Latest / Identity at the Center / #74 - PAM Training with Katie McCroskey

Transcript

#74 - PAM Training with Katie McCroskey · Identity at the Center

0:16
This is the identity at the center podcast.
0:19
This is a show that talks about identity and access management
0:22
and making sure you know who has access to what?
0:25
Let's get started. Welcome to the identity of the
0:33
center podcast I'm Jeff and that's Jim.
0:35
Hey Jim hey Jeff. How's it going pretty.
0:37
Good yourself, good. I've got a Confession to make so
0:41
or lunch? Yeah.
0:42
For lunch today, had buffalo cauliflower and I liked it
0:47
Buffalo college. So is that just cauliflower with
0:50
like wing sauce on it basically? Well, there was a breading shell
0:54
and it was quite wonderful. And, you know, I mean, if I ever
1:00
did become a vegan, that would definitely be either.
1:04
Use it everyday for every meal. You know, we have a restaurant
1:07
around here that does bang bang, cauliflower, which is Basically
1:10
the same thing. It's like lightly breaded
1:13
cauliflower with basically wing sauce on it, but I didn't have
1:15
that for lunch. I had a deconstructed chicken
1:19
pot, pie, courtesy of my wife and the leftovers that we had
1:23
from last night, which was absolutely fantastic.
1:25
Yeah, well, my meal want to show that you care about you.
1:28
If anybody's out there is vegan or playing to go vegan, you can
1:33
do it in an unhealthy fashion. If you'd like, yeah, you can
1:36
deep fry. Anything is what?
1:37
I've what I've come to understand.
1:38
You know, the deep-fried, Snickers.
1:39
Hers Oreos, deep fried green. Beans are really good actually.
1:43
So yeah, you can make anything you want as healthy, or as
1:47
unhealthy as you want, we're recording on hump day.
1:50
So you have to find some way to kind of get over the hump.
1:53
And that was it for me. Well, not only is it a hump day?
1:56
It's, you know towards the end of the year I'm planning on
1:59
hitting on vacation, hopefully, sometimes towards the end of
2:03
next week. It's going to be our last show
2:06
of the year or for the podcast itself.
2:09
So You know, hopefully, we leave on a good note here, I'm sure we
2:12
will. We had some, some great episodes
2:14
throughout the year and this will be.
2:15
This will be it for us in 2020 and will see you guys again in
2:18
2021. But before we get too far along,
2:21
because I don't think anyone wants to hear about our lunch
2:24
habits and our culinary desires. Why don't we talk a little bit
2:29
about privileged? Access management, are you cool
2:31
with that if that fits into the theme of this being an?
2:34
I am podcast so sure. Well you know we try so to help
2:38
us with that conversation. We do Have a guess we've got
2:40
Katie mccroskey, she's the director of Knowledge Management
2:43
and training at psychotic. Welcome to the show.
2:46
Katie, thank you for having me. What did you have for lunch?
2:49
I had a breakfast sandwich actually sausage or bacon.
2:52
Bacon American cheese, not chatter, of course.
2:56
Yeah. All right, I guess you could
2:57
stick around, I can eat anytime of day.
3:02
So with with, with our lunch out of the way, why don't we talk
3:06
about your background? Katie before we get into some
3:09
some Sexy. Pam talk.
3:11
Maybe we can talk through what your background is and you I am
3:13
space. How did you get into?
3:16
I am? Is it something that you chose
3:18
or did it choose you? I am chose me actually I call
3:23
it. The Luck of the Irish.
3:25
I stumbled into it. I'm actually an MBA by trade.
3:30
I applied to join a small psychotic startup almost 12
3:37
years ago at the time we were actually A focused on helping
3:41
organizations build software. So there was an agile focus and
3:45
a Consulting practice. We did have secret server as a
3:49
product and a few other products.
3:51
But at that time it was more of an Ops tool.
3:55
Interestingly enough secret server in some of our other
3:57
products were born from our own needs and as the product
4:01
capability is matured and the organization changed became more
4:05
and more of a focus for identity and access management.
4:09
And for me being an MBA I joined psychotic not knowing what a
4:14
server was. So I really needed to teach
4:19
myself and understand the market and all the different new tech
4:24
terms and Concepts. I was learning and being
4:27
introduced to working at a security software company.
4:30
So yes, I very much stumbled into identity and access.
4:35
That, that story is almost hard to believe because Katie we
4:40
Interacted with you on on a couple of calls and you're very
4:45
technical now, very capable and I just assume that you're
4:51
installing servers when you were like six years old, or some
4:54
things but interesting, my, you know, when I first heard about
4:59
psychotic and found out, they had a product called Secret
5:02
Service. Like, oh, that's so funny.
5:04
I used to work with a product called secret server and it was
5:06
awesome. Well, it turned out, it was the
5:08
same product and You know, I was using it to manage Windows
5:13
service accounts, way back in the day.
5:15
I couldn't give you an exact year.
5:17
But yeah, that's how that that's really from that, that product
5:22
which was, you know, price try just for like a, you know, a
5:27
specific use case. It's really become kind of a
5:30
Enterprise, Pam solution, not any kind of commercial for
5:33
psychotic, but that just was my own personal experience with
5:37
secret server. So, anyway, Katie one of The
5:39
things that I thought we could, maybe kind of talk about today
5:43
is more or less of like a privileged access management 101
5:48
for those of those of our listeners who are, you know, not
5:52
steeped in privileged access management, maybe start off with
5:56
kind of some of the bread-and-butter use cases like
5:59
shared account management, service accounts session
6:03
monitoring and you know session elevations.
6:07
So maybe kind of talk us through.
6:09
From the basic bread and butter 101 stuff for privileged access
6:14
management. Sure.
6:16
I think a lot of it often starts with vaulting, right?
6:20
Just kind of a secure place to store and then of course,
6:25
delegate access ought to access privileged access.
6:29
I think traditionally, folks, look at the infrastructure, you
6:32
look at local administrative privileges domain privileges
6:36
shared accounts, service accounts.
6:39
Any type of database networking infrastructure accounts that
6:43
they want for their controls on now, it doesn't always have to
6:47
be very complex things. Sometimes I preach about simple,
6:53
security steps. I can exponentially increase in
6:56
organization's overall security posture.
6:58
So for example, a password, right?
7:00
Having a long password. So 50 characters, 100
7:04
characters, completely random and rotating that password every
7:09
Week every day, every hour, things like that are really the
7:13
core use cases of privileged access management.
7:18
Now, once you start to get into, you know, more security driven,
7:23
initiatives, or on the flip side, more audit and compliance
7:27
initiatives, that's where things like monitoring video.
7:32
Monitoring key logging proxy. Jump box, jump server type of
7:38
Technologies. And then if you are on the audit
7:41
and compliance, that's where reporting and analytics and
7:44
those types of details really are important.
7:47
So just a few of those core use cases and core components that
7:52
organizations look to when they think about privileged access
7:56
management. You know, I often work with
7:58
clients who are at a fairly basic level of privileged access
8:03
management and one of the recommendations that I like to
8:06
make like you can do this right away is not having
8:10
administrators have like their main user account and do made
8:14
administrator so that if they do get They do fumble, their
8:18
password and kind of a phishing attack or something that that
8:23
person doesn't get their domain admin account.
8:25
So then the question becomes now that I've got two accounts, I've
8:28
got my Jim McDonald account, Jim McDonald admin account.
8:32
My question for you would be, does it make sense to use my
8:36
privileged access management tool to manage that domain
8:40
admin? Jim McDonald account?
8:42
Absolutely. Yes.
8:45
And that's where, you know, Dated privileges come in.
8:48
They should be just on time. They should be need to have on
8:52
specific tasks relevant to an individual's role.
8:56
And like you said, you know, these accounts are targets for
9:01
hackers and sometimes things happen and they do get
9:05
compromised. And that's where you need robust
9:08
security controls in place that can help, you know, stop that
9:12
breed. Shut that bridge down prevent
9:14
any type of lateral movements from that bridge.
9:17
Isolate any type of monitoring that can be done for friends, I
9:21
can Alice's and things like that.
9:23
That is really where the benefit and the criticality of Pam
9:27
tools, come and play. Yeah, I mean I feel the same
9:31
way. I also think like if you think
9:33
about privileged access management for me, the bread and
9:37
butter is about human beings, not knowing passwords, right?
9:41
So that the system knows, the passwords are vaulted, they get
9:45
changed behind the scenes and people.
9:47
People don't go home and have the password.
9:50
Exactly. That's very important.
9:52
And I often describe it, as if a human knows, the password is
9:56
probably not a safe password or a good password.
10:00
Yeah. Right.
10:00
I mean, you know what human could remember, 32 character,
10:04
random digit password, so, that's a good point as well, you
10:12
know? I'm thinking about some of the
10:13
newer use cases that I'm seeing, you know, BC have come up over
10:18
the past few years and what the role of privileged access
10:22
management would be in. So what I'm specifically
10:24
thinking about is like Cloud infrastructure and platform as a
10:28
service. So AWS, Microsoft Azure things
10:31
like that. I'm also the about devops and,
10:35
you know, automation through Bots, for rolling out
10:38
infrastructure and they often have hard-coded passwords and
10:41
then iot use cases. So, I'm kind of wondering, are
10:45
you seeing a lot of that as well?
10:46
Kind of All into the privileged, access management facing.
10:49
Is that the right? Is privileged access management,
10:52
the right place to kind of handle, those use cases.
10:56
Absolutely. I think more and more
10:58
organizations are looking at different areas or different
11:01
aspects of privilege. And looking to, you know,
11:07
privileged access management organizations or vendors to help
11:10
them solve those new challenges that are emerging with things
11:14
like iot and devops and the explosion of cloud adoption I
11:20
think You that is familiar with these AWS and Azure or whatever
11:24
flavor of infrastructure as a service, you know, you prefer.
11:28
These environments have very, very granular types of
11:32
permissions. And you know what?
11:34
I often have experienced talking to organizations is, it's just
11:38
too much. They often don't have a good way
11:41
of approaching it. It's, you know, that idea of,
11:44
you know, too much complexity. I firmly believe in usable
11:48
security and complexity being the enemy.
11:51
Of security. You guys are familiar with that,
11:53
Bruce schneier idea, but again, I think, you know, more and more
11:58
organizations are changing how they Define privilege and it's
12:03
absolutely including some of these cloud devops and and
12:06
non-human types of accounts like Robotics iot and another types
12:12
of accounts that we see. And there's so much to learn
12:14
when it comes to privileged access management and a lot of
12:16
these newer use cases, you know, you can spend you know, almost
12:19
all your time. Figuring out what's next and how
12:23
to tackle some of these new challenges, I'm curious because
12:25
what you mentioned earlier that you know you didn't really know
12:28
a search media was going into this.
12:31
And now here you are, you know, you know an expert on Pam and
12:36
privileged access management those sorts of things, right?
12:38
And you're responsible for Knowledge Management and
12:40
training with psychotic, how do you go about?
12:44
Well, first of all, how did you get into that?
12:46
Type of rule, is that something that you start off with or was
12:48
it something that you kind of accumulated?
12:51
A as a as a responsibility as you went through that kotik, it
12:57
very similarly to my you know, experience in.
13:01
I am I stumbled into the trainer role for years and years I was
13:06
doing different types of roles at psychotic whether it was
13:10
sales or marketing or Channel and as we would hire I would
13:14
always help train and teach people things because as one of
13:20
the Employees at psychotic. I had to kind of teach myself
13:24
these Concepts and understand what was going on from a
13:28
technical perspective. And so I think I really focused
13:32
on taking these technical complex topics and simplifying
13:36
them and it made it a natural fit for me to then transition
13:40
into the trainer role. And as we grew, it became
13:45
abundantly clear that we needed a dedicated person that was
13:49
going to help with. With the massive amount of
13:52
growth that psychotic is experienced.
13:54
So yeah, I really just kind of fell into it, so it would be a
13:58
twenty20 conversation without mention of pandemic and covid
14:02
and things like that. How has, how has the pandemic
14:07
impacted the way that either you deliver or think about, you
14:11
know, training for four different concepts that are out
14:14
there prior to the pandemic, all the training I would do on most
14:19
of the training, I would do was in person.
14:21
So whether that was, you know, in-house, our staff training,
14:26
whether it was new hires or just start our weekly training,
14:29
Cadence that we pull off. It was always in person.
14:33
I also would attend a lot of partner events and conferences
14:36
and things like that to help educate and evangelize on
14:39
privileged access management and those days are on pause.
14:44
So there's no more days of showing up in person.
14:48
Everything is now done digitally.
14:51
So, we are very much focused on webinars and podcasts and video
14:57
enabled. Many learning enablement.
14:59
And just, you know, different forms of Education and Training
15:03
other than the live in person. Because, you know, right now,
15:06
that's not safe, but I'm hopeful that sooner or later, we will be
15:11
able to re-establish in-person training because I do see value
15:16
in having that face-to-face. I think, you know, some things
15:19
are just easier to Understand when you're all in a room
15:22
together and as an educator, I feel a closer connection with
15:27
the students when I can see the look in their eyes.
15:30
And, you know, read their facial expressions to really understand
15:34
our they comprehending. What I'm saying or do I need to
15:37
use, you know, different way of explaining or, you know, Draw
15:40
Something on the Whiteboard or whatever the case may be.
15:43
Yeah, there's no substitute for kind of like the hallway
15:45
conversations and, you know, the site side stuff that kind of
15:48
takes place right in between sessions, things like that.
15:51
I feel the same way about that, what's been, the hardest thing
15:55
or challenge that you've had to overcome kind of adopting or
15:59
adapting? I should say into this, new, new
16:01
model, with remote delivery, I think scalability, I mean,
16:05
everyone's online. Now, I'm sure everyone has
16:09
experienced some sort of resource constraints.
16:13
And so really just setting up our program transferring,
16:17
everything we would do in person face-to-face.
16:21
Digital environment and then empowering that program to scale
16:26
that has also been a challenge. You know, that kind of gives a
16:28
global organization cybersecurity threats are
16:32
Global. So we're always thinking about,
16:34
you know, our customers, and partners in the media or in a
16:37
pack, or last time wherever it is that, you know, we're helping
16:41
folks so. So I'm sure you have some pretty
16:42
good stories, around different training sessions, may be, that
16:45
you've conducted orbit at least been a part of any time, feel
16:49
free to protect the names of the LT and or Innocent.
16:52
But do you have, you know, what was kind of like the best
16:56
training Story You've Got and maybe what's one?
16:58
That would be. Let's call it less than ideal.
17:00
So this is actually pretty crazy story if you're ready for this
17:04
one. So I was privileged enough to
17:09
deliver a training session at the US Embassy in London.
17:16
And I was working with a partner.
17:18
We were presenting in the basement of the US Embassy and
17:22
we were talking Insider threat and I was literally in the
17:28
middle of my presentation standing out talking showing
17:31
slides, engaging with it, the group and the power went out
17:37
only we were in the basement, so there's no windows and at first,
17:42
I wasn't quite sure if it was the power that went out.
17:46
You know, God forbid if it was like terrorist attack or I
17:49
didn't, I didn't know what had happened at the US Embassy, but
17:52
I knew that all of a sudden I was presenting and then split
17:55
seconds later. I was in the dark and we were
17:57
all in the dark and everyone just kind of froze.
18:01
And no one said a thing for a few seconds and it was probably
18:04
only three or four or five seconds.
18:06
It was very, very short if and then the power kick back on and
18:10
we all just kind of acknowledge that we were still there and we
18:14
didn't really know what happened and we We weren't going to ask
18:16
what happened, but we kind of put aside the training and just
18:20
kind of talked and moved onto the coffee phase.
18:23
And yeah it was it was a really interesting session so you went
18:28
from from from Village access management to an episode of
18:30
Homeland and exactly what exactly
18:46
We got to figure out Jim, how we can get to, you know, some some
18:49
International location and and do something on those lines
18:52
because I feel got a little of a James Bond, kind of themed that.
18:56
It's so DC. I feel like, I've been very
18:59
blessed. I have luckily been invited to
19:02
lots of embassies here in DC. And, of course, when I travel
19:05
abroad, I usually get the invited as well.
19:07
It's a, it's a, it's a DC thing, I'm telling, you are the
19:11
Beltway, right? So if if I am, you know, Part of
19:16
an Enterprise. I am program somewhere, and I'm
19:18
running either Pam, or maybe just even, I am General as part
19:22
of a program at my organization. What are some tips that I could
19:27
use to develop my own, either in-house training or some ideas.
19:32
You might have to help kind of bring along parts of my
19:34
organization that maybe aren't as you know, tech savvy when it
19:40
comes to I am or even Pam specifically.
19:42
So I think, you know, security training and Weekly identity and
19:47
access management training for all levels and all shades of
19:52
grey when it comes to technical capabilities is so important.
19:57
And in my opinion, is a milestone of maturity within the
20:01
program because all people need to be educated on why why you
20:06
don't click the link. Why you don't open the
20:08
attachment, right? Why you need a long and complex
20:11
password? Why we're asking you to change
20:13
your password every 90 days or 45 days.
20:16
Days or whatever. The case might be based on the
20:18
organization and then again, as you scale up to the more
20:21
complex, technical use cases and audiences.
20:24
Again, they need to be part of the process.
20:26
They need to have buy-in and in my experience, especially, you
20:31
know, with some of the tools and capabilities that we work with.
20:34
It's not a barrier because we're providing a lot of Automation
20:42
and hopefully we're taking a lot of manual processes off.
20:46
Plate once they kind of understand from a security
20:49
perspective of why that's so important.
20:52
And why you know, the organization is asking them to
20:55
do X Y or Z people buy into it and you know, I did a training
21:02
for what I call the math team which is really our controller
21:06
and our accountant and our billing people I call them the
21:09
math team. So I was doing a training for
21:12
them. This might have been here to
21:13
ago, but I started talking about you.
21:16
No, the nature of breaches and how these threats, you know,
21:19
play out and some of the tools and how hackers hack and people
21:23
are so interested in that they asked me to come back, they
21:27
asked if they could have another training session just to talk
21:30
more and to learn more about, you know what the iconic does
21:33
and what I do and you know, what's going on in the industry.
21:36
And so I think people are genuinely interested and they're
21:39
curious and so, you know, simplifying training, that's
21:43
very important, but having that all inclusive approach, For all
21:47
your different areas of the business and your different
21:50
shades of grey when it comes to technical audiences and your
21:53
different areas and aspects of privilege and identity are very
21:58
important. Does that make sense?
21:59
Guys make science to makes a lot of sense, your KD, I think
22:03
there's probably a lot of our listeners out there like hearing
22:07
you and thinking man, what a cool job Katie has and I'd like
22:13
to do something like that. So I'm wondering, you know,
22:15
obviously Lee, there's many paths to get to the end but do
22:21
you have any advice for for someone who might be interested
22:24
in doing what you do? Don't be shy.
22:27
Be proactive. I think that's, you know, one of
22:29
the most important parts is you have to, you know, take action
22:35
to get into this industry. I've seen lots and lots of
22:38
people start like me where they get in the door in a completely
22:43
different role. So maybe they come.
22:46
Is a tech support person or maybe they come in as a sales
22:50
person, or a marketing person, or a developer, you know,
22:53
whatever the case may be and then just through natural
22:56
education and evolution their position changes.
23:01
And you know, they have the ability to do something
23:03
different and focus on cyber security.
23:06
So I would say, you know, show up Reach Out connect on
23:10
LinkedIn. If there's a local group that
23:12
you want to, you know aisaka or some of the other industry
23:15
groups I think are so important. I'm sure lots of over holding
23:19
digital events when Global pandemic whole thing going on.
23:24
But I think there's lots of ways to just kind of force yourself
23:27
into the community and be proactive about it.
23:31
Yeah, I feel so fortunate that I've ended up in this industry.
23:34
I think it's such a cool industry and I know when I've
23:39
been attending, I am conferences.
23:41
When we still had in-person conferences, you know, 15 years
23:45
ago. Look left and look right and
23:48
more than likely people on both sides, you were were men.
23:52
And now I'm seeing many more women enter this industry which
23:55
I think is a very positive development but wondering you
24:00
know what advice you might have. For women who are in, I am or
24:07
are looking to get into. I am to kind of make that move.
24:13
Well, what kind of advice might you have for them?
24:15
Confidence is Is key, do not let the men in the room intimidate.
24:19
You it is very often that I am. The only woman in the room and
24:25
some women are not comfortable with that.
24:29
And I think it's a mean there's the old adage, right?
24:34
That the magic happens when you step outside your comfort zone.
24:37
But I truly believe that in some ways I think on some level you
24:42
just have to fake it until you really are comfortable with it.
24:47
And it's also important to be on top of your game.
24:51
So I think, you know, part of the reason why I have such a
24:55
depth and breadth of knowledge is because I've forced myself to
25:00
develop this, I always want to be able to answer a question and
25:04
it's okay to not have an answer, right.
25:06
But I pride myself on having a very few questions that I cannot
25:10
answer. Yeah, and I can vouch for you.
25:16
Kind of speaking with confidence and I think that's important.
25:20
Whoever you are like to go in there when you speak with
25:23
confidence. I think that people are more
25:26
likely to agree with what you say and I always say it's like
25:31
it's like sharks can smell blood in the water.
25:34
You don't sound confident? What?
25:36
You have to say whether it's true or not.
25:38
People are going to think that maybe it's not true.
25:43
I'm also wondering, you know. Okay.
25:45
Did you have Mentors in your career either, you know, formal
25:49
mentors or just people in formerly mentored you.
25:52
And I'm wondering how that that helped you in terms of building
25:56
your career, this is a little cheesy and very personal but my
26:00
mom has always been my mentor. So, for years and years and
26:05
years, she was a very Savvy businesswoman, she was a
26:10
trendsetter within her own industry.
26:14
So she was one of the first women Eamon hired into the
26:17
financial management program at GE, she was one of two and she
26:24
was just a very driven Savvy educated business woman and I
26:31
think I've always strived to have her same sort of business
26:36
success. And again, I just kind of got
26:40
lucky and stumbled into Tech and cyber security and identity and
26:45
access management. Didn't I don't think I'll ever
26:48
do anything else. I think I have found my passion
26:51
and my career choice. This is it this is it this is
26:55
where we're going, you know, the confidence thing I think is
26:58
interesting for me, confidence comes from knowing subject
27:02
matter and you know then come from other things like being
27:06
able to articulate etcetera. Would you would you agree with
27:10
that approach? Or do you think that there's a
27:12
different way that people can approach kind of building that
27:14
confidence if they don't necessarily have it?
27:16
I think it's absolutely about, you know, building that and
27:21
developing that through education and just knowing your
27:23
stuff. But I also think especially for
27:25
women their newer to this industry, there's some sort of
27:29
fake it until you got it. That has to happen.
27:32
It's in most circumstances. Anyways, just because of the
27:37
male-dominated industry that is Tech.
27:41
And is really you know, cyber security and identity and access
27:44
well in still inside. Secret.
27:46
I think everybody gets to some degree is Faking it until it
27:49
gets up. So I think that's good stuff.
27:52
I know we're kind of getting here towards the end of the
27:56
topic but what I wanted to talk through here with you is some
27:59
predictions, maybe that you might have in the privileged
28:03
access management space for 21. Is there anything that that you
28:07
think is going to be kind of something that you want to throw
28:11
out there, as hey, this is coming in 2021 and folks should
28:15
be aware About it or at least be thinking about, you know, how to
28:19
approach it. I think, you know, some of the
28:20
things we've touched on during this call and my I think
28:25
prediction for 2021 is that the definition of privileged access
28:30
management is going to change. It's no longer going to be that
28:34
traditional infrastructure since of Pam.
28:37
I think it's going to be cloud and devops and iot and you know,
28:42
all these other types of Privilege in areas of privilege.
28:47
And I think that that is really going to be, you know, under a
28:53
magnifying glass as the pandemic, right?
28:57
Because the digital transformation is forced, you
29:00
know, people are no longer in the office.
29:03
I don't think people will ever go back to the office, the way
29:06
they were. And so I think that traditional
29:09
Pam infrastructure security is going to be less and less, you
29:13
know, of a priority and more and more people are going to To be
29:16
thinking about these different aspects and arrogance, a
29:19
privilege. And it's interesting.
29:21
So I have a couple items on that.
29:22
Cutthroat, you rapid-fire format here for 21, and I'm glad you
29:27
brought up the definition change.
29:28
I'm going to put you on the spot here because this ties right in
29:31
nicely. And there's my question will
29:34
Social logins be more widely considered privileged accounts?
29:38
Yes. Anything that shared should be a
29:40
privileged account and has visibility for the corporate
29:44
social media. Absolutely, that's something
29:46
that I don't see considered very often right now.
29:48
I think the traditional approach is, yeah, of course, server
29:50
accounts and shared accounts on things like that.
29:53
But when I asked how social logins are being managed, it's
29:56
usually kind of like, uh, and it really kind of thought about
29:58
that. I kind of feel like closely
30:00
related to that are accounts that maybe are managed by a
30:06
group like accounting to log into their Bank of America
30:10
portal or something. I'm using that as an example.
30:13
But you know, maybe five people In the accounting department,
30:17
login to a third-party web application.
30:20
They kind of share that password.
30:22
That's one of the probably the most dangerous passwords in the
30:26
organization. HR systems, accounting systems
30:29
Financial systems, even LMS systems.
30:32
Like what I manage there's an abundance of intellectual
30:35
property in our LMS. There's so many areas of risk.
30:40
It's just that in most senses of privileged access management,
30:45
you know, It's and folks like us, we're only talking to the
30:48
Ops and the infrastructure in the security.
30:50
Folks were not talking to the other areas of the business and
30:54
helping them Define and understand what risks exist
30:57
there. And what areas are privileged
30:59
they actually have. Because I think there's a lot
31:02
there and we're going to see it more and more.
31:05
Yeah, you're right. It comes down to risk, right?
31:07
I mean, the risk is there, it might not be the most
31:11
straightforward account to manage, but that doesn't mean
31:14
that you shouldn't be doing. Think about it.
31:17
How about vaults? I feel like those are fairly
31:20
traditional at this point, almost kind of a commodity
31:22
amongst, you know, the the vendors in this space.
31:26
Are we going to see more advanced functions being adopted
31:30
things like session recording application, password
31:34
management, devops Integrations, you know, for whatever it may be
31:38
things like that. Do you see more adoption of
31:41
that, or do you think that there are still a lot of companies
31:45
that maybe don't have? Have the basics of privileged
31:47
access management place and that will still see kind of vaulting
31:50
as the first or most predominant step in 2021, you know, I think
31:54
there's a good mix of both. I do think there's a lot of
31:56
organizations out there that are still using sticky notes and
32:00
Excel spreadsheets and do need a vault, I think and I could
32:04
literally probably talk about this for like 10 minutes.
32:07
So I will try not to go off on a tangent but everyone needs.
32:11
A vault, my hundred year old grandpa needs involved.
32:13
Children need a vault. Everyone has a past.
32:16
Last word problem, everyone has a digital identity nowadays.
32:20
I mean, if you think about literally children that are
32:23
logging in to their school using Chromebooks and they have
32:27
different passwords for their different school systems and and
32:32
everything is digital. Now all of those need to be
32:35
password protected and all of those should be unique, strong
32:39
passwords that should be in the vault.
32:41
So I think there's lots and lots of use for Vaulting.
32:46
But I also think that more and more organizations have kind of
32:50
check that checkbox. And now they're starting to
32:52
realize that there are other areas of privilege.
32:56
They need to address because of that risk that we just
32:59
mentioned. Where do you see artificial?
33:01
Intelligence intersecting with some of the use cases that are
33:06
traditionally privileged access management, like vaulting or
33:09
session recording or you know analytics those sorts of things.
33:13
Do you see AI or machine learning?
33:16
Taking a step forward in the Pam space.
33:20
I think they have to, I think those types of Technologies are
33:23
going to be critical for the vendors, in our space to
33:27
embrace, because the adversaries, and the hackers are
33:32
absolutely going to embrace these Technologies.
33:35
And especially when it comes to like, AI stuff.
33:38
It's very, very scary to me for a threat.
33:42
That doesn't get you the first time to learn, why it didn't get
33:46
Get you and to get you the second time.
33:48
And so for things like that, also as Security Professionals
33:52
and as vendors in this space need to be aware of that need to
33:55
be thinking about that. And using those exact same tools
33:59
and tricks to defend after list is something that has, you know,
34:04
been the topic du jour. It seems like for the last
34:06
couple of years, and there seems to be another Focus around
34:09
trying to become password list at least in an Enterprise
34:12
situation. How do you think this affects
34:16
Access management. I called, can I say this?
34:19
I call bullshit. I call, I call malarkey.
34:25
I do not think that we are ever truly going to get to a password
34:31
list State. And a great example is the other
34:37
day, I was logging into my Verizon app on my phone because
34:42
I wanted to pay my Verizon bill and the action method that I
34:46
have set up is facial recognition on the app and it
34:49
wasn't working. So I needed the password, I had
34:53
to pay my bill and so I had to log into my Vault and get my
34:57
password and authenticate the old school way and there's
35:01
always going to be that need when you know MFA or SSO or
35:06
whatever, type of authentication people are using you know,
35:08
doesn't work or even you know basic other tasks like restoring
35:13
from backups, right? You're going to need the
35:15
password. I think there's, you know,
35:18
circumstances for not using passwords but I also think that
35:24
it's never going to completely just my two cents.
35:27
What's the next Frontier for privileged access management?
35:30
I think it's what we've kind of touched on which is this area of
35:36
privilege, that is expanding and evolving these Cloud assets.
35:41
These different areas of privilege, iot non-human and
35:46
Counts robotics I think you know it's very scary when people ring
35:54
doorbell, cameras, get hacked every seems like almost every
35:58
single day. I watched, you know, the evening
36:01
national news and they have some story about this device or that
36:05
device or you know what you need to do to better secure yourself
36:09
from this cyber security threat. So I think, you know, all of
36:13
these areas of privilege are going Continue to be more and
36:17
more relevant, not only in a business environment, but also,
36:21
you know, in a consumer and you know, end-user at whatever you
36:26
want to call it non-technical way as well.
36:29
Yeah, I think I think it was back, right?
36:30
That definition evolving and you know this as definitions evolved
36:35
for privileged access. The scope will most likely have
36:38
Hall with that, right? What's included as part of that
36:40
and then making sure that you're taking the right steps to secure
36:43
those keys to the castle. So, Well, I certainly appreciate
36:47
the conversation and I know that we're kind of coming up here on
36:49
time before we close things out for the year.
36:55
Are there any, you know, final words of wisdom that you want to
36:58
share with the group Katie, um, get your shot, don't be scared,
37:05
don't be scared to do your part to help us shut down the
37:07
pandemic. Exactly.
37:10
But more importantly, you know, change your password, if you can
37:15
do one thing, In 2021 that will help keep your digital identity
37:20
secure. It is definitely make sure you
37:23
change your password at the start of the new year.
37:26
That's always a good best practice and then put that in a
37:29
vault and make sure that you're using a different password for
37:32
as many sites as you can no daisy chain.
37:49
Having different passwords and having strong passwords and not
37:51
even have to remember that is a big Advantage for folks.
37:54
So definitely agree with that. Jim is there anything that you'd
37:57
like to toss out there? Before we let these fine folks
38:00
go for the year? Well, a few things, so personal
38:04
that was the most practical advice.
38:06
I think any, including you, and I have give any one of our
38:11
guests. I've given what cages said about
38:14
the password, Changing. I mean New Year, like, that's a
38:19
great practice to get into, but the other thing I was thinking,
38:23
is I very much feel like I would have been great as a writer on
38:28
Seinfeld because my observations are about, you know, nothing
38:33
partner there about like the smaller things.
38:35
So Jack, you always say keys to the castle.
38:39
I always say keys to the kingdom and I'm wondering Katie, which
38:44
of us is, right? Is a key step.
38:46
Cast of piece of the Kingdom, but isn't the castle?
38:49
The kingdom. I don't know.
38:52
I'm starting to worry keys to the city or something keys to
38:57
the Galaxy. I just want to throw out there.
38:59
Just remember, who is editing this podcast?
39:02
I'm just gonna throw that out there.
39:03
Okay, what's your answer? Katie keys to the castle that
39:10
was, that was not peer pressure or any type of blackmail or
39:14
extortion at all for editing. Versus Jeff is right, okay?
39:18
So, the last thing I just wanted to say is I hope everybody and
39:22
gets to have a little bit of a break here at the end of the
39:24
year. Comes back with their batteries
39:26
recharged for. For me personally, 2020 was
39:32
busier than most years while we weren't doing as much travel.
39:37
Not nearly as much trouble. Our project load was increased,
39:42
and I think it's just that, you know, It's probably a natural
39:47
progression that information security and therefore I am is
39:51
becoming more and more on the front burner of it.
39:56
Budgets and organizations are needing help to, you know,
40:02
improve their security posture, improve their management of who
40:06
gets access to what. So I'm not hoping that 2021
40:11
necessarily slows down on that front but I would like to be
40:15
able to take a few Vacations, I guess if you will.
40:17
So hopefully everybody has an opportunity to kind of recharge
40:21
and blasted the 2021. And then also, you know,
40:27
constantly looking to communicate with our listeners
40:33
and anybody who's following the podcast, please connect on
40:37
LinkedIn, you know. Share your ideas for what you
40:41
like hearing about, even what you don't want to hear about any
40:44
more. Stations for guests for future
40:47
podcasts, or open all that. But definitely, please send
40:51
LinkedIn connections of unless the network.
40:53
Yeah, definitely. This is a show, you know, for
40:55
the People by the people. And we want to make sure that
40:58
the topics were covering our what's interesting out there.
41:00
So if you've got ideas suggestions feedback criticism
41:04
whatever maybe send it all our way and you know, we're happy to
41:06
take it and you know improve and get better out bad at this and
41:11
hopefully may you continue to make the show grow and get
41:13
better topics and or more interesting topic.
41:15
You know, over time and folks like that.
41:17
So I think that's a good way to end it.
41:19
You know, I think I'll be glad to see 20/20 kind of in the
41:23
rearview mirror and start start fresh again in 21.
41:26
I hope that everyone enjoys the holidays again will be taking a
41:30
few weeks break here and we back in, you know, early mid January
41:34
thing with with another round of identity and access management
41:37
talk. So with that happy Holidays,
41:40
happy New Year and we'll talk with you all next year.
41:47
You've been listening to the identity at the center podcast,
41:51
if you like what you heard, don't forget to subscribe and
41:53
visit us on the web at identity at the center.com.
41:47
You've been listening to the identity at the center podcast,
41:51
if you like what you heard, don't forget to subscribe and
41:53
visit us on the web at identity at the center.com.