what's happening with that account, what's happening with
26:37
that user. Maybe they just recovered.
26:39
Maybe they just recovered their account in a way that's a little
26:41
bit sketchy and GitHub might want to do something with that
26:45
that is more interesting than just re authenticating.
26:48
Before Jeff asked, I follow up, I wanted to make the comment
26:51
that, you know, one of the things that you know, you
26:54
brought it up a few times where you're kind of wanting these
26:57
things to be open standard, you're supporting the open
26:59
standard. So I just wanted to say good on
27:01
you for that. Then I also, as you're just kind
27:05
of describing how you could use shared signals to secure beyond
27:10
identity product. I, I started thinking, OK, well,
27:16
how do I know that a drop of 10 points in the crowd strike is
27:21
where I should, you know, drop people from being able to access
27:24
the HR system? So the way I formulated the
27:27
question was this, do you have some way that like people run
27:32
this in kind of learning mode for a while like that they start
27:36
to pick these things up to say, OK, that is the the bending
27:40
point. And then here's the breaking
27:42
point where we start to block all access for example.
27:48
Absolutely. So people often think of us as
27:50
an authentication company, but we're also an authorization
27:53
company. And one of the things you have
27:54
to do when you are an authorization vendor and you
27:57
have a lot of policy and a fine grained policy engine like we do
28:01
is you have to have an audit mode, right?
28:03
So you have to let customers write policy but not enact it
28:06
and just say, OK, what's going to happen to my infrastructure
28:09
if I do this? And also do policy simulation
28:12
of, hey, I've got a fleet of 3000 machines.
28:15
If I wrote this policy, how many of them would get locked out,
28:19
right? And so doing auditing on your
28:21
real data as well as simulation on things we know about your
28:24
fleet will help you understand what impact those policies have
28:29
and are and are going to have. Yeah.
28:32
So I think you're talking about these identity based threats and
28:37
I'm kind of wondering like what where are they originating from?
28:41
Where the majority of them originating from?
28:44
Are they these things like you said, like the crowd strike
28:47
scores are dropping or is it that you're getting, you're
28:52
finding jail, broken devices or is it even something more simple
28:57
than that? Well, I mean, a majority of
29:00
identity based threats today are password based, right?
29:04
They're phishing, they are password compromised.
29:06
And so we eliminate those all together.
29:09
So most people who adopt Beyond Identity see a a huge drop in
29:14
their risk level in their in their chance of breach to begin
29:18
with. That's because you just, you
29:19
just don't have passwords. We just don't have passwords.
29:22
That's not even a setting that's allowed, right?
29:25
And so that's. Not there, right?
29:28
You're. Putting us all out of business,
29:29
Sarah. I'm sick of those.
29:31
Cut, cut, cut. Yeah.
29:34
So we're moving on to more sophisticated attacks like hey,
29:36
I've jailbroken the phone, I've stolen the laptop, I've somehow
29:39
compromised the operating system, I've gotten that user to
29:42
install malware, those kinds of identity based attacks or I've
29:45
compromised the browser itself. Those kinds of attacks we have
29:49
to detect now that we've now that we've gotten rid of all the
29:52
password based attacks, those are the more sophisticated ones
29:54
that we're going after. Yeah.
29:56
And I. I've run into this question
29:58
before of, you know, is password list more secure than MFA?
30:05
Using MFA you've got, you know, possession based, probably might
30:11
even be, you know, biometric, but you also have a password.
30:16
So does the password add any value?
30:18
Does it is it important to get as many factors as possible?
30:22
Does that make this process more secure?
30:25
Oh gosh, I could write you a novel.
30:27
I mean, you've been to authenticate conference.
30:29
I'm sure you've seen Dean and Pam's great talk.
30:32
If you haven't seen it, it's online about different factors
30:35
and that really thinking about things as multi factor isn't
30:37
serving us very well anymore. And we should be thinking about
30:40
what kinds of threats we want to protect against and how well the
30:43
different ways that we authenticate protect against
30:45
them. And so even if you're using a
30:47
password, there's a chance that your user is using a password
30:50
manager, right? And so then it's not a something
30:52
you know that it's a something you have.
30:54
And so using passwords is, we know it's bad for usability.
30:59
We know it's good for attackers who can compromise those
31:01
passwords. And if you're not using a
31:03
password manager, you're likely to reuse passwords, which means
31:05
that they're going to get breached.
31:07
And then all of the places that you use that password are then
31:10
compromised, right. And so passwords are are not a
31:13
great solution, which is why we we're moving more toward device
31:17
and biometric so. Where are we at as an industry?
31:22
Are we at the point where, you know, the attacks happen and
31:25
then we've react to them? Is there a way that we can get
31:28
smarter about it and kind of like get ahead of the attacks?
31:32
Is that what this is all about? Is that what Beyond the identity
31:35
is essentially trying to do is to be that intelligent platform
31:40
so that you're not you're not having to constantly react to
31:45
what just happened? It is like, that's one of the
31:48
things that I loved about your show with Sean Adele was that he
31:52
talks about like identity and security.
31:54
It's one like it's all one thing.
31:57
And right now the way that our vendors work is that you have
31:59
security vendors and you have identity vendors and they don't
32:02
really talk to each other, right?
32:04
And so you have the the detection and the response on
32:06
one side, and then you have the authentication on the other
32:08
side. And that's not the way it should
32:10
be, right? You should be able to detect and
32:12
prevent, right? So as soon as you get the
32:14
detection, you should be able to ban that authentication and make
32:18
sure that the the attack never happens in the 1st place instead
32:21
of trying to respond and mitigate afterwards.
32:26
I think getting smarter as an industry is always helpful.
32:28
If we have Smart Tools, we got smart people, we have the data.
32:32
It seems to me like this has been something that's been a
32:34
long time coming to actually take advantage of the
32:38
capabilities and the standards development that have enabled
32:41
this. What do you see as sort of like
32:43
the thing that has been really the enabler to get where you're
32:47
at today from a from a product standpoint to say, OK, yeah, we
32:51
are actually at a spot where what password there isn't a
32:54
password to take because I see a lot of password less and then
32:58
password dash less where there's still a password float around
33:00
somewhere. What do you think has been the
33:02
the key to shift that way? I mean, I don't think we are
33:06
fully shifted yet, right? Like we had to do this all
33:09
proprietary, all of our connections with security
33:11
vendors are proprietary the way that we do key pairs as
33:14
proprietary, right? And we don't want it to be that
33:16
way, right? We want this to be the standard
33:19
for the industry. We want this to be the way that
33:21
Fido does things. We want this to be the way that
33:23
shared signals does things. And so I think we still have a
33:26
long way to go in the identity industry to figure these things
33:28
out. But it was absolutely like in
33:30
terms of what made it even possible to do the proprietary
33:33
part, like it was absolutely like phones now have a secure
33:37
enclave that apps can access. Like that's a huge part of it.
33:41
Security vendors now have very robust AP is that we can just go
33:45
call and see if anything is going on.
33:47
So a lot of that has been built out in the last five years and
33:50
that's what enabled this to exist the way it does today.
33:53
But there's so much more work to do to to get an industry wide.
33:56
Sarah, what does the typical deployment of Beyond Identity
34:00
look like in an organization? And what are some of the change
34:04
management or adoption issues that, you know, you talk to the
34:09
practitioners about like get out ahead of this?
34:12
Is there a resistance from a user base of like, oh, you know,
34:17
I don't want to use my biometrics for this thing
34:19
because it could get, it's going to get put down on some server,
34:22
which we know from this conversation that's not a
34:25
realistic thing. But what are some of the the
34:27
main challenges you see? Yeah, I mean, identity is
34:31
extremely sticky, right? Doing a full IDP tear out and
34:35
and reboot is like every Ciso's worst nightmare.
34:40
And so the way that we see people deploying beyond identity
34:45
is either as an MFA layer on top of their IDP and then they'll
34:48
they'll pick certain applications that they think are
34:51
their crown jewels to say, OK, we're actually going to switch
34:54
to full IDP mode here for this application or for a pool of
34:58
users. So we say, OK, we're actually
35:00
going to switch out the IDP for our executive team, for our HR
35:03
team, for our finance team, the teams where we're really worried
35:06
about breach. And so they're not doing that
35:09
full RIP and replace. That's really painful and
35:11
expensive and time consuming, but they're kind of dipping a
35:15
toe in and then they're saying, OK, this, this is going well.
35:18
Let's expand this to another application, another team and
35:21
slowly over time kind of moving it throughout the company.
35:25
And we have seen some resistance to biometrics.
35:28
There are a lot of biometrics laws all around the world.
35:32
And obviously you can turn that off in the product if you feel
35:36
like it's it's not what you want in your company.
35:40
But the biometrics are local, so they are, there is no central
35:43
thing to compromise with the biometrics.
35:45
It is all stored on the on the phone or on the laptop.
35:47
Is there a scenario where you could potentially selectively
35:52
turn off the biometric for certain people and not other
35:56
people? Sorry if I'm hitting you with a
35:58
trick question here, but I'm wondering like, OK, if you had
36:02
kind of a, a Workers Union, I can't even remember the right
36:06
term in in France and those folks for some reason or
36:11
another, you just have to exclude them from using that
36:15
biometric. Is that possible?
36:18
Absolutely. So that's just role based access
36:20
control, right? So that's you.
36:22
You make a role that says, hey, this is the crazy France union
36:25
of people who hate fingerprints. And you make a policy that says,
36:29
like, these people can get in without a fingerprint.
36:32
Love the flexibility of the approach here because I think
36:34
you're right where IDP surgery is a major surgery.
36:39
And if you, and you know, there's a lot of legacy players
36:41
out there. So the ability to add this
36:43
capability to an existing Idpi think is a huge win.
36:46
You know, for everybody. It's, it's the ability to be
36:49
more granular with the approach for MFA, which is important.
36:51
It's the flexibility and the models and you know, just the
36:55
different ways to approach. I think it's a really smart way
36:57
to approach it. So I I tip my cap for you.
37:02
So exactly, yeah, I, I fell in love with the technology, which
37:04
is why I moved to the company. And obviously the, the people
37:07
who I work with at the company are, are all fantastic.
37:10
So it's a really great team. If you get a chance to meet us
37:13
at a conference, please say hello, stop by the booth.
37:17
We're very friendly. And, and my team specifically
37:21
will all be at the Internet Identity Workshop coming up in
37:25
April. So we are excited to talk to you
37:27
about anything innovative. If you have something that that
37:30
you say, like God, I wish ID PS did this or God, I wish I had an
37:33
endpoint that did that, come fly us down and tell us that that
37:38
you want us to build new things because that's what we do.
37:40
I say be careful what you asked for.
37:43
I want my IDP to have a cup holder.
37:45
Might not be a realistic. Hey, we can make it happen.
37:48
Right. So before that though, you've
37:50
got Bioncon and I'm, I guess I'm not familiar with Bioncon.
37:53
Tell me about this, because this is coming up March 20th.
37:56
It's in Palo Alto, CA. I assume you and your team will
37:59
be there as well, but what is Bioncon for?
38:01
For people who aren't familiar with?
38:03
It yeah. So we first started Bioncon last
38:06
year. We did it at our offices in New
38:08
York. And basically it's a combination
38:11
of a Broadway show and a whole bunch of identity nerds, some
38:14
security nerds. We had a fantastic time.
38:19
So Biancon is going to be. So we're doing one on the West
38:22
Coast now in the spring, in two weeks on March 20th.
38:26
And I will be there, our CEO will be there.
38:30
We will have live demos, people on keyboards at stations who
38:34
will be showing you things, who you can ask questions, you can
38:39
touch the keyboard yourself, you can play with the console, but
38:43
none of this is just for show. We want to make sure that the
38:46
technology is ready for you and that you can come and play with
38:48
it if you want to. So having that chance to both
38:53
see some great speakers. So we're going to have Taher
38:57
Elgamal, who I mentioned, who was the CTO of security for
39:01
Salesforce for a long time and then switched over to VC and he
39:04
was one of our founders who who founded and funded us as AVC.
39:09
He will be speaking and Sam Curry from Z Scaler will be
39:14
speaking about Zero Trust and how we kind of implement that
39:19
given today's technologies and capabilities.
39:22
And then a whole bunch of people from Beyond Identity obviously
39:24
will be there talking about the product and doing demos.
39:27
And then at the end of the day, we'll open up the bar and we've
39:30
got Broadway singers coming 'cause we're a New York company
39:33
and we love, we love singing. We actually do karaoke whenever
39:36
we get together at at a company audience so.
39:39
OK, you, you kind of preface my next question here because I was
39:42
scrolling for the agenda and I see a, a private experience of
39:44
Broadway jukebox hits and I see things from like Jersey boys,
39:48
thank you, Valley, Four Seasons, etcetera.
39:52
Tell me I'm, I'm, I'm interested in this because I don't think
39:54
I've seen this at a conference, you know, before.
39:57
What should people expect if they if they see this?
40:00
Yeah, so when we were in New York, we had people from the
40:03
original cast of Hamilton who came and sang songs from
40:07
Hamilton and it was incredible. It was very moving and exciting
40:13
and just allowed kind of the group to to bond and have a
40:16
great experience. And this will be the same thing.
40:18
It'll be very intimate. It will be Broadway singers and
40:21
you will have a have a great time so.
40:25
And you piqued my interest with the the karaoke.
40:28
What's your karaoke song? So my favorite karaoke song is
40:33
Let It Go from Frozen, but instead of singing Let It Go I
40:36
say fuck it all. It's very cathartic.
40:39
Highly recommended. All right, we earned the XLR
40:43
rated on that one, but I'll we'll go.
40:45
Yeah, you can bleep me if you right.
40:47
Now I'm going to leave it in. Hey, we're all adults here, so.
40:51
I certainly feel like there are no children who are so
40:53
interested in my identity that they're listening to I.
40:55
Didn't under 12 if you're listening to this?
40:57
Oh my gosh. Go outside, touch grass.
41:02
You've shared a lot of information with us here, so I
41:04
hope people go check it out Beyond identity.com/I DACI
41:08
mentioned early on. It's been a while since you've
41:11
been with us on the show. And in that time I remember
41:15
seeing a LinkedIn post, and it's probably a couple years ago at
41:17
this point now, where you were heading off to Europe for a
41:20
backpacking trip or, or something.
41:22
Do I remember that correctly? Yeah, that was in April.
41:26
So just about a year ago I went with my sister-in-law and we did
41:32
the community of Santiago, which is walking across Spain.
41:35
So it's a 600 mile trail. We just did the last 200 miles.
41:40
But it was absolutely incredible.
41:41
I highly recommend it. You take your little backpack of
41:45
all your stuff with you and you stay in a different place every
41:47
night. And for this one, you actually,
41:51
you are making a pilgrimage to a cathedral.
41:53
And so you get to the end and there's this huge Plaza and all
41:56
of these people who have walked hundreds of miles and they are
41:59
crying and they're singing and they're screaming.
42:01
And it's, it is an incredible energy in that in that town,
42:05
just to be there with all of these people who have
42:07
accomplished what might be the most difficult thing in their
42:10
lives. It's, it was an incredible
42:12
experience. Highly recommended.
42:14
So what was the impetus to to do this?
42:16
Was it just something you saw? Are you, are you naturally a
42:18
hiker or explorer? Adventurous like that.
42:21
I really like wine and so and I like, I like my fitness kind of
42:28
low impact. So there are there are
42:30
restaurants and there are bars all along the trail and there
42:33
are hotels, right. So it's you get the benefit of
42:36
hiking, but unlike hiking in America where like you bring a
42:38
tent and you don't shower, like you hike and then you have
42:43
dinner and a bottle of wine and you sleep in a bed and you would
42:47
take a shower and then you go walk the next day.
42:50
And so this is, this is like a vastly better experience than
42:54
than hiking in America. OK, you totally sold me
42:58
everything you just said. Like that sounds definitely
43:00
sounds like my kind of hiking. What was the what was the best
43:03
meal or and or bottle of wine or just wine that you had on this
43:09
trip? Oh, the the Riojas all
43:12
throughout Spain were incredible.
43:14
I managed to get some of them back to America.
43:16
Not enough. So I'll have to, I'll have to go
43:18
back at some point and get more. But actually by the end, we were
43:23
so tired of Spanish food. Like we had one Chinese
43:28
restaurant. We were like, Oh my God, thank
43:30
God. I got to the point where I
43:32
didn't want any more ham. And I love ham.
43:35
So like that was that was a lot. It sounds like a lot of fun,
43:40
Jim, would you do a 200 mile trek to go get to do that?
43:44
I mean you're you work out all the time.
43:45
For Chinese food. For Chinese food in Spain.
43:49
Yeah, so I've I've done a fair amount of backpacking in the US
43:54
and gone through the no shower thing.
43:56
I actually remember one time backpacking in New Hampshire and
44:02
going into a river to take a bath because it's been a couple
44:06
days and the water was like just a degree or so away from
44:10
freezing. It was not fun, but it it was
44:14
good to be clean. But yeah, I've I've backpacked
44:17
all over, but I've never backpacked in Europe.
44:19
I think it would be a great experience, but I'm kind of more
44:23
into the next level of luxury, which, you know, would be a nice
44:28
hotel bed and maybe even like four and five star hotels and
44:32
stuff like that. So I probably won't do it.
44:35
I can't say it's on my bucket list, but I've always thought it
44:39
was like kind of a romantic concept to backpack through
44:42
Europe right after finishing college or right after finishing
44:45
high school. So sounds dangerous, but I think
44:51
backpacking anywhere for long periods of time can be
44:54
dangerous. Well, wait to bring it down.
44:57
Thanks, Jim. There's a lot of crazy.
44:58
People out there. What about you, Jeff?
45:01
I'm. Not a backpacker.
45:02
I yeah, I'm, I'm, I'm not anything like that.
45:04
But Sarah, you have sold me on this because I absolutely will
45:08
walk from restaurant to restaurant to winery to winery.
45:12
My wife has big into wine. She's been to Spain and Portugal
45:14
and France and all those places and part of her job in the past.
45:18
So this sounds. Like tell me when you want to
45:20
go, I'll do it again. This sounds like right up my
45:22
alley. For sure, let's do it.
45:25
And you know, I think the hardest part about this is at
45:27
least in the US, it doesn't seem like there's areas where you can
45:30
go 200 miles on foot and have all those amenities kind of
45:34
there, right? You're going from village to
45:36
village or town to town. Like what was the give me just
45:39
like a normal day as as you went through this.
45:42
Yeah, you absolutely. You go from town to town.
45:44
The towns are about 5 miles spaced out, so we would go
45:46
through two or three towns in a day and it's, it's great.
45:51
Like you stop for lunch and, you know, do you have whatever they
45:53
have locally? So they might have a little bit
45:55
of fried squid and some local beer or they might have
45:59
sandwiches with lots of ham, obviously.
46:03
So whatever happens to be in that town, that's what you have
46:06
that day. And then you keep walking and
46:08
you meet all sorts of people from all over the world doing
46:10
this. And people have told me there
46:12
are similar trails in the UK and in Japan.
46:15
So I I might go explore what else there is across the world
46:20
in this vein that. Sounds really exciting.
46:23
I I'm sold. This is this is this is
46:25
something yeah. I'm going to Berlin for EIC in a
46:28
couple months. My wife and I are looking for
46:30
something to do while we're out there.
46:32
I think we're going to end up in Amsterdam.
46:33
So I don't know, I'm sure we'll be doing plenty of walking and
46:35
stuff like that, but maybe we can do something similar to that
46:38
or maybe just sit on a train and go to the countryside and.
46:40
Whatever it may be better. You've been very generous with
46:44
your time. I want to make sure that we get
46:45
you out of here on time. But any final thoughts or things
46:48
that people should be listening, that are are watching, should
46:52
know about Beyond Unity that you want to get out.
46:54
I'm just really glad we could sponsor you guys.
46:56
I really love the work that you're doing here with the
46:58
podcast, the way that you're bringing the community together.
47:01
I think it's awesome. I, I'm an avid listener,
47:04
although it's weird to hear you guys at real speed because I
47:06
normally listen to you at like 1.5.
47:08
So like your voices are pitched. I'm like, oh, you're so
47:10
masculine. Well, you know not.
47:13
Really. But yeah, I, I really think that
47:16
you guys are doing great work and thank you so much for giving
47:18
us the opportunity to to support you.
47:21
Well, we appreciate that flattery gets you everywhere in
47:23
this show, so we'll have links in our show notes for people to
47:27
check out. Again, website
47:28
beyondidentity.com/I DAC, bunch of information there.
47:32
It'll be in our show notes as well as links to Beyond Con,
47:35
which is coming up. So I'll put people will go check
47:36
that out and then share it for yourself.
47:38
We'll have your LinkedIn connection information in our
47:40
show notes so people can reach out with questions, comments, or
47:44
maybe stories from backpacking across Europe or whatever it may
47:47
be. So with that, we'll go ahead and
47:50
leave it for this week. Thanks everyone for watching and
47:53
or listening and we'll talk with you all in the next one.
47:57
You've been listening to Identity at the Centre.
48:01
We hope you've enjoyed the show. Make sure to like, rate and
48:05
review and we'll be back soon. But in the meantime, hit the
48:09
website at identity@thecenter.com.
48:13
See you next time on Identity at the Center.