Latest / Identity at the Center / #129 - Zero Trust in 2022 with Den Jones

Transcript

#129 - Zero Trust in 2022 with Den Jones · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast, I'm Jeff and that's Jim.
0:28
Hey Jim hey, Jeff, how are you and happy New Year?
0:31
Happy New Year. Welcome to 2022.
0:34
The first show of 2022. Yeah, the first call I had was
0:40
on Monday coming back from the long break and I felt like I
0:44
couldn't even concentrate, but I've been on the phone all day.
0:48
Now for you know the behind-the-scenes this Wednesday
0:51
afternoon years and yeah sorry. Get back on track and my
0:57
favorite part is trying to remember what it is.
0:59
I do for a living and how to do all the different things that I
1:02
that I just don't do very often and have to start again, the new
1:05
year. So it's always good times.
1:07
I'm sure other people are like that too.
1:08
Was always a big time for password resets coming home
1:11
security Hobson. No doubt no doubt in for what we
1:14
do, you know I just was reminded of one of the interesting
1:18
aspects today which is, you know, we hold workshops with our
1:23
clients to help. Kind of develop their I am
1:26
strategy and we're meeting with people throughout the
1:29
organization. So we might be meeting with
1:31
somebody from the business continuity test Disaster,
1:34
Recovery side or logging, or you name it, any other part of
1:40
eyeteeth. Pmo.
1:42
And if folks aren't prepared or understand why I am might have
1:48
something to do with their area or their area might have
1:52
something to do with, I am the last question.
1:54
It's like why are you asking these questions?
1:58
What we know, what is my what I do have to do with what you do?
2:02
And so I think that goes for a lot of parts of life, though,
2:06
right? I mean, you got to kind of set
2:08
the context. You got to kind of set the
2:09
Baseline and just, you know, I felt reminded of that today.
2:14
And that was, you know what I wanted to share?
2:16
Yeah, context is key in any in setting expectations for any
2:21
conversation you and I were part of that same conversation and
2:25
Hopefully, I brought it back to try and rescue kind of where
2:27
things were going but you know, I think trick in full
2:30
transparency. It wasn't a great start but we
2:32
figured it out. Yeah, well, I mean, it's
2:37
something we've run into many times over many years or so it's
2:42
something that, you know, I mean, it's it never goes away.
2:46
I used to call it, stump the chump because you get this, get
2:50
in a situation where, you know, you kind of feel like some of
2:53
those questions are Are you know, trying to get you rattled.
2:57
It really kind of depends on the, you know, how aggressive
3:00
the the person gets in terms of white.
3:04
Why are you asking these questions?
3:05
But I think for the most part people are just trying to
3:09
understand like why do you need to know this information?
3:12
Because we're all kind of Guardians of the information
3:16
that were responsible for and you don't want to just give out
3:21
your give out that information willy-nilly we especially if
3:26
it's secret to that business. Yeah.
3:29
Plus I'll so people don't want to waste their time.
3:32
Right. Why am I here was you know,
3:34
what's the point of this? This could have been an email
3:37
instead of a meeting, right? All that all that stuff, too.
3:39
So it goes with it. We also started something new
3:43
over the break. You want to talk about that?
3:46
Yeah, so it's idac identity at the center or idac dot live.
3:53
It's a YouTube streaming. Page, if you will, we're going
3:58
on once a week and we're streaming video, we've always
4:01
been resistant to doing video with the podcast.
4:03
And when you see the podcasts are when you see the video,
4:06
you'll know why that's probably true.
4:11
But I think it's interesting because we do the podcast and
4:14
it's more formal more structured.
4:17
So he's guess where it's the streamers issue and I and it's a
4:21
little less structured. We pick something like an
4:23
article, we read. Recently and just share our
4:26
thoughts and our experiences relative to that or whatever
4:30
comes to mind and I think people will like it as I think, you
4:35
know, I I follow a few podcast myself and, you know,
4:41
definitely, you know, you start down your podcast route based on
4:45
what your interest areas are and you want to, you know, hear what
4:49
these experts in whatever field it is talk.
4:53
But after a while, it's The personalities and the Side
4:57
Tracks that keep you interested in it and if you like this
5:01
personality should keep coming back for more and hopefully, you
5:04
know, people like our personalities and come back for
5:07
more with the with the stream. Yeah, it's fun.
5:12
I like it, it's it's different. We're still kind of figuring
5:15
out, I think format and length, and time.
5:18
And when to do it and things like that, but I like that it
5:20
gives us the opportunity to be more current with things.
5:23
And also, if you're watching Seeing the stream or even after
5:25
the fact, right? You can always comment and we
5:27
can engage in a conversation kind of real-time and answer
5:31
questions and get you know what, what people give our two cents
5:35
on what it was there thinking, you know, we've we've done it a
5:37
couple times here so it's cool. You know, the why, the wild
5:40
Madman ramblings of Jim and Geoff when it comes to I am and
5:44
whatever else strikes our fancy for that particular day.
5:48
Absolutely. Well let's pivot this to where
5:51
we want to take this conversation because Speaking of
5:55
like Smooth Transitions and the wild ramblings.
5:58
I feel like zero trust has been one of those for the last couple
6:01
of years. It has not stopped.
6:03
It is, you know, gained steam over the last, I'd say really
6:07
the last year is when I've seen kind of a lot of growth in the
6:11
area. And we're very fortunate that
6:13
for our first guest to 2022. We've got Dan Jones, he's the
6:17
chief security officer at Banyan security and he's also an
6:20
Advisory Board member with the identity defined security
6:23
Alliance. Welcome to The show Den.
6:26
Hey guys! Thank you very much for having
6:28
me and happy New Year. Everyone, it's great to be here.
6:31
Yeah, happy New Year and I should also, I'm going to T,
6:33
something. We're going to talk about later.
6:35
Also known as Urban punks. So we're going to get into what
6:39
that means a little bit later because I'm totally fascinated
6:41
by this. But before we get there, let's
6:44
talk a little bit about identity and this being the first time he
6:47
on the show, we always like to kind of find out what the
6:50
identity origin story is for somebody, whether it's Identity
6:53
or info suck at Large. Is it something that you chose
6:56
or did it choose you? How did you get into the space?
7:00
Well, I tell you so I was a young kid at College back in
7:05
Scotland, in the mid 90s and, you know, back then it was
7:09
pretty hard to get a job out of college.
7:11
So I of their a class members. I was the one person to go to
7:15
job and the first sheet of leaving college.
7:18
And I just happened to join a factory working in a small, it
7:22
team and my first job. Was I was going to be in the
7:26
vale admin a network admin server admin and email admin all
7:31
of all of the above you know like all these smaller it teams.
7:36
So my first identity gig was really working with NDS Novella
7:42
version 3.0 11. I think it was back in those
7:45
days. And so I'd say in desperation, I
7:51
got the first job that came along so I kind of You have
7:55
picked me. I think what I just wanted a
7:57
job. So, worked hard there and, you
8:02
know, to start to learn more things.
8:03
So then it was really a jack-of-all-trades.
8:07
So I know you kind of had like that, it background.
8:09
What is it? That I guess what was the pivot
8:12
from managing? Like an IT infrastructure?
8:14
We like yeah. Give me infosec like, that's
8:17
what I want. I'm crazy.
8:19
Yeah, it was really bizarre. So I left that company.
8:24
Sometime done some contract, work and landed in Adobe back in
8:29
there and brofist, European it team.
8:32
And then in 2001, move to the US.
8:35
And if anyone follows the Adobe history, we certainly had our
8:40
challenges from a security perspective and it's some point
8:43
as part of a huge investment, Adobe were making to try and,
8:46
you know, get on top of all all of their challenges, they
8:50
created a central it security team and I was part of that and
8:54
what I It was all of the directory and authentication
8:57
stuff all the privilege stuff. So I really everything was all
9:03
centered around the directory type Services because that's
9:09
that's what I had been doing for pretty much 20-odd years.
9:12
So I knew even within Adobe, I'd been in Adobe that point for
9:18
over 15 years. So I knew where the skeletons
9:21
were because I knew about privileged because I knew about
9:24
About how the server team ran their stuff, so privileged
9:27
identities on servers. I knew how we done a Social
9:30
Media stuff. I knew about our Banking and
9:33
Financial systems because I had led Services, they care to
9:36
those. So when you think of identity
9:39
identity is not just the regular personal logs in and checks
9:43
email, right, there's privileged identity, especially is where
9:46
you get into. It's not just an API account.
9:50
It's not just an engineer, it's all of, it's all of the above
9:54
and more. So yeah.
9:56
So that was a fascinating change and you're not the first person
9:59
from Adobe, we've had on the show we had Eric Anderson on a
10:02
few months back. Last year I guess technically at
10:05
this point and it was a great conversations I think it was
10:08
episode 91 if I if I remember correctly so courage people to
10:11
go back and check that out and also shout out to Eric because I
10:15
had forgotten how good the struts were and based on our
10:17
conversation on that one. They totally, they owned my
10:21
Spotify listening habits for 2021.
10:24
So, But I digress. So at this point, then you're
10:27
with Danny and security. What is Banyan security do?
10:31
Because you know, for people who aren't as familiar with the
10:34
organization, I guess, what are? You know, some of the issues or
10:36
challenges that you guys look to solve?
10:38
Yeah, well, well, the first thing to clear up is we're not
10:41
the Banyan veins team. If you know anyone who's been in
10:44
the industry long enough, will know, there was this old company
10:47
called Banyan Vines II, never use their technology so I don't
10:54
really know too. It's about them, but I can tell
10:56
you about us which is, were small start-up in the zero trust
11:01
space and we will get back to what do we mean by zero?
11:04
Trust, I guess soon but in the zero trust space I was a
11:09
customer of Banyan when I was at Adobe.
11:12
Eric and I and our team we adopted by a platform early on,
11:18
we were really excited about it years later because I'd left
11:22
Adobe a few years. Then I rejoined but I joined
11:27
Banyan with really some enthusiasm because their
11:31
proposition in this space I think is pretty unique their
11:34
ability to get up and running really fast is brilliant.
11:40
It's a really customer great user experience, you know, user
11:44
experience friendly platform and then one of the other things is
11:48
VPN or not to VPN, they not only help you recognize and solve
11:54
that. That question but they will show
11:56
you and help you understand where you are in your journey of
12:00
zero trust which is really unique.
12:02
There's there's not a lot of players in the market that do
12:04
that. So I knew the co-founders from
12:07
working with them before in Adobe and you know, they reached
12:11
out they wanted to bring in some people who'd had practitioner
12:15
experience. So me having led the team, Adobe
12:18
to deploy, zero trust, then led the team at Cisco.
12:22
I'm uniquely position to talk. About the scars and the war
12:26
wounds of actually delivering zero trust and how did you pull
12:29
that off? So it's an exciting thing.
12:32
The good thing is I'm not a big fan of salespeople, so I don't
12:35
mean to disparage on them but they're not.
12:39
My favorite type of people to engage with.
12:41
So one thing that we've got which is really cool, you don't
12:44
need to talk to her sales team, you can just go to Banyan
12:46
security dot IO and you can take this test drive and for a small
12:50
team it's actually my teams Edition which is free and you
12:54
can get Running in 15 minutes so you can you can get started and
12:58
it's pretty cool. So I don't want to do the sales
13:01
pitch. That's really not my job.
13:03
I don't want to be a sales guy so I'll let people go figure
13:07
that out for themselves and you know they'll find out who call
13:10
the sales team if they want that.
13:13
Tim love, the origin story is kind of a blast from the past.
13:17
Think about the directory days because I think if you're
13:21
involved in, I am and account security, you know, 15, 20 years
13:26
ago, it was all about ldap, it was all about Netscape directory
13:31
or sun directory or even active directory, which was kind of
13:35
the, you know, it was frowned upon and in this establishment
13:40
in terms of being a true directory.
13:43
It's interesting. Today how much, how much more is
13:46
looked at as the de facto directory standard or maybe not
13:50
the standard, but at least the standard-bearer it's, I am also
13:55
glad that you brought up the Banyan bind speech because I do
13:59
think I'm going to go on a limb here, Jeff.
14:02
And because we had one guess to part of their origin story, was
14:06
they were a banyan, binds administrator and I think it was
14:10
Jackson Shaw episode 52. Back in July of 2020.
14:15
So I'm going to go back and listen to that.
14:18
I think it was him. If I got that wrong, it's my
14:21
bad. But yeah, you don't really run
14:25
into that many folks who are, you know, have banging binds in
14:29
their origin story. Yeah, I don't know for sure when
14:32
it was, I'll be honest, but it's old school.
14:35
I a, I think a banyan I think of Steve Banyan from well, that's
14:39
different. Steve, Daniel.
14:40
But I think of Banyan from Seinfeld.
14:43
So that's just me. Yeah.
14:46
That's that's funny. So but so we're going to talk
14:51
today about zero trust and I'm not sure if you've heard of it,
14:55
but if you have you know, maybe you could give give us a.
15:01
What is your definition of zero trust.
15:03
What does it really mean to you? Is it a product or is it
15:08
something something more? Yeah, that's it.
15:12
It's a great question. I always say people if you get
15:15
20 people in the room and you ask them what zero trust is,
15:18
you'll get 25 answers and I still think after all these
15:22
years you can go, you can go back to the junk in the rug
15:26
days, wherein photo store, you know, he's got the paper out and
15:28
says what it is, you can go before that where you talk about
15:34
the government US Government defense, where the they have
15:37
their views on that and then you've got Google's Beyond Corp,
15:41
I kind of look at it. Like Is an architecture is a
15:45
principle. Is it, you know, an ideal
15:49
ideology. The reality for me is I sum this
15:53
up really simply is I try and see it away from the terror now,
15:58
because I really want to focus on the outcome.
16:01
I think so many people get wrapped up in what they mean by
16:04
zero trust that they forget what actually here to run a business.
16:08
And the biggest part of the outcome is the way the identity
16:12
industry is moved far. Or word years ago.
16:15
I needed to know. It was Dan, it was going to
16:17
access the app. So I put in a username and
16:20
password and there was no thought of trust, given to the
16:24
network. You are on.
16:26
So that whole idea of you've got your firewall, and if you're
16:30
inside the corporate Network, you're good.
16:32
Well, that I think is obviously evolved over the years.
16:35
The way we're being attacked by bad, guys.
16:38
So, I just kind of look at this. Like it's a bit of an
16:40
Eeveelution of how we access. And services taking into account
16:46
that the networks and the environments were coming from,
16:49
have a totally different level of trust.
16:52
So what we're really trying to do now is establish a better
16:55
level of trust and in some cases when you get more mature, you
16:59
might talk about that trust level might be more Dynamic,
17:03
right? I don't know.
17:04
The type of app I'm going to the kind of role I have the kind of
17:08
device, I'm from the country, I'm from.
17:11
So when I think of this is no longer Simply am I in the
17:14
network on my corporate computer where I just go straight to the
17:18
app internally? Well, we've evolved, we've got
17:21
so many more Cloud apps will get so many traveling Workforce,
17:25
especially when the recent years with all the work from home,
17:28
then that's totally changed our concept or our thinking on a
17:32
what this but how we're being attacked, you know, we're no
17:36
longer being Brute, Force attack.
17:38
Let me break your firewall and get in.
17:40
We're being here's an email. Just click this link and All of
17:43
a sudden the Bad actors on your device with your credentials.
17:47
So you know for me it's it's a different mindset.
17:51
I just see this though as an evolution of what we've really
17:55
been trying to do in the industry on guaranteeing that
17:58
it's you and that it's not a bad guy pretending to be you.
18:03
Yeah, I kind of feel like if you were to put together degree
18:06
program in identity and access management zero trust, would
18:11
have to, at least be one of the one of the courses and for me
18:16
required reading would be the newest paper. 800-218-4243
18:23
starco texture. It's it's heavy, right?
18:27
That's kind of putting it in that University context, a lot
18:30
of reading, but it's good reading, right?
18:33
I think if you really want to understand your trust and kind
18:37
of build a footing in it, it's a good place to start.
18:41
I think the other thing is how to talk about zero trust because
18:45
there's the selling process within the organization, right?
18:50
The first time I heard of zero trust you know, it did cross my
18:53
mind, what you don't trust me. And I kind of always feel like
18:57
when we talk about zero trust you, somebody who's not an I am
19:02
lifer or security lifer, that's probably the impression that
19:05
they get what you don't trust me.
19:08
What do you think of that? Kind of selling processor zero,
19:11
trust from C? So perspective, are you have to
19:15
talk to non non information security?
19:20
Nerds like us and make them understand what it is and why
19:24
it's important. And so how do you do, how do you
19:27
do that and get past that those kind of hurdles?
19:31
Yeah and there's three main audience is, you know, so I was
19:37
in Adobe it was a uniquely different experience because the
19:41
term zero trust wasn't as mainstream as it is now.
19:45
So we're going back to late 2017.
19:50
And the, the way I phrased this and I was blessed either.
19:55
Good, architect was in our team that really was hit my head off
20:00
a wall. Saying, hey, we should look at
20:02
this. We should do this.
20:03
It wasn't my brainchild and Adobe to start the program off.
20:07
I think re-architect Benzie John, he was hit my head off a
20:11
wall thing, but but look think of this thing.
20:13
So it started with him selling it to me and he was selling it
20:17
to me, really a technical level But then an emotional level and
20:22
the first thing I thought of is okay, this thing actually would
20:25
be brilliant, totally, they don't know, I'm sold in the
20:29
principles of the easiest sales technique.
20:31
There's three audiences. There is the person that runs
20:35
it. There's a person I run security
20:38
and then there's your user base. And if you start with your user
20:42
base and you turn around and say, would you like to never
20:45
have to enter your username and password again?
20:49
Right, I'd sounds like an easy question.
20:52
So, would you like to never have to login via VPN again?
20:56
Okay, sounds like an easy question.
20:58
How about you never want to change your password every 90
21:01
days again? And that sounds like an easy
21:04
question. So if you got your user
21:05
community and you say, hey, do you want some of that?
21:08
That's easy. If you go to your CIO and their
21:13
leadership team, they are all about user experience in the
21:18
organization and that all about saving money, right?
21:21
Cios are under extreme pressure. To reduce the operational cost.
21:26
So if you turn right into them and you would say, how would you
21:29
like to reduce the service desk ticket?
21:32
Related to password change by 60 to 80%.
21:36
They're all over that if you would like to say to them or and
21:40
how would you like to not have to have users change passwords
21:43
and user passwords? And, and when you tell them the
21:46
same thing, their eyes light up because they get it, and they
21:50
can translate that to soft dollar value that they can take
21:54
back to their leadership. Now, if you go to the, the
21:58
security leader, now, in those days, in Adobe, I was the Right
22:02
to reporting to their CSO. When I go to our CSO, an adult.
22:06
We I was like, hey, how would you like to improve security?
22:10
And these ways? Oh, and by the way, your peer,
22:13
the CIO, she'll reduce our cost by X y&z here.
22:17
Here and here, At that point, the security conversation is
22:23
really good. Would you like to improve
22:26
security? So, the bad guy is kind of
22:28
scraped passwords and we're doing more more male factor or
22:31
more Dynamic than to keishon. Would you like to remove the
22:35
ability for lateral movement? Would you like it so that when
22:39
you VPN the employee, who vpns and doesn't have full access to
22:43
the corporate Network? Because most companies when they
22:46
build VPN Solutions They lock it down for all these groups, but
22:52
generally, the full time employee Group, which is your
22:55
biggest group. They're not locked down.
22:57
They usually get full access because locking it down was very
23:02
expensive, and very complicated and usually flawed anyway.
23:07
So when you tell these people, that all of a sudden these three
23:12
audiences, they love with the here and you're not mentioning
23:16
zero trust because you don't have to say, Would you like some
23:19
zero trust, especially nobody really agrees?
23:22
What zero trust us? Yeah, it's not like there's like
23:25
an easy button right for it. So, so Dan, you sold me.
23:28
I don't want to change my password anymore.
23:30
I don't want to have to enter the one.
23:32
I do have as often now comes the hard part, I think in a lot of
23:37
people's minds and that is where do I even start?
23:40
I guess my question to you would be how do I get started with
23:44
zero trust? And if you can kind of help me
23:47
understand that I think that would help a lot.
23:49
People out there. Yeah.
23:50
So there's there's people process technology but just from
23:54
a you know, most of us are in the listeners are technologists,
23:58
right? So let's talk about technology.
24:01
So I was in charge of the identity management of both
24:05
companies Adobe in Cisco, and you don't need to ask permission
24:12
to improve the experience of the authentication workflow.
24:16
So I started there, I said, well, wait a minute, I'll
24:19
improve the experience. We connected our alte platform
24:25
in Adobe to r0. Trust platform for posture
24:30
check. So, the very first thing we done
24:32
with we do not really small pilot where we built these
24:36
little environment. You know, the pilot environment
24:39
and we took OCTA. And in those days, it was a
24:43
VMware, the IDM and Five, apm's for the reverse proxy and we
24:49
built these things together in a small pilot to prove that we
24:54
could use a certificate instead of the password that we could do
24:59
a posture check on the device and then we could seamlessly let
25:03
you into our applications on the network but only to the specific
25:08
selected applications. So basically we were internet
25:12
enabling those apps. That was the kind of feel in
25:14
your giving. For someone who's on the device
25:17
which has the zero trust stuff. So in our case is zero trust off
25:21
was, was it managed did have our endpoint protection on it or we
25:27
look at the iOS version. Do you look at the patch version
25:31
and your journey of zero trust? You know that that posture check
25:36
can improve? We didn't start to off
25:39
complicated at all. It was latest OS and was it
25:43
managed and then with the endpoint protection, And our
25:46
certificate have our certificate existed that was, you know, a
25:50
big thing because we use that to hide the username and password.
25:54
So if you can inject into the authentication flow and then do
25:58
the posture check and then divert traffic.
26:01
If it's an internal app via your proxy.
26:05
That's not a complicated architecture to build out.
26:08
We built our pilot environment in a couple of months and then
26:13
actually to expand that to a production friends.
26:16
And Family launch get some feedback that that for us in
26:19
Adobe was a seven-month project to go from concept to actual
26:25
fill go live with 40,000 users and along that Journey.
26:30
We were just testing out with larger groups but the
26:34
architecture wasn't very complicated.
26:37
So I think people that think how do I get started?
26:39
I've heard all sorts of nonsense.
26:41
I've heard someone say asset management and it's like, what
26:45
do you mean asset? Judgment.
26:47
I don't think in 20 years I've ever heard of the cmdb ever been
26:50
right? And asset management ever been
26:53
great, you know? So for me one thing I could do
26:56
though as I could say using our zero trust platform, we could
27:01
scrape the data of the, your device, and the fact you logged
27:05
in. And we can fair that we see you
27:07
every day on this laptop week, them fair that, that laptop is
27:11
there for yours or were tagging it to you and then then we'll
27:15
drop that in this. Cmdb and then and you would have
27:19
heard Eric talked about this on your show how we gamified and we
27:23
showed that devices. So if you logged into an
27:26
application from a device that had nothing like didn't have any
27:31
of our zero trust. No end point.
27:33
We would throw it under your name on that portal and give you
27:37
a flat zero. You've got really low score so
27:40
if I wanted my organization of a good score then hey guys, I
27:44
better get to a position where that device Is managed because
27:47
any unmanaged device is a log in to any of our apps from.
27:52
I'm going to get a bad score so you can scrape that information
27:55
and stuff. Like that was really cool.
27:57
Well I think of zero trust for me zero.
28:00
Trust says, I don't trust a device that doesn't have at
28:03
least three things that we wanted to have and we would
28:06
which grape that. And then you get to the position
28:09
as well. We're within that.
28:10
Same thing that you built out, you could deny access to the
28:15
application. Even if you were zero trust
28:18
enabled meet in our minimum posture and that's the really
28:22
powerful piece. So I have a quick comment around
28:26
gamification and I just this is my brilliant identity software.
28:32
Feature enhancement idea for 2022 that I'd love to see
28:36
someone build and that is take the idea of Spotify unwrapped
28:42
right where it listens to your music history and kind of comes
28:44
in with, here's your things. Do the same thing for
28:47
authentication except gamify in a way was like, oh, you typed
28:51
your password in X number of times this year, or you took
28:54
advantage of x y z, you know, methods whatever.
28:57
Maybe that's how big of an identity nerd.
28:59
I am. And I'm sure that somewhere out
29:01
there. Someone wants to build something
29:02
like that. Well, we were doing.
29:04
Yeah, in the Adobe team. So in 2001, we build a portal
29:10
myself and this one lowest notes developer.
29:14
Believe It or Not, Eric. Talked about this poor old where
29:17
we used to allow self-service for groups, right?
29:20
We done groups and password that lipstick on the pig in front of
29:23
all these platforms that we had an adobe.
29:26
Well, myself, in this guy, venkatesh, we built this and
29:30
then the original version of it. He built a Lotus Notes, front
29:33
end, and I had batch files at the back end, all going to
29:37
active directory and there's like net group, blah, blah,
29:40
blah. And so, we were, adding removing
29:42
users from groups way back in 2001.
29:46
And in, for me, I wanted to evolve that thing to where we
29:50
were going to be like, like a dynamic playlist.
29:53
So I remember Tallman your show, talking about role-based access
29:57
control. And for me, I was never a fan of
30:00
it because it never really, it was always expensive, right?
30:04
So I was like, well, why don't we create it that you as a user
30:07
could go in there and you could create rules, but you can create
30:10
roles in the form of a dynamic playlist.
30:13
Hey, if you didn't this org, you've got this title.
30:16
You get in this country, I want you to be in this group and this
30:19
group has access to these things and then all of a sudden we just
30:23
do the look up every night and we'd start to see that and then
30:28
all you know you can't have no gamify it but you you make it
30:32
all self-service, my whole thing in my career was I don't want to
30:36
have to work really hard. I want to build things that
30:40
enable things to happen without being intrusive to our users,
30:44
and and sense. That makes me don't work so
30:47
hard. So Dan, one of the things that
30:50
crossed my mind? Well, first, I have to kind of
30:52
go back to the cmdb point because I just thought this is
30:55
funny Jeff. And I, we were during our stream
30:58
this morning, you know, both in lockstep need to cmdb need, a
31:03
good asset inventory, right? I mean, but I think the point
31:08
that you're making, right, is you never seem to seem DP this
31:11
perfect. But have you ever seen a
31:14
non-existent cmdb or One that is like such garbage that you can't
31:18
even use as a starting point. That's the problem that I run
31:22
into a lot. And it's like you at least need
31:24
to know the basics of your environment.
31:27
Because how are you going to get control of access to your
31:31
environment? If you don't know what your
31:33
environment is? Yeah.
31:35
Yeah, absolutely. No.
31:36
I've never seen one that's been so garbage that you've wanted to
31:39
just throw it out and start all over again.
31:42
I've seen some fancy Excel sheets.
31:46
I remember really in the early days in Adobe we had before this
31:51
is all automated. A lot of our networks were all
31:54
Excel sheets. I mean it was all, you know,
31:57
this huge big tables and tables and tables.
32:00
And in the end we we deployed you know, bmc's platform.
32:06
But we also deployed in four blocks his platform, we
32:09
integrated them. And then we go bmc's Network
32:12
automation technology. So that it was always bring that
32:16
In and I think the principle is a good cmdb is something which
32:21
is derived via, you know, Discovery and automated means.
32:25
So if you're if you've got a nice, you know, is our Cloud
32:29
platform where you're building compute, you do have a choice to
32:33
say, if I'm going to build a computer where it's only going
32:35
to last 15 minutes. However, going to record that
32:39
thing existed for 15 minutes and then was pulled down like these
32:43
kind of decisions. I think where you get into the
32:45
net Nitty-gritty of it. But ultimately, I can look at
32:52
this, like, we have enough logs. We've enough automated processes
32:57
where it's not hard to put it together.
33:00
It's just about dedicating resources and time to kind of
33:04
make that effort. And, and, you know, a lot of
33:07
cios, they all talk about cmdb has been brilliant, but at the
33:12
end of it when they're really pressured about, where do they
33:14
put their money, they put their money on.
33:16
Things are very visible to the business and sometimes the cmdb
33:20
and he's back end Services. They're just not so visible.
33:23
So they don't really enjoy the same level of funding attention
33:26
and love that you really need to have, you know, but that's life
33:31
Point. I've definitely seen that.
33:34
One other thing I wanted to mention about the selling
33:37
process of zero trust as I think even people might start with the
33:42
question, like well why do I need to see row trust that?
33:45
All right, what is Protecting me from like, what is the benefit I
33:49
get. And I think if you kind of
33:53
dissect a data breach or ransomware attack and you kind
33:58
of go through the parts and pieces of how somebody gets in
34:01
and then what they do from there, so you talked a lot about
34:05
authentication, right? Which is the, how do they get in
34:08
or, you know, but there's other ways that you can have a
34:11
ransomware attack which is somebody's machine, could be
34:14
compromised at a Starbucks. Buck's location or they're
34:17
working from home and click officially part of the, the
34:23
smart thing about ransomware containment is containment
34:26
right, making sure that that can spread laterally.
34:30
And when we talked the other day, you brought up an idea,
34:33
which I hadn't thought of before, which was brilliant
34:36
around. You know, when you, you join the
34:39
corporate, when you come on the corporate Network, right?
34:42
You're in your own little cell kind of like when you Go to a
34:46
Starbucks or something, you join a public public Wi-Fi, right?
34:51
You're not. You shouldn't see the clients
34:53
who are our next to you also on that Wi-Fi, maybe you can, but
34:57
that would be a security flaw. All right.
35:00
It reminded me of, you know, 15, 20 years ago when you would go
35:04
on to corporate network with your Windows machine and you go
35:09
into Network Explorer and you see all these computers and all
35:12
these printers and you could just go and see what are they
35:14
sharing in a people? For oversharing potentially
35:18
could get into their file shares and and do things, right?
35:22
I was kind of like a network guy.
35:24
So I was always goofing around like looking around and people
35:29
over share all the time and you know, I mean who could who could
35:33
be completely aware of all the settings and what they're
35:36
sharing on their computer. But sorry, I wanted to turn it
35:39
over to you to kind of explain what your idea was around that
35:42
because I thought that was really interesting.
35:44
Yeah, this is so, One of the earliest things that I shared
35:48
with our CSO was, you know, what do you wanna do, you want to?
35:52
And I put the word almost eliminate lateral movement
35:56
because in every big attack. The bad actor comes in, they get
36:00
a machine. And from the machine, they start
36:03
spreading out and they can spread out in seconds right
36:05
there. No, this isn't over months.
36:07
It's this, this they can be hiding for months, but they can
36:10
spread out over s. So, one of the things in that
36:14
concept was If you just look at Network segmentation and the
36:18
industry. So, first of all, a lot of
36:20
security people, a lot of their Origins are networks, so they
36:24
think of it like Network segmentation and firewalls solve
36:28
all problems, right? Or most of our problems, I'd
36:31
like to expand on that little bit farther and say don't don't
36:34
necessarily disagree that they solve lots of problems.
36:38
But, if you take a network, you say, look, I've got a data
36:41
center. I've got a lab Network and I've
36:44
got an office Network. so just those three kind of based
36:48
Networks, To get from the office Network to the data center.
36:53
Normally every good company with a Bastion host and they should
36:56
require multi-factor authentication.
36:59
So there's some level of gate to get in there and and lab
37:03
networks. You know, maybe they're a bit
37:05
twice eaten unique so they may have that they may not they
37:08
might be wide open to get to. But if they were then why would
37:12
you segment them off to begin with, right?
37:14
So the office Network, that's the one where the Massey's are
37:18
if you think of your privilege. Users.
37:21
They're usually always in the office Network before the get
37:24
privileged and go into, you know, their computer horse
37:28
bastions or whatever. But if you took that office
37:31
Network and you turn that into a guest network and on all guests
37:36
networks Starbucks, for example, is like a guest Network, all
37:40
guest Network. So you've got the principle of
37:42
all I can do is get to the internet.
37:45
I can't see those arriving to me, right?
37:47
So if you do that, That to your office Network and your
37:53
applications and services at all behind your zero trust platform.
37:57
Then you're not VPN again to get any white access.
38:00
The only thing you can do is connect to your zero, trust
38:04
available applications and you get to the app and nothing else
38:08
via that port and protocol and it guarantees, and ensures your
38:12
device meets a minimum security posture.
38:15
So, the problem with things like ransomware and all this other
38:18
stuff, is it cancer? Right really quickly to things
38:21
you don't want and and it gets in really quickly because
38:25
usually the point of entry, is someone clicked a link and their
38:30
endpoint security software, didn't catch it.
38:33
So do you have good endpoint? I don't know, like which one's
38:37
the best. I don't want to debate that but
38:38
the reality is is give yourself a Fighting Chance as an
38:42
organization by saying I will require that device have a good
38:47
awareness, be patched have good. A software, good logging and
38:52
require multi-factor. You know at least a basic
38:55
hygiene that we know is all goodness.
38:58
So the problem is is traditionally before zero trust
39:03
before what we were building, it was just username and password
39:06
regardless of the device posture and it was on a network that was
39:09
wide open. So if I can see for a thousand
39:13
devices inside a corporate Network like Adobe or Cisco or
39:17
whatever, right then that means A doctor, once they're in they
39:21
can spread that far that far that fast usually in those
39:27
Networks you're going to find devices evading stay of quality
39:32
of security posture. So me you're gonna have a,
39:36
you're going to come in on the one machine, you're going to
39:39
scan, whatever you can scan, you know, in the lateral way.
39:45
And then if you can find another device and in fact it Take over
39:50
that device, use whatever authentic, whatever accounts
39:55
have been, authenticator hashes exist on that computer and then
39:59
we play that until you get to the point where eventually, you
40:02
can own the active directory and then it's game over, right?
40:05
That's when you pay the big Ransom, whatever.
40:08
It's going to take because your company's been brought to its
40:10
knees. But interesting, one thing I
40:14
wanted to key off of the you talk about their, she talked
40:16
about corporate networks, I haven't been on a corporate
40:19
Network and Two years, right? I haven't gone into an office in
40:22
two years, but I VPN in and I'm wondering, you know, I learned a
40:27
lot about ztn a over the past two years, you know, especially
40:34
over this past year and I'm wondering, is that the Next
40:38
Generation for VPN is VPN going to the go the way of the
40:41
dinosaur? Is that the TLs instead of HTTP?
40:48
If you're following what I'm here?
40:50
Yeah, so it's great. Great quite so I great question
40:55
when I've done a lot of presentations. 2018 onwards on
41:00
on our zero, trust efforts over the years, both the Adobe stuff
41:04
on The Cisco stuff. And most of the questions that
41:08
people gave me were, is this a VPN replacement project?
41:13
Or did you justify the funding for your zero?
41:16
Trust by using funding from VPN in an Cases.
41:20
I said no there's there's a place for VPN and I never used
41:29
the funding for it. Why did use though was the
41:32
luxury of saying? Hey we're going to deploy this
41:35
zero trust thing and if ever this thing doesn't work you can
41:38
still use a VPN stuff. We're not taking that away just
41:40
now and then over the course of the maturity of your efforts you
41:46
get to decide. Are you going to reduce the
41:48
investment and VPN One of one of the things that people really
41:54
struggle with on any zero trust initiative, where they're trying
41:58
to reduce the VPN usage is understanding the VPN stuff and
42:04
you know what activities happening over there VPN
42:06
network. I would always just say to
42:08
people. There's a lot of players in the
42:12
market. One thing I love about what
42:14
we're doing is we enable that visibility.
42:17
We actually do have a VPN solution as well.
42:20
So we do, we do acknowledge that you might not be comfortable
42:24
taking VPN away, there may be usages for that but we use that
42:29
to our advantage as part of your journey, I look at it.
42:33
Like there's vpns are usually wide open to your network with
42:39
any port and protocol. Well our proposition is with
42:43
zero, trust deployments is to say, it's only that application
42:47
and only that Port protocol that you need.
42:50
Need to get to the application and you don't get to the rest of
42:53
the stuff inside. Get ecosystem, which from a
42:56
security perspective is huge. And from a user experience
43:00
perspective is huge because you don't know where the app is.
43:04
You don't need to know where the app is and you're not VPN again.
43:08
I think the first scenario is less administrative effort.
43:14
You can just have access to everything, the others more
43:17
administrative effort by much. Secure you know, the last
43:23
question I went to kind of hit on relative to zero.
43:26
Trust was you were talking about how much money you can see for
43:30
passwords and sticky from the CEO, I'm thinking to myself, I
43:33
don't want to spend anything on passwords.
43:35
It's like you came to my house and said you know, I could put
43:39
it in a new well and it's like already have a well I don't want
43:42
to spend money on that but just thinking of.
43:47
So another words where I was going with that is like I'd
43:49
rather. Ergo password less, you know,
43:52
you talked about, you know, the days of people trying to Brute
43:55
Force passwords is over, but people are still trying to use
43:58
the password as a way, as probably the most common way to
44:03
start a ransomware attack or at least a data breach or any way
44:07
to infiltrate a network or an application is through a stolen
44:11
password or you know, commonly use password things like that,
44:15
go to possession based authentication to me seems like
44:20
It's a critical component of zero trial straight.
44:23
It's a it's your level of assurance that the person is who
44:27
they say they are of course much more by going past from this,
44:32
would you? Yeah.
44:33
Yeah. Absolutely.
44:34
Now I'd love to come by to one point, you mentioned on the VPN
44:38
and the cost of administration. One thing to think of in the ztn
44:42
platform zero trust. Environment is you're not
44:45
worried about the network articles and all that business.
44:49
So there's Nothing of that. It's a few two members of the
44:52
group that has access to the application.
44:54
So it's really just by nature of you being in the directory
44:58
group, you get access to the app.
45:00
So there's absolutely zero Administration from a VPN
45:04
equivalent, which is a great cost saver from an operational
45:08
perspective from a password list perspective, I've been trying to
45:13
go password list since about 2011.
45:18
I think I wrote a way, Paper internally to do, be working
45:23
with PWC, just own identity strategies and in this idea of
45:28
being able to go password list was just, you know, always
45:31
intriguing to me because, yeah, look, we always just write the
45:37
same crap down on a Post-It note, you know, back then.
45:40
And you'd be like, password, and then it's like, okay.
45:42
But you got to change your password 10 times, you know, or
45:45
like every so often. But you can't reuse the last 10.
45:49
So you're paying the The 1 or a 2 and a 3 and you said it's
45:53
always the same format, we're human, we're not, we're not that
45:56
creative. If we use a password manager,
45:59
now that's brilliant. But from a corporate perspective
46:03
and this was great in Adobe, we used to give password managers
46:07
out as part of, you know, just being an employee.
46:12
But at some point we ended up saying, look, we're not going to
46:14
pay for this anymore. We'll arrange a discount and
46:17
here's a discount code because Corporate ways we had over 2,000
46:23
applications tighter opta platform all requiring MFA so
46:29
when we use certificates as part of that first factor or not
46:32
password we're like what's that password manager doing within
46:36
our corporate really not much in your home like you may still
46:40
have hundreds of things because they're not easily tied like
46:42
that. But the desire to go password
46:46
list is if I'm not entering a password.
46:48
I've nothing for a bad day. Actor to scrape and that's a big
46:52
thing, right? So for us, it's like, it's
46:54
changing the security posture at the same time as it's changing
46:58
that user experience. I think that's the key part of
47:02
password list, right? Is removing that, that hash that
47:04
can't be compromised. Yeah, we've covered a lot of
47:07
ground on the Zero trusting and it's, you can see why people are
47:11
confused over it, just on this conversation alone, sometimes
47:15
where it's sprawl. So much of the infrastructure
47:19
and The network and the internet and all the different things
47:23
that are out there which leads me to my last question for you
47:27
done. And that is what is good enough?
47:29
Look like 40 trust in the year 2022 because I feel like
47:33
sometimes we get lost and say, oh, you need to have the latest
47:36
and greatest all the bells and whistles and you're never truly
47:39
done. But I think about this from a
47:41
more pragmatic perspective is, okay, how do I get to good
47:44
enough? Because this is not the only
47:45
fire as a sea so that I need to fight.
47:48
Yeah, I know that's a brilliant question, Jeff.
47:50
And it's funny, right? So, my both of my team is but my
47:53
Adobe leadership team that I worked with for years.
47:56
Great, great, great team. But they would give me so much
48:00
grief because I'd use a term good enough all the time and
48:03
they're like, if I told the organization had good enough,
48:06
they're thinking that I'm loading my standards and it's
48:10
like no I don't want to lower the standards, I want to
48:13
recognize that we have other things, I don't think are good
48:16
enough. So let's get this to good enough
48:18
and then decide how far You want to take it, right?
48:21
So, good enough, if you haven't taken any steps and zero trust,
48:27
I want to say look, it's easy. You're not having to bring in a
48:30
million players. I need one person to my staff
48:34
and Adobe we use the existing team that does the existing
48:38
endpoint, the existing Network that exists, all the existing
48:41
people, you know, they're just working together and the good
48:45
enough for me was get them working together, get a small.
48:50
Pilot going and then expand the pilot into production.
48:53
And the first thing you want to really do, say, can we do a
48:56
posture check as part of the authentication from?
49:00
If can we get to the internal applications via a reverse proxy
49:05
or some other capability? And if you can, if you can get
49:09
to a position where you can see, let's let's do those things.
49:14
Then for me, that that be a great accomplishment, as you go
49:17
through your year, you get to Further, you know, the network
49:22
concept of turning your network and two guest Network or if
49:26
you're doing an m&a try not connecting their Network to
49:30
yours and have the things that that company needs.
49:32
Those people needs available via zero trust zero.
49:35
Trust enabled their devices we done that in Adobe a couple of
49:38
times and it worked a charm. I would just say you know take
49:45
one step forward every day that gets you in a position where you
49:49
would a little bit better. Better off than you were
49:50
yesterday. One of the big things that
49:53
people get hung up on and they don't take a step forward is
49:56
because it's not perfect. So, good enough for me, is a
49:59
brilliant term because it simply means I want to be better today
50:02
than I was yesterday. And I want to recognize that
50:05
this week, I might Focus here. And next week, you might focus
50:08
on security intelligence or something else.
50:12
It's okay to get smarter, right? What is he doing?
50:17
Sorry, good sorry. I was just going to say look we
50:19
don't have enough money and resources as Enterprises to do
50:24
all the things you want to do. So you have to be really smart
50:27
and pick your battles wisely and just know, you know, not try and
50:31
boil the ocean on Everything You Touch.
50:34
So I know that we normally would do like predictions at the end
50:37
of the year, so it, but we're weird.
50:38
And we're going to start with, or at the beginning of the year
50:41
real quickly, because I know we're running short on time.
50:43
Is what is zero trust? Good enough look like next year
50:48
in 2023 of table Stakes right now, in your mind is being able
50:51
to do that posture check, what should I be planning for as
50:56
table Stakes for next year? I would say, you know,
50:59
especially as people will return to the office figuring out how
51:03
to start. Learning office networks and two
51:06
guest networks and, you know, allow listing core services that
51:10
you just couldn't zero trust and able and and for everything else
51:14
have users, just go to the internet to get any internal
51:19
Services acknowledging that you have a blend of internal and
51:22
very likely, a lot of cloud services.
51:25
You can do that. That would be that because
51:27
ransomware is not slowing down, right?
51:30
And that's something that can really help save and reduce the
51:34
Impact of any, you know, ransomware attack.
51:37
That makes sense. So let's it's--this at the
51:40
beginning of the of the show. When I mention Urban punks.
51:44
So who / what is urban Punk's dead?
51:51
Yeah. It's brilliant.
51:51
You don't link link to the I guess I left sitting in there
51:54
that, you know, co-founder of our Urban Punk's.
51:57
Not for we originally, Urban punks was my idea where I've got
52:03
a big musical background and I just had the idea.
52:07
I wanted to get a collective of producers together and we would
52:11
collaborate on every song that we released, but I got really
52:17
busy in this work business so I never got to get the other
52:20
people together. So Arbonne Punk's is just one.
52:23
Punk is to still just me where I over the years, I've released
52:28
music under many names are Ben Punk's was the the most recent
52:32
one that I've used. I'd been releasing music since
52:35
94 released my first First single on vinyl hoping everyone
52:40
remembers what vinyl is because it's making a huge comeback.
52:43
I say it, it's the new rage right now again like yeah it's
52:45
right up there, a bell bottoms. Yeah, yeah, is right.
52:48
So I was fortunate enough to get a record deal in my early 20s
52:54
played gigs release Records Was a ghost ghost writer for other
52:59
bands and DJs so, you know, I done I don't know a lot of that
53:03
stuff in my mid-20s and then when I moved to the u.s. in,
53:07
One, I continue to do it, but just know as not know, I
53:11
successfully or not as busy I guess, because I was focused on
53:15
this, it career. So the type of music, you know,
53:19
you were kind enough to share kind of the SoundCloud with it
53:22
and is I guess electronic dance music but I don't want to over
53:27
generalize it. How would you describe your
53:29
music to someone's like, okay, what the heck?
53:31
What the heck am I listening to? Yeah, I mean it's it's
53:35
electronic. It's based on sense and that
53:41
style of gear, you'll not find much in the way of a guitar and
53:46
a saxophone in my music. But sometimes I've been known to
53:48
drop them in there and, and, you know, I try to think that it was
53:53
house techno trance, but I never seem to think I faii easily in
53:58
any of those genres. So, I try not to label it.
54:02
It's a hobby, it's fun. You know, and I'm trying to not
54:06
like, Pressure on myself to try and like get the next top 40 hit
54:12
I guess although that would be nice.
54:16
So I guess you've been kind of, we're actually going to play one
54:20
of your songs. I'm going to append it to the
54:23
end of the show here, so people will check it out.
54:25
It's a track called gee, I guess, tell me what the
54:28
inspiration for that is, well, it's funny because all the names
54:33
of the songs is kind of like, going back to the days where I
54:36
was sharing earlier, you know, naming servers, when I was
54:39
building servers. I could never think of a name.
54:41
I could build this error quicker than I could think of the name
54:44
for this Arbor So usually I'm pulling names from famous
54:50
actresses, actors TV, movie characters and things like that.
54:55
So randomly these names just pop up.
54:58
I guess, I don't really know where they come from.
55:01
Usually with enough of the right, the right liquid
55:05
refreshment. Then you can come up with some
55:07
creative names that is known to been to be truth, the world
55:12
over. All right, well, I think that's
55:13
a pretty good spot to leave it. It for this week real quickly.
55:18
Any final thoughts Den on the topic of zero trust or or
55:22
anything. That's kind of spark at your
55:24
brain right now that people should be taking away from this
55:27
specific conversation. I mean I yeah I mean I think
55:31
well first of all zero trust is going to continue to be a huge
55:35
Buzz board and probably become mind-numbingly boring as a term,
55:40
I really just say focus on the outcomes.
55:43
Don't focus on the term, focus on the Outcomes and focus on
55:46
that business value and find a way to connect with the
55:51
leadership above you and the the customers around you.
55:54
Because if you can get connected there without emotional level,
55:57
then you'll find that they want those outcomes.
56:00
Jim. How about yourself?
56:04
Well, something that I think Dan just kind of touched on very
56:09
briefly, which is around, you know, the idea that we want to
56:14
invest in something that's something that can be seen or
56:19
felt or, you know, I think in it a lot, it's the user experience,
56:24
right? It's improvements to the user
56:26
experience, so even if that's most of the money is going in
56:29
behind the scenes, if you can, you know, remove somebody's
56:33
ability. Or requirement to put in a
56:36
password, you can improve security, but also improve the
56:39
user experience. So I know that in our past
56:42
conversation, when you hit on it too much on the call today, but
56:44
in our conversation previously, with then we talked quite a bit
56:48
of a lot about that. And I think that ought to be
56:52
kind of a minor take away that people tie that user experiences
56:57
way to sell something like zero trust, or the parts and
57:01
components of a zero. Trust are Architecture.
57:05
I don't care how good your product is, if it sucks to use,
57:08
no one wants it. So and very I was going to say
57:12
Jeff from very rarely in your career do you get a chance to
57:15
improve the user experience and improve security.
57:18
This is one of those rare things where you get to do both.
57:22
Yep. This is why I like the, I am
57:24
space. It's the opportunity to fix
57:27
process through the proper application of people, process
57:31
and technology. So, how's that for a nerd speak?
57:35
All right, so I think we'll go ahead and leave it for this
57:37
week. You could learn more about
57:39
Banyan security at Banyan security dot IO.
57:43
It's be a ñ, ÿ åý, ñ security. .I o if you want to learn more
57:47
about us and the show we're at idac podcast.com and you can
57:51
follow us on Twitter at idac podcast and come on, check out
57:56
our YouTube show that we're doing weekly.
57:59
It's idea CDOT live, that'll take you right to our YouTube
58:02
channel. Again, kind of a A work in
58:05
progress as we work through it. But hope to see more and more
58:08
people kind of attending live and continue the conversation
58:11
with that. So, rather than our normal
58:14
clothes out, I'm going to through the power of audio
58:17
editing, insert Urban punks and a track called Gia.
58:22
So thank you all for listening and here's that,
1:03:45
Thanks for listening to the identity at the center podcast.
1:03:48
If you like what you heard, don't forget to subscribe and
1:03:50
visit us on the web and identity at the center.com.