Latest / Identity at the Center / #93 - Open Banking with Nathan Coffing

Transcript

#93 - Open Banking with Nathan Coffing · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:27
sender podcast, I'm Jeff. And that's Jim.
0:29
Hey, Jim hey, Jeff, how are you? Oh, not so bad yourself.
0:34
I'm good. I'm conserving.
0:35
My guess the little that I have left and driving my guest house
0:39
or car when I'm not conserving gas.
0:42
But, you know, I'm living in the southeastern United States where
0:48
our gas supply has been affected by two things.
0:52
One is a cybersecurity attack that Happened on the pipeline,
0:57
that fuels a lot of the southeast.
0:59
And the second is by Panic, buying, everybody rushing out
1:02
the fill up their tank, all in the same day and it's the same
1:06
thing that happened, you know, right after covid, where
1:09
everybody had to rush out and buy toilet, paper of all things.
1:12
Yeah, I think I saw a picture of you filling gas tanks and
1:14
putting them into the trunk of a car or something like that.
1:17
Maybe make a few extra bucks on the side here.
1:20
The Good Ol American Way. Yay, capitalism that sort of
1:22
thing. Yeah, we all knew.
1:24
Bunker, right? So it's interesting you bring up
1:27
the pipeline thing. So the latest that we have as of
1:31
Wednesday, May 12th on recording this and this will go out into
1:35
the internet and all of our listeners on the following
1:38
Monday. 17th is that it's is that the pipeline hack may have
1:44
come from The Exchange vulnerabilities that were widely
1:48
touted a couple months ago. I think it was back in March or
1:50
whatever means and yet again you know patching didn't get in
1:54
place. And wasn't remediated and your,
1:56
we are having another ransomware story and now we're seeing
1:59
prices gas, go up because of that.
2:01
But also because of, you know, the economy, I think starting to
2:03
open up a little bit here in the US.
2:04
So, I guess keep those systems patched.
2:08
Well, I think, you know, a lot of the, a lot of these
2:11
ransomware attacks are, you know, eventually boiled down to
2:15
basic blocking and tackling we talked to dr.
2:19
Jason Cunningham on the show, a few months back and you know he
2:23
mentioned that these types of attacks.
2:24
Or moving Downstream, not that utilities.
2:28
And and kind of core infrastructure is that far
2:31
Downstream but they're going from government agencies and
2:35
Banks down to, you know, kind of companies that haven't seen
2:38
themselves as Prime Targets in the past.
2:41
But I think what you and I have seen with a lot of organizations
2:45
we work with is that they're understaffed.
2:49
And you've got a lot of, you know, not enough people running
2:52
around trying to keep up and They're doing yeoman's work and
2:56
there I am here as but if they don't have the tools like MFA
3:01
everywhere, there's only so much that they can do and so run into
3:07
these kind of situations where nobody wants to end up on the
3:11
front page of the newspaper, but I certainly what's happening.
3:14
Yeah. I mean, job security, I guess,
3:15
right? Human error gets involved and
3:18
people start to, you know, fall behind.
3:20
I think, you know, one thing that we see a lot, right is
3:23
underfunded. Man, they're understaffed teams
3:27
really doing heroic effort to keep organizations as best of
3:31
the camp, but the can't do it. All right?
3:32
And they can't do it forever. So something is certainly
3:34
consider. Yeah, well, hey we, you know,
3:37
we've been talking a lot about that.
3:40
By the end of this year, we're hoping to be able to do some
3:45
business travel again. It's there's nothing like a year
3:48
of no business travel to make you miss business travel, but I
3:52
think you'd agree that probably the Favorite business travel is
3:56
conferences because we get to see and interact with people in
4:00
our industry. Hopefully, when this starts up
4:03
again, we'll get to meet a lot of the folks who listen to the
4:06
podcast, but I had an interesting story and that our
4:10
guest today is somebody that I met at a conference that
4:14
actually had a couple of forgerock conferences that I can
4:17
recall. One of the cool things about
4:19
forgerock was especially in the early days was you know, the Of
4:25
some of their conferences. And a lot of times, the two that
4:29
I'm thinking of we're in California, which is such a
4:31
beautiful state but the Asilomar Conference Center it was like
4:38
Pine Forest right on the woods and our I'm sorry right on the
4:42
beach and it was such a cool place to be and the other was at
4:46
the Ritz-Carlton a Half Moon Bay and the Bay Area and wow I mean
4:52
couldn't pick a better place to To go for a work trip.
4:56
Yeah. I always enjoy going west for
4:57
that for conferences. I'm a California guy.
5:00
So I like it. So speaking of our guests, why
5:03
don't we go ahead and introduce Nathan coughing?
5:05
He is the head of strategy at Cloud entity.
5:08
Welcome, Nathan to the show. Thanks for joining us.
5:11
Thanks for having me really, really glad to be here and
5:13
thanks for going to the Wayback machine.
5:16
There's, those are wonderful conferences, both from a
5:18
technical point of view as well as you know, the atmosphere
5:21
absolutely phenomenal for idea sharing and kind of growing in
5:24
the The I am space. Yeah it's a lot of fun to kind
5:27
of interact with folks. I do miss the conference thing.
5:30
You know, I never thought I would say this is I miss being
5:34
in the line to get on to a United flight scrambling with
5:37
the, you know, 200 other people trying to fight for overhead
5:41
space or under, you know under seat space, you know whatever,
5:43
maybe so maybe it's some point here in a future that will
5:47
resume, I know we're going to talk a little bit today about
5:49
open Banking and how that has started to I guess we'll open
5:54
up. Up right, for organizations,
5:56
start, taking advantage of. But before we get to that, I
5:59
think would be helpful for the folks who are listening to a
6:01
kind of understands you know, your journey, you've known Jim
6:05
for a long time and in Prior roles and sort of, you know, the
6:09
the maturation of your own career.
6:11
But how did you get into the? I am space.
6:14
Is it something that you chose or did you choose it or well, we
6:18
gotta go in the way, way back machine back to the Netscape, I
6:22
Planet days where I was actually At Boeing working just in cyber
6:26
side building you know some of the initial firewalls and then
6:31
son chose me somehow. I'm not sure how they got my
6:34
number. But apparently there was there
6:36
was Data sharing back then that required some type of consent,
6:38
right? And I got recruited into the eye
6:42
planet Sun Alliance or the AOL Sun Alliance.
6:45
And then from there just kind of continued both in the identity
6:48
space as well as the cyberspace. So it's been about 15 years
6:52
doing just identity and then hop back.
6:54
Over to the Cyber side. Because maybe one of the are
6:56
joining, as one of the first couple dozen employees, at
6:58
imperva back in 17, 2008, 2009, and then release all kind of
7:04
this inculcation. This need to bring cyber
7:07
together with identity. I think that's one of the core
7:10
tenets of the podcast, right? It's identities at the center.
7:12
Whether that's the center of your application security or the
7:15
center of your user security unit becomes a fundamental part
7:18
to building out your next generation of applications.
7:21
Sorry to give you to give you a plug guys, but it's too easy,
7:23
right? Definitely love that.
7:26
I always love hearing somebody about somebody's journey in this
7:29
industry because usually they started off somewhere.
7:34
Like I don't want to say the bottom, right, but they started
7:36
out somewhere in kind of the guts of the machine that you
7:41
started off with the Netscape directory, which of course, this
7:45
kind of like core functionality, but as you know, more or less
7:49
than the back office and now you said your Chief strategy officer
7:53
at Cloud identity. I'm sorry Cloud density and I'm
7:58
wondering if you could tell us a little bit about that role.
8:01
Yeah, so I think I alluded to it right in that previous
8:05
monologue. But you know what we've done is
8:07
we've looked to bring Dynamic authorization and when I mean
8:12
when I say that is bring in a lot more context right now, can
8:15
be cyber context, it could be consent context and push it all
8:19
the way out to the edge of the service.
8:21
And so we started like thinking, how can we start building
8:23
product around this? Looking at microservices, you
8:26
know, API light infrastructure back in 2015, 2016 and then sort
8:32
of rolling, you know, Intelligence on top of it and
8:33
machine learning is much better descriptor than AI, but I know
8:37
AI is nowhere more in Vogue to use those words these days.
8:41
So, what we started, building all these pulling these
8:43
different pieces together, right?
8:44
Making sure that we could have adequate data sets, adequate
8:48
rules and adequate policy decision points at the edge of
8:51
the service and you know as we've built that you know
8:54
started Getting Believers both in the marketplace, right?
8:57
Meaning some early adopters of our technology, as well as
8:59
Believers in the, in the VC Marketplace and can Under 12
9:02
first round of funding last year, as part of that.
9:05
You know, I kind of shifted out of the the sheer Tech point of
9:08
view and really moved into, you know, how can we lead the team,
9:11
how can we start building a bigger broader team and we've
9:13
been able to bring in some incredible Talent, both from
9:16
people running in the Olaf circles as well as other I am
9:19
platforms. So Nathaniel I was kind of
9:22
wondering You go to a prospect, is this something they've sought
9:29
you out? Because they understand your
9:30
technology are usually going through education process.
9:35
So I'd say that's actually really transitioning over the
9:38
last three to six months, right? So part of its due to covid, you
9:43
know, part of its due to the adoption of distributed
9:45
services, but what we're seeing is that, you know, as people
9:47
move into the next generation of services and whether that's a
9:50
kubernetes, or a service mesh or functions, they have no idea how
9:53
to bring identity. He constructs into that much
9:56
less cyber constructs, and one of the big goals as your
9:59
building, you know, this next Generation services to make them
10:01
immutable, right? So how can I externalize
10:04
identity, authorization and privacy?
10:07
Make that incredibly easy for my developers.
10:10
So anytime I bring in a new service it's protected by a
10:12
default set of rules. So if we think about like
10:15
identity for the last 2,000 years, right?
10:17
What's been the hard part? It's always been onboarding
10:20
applications bar not and now you're starting to have the
10:23
capabilities to Get on board, right?
10:25
Make it very very seamless, like an onboard 10,000 services in a
10:28
matter of minutes, so long as their next Generation services
10:32
that our API driven. So you're able to really start
10:35
driving Innovation forward and instead of becoming this kind of
10:38
tax it happens. After the fact, you're able to
10:40
lead the digital transformation by saying, I'm going to make
10:42
these parts easy for you and we can we talk about that from a
10:44
customer perspective. Now, the reason that we have
10:47
open banking like at the center of the discussion is, because
10:50
that's really one of the first mandated and Regulatory
10:53
regulated areas where a Apis have to be, you know, the center
10:57
meaning, the first, you know, real API Centric transaction
11:01
requirements coming from, you know, Federal bodies or
11:04
government regulatory bodies depending upon the the
11:07
nationality. So we talk about open banking
11:09
here a little bit. I guess, why don't we start with
11:13
what is open banking? Because I think people may be
11:15
using it and they don't maybe even know it, right?
11:18
If I think of services may be something like plaid or you're
11:21
connecting different Financial Services together or I think you
11:24
do. Into personal Capital, you know,
11:26
there's a bunch of these out there that lets you interface
11:29
and pool financial data, right into third-party apps that
11:34
aren't necessarily owned by the financial institution themself.
11:38
Is that a good explanation of it?
11:40
Or is there is there more to it? You're hitting on the core
11:42
tenets, right? And it's really about the
11:44
democratization of banking, right?
11:46
So I can build, I won't be a build a bank.
11:48
I'll be able to build a service that can consume Bank data and
11:51
then the second aspect of it is the utilization of Of privacy
11:55
and consent, right? So I've seen gdpr CCPA, things
11:58
of that nature, kind of bubble down on a larger industry basis.
12:02
But then open bank has been very, very explicit in the
12:04
flows. Here's where I need to consent
12:06
to what? Here's how fine grain that
12:07
consent to be that consent should be and we're also seeing
12:11
that start to now percolate into some of the different standards
12:14
bodies. Right.
12:14
So, you know, we've seen just in the last six to seven months, is
12:20
a Grant Management standard pop into the oauth into the or
12:24
standards bodies. And that's becoming increasingly
12:26
important because everybody, you know, every user now once to
12:29
understand where their data goes are tired of seeing, you know,
12:32
the Facebook, Cambridge analytical, if you know examples
12:34
or the experience data breach that just happened, you know,
12:37
last week or the week before last.
12:39
I'm sorry. You know where highly insecure
12:41
API. No authentication right?
12:45
For user, or for another service?
12:47
No authorization. And the only constructs
12:49
protecting it was public data. Meaning my birthday.
12:52
I'm sorry. Not even my birthday.
12:53
I first name last name. My address, and then a
12:57
unvalidated birthday, right? So you can program.
13:00
And when using it in the API perspective, right?
13:02
You can programmatically go and just download all of it, right?
13:05
You can literally iterate all the way through it.
13:06
Taking public records to either pull from the dark web or maybe
13:09
you have, you know, from Peridot or something like that, right?
13:12
And just boom, boom, boom boom, right and now I've got
13:14
everybody's credit score number and that's that's sensitive data
13:17
to me. I'm sure it is to everybody else
13:19
listening as well. So I think one of the challenges
13:21
that I've seen having been a consumer of some of these
13:23
services, Is the inconsistency with how they may be implemented
13:29
and I think of things where, you know, you have to go into this
13:32
interface, you type in your ID and password for the Target
13:37
financial institution. And if they have MFA in place or
13:41
some other type of, you know, second factor that you need to
13:44
provide, it's a very sticky situation.
13:47
Sometimes where you're waiting, it's almost like they're doing
13:49
screen scraping behind the scenes sometimes and it's
13:52
frustrating for me as a consumer.
13:54
Zoomer right? Trying to get the kind of keep
13:56
my accounts linked. How does you know, from an enemy
14:00
not knowing enough of how it works between the open banking
14:02
standards and that have been developed and companies who
14:05
maybe aren't using it? Is that a symptom of, you know,
14:09
a poor implementation of it is just, you know, how it works
14:12
right now? Or maybe they're not even using
14:13
open Banking and that's why my experience is so poor.
14:16
So if they are screen, scraping, they're not using open banking,
14:19
you know, screen scraping is a security vulnerability right
14:21
there, doing an impersonation against both, probably your
14:24
Banks. Standards of conduct as well as
14:26
even even their Partners standards of content that you're
14:28
that you're logging into and that's been kind of the de
14:31
facto, right? For the last half dozen years,
14:34
right? If we seen Financial aggregators
14:36
really come to fruition. Now, that's changing because,
14:39
you know, of open banking right? Literally everybody, realizes
14:42
that's a big problem. So how do we start to normalize
14:45
that how we build common patterns around consent and
14:49
around data? All right, flows.
14:51
So so if you're seeing screen, scraping, you're seeing that
14:54
delay. You'd probably not in open
14:56
banking, in open, banking ecosystem, and you don't have
14:59
the security that's wrapped around open banking.
15:01
Now, I'm actually gonna go back to your earlier Point Jeff, and
15:04
it's a lot worse than we actually think particularly over
15:06
here in North America. And what I mean by that is, you
15:08
know, we've got all of this identity and authorization
15:11
sprawl. So depending on, when you're
15:13
doing your, your application was build, right?
15:16
It was a 2008 mobile app or maybe it's a 2020 mobile app.
15:19
Probably have a different ID P. You have hard-coded
15:22
authorization. You have hard-coded, privacy,
15:24
built into And even those different Services different
15:27
applications from a singular Bank, don't talk to each other.
15:29
Well now the banks are actually trying to fix that and kind of
15:32
give a little bit better user experience, but I can jump, you
15:34
know, within some of the credit bureaus.
15:36
I can jump from service to service to service and I'll have
15:39
to re-authenticate. I'll have to reauthorize, will
15:42
have to re Grant consent, because none of it's stored
15:45
outside of the applications, all hard-coded in there, and nobody
15:47
has any good way of reporting. Now, that's obviously a
15:49
tremendous liability for the bank's, the credit bureaus, Etc,
15:53
or for any of the financials. Because they're storing
15:56
different data. And any time a regulatory body
15:58
comes and says they show me, you know, prove to me that Nathan
16:00
allowed you to use his account data proved to me that Nathan,
16:02
like mother's last name and they have to go and say, okay, well,
16:06
I don't know why policies look like right, I've got to find the
16:08
developer that wrote that application that developer has
16:11
to go back to the code more than like that developers in another
16:13
company by now. Right?
16:15
They have to go back into the code try and pull extract it and
16:19
then showcase exactly what. Transpired, right?
16:22
You and I both know, that's almost an impossibility, right?
16:24
The reality is is going across all those different systems and
16:27
platforms, trying to showcase exactly what happened within a
16:31
transaction is a lot harder than it even is to explain, right?
16:36
But so being able to externalize that normalize it, right?
16:40
And then use a common authorization, privacy identity
16:43
standard across all of them. Well, that's exactly what oauth
16:47
was designed to be. And what I mean by that is we so
16:50
often do ATC kind of pop out in 2012, right?
16:53
2011 2012 depending Upon which one we're going to count by.
16:57
And the design, there was, let's separate context, right?
17:01
And separate the authorization construct away from the
17:04
identity, the session building, right?
17:06
But we saw the industry do is we took you know kind of these big
17:09
model list that we've been using for Wham.
17:11
You know. For the for the 2000's own.
17:13
Let's layer on top of federation.
17:15
You look we're using sample. Its layer on top of oauth.
17:17
Rider looks layer on top. All you think we took a model?
17:20
If we threw another model with that.
17:21
It right? We built kind of these giant.
17:24
Rocks that are difficult to use difficult to upgrade and aren't
17:28
meeting the needs of modern application developers.
17:31
You know, until we did is we said, well, what happens if we
17:32
go back to the original intent, right?
17:35
What happens if we think about authentication as a session
17:37
generation and then there's all kinds of great contacts, it
17:39
comes from your authentication provider and then authorization
17:42
and application identity. That's a whole separate
17:44
construct. And then when I want to move
17:46
into finer grained, authorization or I want to move
17:48
into fibrin consent management. I want to layer on top.
17:50
You open banking based, regulatory demands, Now, I can
17:55
do that very, very simply write. It can spin up open Banking,
17:57
apis, and minutes, instead of saying, we've got to build this
18:00
giant sandbox. I've got upgrade my loyal
18:02
servant of fappy 1.0 compliance. I got to do all these different
18:05
things which could be man months or even man years you know, I'm
18:09
curious because I highlighted my poor experience with not having
18:15
open banking in my life, right? So in your mind and you know,
18:21
I'm curious, what does good look like from an open banking?
18:24
Patient can, is there a gold standard or an example that you
18:29
can kind of provide to say if you're doing it, right?
18:32
Here's here's what it should look like.
18:33
What's the process as a? Just a normal customer, trying
18:37
to collect my finances. So I'm going to do one better
18:41
than that, and I'm going to talk about the gold Center that we've
18:43
seen already in the UK. And so there's a company called
18:46
Sterling Bank. Obviously, we're not sure the
18:48
motor from the North America so much, but what the, you know,
18:51
Millennials and gen Z of set is I want all of my financial
18:54
Offices. And this is not just Banking and
18:56
moving money around but also home insurance car, insurance
18:59
life insurance, right? All these different financial
19:01
services available in a singular portal and by using open banking
19:06
now, Sterling Bank has created Created that portal for Gen Z
19:09
and they seen tremendous account.
19:10
Adoption, because of it, what they've seen is a tremendous
19:13
Boon right to there to account adoption, by Third parties and
19:17
buy additional new customers. Because now, they have kind of
19:20
this comprehensive ecosystem. They never have to leave that
19:23
Sterling Bank portal. Able to see.
19:25
Okay, I'm going to sign up for these different Insurance
19:27
different retirement funds. You know, different investment
19:30
means as well as do their regular banking all from a
19:32
singular interface and it's completely changed the way that
19:35
people interact with them. And that's what, you know, the
19:37
account aggregators, you know, that the Minsk cetera have to
19:40
have strokes driven do to do in North America.
19:43
But without having kind of this common symbiotic, methodology of
19:47
exchanging data of protecting, privacy of all of these
19:50
different fundamental features of open banking, they're just
19:53
not able to get there in a Secure manner.
19:56
It sounds to me, like the Millennials and gen Z are
20:01
driving. The demand for open banking.
20:05
Would you say that's accurate and you know, I'm kind of
20:09
wondering about the value proposition for the banks is
20:12
this something that they want to be able to to enable these
20:16
Financial aggregators in a secure way?
20:19
Or is it you know a compliance driver.
20:23
So it started as a Appliance driver.
20:26
Well, that was a two-part question.
20:27
Let me start from the beginning, right?
20:29
So first of all, you know, gen Z and Millennials are the first
20:32
digital natives, right? Jen's even more.
20:33
So than Millennials, meaning, they grew up.
20:36
Always on internet's everywhere Services should be everywhere.
20:39
So they're looking for distributed services and the
20:42
best user experience possible, that means pushing the service
20:45
all the way down to the edge of the millennial or the edge of
20:47
the Gen Z. Alright, so my phone's got to be
20:50
able to do everything in that circumstance.
20:52
So if we look at, you know, Banks, As you know, we've seen
20:55
Banks Banks are responsible for where we are today.
20:58
And what I mean by that is not just technological innovation,
21:00
but Innovation across you know infrastructure.
21:03
Accelerate banks have really stepped up to the plate in the
21:05
last, you know, five thousand years, I think, is a fair way to
21:09
say it right, due to the exchange of money and helping us
21:11
build the world as we know it today.
21:14
And so when they first started adopting open banking you're
21:16
right. It was absolutely, you know,
21:18
across the bear. It was literally, you know, it's
21:21
another regulatory burden that we have to kind of pass through
21:24
but we've Started to see that transition where it's no longer
21:27
seen as that because not only are they getting better
21:29
engagement from the customer communities, but now they're
21:32
actually getting much better visibility into how their
21:34
services are being used. You know, what apis are being
21:37
called, who are their biggest users?
21:38
How are they transferring money? You know what other Partnerships
21:41
and what other services should they package and integrate that
21:44
are allowing them to better monetize their customers.
21:47
So all of that data that very rich rich data that now they are
21:50
allowed to have because they have the appropriate consent is
21:53
also the date of the It's feeding back into a, circular
21:56
Loop of better Services which are able to again to offer out
21:59
and to monetize and to build better customer adherence.
22:02
Have you seen any differences in how, you know, the pandemic has
22:06
affected uptake of some of these Services, you know, around
22:10
getting open Bangkok open banking off the ground and
22:14
becoming more digital first, you know, less touch.
22:17
And, you know, I look around in my hometown, where I marry it,
22:20
where I'm at and I see Bank branches shutting down right
22:23
there just they Had the physical presence anymore, I can't
22:27
remember. The last time I went into a
22:28
bank, I've been digital banking for at least, if seal, it feels
22:32
like 10 years. And, you know, that's probably
22:36
the trend for the future, and I see a lot of those spaces being
22:38
repurposed for other things. You know, one's been turned into
22:40
electric car charging a spot because they have the parking
22:44
and, you know, no one else is using it but I'm curious if from
22:47
your perspective having worked on this much more closely is if
22:51
the pandemic has driven this any more than it probably would have
22:56
gone already just to the Natural flow and evolution of services
23:00
or if. Yeah, there was something here
23:02
where you know, covid here and we've got a kind of speed this
23:05
up and maybe faster than we were planning on doing it.
23:08
Your bang on, right? I feel like that was a softball,
23:10
be honest. Because, you know, what is
23:13
covid, done, you know, to push work from home.
23:14
It's pushed distributed Services out everywhere and whether
23:18
that's, you know, upgrading your VPN and do a CT and a for the
23:21
podcast last week or whether that's offering your services.
23:24
Very distributed fashion. And a very integrated fashion
23:27
out to your consumers are to your partner's to resell, right?
23:30
Both of those are driving at lightning speed.
23:33
You know it's you're right. We don't go into any branches
23:35
anymore. I mean even Starbucks, you know
23:37
I have to order online right? Then I can go pick it up from a
23:40
branch but you know there the reduction in touch interaction I
23:46
think is a fair way of saying it you know do the covid has really
23:48
pushed net, new digital services and net new ways to engage with
23:51
your customer base out into the marketplace.
23:55
I'm thinking about these open Banking apis, and I'm wondering,
23:59
are banks deploying the apis to bolt onto their applications
24:05
and, and their systems, or they deploying the apis, and then
24:09
building their services on top of it.
24:11
And I guess I'm I'm getting at that from the standpoint of the
24:17
security being layered at the API level, right?
24:20
It seems to me that if you're building apps on top of it, you
24:24
still want to Put that security at the API level.
24:26
So, Broad question I guess is are the banks themselves using
24:31
those apis? They're deploying.
24:34
And then why is securing at the API level necessary?
24:39
Okay, lots of questions are so let's just parse them out, one
24:41
by one by one. Right?
24:43
So when we look at open banking, you know, I break it into kind
24:46
of three major fundamental steps.
24:48
So the first is building, an API driven infrastructure.
24:51
This is where you'll create a net new API, you know, through
24:53
apogee or acts way or one of the API Gateway vendors to your
24:56
back-end Services, right? And that's Step 1 and that is
24:59
just to participate in an API driven ecosystem, which
25:03
obviously open banking as one of them, step two is bringing in
25:07
that security layer, right? So open banking has designated
25:10
fappy, which is financial API. It's a standard put out by the
25:13
idea of the open ID Foundation that, you know, mandates.
25:19
A number of things, big things like pairwise identifiers,
25:21
right? So shared Secrets, essentially
25:23
the easy way to think about that Mutual TLS between client and
25:27
server. Secure software assertions,
25:30
right? So, you have a signed
25:31
certificate that says, I can be a client of this service or kind
25:36
of the fundamental pieces, right?
25:38
So, they have mandated a gold standard for API security is
25:41
easiest way to think about that. And I think that should be
25:44
carrying across all Industries because we wouldn't have the
25:47
experience problem, right? To just to relate it back today.
25:50
If that was in place yesterday, right now, the third step is
25:54
that consent factor? And I think this is where things
25:56
start to get really, really interesting.
25:58
Ting because consent has kind of changed rather dramatically in
26:02
the last five years, right. So start off with gdpr, we got
26:06
all of these kind of blanket. Consensus got the pop-up ad, you
26:08
know, are the top Banner saying? Hey, I'm consenting to my
26:11
cookie, you know, take all of my data or store your cookie here
26:13
and capture my pee, and everything else, which we all
26:16
hate. But it seems to be a necessary
26:17
part of using the internet at this juncture, right?
26:20
So that's been around for a little while and I was kind of
26:22
the start of, how do I mitigate? You know, some of the GDP our
26:25
needs that's a very blanket base.
26:27
Can set the It is the oauth based consents.
26:29
Right, that I think most of us are familiar with this.
26:31
Is we're going to Facebook. Facebook says, Hey, I want to
26:33
see your first name last name, phone number.
26:35
And I'm gonna do whatever I want with it.
26:37
Right? You know, I'm going to store it
26:39
and you know, it's going from you now.
26:42
And that's the second one and it's definitely not fine grained
26:44
enough, right? Because there's no real consent.
26:46
There's just hate take my data and do whatever with it.
26:49
Now, the third one, which open banking's and reduced is really
26:52
consent. That actually happens before the
26:54
oauth consent that is I'm going to consent and you're very fine
26:57
grain. Around this account with this
26:59
transaction ID. I'm going to consent to sending
27:01
it to this third party. Right.
27:03
And this is where those third-party providers and the
27:04
aggregators really come to bear. And so, what we're seeing is
27:08
very disconnected, approaches to consent, you kind of again,
27:10
based upon that sprawl, we're talking about earlier.
27:13
You might have the, the blanket consent.
27:15
You might have some oauth consent, but unless you're an
27:17
obeah ecosystem, the open banking ecosystem, you're not
27:20
bringing to fruition the open bank consent.
27:23
So what we've done is we brought all of those together, right?
27:25
So you have a common model for consent that spans the Three
27:28
different types. Actually, a fourth type as well,
27:30
but will dive down the rabbit hole if we go that way.
27:33
So I have a common model for understanding.
27:35
What I've consent to do to an organization as well as what
27:38
I've consented to an organization to share about me
27:41
and I can go and revoke manage it.
27:42
I can give you, you know, you can use it one time.
27:44
You can use it seven times. You can sit for 30 days, you can
27:46
use it for 24 hours, right? So I've got very fine-grained
27:49
controls around. How I'm willing to share my data
27:52
out to an organization and how that organization has to treat
27:55
the data going out to third parties.
27:58
Sorry, the rest of your question was where should a pi security
28:01
lie, right. And so the very interesting
28:04
thing about apis is something like 80% of the internet traffic
28:07
is Now API driven, right? And you have to think about apis
28:11
as machine-to-machine, right? Or service to service because
28:14
that is the fundamental underlying flow, right?
28:16
And whether it's me going through my, my iPad right
28:19
through an app. On my iPad, it's making an API
28:21
call back up to, you know, Wells Fargo or two to my bank.
28:26
And that is a machine to machine communication.
28:28
We have to start rethinking identity.
28:30
So, we've always thought about identity as a user identity,
28:32
right? Super easy.
28:33
I know how to authenticate users, right?
28:35
We can do that very well, although we don't do that for a
28:37
while, but that's a, that's a different point of discussion.
28:40
Now, when we start thinking about identity of machines,
28:42
right, I've got two different aspects of that.
28:45
I've got workload identity. And this is like the carbon,
28:47
right? This is my function.
28:48
That's done up or my kubernetes, no Dharma, kubernetes pod, sorry
28:56
that I just spun up that kubernetes.
28:58
Each pod your registers. And if it's in something like a
29:00
CEO or service much, it'll go and get its own.
29:02
What's called a spiffy service product service.
29:05
Provider identity for everything, which is an x.509
29:09
service, essentially. That's giving a very short term,
29:11
often times, it's 90 minutes to two hours, identity, down to the
29:14
workload. Now, what we've done is, we've
29:17
also broker that's we can take a spiffy identifier and now we'll
29:22
assign a service identifier oauth, client, ID down to the
29:26
that workload identity. Brought those two.
29:28
The other. And now we have a much better
29:30
way of governing, a user, accessing a service identity,
29:33
which is tied to a machine identity.
29:35
So I have independent client identities that are now tied to
29:38
different workload identities. So, every instance of my
29:40
service, it spins up has its own unique identity.
29:43
Instead of now, instead of old way, which is, at an API key,
29:46
right? That was shared across a hundred
29:48
different services or 1000 different Services.
29:49
Even now, I have individual x.509, certs.
29:52
So if I have a breach, I can know exactly which individual
29:56
instance, it was as opposed to My service, got breached, I can
29:59
say this. Service instance got breached,
30:01
I'm going to go and rectify and look at the low audit logs for
30:03
that as well. The sounds pretty spiffy to me.
30:08
No one thing I thought as you were describing that framework,
30:12
which included open banking. You peel out kind of the open
30:16
banking thing. I'm just kind of freestyle your.
30:19
It sounds very much like a framework that can be used
30:22
across Industries, which I think is what you said.
30:26
But I was also having the thought I think, you know, to
30:30
put it in oil parlance, you're talking a lot about allowing
30:34
certain Scopes, kind of put me into the mindset.
30:40
I thinking of when it comes to that, I mean that's almost
30:45
functionality, Shores security. So, you know, especially from an
30:49
authorization context. But that's really like at the
30:52
core functionality of what is happening here.
30:56
Jim, you're right. So You know, kind of putting it
30:59
into that oauth scope our lands, right?
31:01
So what we're talking about thus far was all like oauth client.
31:04
Credential flows, right? How am I going to get a service
31:07
identity to a machine identity? Now, when I start talking about,
31:10
how am I going to authorize data and whether that's privacy,
31:12
related data, you know, be a grants or even other data that
31:16
might be t.i. at it, might not be Pi.
31:18
Those are the Scopes that you're talking about and so you know
31:22
what we've done and not too kind of toot, our own horn too much
31:26
but is we built governance around the Scope.
31:28
So as a developer have governance that covers exactly
31:31
what's going to transpire. So when I register a service, I
31:34
can no longer ask for, hey, I want that full jot.
31:36
I want the full user record. I need all this data unless I
31:39
actually need it, right? And that's very different way of
31:42
treating it. So I just used this metaphor on
31:45
the open banking World Congress just last week, but you know
31:48
what we're seeing is that Pi? I write for the last decade has
31:52
been called. It's the new oil, right?
31:54
You know, from whether it's Harvard Business review or CIO
31:56
monthly, but it was really We becoming as the new CEO to write
31:59
because we're not able to control it, we're not able to
32:01
constrain it, it's propagating wildly because we're sending
32:04
these giant jobs or do these giant access tokens from service
32:07
to service the service, no idea where the data goes.
32:10
Right? Might get dumped in a syslog,
32:12
might get pumped out to another another API that we are unaware
32:15
of. It might go into any recording
32:17
platformer, might go to a rogue service, no clue once it's out
32:21
the door. So by actually doing governance
32:23
around the access token, that's being meant to write.
32:26
What are we able to do? We're able to say service, a can
32:27
see We'll use a record service. Be can only see first name and
32:30
transaction ID. I think of all the things that
32:34
can go wrong for banished from a security perspective and it
32:37
comes to apis. And then you toss in like
32:40
Facebook, wanting to be at having access to financials,
32:44
right? You mentioned face.
32:44
I'm like, there's no way I'm ever going to allow like
32:47
Facebook, to be financially, connected to the rest of my
32:51
stuff, right? But that's just an editorial
32:54
coming anyway from a security perspective.
32:57
What is the Worst thing that could happen if the open banking
33:02
apis are really just apis in general, aren't properly
33:04
secured, I mean, obviously there's theft, right, someone
33:07
could intercept and steal money, I think of an attack.
33:11
If you're a fan of office space where your may be developing an
33:13
API that, you know, just takes fractions of a penny, right?
33:16
From a bunch of different accounts and you know, you hope
33:19
you're never caught. What are some of the other
33:22
things that maybe aren't as noticeable from a security
33:26
perspective that People should be concerned about and drive
33:30
towards making sure that apis are probably governed are
33:33
properly secured and being utilized the way that they've
33:36
been designed to. Yeah, so that's a good question.
33:38
And, you know, it's actually relatively scary like when we
33:41
start back to talk about it, because if I look at, you know,
33:44
what's driving my Tesla, its API, right?
33:47
It's calls from, you know, a service on my steering wheel and
33:50
my accelerator down to, you know, the central control panel
33:54
and then talking about to the internet somewhere.
33:56
So what can what's the worst-case scenario, you know?
33:58
Yeah. Well, somebody takes that over.
33:59
And we've seen it. We've seen it hacked many a time
34:01
already. I think, Dodge not successful in
34:04
a fairly but Dodge and a few other ones have had their, you
34:06
know, their auto-drive features and apis hacked.
34:10
We saw that we're just person Mercedes.
34:12
I think believe that was the end of last year.
34:15
It wasn't a hack of the driving system, but it was a hack of the
34:18
data coming through the Bluetooth platform, right?
34:21
So so it's not just personal data but you're actually
34:23
livelihood, right? Can be impacted and whether it's
34:26
a, you know, heart monitor. And I T device or whether it's
34:29
the car that you're driving, right?
34:30
And not doing a pi security, right?
34:32
Is going to fundamentally, put you at risk and put your
34:35
organization at risk for not just, you know, Financial
34:38
liabilities but potentially, you know livelihood of people?
34:41
Yeah. I think about that too.
34:42
And it's a connected world and if a human designed it, that
34:47
means that there are flaws in it and there will be, you know,
34:50
ways to break systems as that have been designed.
34:55
I know that you've been very generous With your time with us.
34:59
And one of the things that we've started to do is kind of close
35:02
out with maybe something not. So I am so that we're not
35:05
leaving on a heavy note, right? Try to lighten the mood after
35:08
the Doom and Gloom of not having apis being secured and I think
35:12
all your money stolen and Facebook watching you, Jim came
35:16
up with a good one. I'll let him have the honors
35:18
Jim, why don't you go for it? Yeah, but before I do that Jeff
35:21
went to remind you. They are fractions of a penny.
35:23
Have you seen the the penny dish at the convenience store?
35:28
Therefore everyone right, Community pennies.
35:31
That's little Office Space. Chatter if you will so mine on.
35:38
I am question and this is really timely because of my guests.
35:43
Guzzler that I mentioned earlier, my nan, I am question
35:47
is what is the coolest car you've ever owned?
35:51
And I'm going to start with Nathaniel.
35:53
Oh, this is a, I got a two-part answer on this one too, so I
35:57
still own it. So I have a 77 Vijay 40, which
36:01
is the old Land Cruiser, but the BJ is a diesel does Ignatian, I
36:05
imported it from Canada on 25 some odd years ago, so it's kind
36:10
of like a diesel Jeep essentially, that's incredibly
36:13
low geared. Seemingly can drive up trees,
36:15
although I would never hurt a tree, second one would be an
36:20
F100. So I've got a 52 F100, that's in
36:24
my garage. That's, I mean, it's pretty to
36:27
look at and that's more my wife's car, but I bought it for
36:33
us. There's a tough guy.
36:35
For me to my first cars. Like I love this so much.
36:39
It was a 69 Ford Falcon with dry-rotted winter tires.
36:45
So in other words, these tires were like if I stepped on the
36:49
gas they spun and left. A black streak behind me and
36:53
left a bunch of smoke because they were just like just so old
36:58
of tires and everything but that was a fun car.
37:01
I had a 72 Nova SS in college. I drive a Mustang convertible
37:07
now, but I think the fun is car I've ever owned was, I had an 88
37:12
v w Vanagon with one of those tops and popped up and became a
37:18
tent. And it had a full size bed under
37:21
it. And a full-size, the back seat,
37:25
folded down to become a full-size bed.
37:27
It had a kitchen and a refrigerator in it.
37:30
I mean, it was like my Hippie Mobile.
37:33
So that thing was You know, everybody loves it was a
37:37
conversation piece, the only downside to others to downsize,
37:42
one was, I mean the thing broke down a lot so it was in the shop
37:46
about as much as it was in my garage.
37:48
The second thing is it was a gas guzzler.
37:51
So when gas was cheap that was no problem.
37:54
But when gas got expensive and like I'm experiencing right now,
37:58
we're gas has not existed in my part of the country, that was
38:03
not the best. So, With that, I already know
38:06
what Jeff sensor is going to be. So go ahead, I'll pass the you
38:09
Jeff. Well, okay, so I'm not a car
38:11
person at all. I'm more of a, you know, the
38:13
tech geek nerd. So, of course, my answer is
38:15
probably not going to be surprised, but it is definitely
38:18
my 2018 Tesla Model 3. Absolutely.
38:21
Love that vehicle. Absolutely perfect.
38:24
Never had a problem with it at least no major problems.
38:27
Right stuff that you know, little things here and there but
38:30
it is so much fun to drive an electric vehicle.
38:33
You know I'm a Tesla fan just They were the ones that that
38:37
came out ahead of time and the one that was available.
38:40
And I've been waiting on that one for a while.
38:41
So I guess you can coin that my maybe midlife crisis car, but I
38:45
think it's fantastic. I have not been to the gas
38:47
station in, I don't know, at least six months, maybe even
38:51
longer mostly just to fill up my wife's car and I haven't, you
38:55
know, I can't remember the last time I had to take care of an
38:57
oil change or anything like that.
38:59
Mean the only maintenance I've had to do on it is putting in
39:02
windshield, washer fluid, that's it.
39:04
So I absolutely The Tesla is just so much fun to drive and
39:07
you know, I think it's not it's not specific to Tesla, right?
39:10
The the quick acceleration and the torque that you get from an
39:12
electric motor. Most electric cars are a lot of
39:15
fun to drive and it comes down to, you know, probably the
39:18
Comforts that come around it. But, yeah, absolutely.
39:21
It is, is my Tesla. That is my pride and joy, and
39:25
I'm looking already looking forward to my next EV and
39:29
whether I'll stay with them, Tesla brand, or maybe.
39:31
Look at something like you were kind of talked about this last
39:35
night. Night, my wife and I around, you
39:36
know, maybe the Ford Mustang Mach e which is, I know there is
39:41
polarizing. A, whether you should be using
39:43
the Mustang name for an electric vehicle, but it looks pretty
39:47
sharp and seems to have some some pretty good metrics around
39:50
it, so I'm going to go but I'm going to go with my Tesla.
39:52
That's that's my jam and it's a lot of fun to drive.
39:57
So I think with that, that's probably a good spot where we
39:59
can go ahead and leave it. We had a pretty good mix of
40:02
vehicles there between trucks and hippie mobiles and Mustangs
40:06
and Tesla. So I think we covered really the
40:09
the wide variety of vehicles that could potentially be out
40:12
there. Nathan's think thank you so much
40:15
for joining us and hopefully people were able to get, you
40:18
know, idea of kind of, at least, if they, if they aren't familiar
40:21
with open banking, you know, how they might already be using it
40:24
and not even just be aware of it, but How, you know,
40:27
Technologies and standards are developing to make life easier
40:31
to be able to manage finances. And, you know, and Underneath It
40:34
All. There's identity, right?
40:35
It's part of this process etcetera.
40:38
I will have a link to Nathan in the show notes.
40:41
If you want to connect with him on LinkedIn, obviously can
40:44
connect with Jim and I is there as well.
40:46
We're always happy to engage and talk with, you know, our
40:49
listeners and get ideas for shows, and so forth.
40:53
Also have a link to Cloud entities website.
40:55
So you can learn more about what Nathan and his company has been
40:57
doing in this space you can get familiar with their offering and
41:02
for us right you can always find us on the web at identity at the
41:05
center.com you can find us on Twitter idac podcast and with
41:11
that we're going to go ahead and close it out for this week.
41:13
Preciate everyone thanks for listening and we'll talk with
41:16
you all in the next one. Thanks for listening to the
41:23
identity at the center podcast. If you like what you heard,
41:26
don't forget to subscribe and visit us on the web and identity
41:29
at the center.com.