Latest / Identity at the Center / #197 - GSA & CISA PAM Playbook with Ken Myers and Ross Foard

Transcript

#197 - GSA & CISA PAM Playbook with Ken Myers and Ross Foard · Identity at the Center

0:09
You're listening to the identity of the center podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast, I'm Jeff and that's Jim.
0:28
Hey Jim hey, Jeff, how are you? Oh, and that's a bad yourself
0:32
doing great. So I heard an awesome Albert,
0:36
Einstein, quote this week, which was it, it's not the one about
0:40
the definition of insanity which every single human being, I
0:43
think at this point of start, no, it's this.
0:46
If you can't explain it to a six-year-old you don't
0:50
understand it yourself. I'm like that is the best quote
0:53
because Really the we've got all these different things that are
0:57
happening in identity and in 90 and in society you're about and
1:02
like okay kind of really explain it and I wanted to ask you to
1:07
explain something to me as if I was a six-year-old because I
1:11
don't understand it right now. And so the topic is chat GPT
1:17
hear about it all the time. I really don't know what it is.
1:21
Apparently it might put us out of business.
1:25
But what is Chad GPT? Wow.
1:29
Alright, I don't even know. I first of all, I'm not
1:31
qualified to answer this but I'm gonna do my best.
1:35
And you're six years old. So I got to kind of think about
1:38
it here. So if let's see.
1:42
Wow, that's good one. All right, so let's say you
1:44
wanted to have a conversation with Elmo.
1:47
Write your Elmo doll, your Elmo doll right now, only knows a
1:50
couple things, right? What if you're Elmo, not all new
1:54
everything and you could have a full conversation with it and it
1:56
can answer your questions and give you advice and so forth.
2:01
That's what chat GPT does is it helps Elmo have a much.
2:05
You know, have have a longer better conversation with you
2:08
rather than just a three or four freezes that it knows when you
2:10
pull the string on the back. How's that?
2:13
Well, that was actually much better because I was ready.
2:16
I was. I was ready with a stinger up on
2:19
you for using Elmo. Which I mean Elmo.
2:22
You probably are thinking back to when you're like a 22 year
2:26
old uncle and you had a six-year-old niece or nephew and
2:29
you're like, oh, you went to the store and you bought them and
2:32
Elmo doll is, I don't even think anybody knows who Elmo is
2:35
anymore. Like, I don't think I'll most
2:37
current thing, maybe I'm wrong because I never really done that
2:41
market. I don't know.
2:42
Erin seidler just pick it up. First thing, I can't do any
2:45
work. Yeah, that's the only thing I
2:47
could think of, I don't know what, I don't know what their
2:49
property or cool, six year old toys right now.
2:51
I'm assuming it's probably an iPad.
2:53
Whoops, let's work some sort of video or game on it.
2:55
I don't know. Yeah, for sure.
2:57
Well, I think anyway, that was good explanation.
3:01
It just seems like everybody's kind of thinking like, okay,
3:04
this Chachi BT could really be a game changer.
3:09
I'm going to show his chat GPT like Open source platform that
3:14
scans the internet and build so this gets know obviously beyond
3:18
the six-year-old explanation. But where's it getting all this
3:21
knowledge from where, what is he using to learn?
3:25
I would think that it's must be scouring the internet and like
3:28
absorbing all this information. So it's based on a language
3:32
model that is currently I believe of through the year
3:36
2021. So it does not know anything
3:38
beyond the year 2021. It's funny.
3:41
You ask that because Literally just asked chat GPT myself.
3:45
How does chat GPT work? And this is what it told me.
3:47
Chat GPT is a language model that uses deep neural network
3:51
with a Transformer architecture to generate human-like text.
3:54
The motto is trained on a large Corpus of Text data and uses
3:58
this training data to learn the statistical patterns, and
4:01
relationships between words and phrases in the language when
4:05
given a prompt or a starting text, the model uses, this learn
4:09
knowledge to generate a response, predicting.
4:11
The next word in the the sequence based on the preceding
4:14
words, this model can be fine tuned for specific tasks such as
4:18
question-answering or text completion.
4:20
By training it. On a smaller data set specific
4:22
to the task, definitely not the six-year-old answer, but yeah, I
4:27
feel like business conversation. Have to cut start calling this
4:29
like AI at the center or chat gbt at the center or something
4:32
like that. But that's what chat GPT says is
4:35
how it works. Yeah.
4:37
I was going to say. So you said Elmo, huh?
4:41
Well, you said a six-year-old? I don't know.
4:43
Yeah, okay, anyway, well, I guess you keep exploring but I
4:47
think that concept of, you know, maybe it's not even a
4:50
six-year-old. Even though I think that I'm
4:52
saying, quote, I don't really want to change it.
4:54
I think there was a quote, in a, like a Wesley Snipes movie where
5:00
he's like, explain to me like a fifth grader.
5:03
And yeah, I always thought that was a good one, too.
5:07
In other words, if you can't boil it down to something,
5:11
almost anybody. I can understand that then you
5:14
don't really understand it yourself.
5:16
And so I think that's where we ought to be challenge yourself
5:18
with, you know, a lot of the really hot Concepts like
5:23
blockchain like decentralized identity like verifiable
5:28
credentials. Like, you know, pastoralist I
5:32
think some of those Concepts kind of make more sense just by
5:36
the their name and weathers blockchain decentralised
5:40
identity. You really have to Kind of like
5:43
learn a lot to get to the point where you can actually describe
5:48
them in a very simple way. And I think that's that's what I
5:51
do. New Year's resolution for this
5:54
year's to be able by the end of the year to explain those to
6:00
let's just say a fifth grader. Explain them to a 5th grader.
6:03
What is blockchain? Decentralized identity and
6:07
verifiable credentials? We think.
6:10
Well, I'm concerned about you walking around town.
6:12
One and two playgrounds with fifth graders talking about
6:15
identity. I think that sets you up for
6:16
failure so I would be careful about that.
6:20
But no I think that's good. Here's the only real.
6:22
Here's the only problem I have with this and this is I think
6:24
you can understand it. The challenge is how do you
6:27
articulate that understanding someone else?
6:30
Like do you have the language skills to be able to convert
6:33
what, you know, to the same level language ability of
6:39
someone else and understanding? So I think you can understand
6:42
The not be able to communicate it.
6:43
There are lots of people who are really smart a lot of things and
6:46
they just struggle with having that communication ability to
6:49
articulate that right? We see that all the time and any
6:51
spaces like you can be the smartest authentication engine
6:54
in the world, but you can't put, you know, a sentence together
6:56
that AC. So or a CIO understands because
7:00
you're not speaking their language, you understand
7:02
authentication. You know how it works.
7:04
You're writing the sample code. At least for now until chat.
7:06
Gbt starts doing it for you, but you're not able to communicate
7:11
which I think is really the True skill is being able to have that
7:16
conversion ability to be able to take the, that's really right.
7:19
Think the importance is its can you communicated?
7:22
You can know it and not communicate it.
7:23
There's a lot of people can do that.
7:25
There's very, there's fewer people who know it and can a
7:28
communicating in a way that people understand.
7:30
Yeah, I think he'll sometimes almost like intentional like.
7:33
Well, if I make a sound really complicated and I explained to
7:37
you and you don't understand it, you're going to think I'm a lot
7:40
smarter than you because you justice.
7:42
Explain it to me, and I still don't understand it, so I think
7:45
that, but I actually think the mentality should be flipped on
7:49
said, it's not very for most people is if you can make me
7:53
understand it. That means you really understand
7:56
it. Yeah, I would agree with that.
8:00
So anyway, thank you for the Elmo piece because I think that
8:05
really like, oh I gotta get that.
8:08
Yeah, well, you know, I don't know, it was totally off the
8:11
cuff. I was not prepared for that one,
8:12
but as is usually most of our intros, I have no idea which ask
8:16
me we start off. So here we are.
8:19
Why do we talk about some things?
8:20
We got coming up, before we pivot to why people are really
8:23
here. We've got the Gartner, I am
8:26
Summit coming up in March, you. And I will be there we are
8:28
working on what that At presentation / show that will be
8:32
doing live on stage with Henry, K and Becky and who knows who
8:36
else might be part of this. So that's something that people
8:39
should be looking forward to. If you haven't registered for
8:41
Gartner, do it come, see us, we'd love to have friendly faces
8:45
in the audience. I'd love to be able to, I'm not
8:47
sure how will kind of start the show.
8:48
But I'd love to be able say, has anyone heard of us before?
8:50
And I'd like to see more than maybe like my own hand and your
8:53
own agent. So be cool to have come people
8:57
come out and support us for that.
8:58
Yeah. Well I think that You know, I'm
9:00
super jazzed for that event and I think maybe just State the
9:03
obvious, right? It's in a new place in a new
9:06
time, right? So normally Gartner is towards
9:09
the end of the year and then Las Vegas, Nevada.
9:12
This year is March 20th through 22nd and it's in Grapevine Texas
9:17
which is essentially like right near the Dallas-Fort Worth
9:21
Airport. So I think putting it there as
9:25
should keep the cost down a little bit because Vegas is so
9:29
darn expensive. Of the other thing that I'm
9:32
jazzed about is trying to do some kind of community that.
9:36
So I think we'll have some more communication out of this over
9:39
the coming weeks by anybody who's interested in, you know,
9:44
getting together meeting may be mingling with some of the
9:48
community of other folks who listen to this podcast, reach
9:53
out to us on LinkedIn. We don't know what the exact
9:56
format is going to be yet. We don't have the plans nail
9:58
down as Things come together over the next few weeks.
10:02
If you're planning on being at the conference and you're
10:06
interested in meeting us, and your peers, you have reach out,
10:10
let us know. We'll make sure that you get on
10:13
the list. Yeah, consider that the official
10:15
invite, right? We're going to send out like
10:17
RSVP males or something like that.
10:20
So what else we got? We got episode 200 is coming up,
10:23
this is episode 1 97. So we're only three away.
10:27
We've got, I'm not sure what we're going to do yet.
10:29
I do have A new intro and a new outro kind of prepared for that.
10:32
So, Jim has heard it, we will talk about it a little bit.
10:35
We actually get to that episode, but 200 will have a new intro
10:38
outro, which I'm pretty jazzed about.
10:40
Yeah, no, I mean, I think everybody will enjoy that.
10:44
I mean, you know, I think what happens is like you, even if you
10:48
like the intro and outro in the beginning, after you, if your
10:51
regular listener, you're like, okay, I've been doing this for
10:54
20 weeks, you start to jump through it, but I think you did
10:58
a really cool job with it. So definitely something to be
11:02
proud of. Yeah, thanks.
11:04
So can't wait to debut that. All right.
11:06
Why don't we get to our main topic?
11:08
We've got a, I guess kind of a few things to cover and it seems
11:11
to me like we're heading right into the middle of acronym City.
11:15
We're going to talk about the GSA sisya.
11:19
See is a, we're going to talk about identity and access
11:21
management. I am we're going to talk about
11:23
Pam privileged access management and this is one of the few few
11:27
shows we do. We're actually have multiple
11:28
guests, so First, I'm gonna introduce Ken Myers.
11:31
He's a director in the identity assurance and trusted access to
11:34
vision for the GSA welcome back to The Show Ken because you've
11:37
been with us before. Yes.
11:40
Thank you very much Jeff. Jim pleasure to be back.
11:43
Yeah, so it was April 20-21. Last time you were with us.
11:46
That was identity at the center number 87.
11:49
And now here we are. 197 we talked about I am workforce
11:53
planning, which is a great topic.
11:55
And I think it's probably one of the more popular episodes, you
11:56
know, I'm kind of talking before this, it sounds to me, like, I
11:59
di Oh has it's one of the more popular articles on the ID Pro
12:03
website so congratulations on that, which is great.
12:07
Thank you very much. Yeah.
12:09
Shining SHINee Mo my career that can actually capture some
12:11
knowledge, and, and share it. And I'm actually in the last, I
12:14
mean related to the last episode, I'm in the last
12:16
semester of my doctoral dissertation, which is focused
12:19
on workforce planning. And so it's a bit Bittersweet.
12:23
I gotta finish and then move on next thing, but you really enjoy
12:29
the ride. Let's see.
12:31
We also got Ross Ford. He's IT specialist in the
12:34
infoset group of cyber security and infrastructure Security
12:37
Agency sisya, welcome to the show Ross.
12:40
Well Joe Jim Greg be here looking for in a conversation
12:43
today. Yeah.
12:45
And thank you guys both for taking the time to talk with us.
12:48
Can we know a little bit about your background from the last
12:51
time you were here? So I won't ask you to go through
12:53
it again in super detail, but maybe the cliff notes version of
12:57
the elevator elevator ride version up, you know, how did
13:00
Get instead any space. Is it something that you chose
13:02
or did it choose you? Yeah I would say it chose me.
13:05
I mean not well actually honestly I think with most idea
13:08
professionals you know we all went to school got our I cam or
13:12
identity and access management bachelor's degree.
13:13
No, actually I joined the Marine Corps.
13:16
I worked on radios. The radios turned over to Cisco
13:18
equipment. I became a network operator and
13:20
up in it policy and then it was it identity policy and then here
13:25
I am today, and now we've got Ross, Ross, it's your first time
13:29
on the show. Oh, so tradition around here is
13:31
we like to find out a bit more about people's backgrounds, how
13:33
they got no identities base. How did you get into identity?
13:37
So, this is my third Korea. My first career was a Submariner
13:40
in the u.s. Navy.
13:42
Then I worked for a company doing a large Manufacturing
13:45
Company game operational technology, where it and OT are
13:49
all kind of together and even boasts, both sides of the thing.
13:53
And then when I go computer engineering degree, I went to
13:56
work for a large technology company International Ecology
14:00
company in in it and they was asked to stand up a knowledge
14:05
management system for them that they could then deliver all of
14:09
their digital assets around to their people that are around the
14:13
world are ngos around the world, but I'm on a website and this is
14:17
the end of the 90s that was still pretty new.
14:20
I used a prodigal Netscape publisher, my did that and we
14:24
had tens of thousands of documents that were up there and
14:28
I went to the manager Ager and I said, okay, now you need to tell
14:31
me know whose needs access to these fangs in, which documented
14:35
they need access to so that I can, you know, stand up an ldap
14:40
and give them all your name. Password.
14:42
And, and you looked me to know, I just want you to put on on the
14:46
network, right? Unlike and and yeah, Jim like
14:50
the six-year-old, I tried to explain to him the Folly of
14:54
doing that and said it was not his responsibility.
15:00
What might happen to those documents.
15:01
His was just to do this he didn't been lifting my advice at
15:07
that point in time I realized that really I need to focus on
15:10
this identity and access management stuff because it is
15:14
not apparent to people what the downside of that I'm not doing
15:18
that well was going to be and I was, you know, 20 some years ago
15:23
and I'm still doing that now now on the federal government, It
15:27
seems like it's gotten just more important.
15:29
It's obviously with, you know, the risks that are associated
15:31
with, it federal government has a zero trust strategy, kind of
15:33
officially that's out there so identities at the center.
15:37
Hello. Our podcast, that sort of thing
15:40
for folks who are not familiar because we have listeners all
15:42
over the world, which is very cool, but they end up may not be
15:45
familiar with US government and the agencies that you guys work
15:48
with work for and with can let me start with you, the GSA, what
15:53
is the GSA and what is the mission?
15:56
None of that. Yeah, so the u.s. general
15:59
Services Administration is actually an independent agency
16:03
of the Federal Executive Branch, right.
16:05
And the US government has three branches.
16:07
This is in the executive branch and actually has three main
16:10
functions. One is managing property and I
16:12
pulled a couple of interesting stats here.
16:14
So the general Services Administration, maintains more
16:17
than 370 million square feet of work space for a hunt for 1.1
16:23
million federal employees and they actually We actually
16:27
preserve more than 500 students, historic properties.
16:29
Also that's one part of managing property and the second is
16:33
helping the federal government by smarter.
16:36
So there's a the federal acquisition service, they have
16:39
government-wide contracts, that any federal executive branch
16:43
agency can use. The third part is actually where
16:46
I sit it says government-wide coordination.
16:48
You know when you think of government you think of
16:50
efficiency you think of like on-time delivery.
16:55
So with it That is this within that, there's a of coordination
17:00
function is critical, right, whether that's it National
17:04
Security, delivery services, but coordination is important part.
17:08
And that's where I sit. And the where place I say, it is
17:11
actually the office of Technology policy.
17:13
So we helped write, and Implement data driven policies.
17:18
Focus on I.T modernization, emerging technology, and then
17:23
where I said Amber identity assurance and trusted access and
17:26
No, we're going to talk about playbooks today, I'll explain
17:29
how to play books, fit into that and then pour their coordination
17:33
role is like the Playbook. We're going to talk about today
17:35
is I work with Ross over at the cyber security and
17:38
infrastructure Security Agency. Let's go over to Ross then.
17:42
Ross for people who aren't familiar with Cicero or C is a
17:44
for people who don't know how that works.
17:47
What is sisya? Same question to you.
17:49
You know, what's the mission? And I think would be interesting
17:52
to talk about this conversation of how this played out kind of
17:55
evolved. And kind of get creative, but
17:57
we'll get to that in a second. After you tell us what this is.
17:59
Sure, thank you. Yep.
18:01
Trisha is a component operation component of the Department of
18:05
Homeland Security, DHS. And as the name implies, we are
18:10
our responsibilities are cyber security and infrastructure
18:13
security. And so it covers a pretty broad
18:16
range of cyber security aspect of.
18:19
What we do is we devised the government and, and people and
18:25
organizations outside The government, how to secure
18:28
themselves and to scare their organizations and the
18:33
infrastructure security part expands that into Old other
18:37
types of the critical sectors that make up the United States.
18:42
And there's there's many a dozens of critical sectors and
18:45
we advised people on how to manage a risk within those
18:48
critical sectors. The court of sisal that I am in
18:53
the cyber security division. We focus on The dot-gov a lot on
18:58
the federal dot-gov, and although we do and why state and
19:03
local dot-gov, and we manage the dot-gov domains space.
19:09
So as long as things we do there and furthermore, that I have a
19:14
pro, I work on a program and we do the architecture and
19:19
engineering have a center of excellence.
19:21
And so I advised, or Center of action to a lot of different
19:24
organizations in And across the federal government about
19:28
identity and access management. I'm always, they consider a
19:31
subject matter expert. And so I in that regard, that's
19:35
how I work with Ken Ken. He's at one of the agencies in
19:39
the federal civilian executive branch that we support that GSA
19:44
and Ken. And I work really closely
19:46
together in that role that he's as GSA and TSA has
19:50
responsibilities and Tricia helped GSA meet their cyber
19:54
security goals. It sounds like there's a lot.
19:56
Of coordination there between the TV, guys.
19:59
I'm wondering where does nist's kind of fit into this because I
20:01
think that's probably the standard that most people are
20:03
most familiar with, is you guys weigh in on that is that a
20:06
separate group? I guess, you know, help me
20:08
understand sort of that that triangle there.
20:10
Yeah. So nist.
20:11
The National Institute for standards.
20:13
And technology is actually a sub Bureau of the Department of
20:18
Commerce and their their main mission is standards, right.
20:23
Making sure that I think one of the first aiders they created
20:26
Around like fire hydrants or something like that.
20:28
If you go, you can go to the nest Museum and see it.
20:31
It's actually pretty cool. So, within the context, I would
20:34
say of identity, they have a couple different special
20:37
Publications there. They have a special type of
20:40
standard called a federal information processing standard.
20:44
The difference there is that federal information processing
20:47
standard is required, is a requirement of all executive
20:53
branch agency to implement. So for example, they have a
20:57
processing standard on our personal identity verification
21:00
card which is a public key infrastructure based smart card
21:03
like very much our federal employee identity badges.
21:07
They have a specific standard around.
21:09
What it is, how it is issued, how it's secured and then
21:13
there's actually different programs that make sure that
21:17
agencies are following that. But usually, I would say, I
21:20
would say, for my perspective, I Look to miss for those
21:22
standards. And also that coordination to
21:24
make sure that GSA understands what's the intent of it?
21:31
And actually, where I sit within the general service
21:33
Administration, I help other agencies, implement it, I don't
21:36
I may help my own organization but in that coordination role, I
21:40
help other agencies Implement and understand best practices.
21:44
We're outside of you, how you interact with its gonna see Joe.
21:48
First of all my role is very similar to yours in the fact
21:51
that I, you know, I helped a Angie's Implement cyber security
21:54
capabilities, Windows 8 and cheese, right?
21:56
Right in relation to nist, we have a we have a conversation, I
22:01
think is a great way to put that.
22:02
We helped nist understand this tarantula, cyber security
22:07
landscape. They that we had sister have the
22:09
unique ability to see and I should say a little further that
22:13
Cicero also has a lot of opportunities to interact with
22:18
the private sector. I mentioned these critical
22:20
sectors you know there's there's a lot of verticals in the
22:23
critical sectors, they help sis understand that.
22:26
Associated with those different. There's different Industries and
22:31
we have Partnerships. Will we have vendors and people
22:33
that are working in threat intelligence, that we work with
22:36
understand the threat landscape and that we can help miss them.
22:40
Understand what the threat landscape is so that when this
22:42
develop standards are there building those informed about
22:45
the in the nature of the threat that know that organizations are
22:49
are experiencing and they can help highlight capabilities, you
22:53
can help help mitigate that. I agree May further and say one
22:58
gue things that were most closely working with when I see.
23:01
We I mean not only justice issue but other agencies in the
23:04
federal government are working with nist, as nesters developing
23:08
zero trust architecture and they are implementing a project in a
23:14
lab implementing, your trust architectures, right?
23:17
And so this is an interesting way for the vendor Community to
23:23
participate with nest in constructing major.
23:26
Trust architectures. And then we all would be to
23:28
observe how they are doing that. And in particular, one formed in
23:34
a weekend, inform others about, you know, the kind of the
23:37
implementation methods that work best and that has proven to be
23:42
very, very much supportive of the domain that we're talking
23:46
about here today identity and access management has a lot of
23:49
strong capabilities around your trust, architectures.
23:53
And nist has helped to solidify that through there.
23:56
Their project. And I'll just say finally that
23:59
nist actually publishes a special Publications for that
24:04
project as well. It's 1800 dash 35 series and in
24:10
your audience, probably might be interesting going to look in it
24:13
at that implementation architecture.
24:15
It has a suite of documents and pretty neat to look at.
24:18
And we pay attention to that too because it helps inform what
24:21
they're learning about. You know, I kind of a reference
24:24
architecture for implementing your trust a cat.
24:26
Like to take the conversation back to something that you
24:29
brought up around this privileged identity Playbook,
24:32
that, you've been that you put together over at GSA and I
24:36
wouldn't even start with a more basic question, which is what's
24:40
the Playbook? Yeah, so the idea with playbooks
24:44
and actually we have we have a bunch of different Play books on
24:46
various identity topics. The insides of the Playbook is
24:49
it's a plain language guide aimed for potentially
24:53
non-technical people, like a technical person could use it.
24:56
It to understand kind of high-level Concepts.
24:58
It has some technical content in there but the idea with the
25:01
Playbook is that someone can pick it up, understand what
25:05
they're trying to do, for example, privileged identity,
25:07
what are the best practices? What are the pitfalls where the
25:10
challenges and the playbooks are actually developed through
25:14
government-wide working groups? And I don't know if this is a
25:17
surprise or not, but actually within the US federal
25:19
government, there's been different Federal identity
25:22
initiatives for the past 20 years.
25:24
I can date it to about 1999. Maybe there is something before
25:27
that, but there have been different Federal initiatives
25:31
around mature, identity and access management processes and
25:35
so prove his identity of the latest Playbook.
25:37
I think the one before that Ross, and I worked on with the
25:40
identity lifecycle management, Playbook single sign-on, there's
25:44
some Niche areas to digital identity risk assessments.
25:48
I actually did a little bit research seeing if there was
25:51
something called a digital identity risk assessment outside
25:54
of the federal government and I couldn't find anything.
25:56
They have y'all ever heard of digital identity risk
25:58
assessments day in day out? Again, I feel like everybody's
26:02
gonna think about process to do one.
26:03
Yeah, a formal process. I think this is secret sauce for
26:06
probably four for some folks and how they approach it but tell us
26:10
how that works. On your perspective, just a high
26:12
level of the digital identity risk assessment Playbook is it
26:16
takes nist special publication 800-53, their digital identity
26:20
guidelines and it helps you understand the risk of a
26:24
transaction if that account or if that Identity were
26:27
compromised and then it helps you line that risk up to one of
26:32
the Assurance levels within that special publication.
26:34
So like an identity proofing or identity Assurance level and
26:38
authenticator Assurance or authenticator level in
26:41
Federation also. So Playbook kind of walks you
26:44
through each one of those steps like identifying, your community
26:48
of users, identifying the risk of the transaction and then
26:51
lining up that risk in those users with what level you should
26:56
implement Element will seems like it's a lot about taking
27:00
some expertise and turning into guidelines.
27:04
I almost take it that the agencies are in kind of a
27:07
Federated model. In other words they they
27:10
leverage some common shared services but they have a lot of
27:14
autonomy in terms of how they run it and to some extent
27:20
information security Talk to us a little bit about the agencies.
27:26
Are they one size, fits all or do you have some small agencies
27:30
and some really large agencies and do they interpret the
27:34
Playbook differently based on that?
27:38
Yeah, so we try to write the play book from the from both
27:40
perspectives. I mean, I'll say for the
27:43
civilian we usually split the Federal Executive Branch between
27:47
military and civilian and it's mostly based on the policies and
27:51
requirements that we follow on the civilian side, the largest
27:57
civilian agency has to be Veterans Affairs.
27:59
It's somewhere around 350, 400 thousand down to the very small
28:04
list, which might have just maybe One full-time federal
28:08
employee and maybe some part-time staff.
28:11
And so we try our best to, to work to the to work towards
28:16
that. So we don't, we may include
28:18
challenges that specific blower. We identify those like for a
28:22
large agency that has a complex architecture.
28:24
You might find this as a challenge, I know on Andros is
28:28
area. I mean, he works over his agent
28:31
with agencies across all sizes. What do you think, Ross?
28:34
Yeah, I was going to say that we do work with the largest agency
28:37
Yay. In helping them Implement their
28:40
cybersecurity standards. But don't we also have me in the
28:43
program that I that I'm one of the advisors for it's called The
28:47
Continuous Diagnostics and mitigation program CDM it has a
28:52
shared service and so we do that shared service.
28:55
They provide cyber security capabilities for small agencies
28:59
and or in what hinges are. We're not part of what they call
29:03
the that Chief Financial Officer act agency.
29:07
So the large agencies are mostly Chief Financial active in
29:11
Chittagong and CFO act agencies and the smaller engines are not
29:15
part of that and they they operate, you know, they have
29:19
very, they have some larger AG, you know, thousands of users.
29:22
But a lot of ancient Edge can with Shane is quite small and
29:25
they really are benefited by having some shared services.
29:29
Particularly shared cyber security services to help them.
29:32
But I do want to add that that in the case of the privilege
29:36
management. Like book that can help video
29:40
author with the working group. I asked actually asked him if he
29:44
could help us with that because I was delivering coverage access
29:48
Management Services to the CFO act agencies through a to a
29:53
project that I had started a few years ago, they, when I got to
29:58
sisya, there had been a breach that many who may have heard
30:02
about though p.m. the office of personnel management.
30:07
Add a breach and there was a cybersecurity Sprint that was
30:11
performed and it's a resulted at Sprint.
30:14
They recognize they needed to the federal government needed to
30:17
helping cheese improve their privileged access management.
30:21
And one of the projects that I was in charge of bore these many
30:26
see avoid being cheese was implementing what they called
30:29
print management for those agencies.
30:31
And I while I had an idea of what, you know what I should be
30:36
doing to help people. Privilege management tools and
30:39
order. I needed to have some structured
30:42
way to describe what privileged access manager was so that
30:45
sponsors and people that are experts and identity management.
30:50
Could understand what the goals are doing this world.
30:52
Other than just they keep bad guys from to a think to us,
30:55
right? And that's where you can really
30:58
did a great job filming the working group and putting
31:01
together the the privileged access.
31:03
Man. I'd any magic Playbook.
31:04
Yeah, I can see a lot of applicability.
31:07
And what we're talking about here, even in the private
31:09
sector, especially the more decentralized and organization
31:13
is. And there are any, I've seen
31:17
over my 10 years in Consulting and basically the last decade
31:22
more and more organizations, even ones that were very
31:26
decentralized in terms of how they delivered it, how they
31:29
handle security have moved much more towards centralization and
31:36
what I've seen in those Areas is really a focus around.
31:40
Let's get on the same technology as well.
31:42
To not only, you know, kind of simplify and homogenize how we
31:48
deliver services. But also to achieve cost
31:51
efficiencies, but I'm kind of wondering in this model that you
31:56
describe can is. You know, when you're we're
31:59
putting together the the playbooks, are you taking more
32:04
of a product Centric approach in other words?
32:07
You know, we're talking about privileged access management.
32:09
Here is the assumption that, hey, we're going to start with a
32:13
product, a privilege X measure product, and we're going to
32:16
adopt the best practices within that product or do you try to
32:20
stay independent of the product and just say, these are industry
32:24
best practices and that's the approach that we're going to
32:28
base our recommendations on because we don't know what
32:30
product you're going to select for your privileged access
32:33
management. Yeah, for the play books we try
32:35
to take a vendor Vendor agnostic approach, because that I mean,
32:41
keep it keeps us fairly aligned and looking at Enterprise
32:47
requirements, aligned with business, and that's really like
32:50
where I sit no within the general service Administration.
32:54
Its kind of translating business requirements in the technical
32:56
requirements, and then agencies or even other other coordination
33:00
services like like, Ross can take those and then they convert
33:04
those into technical requirements.
33:07
So actually, like some of the highlights of the Playbook that
33:11
that I found interesting was the first step instead of jumping
33:16
straight into technology come up with your policy.
33:20
Like why why do you need to do privileged access management or
33:23
identity management? Actually, that was one of the
33:25
things that, you know what? What is the proper term to use
33:29
for this? Should we call it privileged?
33:30
Access management? No, no, privileged.
33:32
Identity management. Oh, it's it's privileged access
33:35
security right. There was kind of a bunch of
33:37
turn. Around.
33:37
And so we've kind of went with the agnostic privileged
33:40
identity, Playbook and try, not to play sides there, but that
33:43
first step is just understanding as an organization.
33:46
Why what are we trying to protect, right?
33:48
What are our crown jewels? What is our tier 0 or tier one
33:52
that we need to protect? And that's and then and then we
33:55
get into identifying, what is your privileged user population?
34:00
First thing? We might think of as people but
34:03
something that Ross and I agreed on is that people are accessing
34:06
things but they're are accessing it through a device.
34:08
So, there's that underlayer in the federal government, we call
34:12
them non-person, entities MPE. I've actually heard machine
34:16
identities, a new one. I heard the other day was
34:18
workload identities. Digital workers.
34:23
Yeah, there's a bunch of different terms but pretty much
34:24
any any, like, non-person any device that's on your network,
34:27
right? And we have a pretty cool
34:29
diagrammed. It's like a little Iceberg.
34:31
You have the, the small part on Top, which is the people.
34:34
And then the big part on the bottom that represent your Just
34:37
as a sage Keys, Your Secrets, your service accounts, your
34:40
service principles, you know, whatever platform within those
34:43
users is also identifying where, where those way right databases
34:49
kind of scans the whole and so that's where it gets.
34:51
We try to stay vendor agnostic but honestly within our
34:54
community we're using commercial off-the-shelf products.
34:58
And so we try, we try to identify what's a vendor
35:00
specific requirement or best practice versus what is kind of
35:03
like an agnostic best practice. What would you do?
35:06
Good, you you Kind of sort of taking us down the route of
35:11
where I wanted to go. Is I'm ready to start geeking
35:13
out on the tack a little bit, right?
35:16
And actually, I don't even notice the Technics early, but
35:22
it's because it seems to me when you talk about the play Booker,
35:25
you're talking about like helping agencies to find a
35:29
framework for how to manage privilege.
35:33
Let me start with a question, like, what is privileged?
35:36
Well, I can talk. What about how from my
35:39
perspective on my book on how we Define privilege, and we were
35:42
very specific as we were doing this, this privilege management
35:47
initiative. This project is, we wanted to,
35:51
we wanted to help aid and cheese complete management of their
35:56
most important assets. And so we looked at systems
36:00
administrators, administrators, that that could make
36:03
infrastructure impacting. That was the term that we use to
36:06
help. Separate.
36:08
There's so many administrators in the environment, right.
36:12
We were trying to help agencies understand the most important
36:15
ones that could really affect their whole infrastructure,
36:18
right? So every structure impacting was
36:20
a terminal used, and and we described I'm about a dozen
36:24
different administrator types that work would fall into that
36:27
category, and I think that that worked for my implementation
36:32
perspective and they can can, that's more broadly describe
36:35
what privileges in the, in the privilege.
36:37
Denny like look down. Yeah, a friend.
36:40
In the Playbook, we have key terms, and so we Define a
36:42
privileged user as someone who is authorized and trusted to
36:46
perform a security relevant function, I mean, that's kind of
36:50
a basic. I mean, we also Define
36:53
functional privileged users. So, those are kind of like your
36:56
managers. Your, I think that's a very
37:00
broad category, right? Because I've heard something
37:02
like well, our social media people, they could totally
37:05
impact our stock price. If they have A weird tweet out
37:08
there or something, but I mean, have you heard?
37:10
I want to say functional privileged users may be specific
37:13
to the government, but I mean, what would?
37:16
What terms of the piece on social media there?
37:18
I wouldn't be surprised if you pick that up, listening to the
37:21
podcast because Jeff and I have had this debate a few times
37:24
we've had guests on who, you know, that's what their company
37:28
does. I mean, I think Jeff is kind of
37:31
pulled me over to the side where I do think they are privileged
37:36
accounts. Social media users.
37:39
Well, I think it's mostly. So, when we talk about
37:42
privileged identity and access, right, this is clearly an area
37:46
that can you mention, right? Can drive stock prices, could do
37:50
damage to Brand whatever it may be.
37:53
And I don't think it's an area that's gotten a lot of focus
37:56
from information security groups within any type of organization.
38:01
Yeah, it's important. But we kind of let the marketing
38:03
team. Run with that, okay, cool,
38:04
right. And I think used when I have
38:06
that conversation with with with folks, what I'm not advocating
38:09
is for information security to come in and take over right.
38:13
The social media accounts, that would be a really boring social
38:16
media account, first of all, but what I am saying is that, you
38:20
know, whoever's in charge of rescue organization should be
38:23
aware of it, and should be putting some guidelines, put MFA
38:26
at least on your accounts, right?
38:29
Things like that or have some way to kind of understand how
38:32
it's being used who has access to it and make sure that's being
38:35
consistent from a governance perspective, that sort of And so
38:38
I think people maybe are starting to see it but I still
38:40
see a lot of companies that they just kind of defer and say yeah
38:42
well we'll worry about other things.
38:45
Yeah, we got two things to worry about first.
38:46
Let's let's come back to that later.
38:48
I don't know if they ever actually do or not but I'm glad
38:50
that is getting some air time here because I think it's worth,
38:54
it's worth asking the question. How are we securing them?
38:56
And to me very privileged. Yeah, yeah right I just follow
39:01
up on that. I mean if we're talking
39:03
framework to me what is privileged really?
39:07
The driver is the risk of the account.
39:10
And I think especially, you know, risk is kind of two
39:15
factors is likelihood and impact.
39:18
But you know, if we take that impact axis, what is the impact
39:23
of, you know, the Security administrator of SurveyMonkey?
39:28
How does that compare? With the ability of somebody to
39:32
use the Twitter account? You know, you own the Twitter
39:34
account, you post all this garbage in Nation or, you know,
39:39
the CEO has been fired. Like that could drop the stock
39:42
price, whereas like, if you go into the SurveyMonkey, I don't
39:46
know, I guess maybe that might not even be the best example,
39:49
because you probably do some real brand damage with that one
39:51
as well. But you get my point is that I
39:54
think risk is probably the number one factor in terms of
39:58
what is considered privileged now Dem.
40:01
I agree. And I can tell you that right
40:03
now, the things that I think we're observing and work.
40:07
Trying to respond to our the fact that that people
40:10
administered was a very powerful, whether they are
40:13
domain administrators in your legacy environment or Global
40:16
administrator Gina Cloud environment, the ability to
40:19
acquire those. Those accounts is egregious
40:23
still, right? And so, we're trying to help
40:25
agencies focus on learning how to get a handle on those along
40:29
with them doing that. He's gonna come classifying, you
40:32
know, learning how to classify, you know, roles that people
40:37
have. By risk.
40:38
And and once they learn to do that, then they'll be able to
40:41
extend that into other uses right now that they understand
40:44
how to classify roles and then, oh, okay.
40:47
Now I gotta roll over here that too risky, right?
40:49
And you just imagine one, right? Yes, it be to your social media
40:53
account or is a risky account. Oh, we're taking looks kind of
40:57
worst-case first and then we'll be iterating on that and trying
41:01
to helping cheese cover. The the realm, the thing that
41:05
he's that I think is really beneficial.
41:07
It is that once an organization learned about, you know, how to
41:11
articulate whisk Barnes, how to use tools that can manage the
41:15
lifecycle of an identity and again reach of mother Playbook
41:18
that can wrote. And it really helps us out a
41:21
quote, like chuckle again, who is a pain management?
41:24
Know what you learn how to do those things.
41:26
You can repeat this over and over again on your
41:29
infrastructure should be able to support you becoming more, you
41:32
know having a larger breath in Greater depth into what you
41:35
doing. So You brought up another topic
41:39
that I thought was interesting, but I thought you were going to
41:42
go a little bit differently. So you talked about humans and
41:46
their devices, which I think is a footprint, it's an enhanced
41:51
footprint. Over just hey, it's this human
41:54
is now this human in this device, we don't recognize but
41:57
what I thought you were going to say was humans and nonhumans in
42:00
other words, these machine identities and think of machine
42:03
identities, in terms of kind of quote, unquote Internet of
42:06
Things, Or OT or you know, the dev SEC Ops area where maybe
42:15
you're using terraform and you're creating all these
42:17
machine identities to deploy infrastructure as code.
42:21
I guess. Question number one is like from
42:23
a from a Playbook standpoint. This something that you guys
42:27
felt comfortable taking on another another words giving the
42:31
this advice around this but then number two like to me this is
42:35
like this is the next Frontier of privileged access management
42:39
and almost like I feel like Pam has gotten to the point where
42:44
you know it's relatively easy to manage The Human Side compared
42:50
to the machine side. What are your thoughts?
42:52
Let's start with Ken. Yeah, you know, with with our
42:56
Playbook, we try not to boil the ocean on the first pass.
43:00
And so, it's just like Ross matching.
43:01
This was a collaboration and it was a matter of.
43:04
Hey, now you have Two leading federal agencies, having similar
43:10
guidance, right? This should be enough to help
43:13
your Executives understand that this is important.
43:15
And so while we do talk about a non-person machine identities
43:20
and actually one of the things I like about me and identity, it's
43:23
such an evolving space. I could even come up my new
43:25
term, you know, and throw it out there actually I think Ida Pro.
43:29
I Depot just published a new body of knowledge article on
43:33
identity terms which is actually pretty interesting.
43:36
But I would say we put a stake in the ground with an art,
43:40
brother's identity Playbook that non-person under new devices
43:43
machine identities. Whichever is the term of the day
43:46
is important and they need to be managed and then probably stay
43:49
tuned for the next iteration of it.
43:53
What do you think, Ross? Yeah, I was going to say, you
43:55
know, Jim be in and one of the good.
43:58
So there's some good news and some bad news, he, alright.
44:01
Some of the good news around managing machine identities and
44:03
some of the tools that you can use to manage your Privileged
44:07
users, the well-known using bolts, and that kind of stuff,
44:12
they lend themselves to being able to do that with you.
44:15
No other machine account. The bad news is they can help
44:19
you do all the machine accounts, right?
44:21
And so there is, there is a number of different tools
44:24
they've seen identities. World is pretty pretty.
44:28
It's a pretty broad tool, right? There's a lot of different types
44:30
of non human interactions in the environment and they don't all
44:35
respond to the same. About privilege management.
44:38
So particularly, and that's evolving very quickly, right
44:42
now, right, with containers and the way he infrastructures code
44:46
is requiring a very ephemeral type of management of
44:51
privileges, as, you know, machine access and, and, and the
44:55
tools that we built for the old year of privilege manage when
44:59
the humans, right? Don't really translate well,
45:03
into the new year. It's not that there aren't ways
45:06
to do it. It just They're just different
45:08
weight. Yeah, absolutely.
45:09
So I wanted to ask one other question kind of like this, put
45:15
it on your future thinking caps, or maybe you guys are really
45:18
taking this on right now because I mean we've all been thinking
45:23
about least privilege for so long but it's really hard to
45:27
achieve especially if we're going towards our old base
45:30
model, which it's like, that's where everybody's been heading
45:33
for the last decade plus just like let's Group access into
45:38
roles. But at the same time we want to
45:40
keep it at least privilege. Well now the industry talk is
45:45
going to just in time. So in other words 0 privilege
45:49
until you need it then you check it out and you get it but then
45:54
it's taken away as soon as you don't need it.
45:57
So is that influencing where you guys are taking your
46:04
recommendations and what are your overall Overall thoughts.
46:08
Yeah, I'll take, I'll take that one first.
46:09
I mean, just from a practical standpoint, use the tools that
46:14
are available based on your wrist.
46:16
So if you can do, if, if your wrist says, role-based is good
46:19
enough gold role-based. If you have higher level risk,
46:22
that says, you know, I can justify acquiring tools that do
46:28
just-in-time provisioning and I have the talent again.
46:30
Workforce planning guy, remembers not just about buying
46:33
tools, you know, you have your system administrators or
46:36
managing 52. Can, can they do a 62, Lan top
46:39
of that actually? Yeah, I mean in The Playbook, we
46:43
do talk about enforcing least privilege and it possible
46:46
implementing just-in-time provisioning and some of the we
46:49
call Advanced, right? And so similar to the different
46:52
sized organizations and trying to work within their
46:56
requirements. We identify basic capabilities
46:59
that probably common kind of your everyday identity tools and
47:02
then Advanced capabilities that probably come in a in a like a
47:08
privileged access management or some other type of privilege
47:10
tool like that. So we do mention, if you have
47:13
wrist that aligns with it and you have the capability to do
47:16
just-in-time provisioning, definitely go for that.
47:20
Yeah, I mean I agree. I know one thing I think is true
47:23
that having static credentials that persist a long time, is a
47:29
risk, right? And they tend to be stolen and
47:32
then get used in the context are not intended to write.
47:35
So shortening, the available reality of an authenticator,
47:38
exactly, a good thing to do and then there's two aspects to help
47:43
people have a, some of them are not nursing.
47:47
College credentials right there. They're just using a normal.
47:50
People's credentials from the L hate, on those account.
47:52
So that gives you an ass that you still need to have some way
47:55
to understand that, that an individual should be able to be
47:59
elevated, right? They have the skills or the need
48:02
at the time and often that may require interaction to do that.
48:06
Well, write some some approval by some human individual.
48:10
So that's kind of the constraining.
48:12
You just case, right? If you're happy, I'm with
48:14
somebody a permit before letting them in.
48:16
But look, we've had these cases where we've had things like, you
48:19
know, and Part of the implementation, I've done by
48:21
plant manager, and there's capabilities and there's tools
48:24
for to enroll, right? And stuff like that.
48:26
There are very highly secure systems that need to be managed
48:31
in special ways, right? And we need to have, you know,
48:34
kind of really important, maybe not.
48:37
Normal process is extraordinary process before that.
48:41
I think of, you know, was it a where the movies, you know both
48:45
people need to turn their keys at the same time probably most
48:48
military stuff, right? Stuff like that.
48:50
I would like to kind of shift the conversation a little bit
48:53
and talk we've been talking theoretical is what I feel like
48:57
we've been right. These are ideas playbooks which
49:00
is good. Right?
49:00
We need that but now, let's enter the real world and let's
49:04
talk about briefly adoption right now that we know what the
49:07
plan is, how do we get this in front of people and specifically
49:10
privilege. This is one of those areas where
49:12
I feel like it's hard and easy and hard at the same time.
49:17
This is everything. It's, the easy part is that it's
49:20
generally a much smaller population that you're doing
49:25
right, not deal with a mass rollout of MFA for all your
49:27
consumers or something like that.
49:30
But you are dealing with a very vocal group, typically
49:32
developers who have a lot of disparate access requirements to
49:37
make their things work, or did you know, for their job?
49:40
Etc. Devstack Ops pipelines.
49:43
See ICD right? All that good stuff, code, apis,
49:46
etcetera, whatever might be, and I feel like this is an area
49:49
where, you know, if you guys have tips on how do we actually
49:53
deploy privileged identity management or access management,
49:57
or at the new one privilege Act was access Services Kelly you
50:02
mentioned earlier, right? And in the real world this needs
50:05
to actually get to put. It can just be on paper.
50:07
What are your tips on? How to get this out there and
50:10
Ross? I feel like you're probably in a
50:11
good spot to answer this one. I'm sure to die and you've got
50:14
some good ideas. But Ross, how do I put Pam in
50:17
front of my users? You know, I first of all, we try
50:22
not to impact normal users with this, right?
50:24
We're targeting privileging, right?
50:26
As I mentioned and the most important ones, right?
50:29
But even though that conversation has been difficult
50:32
because they're there, the Legacy environment has allowed
50:37
us to implement a network that was fairly flat butt.
50:40
Then because of that, it exposes even know privileged accounts
50:46
even on General years as machines, right?
50:48
And it won't go into detail about why that is.
50:51
But, you know, it's been a real challenge.
50:53
So what I think, moche, what we do is we first we try to educate
50:59
about the different options that agencies have to manage their
51:03
privileged users. The federal government really
51:07
puts a lot of strength in the Smart car.
51:11
And we make the smart card as a, as a foundational aspect of
51:14
privilege management, right? So whether you're using it
51:17
directly to the login to the system, or whether you're using
51:20
to log into a Pam tool that Den will V protecting both the
51:24
conventions for you, right? We really do help agencies
51:28
understand that that has been a very good thing for the federal
51:30
government to do. We invested a lot of time and
51:32
effort to make sure, you know who the privileged users are and
51:36
that we really want to do that. So then we start talking to
51:39
different organizations within In a dingy that are going to
51:42
Champion. That's right.
51:43
And that's one thing I'll say to anybody, that's trying to do
51:46
something difficult, find your Champions, right?
51:49
If you don't have a champion, you don't have an organization
51:52
within the organization. You're trying to work in that is
51:56
willing to take the first pain and not you're not complain
52:00
about it and just keep moving through it as part of the
52:02
growing pains, it's really hard to be successful, right?
52:06
But if you have a really great Champion organization Nell take
52:09
the hits for you as Cheryl learning how to implement these
52:12
things in their environment. And then, once you know what
52:15
your landed in the environment, with these capabilities
52:18
experimenting is a whole lot easier, right?
52:20
Because then people get used to doing it.
52:22
And even though it's people that were really resident to do, the
52:25
they don't want to do this, right?
52:27
They see the, you know how much easier it is to do what they are
52:31
doing before, right? Because they got to process
52:33
their do and every time they access the system, they do it
52:35
the same way and they don't have to manage all these great and
52:38
passwords of Shiva luck with the clutch.
52:40
Right? Can I know the Playbook has a
52:42
section on kind of executions recommendations?
52:45
I'm prioritization. I guess, what are some things
52:47
that that from your perspective on?
52:49
How do we get Pam in front of people and what are your
52:51
thoughts on the same question? Yeah, I would say, I me on.
52:55
That's the last step of the Playbook prioritize and execute.
52:58
I mean, the main part of that is prioritizing your risk, right?
53:00
So you've identified like if I have an e-commerce websites
53:04
that's hosted on kind of Linux machines.
53:06
Using Oracle databases may be going with a tool that does
53:09
Windows privileged man. It may not be for me, and so,
53:12
that's number one, what a nice. One of the nice things that I
53:16
like to describe playbooks. It's also a set of glue right
53:20
for someone not familiar with the the federal government.
53:24
We I think we've mentioned about five or six different
53:27
departments already. I've been kind of paying
53:30
attention, but different department, different
53:33
departments, have different authorities and different
53:35
functions. So for example, Ross, with this
53:38
continuing does not stick to mitigation program.
53:40
Um, have their separate set of privilege requirements, missed
53:44
actually has two separate functions.
53:45
One, special type of special publication which is actually an
53:50
implementation. Like Rick Ross had mentioned, is
53:53
your choice architecture. There's actually an S special
53:55
publication for privileged Pros, identity management and it goes
53:59
into like step-by-step administrator detail.
54:03
And so that's for the Playbook that's really where we rely on.
54:06
If someone's looking for that kind of step-by-step technology
54:09
changes so fast. You know, it's hard to stay on
54:12
top of it, but I would say for implementing, getting in the
54:14
hand, definitely prioritizing a risk focusing on the systems
54:17
where you need to implement it and then lining up with.
54:20
Do I have a tool that provides that mitigates, that type of
54:23
risk? And if I don't, then I need to
54:25
find what that tool is. Whether that is, you know, some
54:28
kind of command line monitoring to make sure that someone's not
54:31
fingering or sudo command. Or if it's like you just have a
54:35
bunch of Cisco, Cisco Network equipment.
54:37
So you want to protect your Your Cisco, enable commands, are ya
54:46
been a while since I've been a keyboard.
54:47
I'm trying to pull some memories out here.
54:48
But, but, yeah, it's definitely. I mean, the fourth step is all
54:50
about is all about executing. And like I said, the thing I
54:53
like about it is that we break down what we were calling
54:57
Advanced capabilities versus Baseline capabilities because,
54:59
you know, if you're a small business, if you're a small
55:01
business, a small Federal agency, you know, you have less
55:05
than 50 employees. Maybe you have, like one
55:07
administrator to administrators. Getting getting a privileged
55:11
tool for those two people may just be Overkill and so it's
55:15
like looking at your existing tools and like mapping it up.
55:17
So like account Discovery that's a big one.
55:20
Managing your policies doing access reviews kind of like
55:23
basic identity hygiene items and then you know if you grow and
55:27
you get kind of big and then your wrist gets spread out in a
55:30
more then maybe it takes time to look at maybe we should have a
55:33
password vaulting tool. Maybe we should do session
55:35
monitoring. Maybe we should do more
55:37
automated automated discovery. But thanks to make sure that
55:42
accounts are being created outside of our lifecycle
55:45
management that could just turn into an orphan account.
55:49
I mean, there's one, there's one classic reset.
55:51
I like to mention. And that's when like a WebEx
55:55
administrator left and then three months later, disgruntled
55:59
went back and and took down. I mean, is that sent that one
56:02
sound familiar? It does?
56:05
Yeah, yeah. Well I think that's the thing,
56:07
right? You is you're leaving The, if
56:10
you're leaving doors available to be opened, you know, that
56:13
actively open. If they're just if they exist,
56:15
right? You're rude.
56:15
You're increasing your risk. I like the way that the Playbook
56:19
proaches and I should note, we're going to have links in our
56:21
show notes to this stuff. So I've got it.
56:22
Pulled up here in front of me, kind of for easy reference, but
56:25
even for, for organizations, that might be big, but they
56:29
really haven't started down the path of proper privileged
56:32
identity management, the basics. You have to start there.
56:35
You can't just go in and say, you know, a vendor showed me
56:38
something shiny and that's Cool. We're going to be there like
56:41
right away, is that okay, well, that's cool.
56:43
But do you even know what you're going to protect?
56:44
Well, you should be working on it, cut Discovery.
56:47
What are your policies is social media defined as one of your,
56:51
what are your privileged access their accounts?
56:52
Like how you tracking that? And again, the same time, right?
56:54
Will closing doors. When people leave the company,
56:57
when they transfer, is always a pain in the butt, right?
57:00
Stuff like that. So even if you're a bigger
57:02
company, there is really good guidance in here that people can
57:05
refer to say, okay, well, how do you get started?
57:07
You are, do we have the basics? Because if you don't have the
57:09
base, Asics done, you're not going to be very successful at
57:12
anything past that. It's just you know the the
57:14
efficacy of the program that capabilities just aren't going
57:18
to be there. We've been going for almost an
57:21
hour I'm protecting identity management and this stuff and I
57:23
feel like we could go another 23 hours easily.
57:26
Well I'm not going to do that to you on a Thursday evening here
57:29
as a recording it. So I want to wrap up on a
57:32
lighter note. This is again one of those rare
57:33
episodes where we have two guests.
57:35
So we actually two lighter, note questions.
57:36
And I'm going to make it a free-for-all.
57:38
You can ask you can ask Answer either of these or both, it's
57:42
totally up to you. I will start with what is the
57:46
best dad joke that, you know, and I'm happy to go first on
57:50
this one. I'm not a dad, but I am an
57:52
uncle. So I have I called us Uncle Joke
57:54
instead and I'll go to you guys next.
57:56
If you whoever wants to answer it, my favorite dad joke is what
58:01
kind of shoes do ninjas wear? What kind of sneakers?
58:07
So sorry about that. Good one, good one.
58:09
Terrible. But I do Ken or Jim.
58:13
Do you guys have a good dad joke that you guys use?
58:16
Can go go. I'll go with Dad joke and
58:18
actually I got two kids so I'm building my Rolodex or
58:22
repertoire of dad joke. So where do boats go when they
58:26
get sick. I don't know to the dock.
58:31
That's a good. I like that one.
58:32
I'm adding that to my to my repertoire as well, Jim deal
58:35
one, I have one. So I ordered a chicken and an
58:39
egg. Go online.
58:41
I'll let you know which came first.
58:45
All right. I like that.
58:47
That's like a deeply philosophical dad joke, Ross.
58:52
I'm not sure if you got a dad joke, but before we go far,
58:55
you're gonna like skip next. Alright.
58:58
So here is because we've got government folks on.
59:01
Here's my other one, you are in charge of a new government
59:05
agency, just been funded approved, all that stuff.
59:09
What? Is it called, and what is the
59:11
mission? What is your new government
59:13
agency? What is the mission?
59:15
Ross to skip the first one, you got something for me on this one
59:18
they do. It's about, we do it all the
59:20
agency. It's often what we need.
59:25
You know, when people come up with new ideas for the
59:27
government to do something with me, made you adjust can do it,
59:30
right? Give it to the, do it all
59:31
agency. It's like a One-Stop shop for
59:33
everything. Exactly.
59:35
Can you want to wait on this one?
59:36
You want to stay at dad jokes? You know what I like?
59:39
I like Ross. I'm gonna I'm gonna hop on Ross
59:40
about on this one. That's a good one.
59:43
Okay, Jim you gotta dig government, would it be possible
59:46
to have a government agency focused on the happiness of Jim
59:50
McDonald, basically? Just make sure that I am always
59:54
taking care of, never have to lift a finger unless I choose to
59:59
I mean, I guess it's a little outrageous.
1:00:01
So I don't know if it's not very deep thinking, right by.
1:00:05
I put all my effort into the dad joke and very little in To the
1:00:10
into the agency. Well, let's, let's, let's skip
1:00:14
all this little bit. So instead of the office of is
1:00:16
Jim happy, maybe it's citizen well-being, or something like
1:00:21
that. I don't know.
1:00:23
Now I, you know, now I'm turning government.
1:00:25
Oh boy. Yeah, so I don't you know, I
1:00:29
don't know if I would have a specific one.
1:00:30
It would be. It would be very specifically
1:00:31
focused on like annoyances like you know, I know, I know, I know
1:00:36
we're in a government was like, okay, why do I pay my taxes?
1:00:38
You know what, I owe you one. Just tell me what I owe you and
1:00:41
then instead of making me figure out what I owe you and I'm
1:00:45
telling me if that's correct. It's like this is a math problem
1:00:48
and the government is a teacher. Just tell me what I owe you.
1:00:50
We just want to check your work, right?
1:00:52
Yeah, exactly. Okay.
1:00:54
I know we're going to look at long guys, I really appreciate
1:00:57
it. You know, can you expect, you
1:00:58
know, multiple times now with us, Ross, I hope you'll come
1:01:01
back and join our shenanigans on identity at some future date
1:01:05
will have some show notes here so you can check out the
1:01:08
privileged identity Playbook. Ross, you mentioned 835 which is
1:01:13
the zero trust architecture drafting the hunters 1835.
1:01:18
I do want to mention that way your audience know that missed.
1:01:21
863 reason is you know release headed right now so you can go
1:01:26
in and look at that, that's where it describes, you know,
1:01:29
digital identity and its guidelines for that.
1:01:31
So all your listeners who have an interest in that you go read
1:01:35
it and reply if they have problems with it yet, Yeah, I'll
1:01:40
put that in the show notes to us.
1:01:40
That's a good point, as well. So we'll have a bunch of really
1:01:43
good information that people can leverage in their daily lives.
1:01:46
Right? Are you doing these things?
1:01:48
If you're not, what's your strategy or plan to address some
1:01:52
of these issues that are out there?
1:01:53
Yep. We're going to go ahead and wrap
1:01:56
it up. I think for this week you can
1:01:58
follow us on the web if you're interested.
1:02:00
Idac, podcast.com, we're on Twitter at idac podcast, run,
1:02:06
Mastodon at idac. Stat infosec that exchange.
1:02:11
I really hate Mastodon links, but that's just the way it works
1:02:14
today. So, feel free to connect with us
1:02:17
there. You know, we're putting out the
1:02:18
call for question, you know, for ideas on, you know what we want
1:02:22
to do here for episode two hundred will be at Gartner and a
1:02:25
few weeks here so lots of stuff going on and be sure to hit that
1:02:29
subscribe button so that you know, when the next episode of
1:02:32
identity to Center drops, that's my my Shameless plug for us.
1:02:35
So we'll go ahead and leave it for this week Ross thank you so
1:02:38
much for joining us. Ken, thank you so much for
1:02:40
joining us gym. Always a pleasure and with that,
1:02:42
we'll go ahead and wrap it up for this week and talk to you
1:02:45
with you all in the next one. Thanks for listening to the
1:02:51
identity at the center podcast. If you like what you heard,
1:02:53
don't forget to subscribe and visit us on the web and identity
1:02:57
at the center.com.