Latest / Identity at the Center / #276 - CloudSec with Kat Traxler of TrustOnCloud

Transcript

#276 - CloudSec with Kat Traxler of TrustOnCloud · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:27
Not so bad yourself. I'm doing well.
0:30
I mean, you know, I'm going on vacation next week, so yay for
0:34
vacation. But you know, and I think
0:38
everybody can probably relate to this, the week before vacation
0:41
and the week after vacation is like hell on earth in terms of
0:46
your work life. You've got to get everything
0:48
done before vacation. Then you come back and it's like
0:51
your inbox has 1000 emails or whatever.
0:55
But as you know, I live in Augusta, GA.
0:59
It's Masters week. We're the center of the world's
1:02
attention for one week out of the year, and that's next week.
1:07
So I'm looking forward to it. And damn the damn the stress.
1:14
Well, there's no such thing as vacation, I think, and kind of a
1:16
job that you and I have. It's just periods of work you're
1:19
hitting pause on. It doesn't mean the work
1:21
disappeared while you're gone and you'll spend some time
1:24
catching up. Yeah, and but I'm going to spend
1:28
the week like doing all kinds of yard work and things that I
1:32
don't have time to do the rest of the rest of the year.
1:36
The the other weeks, I feel like weekends you have to have at
1:42
least one day to do something fun where your life just goes by
1:47
and you do nothing. Like, I just can't stand
1:49
spending my whole weekend going to the store and doing laundry
1:54
and XY and Z and spending your whole weekend and you've done
1:58
nothing fun. So I feel like you have to do
2:00
one thing fun, so I never get to things like, you know, updating
2:04
the flower bed and stuff like that.
2:06
I can imagine updating the flower bed.
2:08
That's not something that I'd normally picture you doing.
2:12
It's not something I normally would do, but Denise and I are
2:15
going to go to the nursery and buy stuff because I've only been
2:19
in this house for like 2 years and basically the entire flower
2:23
bed died, which I don't know how that happened.
2:25
I think they bought all kind of like low end plants to get ready
2:29
to sell and they probably didn't put a lot of effort into
2:33
planting them and they probably just sat and you know, never
2:38
rooted etcetera. So anyway, my flower bed is just
2:42
like, you know in the South you use pine straw rather than wood
2:46
chips because we have like termites.
2:49
Termites is a major issue in the South.
2:51
So you use this pine straw and basically my flower beds are
2:54
pine straw with nothing coming out of.
2:56
It that sounds real attractive. Well, good luck with to to you
3:00
and your fun vacation in quotes. We're gonna have a couple
3:06
conferences. Gonna be at those.
3:07
Those aren't vacations, but those are fun, right?
3:10
They're fun. They're like work vacations.
3:13
Yeah, you want to tell us about Identiverse?
3:15
Yeah, I mean, I'm always excited about Identiverse.
3:17
We're going to have a lot going on there.
3:20
We're going to have a couple of events which I'm not ready to
3:23
announce, but there'll be opportunities to interact with
3:28
us, maybe see us put on the podcast in kind of a a live
3:32
setting. And for those people who haven't
3:35
registered yet, we're going to have a link in the show notes.
3:40
But essentially you can go to identverse.com and use their
3:43
discount code which is IDV 24, Dash IDAC 25, so you can go and
3:52
there's still like a version of early bird.
3:55
Price hasn't gone to the maximum amount I think at the near the
4:00
end of April. So don't take my word for the
4:02
exact date. I thought it was like April
4:04
26th, but if you missed the date for early bird pricing, don't
4:08
say Jim McDonald, you know, gave us this misinformation.
4:11
So I want the discount. That ain't happening.
4:14
You need to go out there and check for yourself.
4:16
The conference is, I can get this part right for sure.
4:19
The conference is May 28th through the 31st.
4:24
Is that the Aria in Las Vegas, which I love Las Vegas, I mean,
4:29
I don't gamble. I do drink a little bit, but I'm
4:33
not like, I don't go crazy. I know it's in city, but I don't
4:37
go there and like sin extravagantly.
4:40
But I do have a good time. I mean, the food is great.
4:44
I know you're real into the people watching.
4:45
I like doing that as well and I just have a good time overall.
4:50
Yeah, the people and the food I like.
4:51
I think that should be like your your tagline.
4:53
I don't sin extravagantly. That's the motto for that, for
4:57
the podcast. Yeah, I don't sin extravagantly,
5:01
but that doesn't mean it don't sin at all.
5:04
Yeah. So we'll have that link in a
5:05
show note, IDV 2 four dash, IDAC 2/5 is 25% off.
5:09
Then right after that, I know a lot of people are hopping on a
5:11
plane. Basically they're going straight
5:12
from there over to Europe and Berlin, specifically for the
5:17
European Identity and Cloud conference.
5:18
So our friends over at Kubner Cole have given us a discount as
5:22
well. EIC 24, IDAC 25 gets you 25%
5:26
off. Unfortunately, Jim and I won't
5:28
be there this year, but we hope make it next year.
5:30
I think that's kind of on our bucket list.
5:31
We've been talking about that for a while, but it would be
5:33
cool to go to that finally after the, I think, I feel like like
5:37
two or three years now of us talking about it.
5:40
You know, I think that one of the other cool things that we
5:42
should point out is that for the years that we've been doing this
5:46
podcast, we've always been. I think that the listeners of
5:50
podcasts have been weighted more towards the United States and
5:54
now we are actually a majority of listeners outside of the
5:58
United States, which I think is super cool.
6:01
And I think we always try to remember that there's so many
6:07
people listening who are not in the United States and I don't
6:09
think we always nail it. Sometimes we forget and we have
6:12
our US centric statements. It's not anything intentional,
6:18
of course, it's just we're just it's just a matter of
6:21
convenience, if you will. But yeah, a lot of people, that
6:25
conference was probably right in their backyard.
6:27
Yeah, easy to get to, but yeah, that's something we want to get
6:30
to next year. And then Speaking of worldwide,
6:32
we've got Identity Week coming up later this year.
6:34
There's Europe, which is June 11th and 12th in Amsterdam,
6:37
America, September 11th and 12th in Washington DC That's where
6:40
you and I will be at. And then Asia is October 22nd,
6:44
23rd in Singapore, if you use the code IDAC 3 Zero 30% off.
6:49
And that code works for all of those conferences, which is
6:52
super cool. So I know you and I are looking
6:54
forward to the one in DC and we'll be doing podcasting things
6:58
there And and I think I was supposed to host like a panel.
7:01
Don't know what we're going to talk about or with who yet, but
7:03
we'll make it. We'll make it work.
7:06
I'd like to. I'd.
7:08
I'd be more excited actually to go to the one in Europe and in
7:11
Singapore. I've never been to Singapore,
7:14
but I really want to fly first class if we go, or at least
7:18
business class. We have to get a few more
7:19
sponsors, I think, for that. So if you want to sponsor an
7:21
episode of the podcast, hit our website.
7:25
All right, let's talk Turkey or Cloud.
7:28
In this case, I wanna welcome to the show her first time on it,
7:31
Kat Traxler. She's a security researcher at
7:34
Trust on Cloud. Welcome to the show, Kat.
7:36
Hey, guys and hey, everybody. Thanks for having me.
7:39
Yeah, thanks for making an appearance with us.
7:41
You're currently holding either lump or Yawn, I'm not sure
7:44
which. On your lap, one of your two
7:47
dachshunds. Yeah, I have Mr. Lump.
7:49
Here he is. He was whining to get out of my
7:51
lap, so if we don't want to hear him whining through the entire
7:54
episode, I think it's best I just hold them.
7:56
Well, I'm a dog fan and I think dogs are the best people, so I'm
7:59
totally OK with that. We're not doing video for this
8:02
episode, so people just have to take my word for it that that is
8:05
one adorable puppy on your on your lap.
8:07
Let's talk about though, your identity background, because one
8:10
of the things we do when we have someone on for the first time is
8:12
really to kind of understand how did they get into the identity
8:15
space. So tell us a little bit about
8:18
sort of how you got up into this you know, area.
8:21
Is it something that you chose or did it choose?
8:24
You very much the latter. You know I have an I have a
8:28
background in application development and then web app pen
8:34
testing. That was my initial pivot into
8:37
security and a number of years ago and in that realm of
8:43
internal white box testing. One of the large testing
8:48
projects I was able to do was a white box test of a new IDP.
8:56
My employer was looking to switch ID PS and needed to have
9:02
an independent look at the on Prem systems, the connections,
9:09
the, the configurations and assertions that we're going to
9:13
be creating. And I mean my memory has it that
9:16
I probably spent six months tearing this thing apart.
9:19
And you know it was that that experience that really showed me
9:25
the impact that Identity had across a major enterprise and
9:31
kind of got me into becoming this, yeah, I mean I I guess you
9:36
could say identity junkie, right.
9:38
But it was really more of like an impact junkie.
9:40
Like I wanted to work on systems that had the most impact to my
9:47
customers and to my employers. And that was just like identity,
9:50
clearly. And having been, you know, so
9:54
deep inside of an IDP and seeing the guts and glory of it.
9:59
And from there I knew that if I wanted to be at like having
10:03
packed full work, it was going to be centered in identity.
10:07
And you've got a lot of, you know, pans in the fires.
10:10
We like to say a lot of stuff that you work on.
10:12
You've got your own consulting firm, Nanuke Security.
10:16
You're working with trust on cloud now it's a security
10:18
researcher. You also do work with Stans
10:19
Institute, IANS, Defcon. I mean, tell me about some of
10:23
the other. I don't want to call them
10:24
extracurricular activities, but tell me the other things that
10:27
you kind of work on and help me kind of understand as second
10:30
part of that question, what does a security researcher do?
10:34
It's like a really, really good question.
10:35
It's so broad, you know, what does the security researcher do?
10:41
And that's that explanation is going to be different from 10
10:45
different researchers you talked to.
10:47
But I like to think of it like I take complex amorphous systems
10:53
and try to break them down to their essential parts and
10:57
through that process try to identify the the security
11:03
weaknesses typically at the joints where two trust
11:06
boundaries meet, where two systems interact.
11:09
And so it's that process of distilling and really like fully
11:17
understanding that within the complex system there is no
11:20
magic. And if you can say there's no
11:22
magic in here, it all is understandable.
11:25
If you want to distill it to its essential parts, that's
11:29
ultimately like what research is, is trying to distill it to
11:32
its essential parts and then understand where you have, you
11:39
know, security relevant issues. I might stumble across a lot of
11:43
bugs here and there, but determining whether or not it's
11:46
security relevant is kind of like the the unique, unique
11:53
skill to have. You know, what ticketing system
11:56
do you submit this to? Do you submit this to a general
11:59
public issue tracker where everybody can see Because it's
12:02
like not security relevant and hey, I fixed this, or do you
12:06
submit to this like private bug boundary where it should be kept
12:09
confidential? So yeah, that's what I do in my
12:14
day job with Trustmont Cloud. The work product is threat
12:20
models, GCP services specifically, where ultimately
12:25
there is a diagram of all of the flows and interactions of the
12:30
service, and then a list of all of the threats I've enumerated
12:33
and then all of the controls. I do similar work.
12:40
I had done similar work with past employers with SANS.
12:44
I wrote a course, the SEC 549 Enterprise Cloud Security
12:50
Architecture course. Less threat focused, more just
12:54
like what are the overarching controls?
12:55
Lot of identity, surprise, surprise, big big identity
12:59
course. What was the other thing?
13:02
Oh, Defcon, right? I for years I've helped run the
13:07
local Defcon chapter here. So everybody knows there's the
13:10
big Defcon Vegas thing. I personally hate Vegas.
13:16
I like it's torture for me being there.
13:20
But there's also these, like, local chapters in every
13:22
community that meet, and I've helped run that for many years.
13:26
I think that covers some of the extracurricular stuff, yeah.
13:31
Now I feel like you need to defend Vegas, but I'm not going
13:34
to you. You form your opinion, I'll form
13:36
my opinion. We can still be friends but I
13:39
had did have a follow up on the security researcher thing which
13:43
is like how why what what drives people to become security
13:51
researchers or do the kind of research and get these you know
13:55
find these zero days and things like that.
13:59
My understanding is OK, there can be bounties that are paid
14:05
and then the other is like street cred.
14:08
Like I found this zero day and like I can become famous as a
14:12
security researcher, But since you brought it up, I mean what
14:16
is the motivation? I mean those are two of them
14:19
also, you know there's also the do good part, you know that just
14:24
we want subsistence more secure. That's definitely a factor.
14:28
I'm working on a project now that because of the kind of
14:31
research it is, I won't get any bounty, might not actually get
14:36
any St. credit of it, but if it works out, it's actually going
14:39
to be really impactful for people and secure a lot of
14:43
systems in the future. So you're always balancing those
14:47
three and like you do it because you're just like insatiably
14:51
curious and you know and you you try to just balance that
14:55
between, you know, having a life and you know, enjoying non tech
14:59
things and not have it take over your life.
15:02
But I know when people first start out, it can really be
15:05
consuming just this insatiable curiosity of systems and trying
15:10
to break them and understand them and dissect them.
15:16
Yeah, yeah, definitely got the sense that that's a a big
15:19
motivator for you from the different things that I've seen
15:23
you do on like YouTube and things like that.
15:26
And you know, one of the things that attracted us to ask you to
15:32
be on the show was that, you know you're in this IAM space,
15:36
but you're also focused on the cloud.
15:39
You kind of spend a lot of time on GCP, Google's cloud, a lot of
15:44
time on AWS. And I'm just going to start with
15:48
kind of like one of the questions I think every identity
15:53
practitioner has either faced or is facing now as they're
15:57
transitioning having to manage you know on premise environments
16:03
and having to manage cloud environments from an IAM
16:07
perspective. And I'm wondering, you know, the
16:12
investments that we've made over time in IAM tools, can the same
16:18
tools that we bought for on Prem be used for the cloud?
16:22
Is it black and white? You need different tools or is
16:25
it there's some kind of like Gray area?
16:29
I will have the most, you know, probably frustrating answer and
16:33
saying maybe maybe you need new tools.
16:37
I think, I think that's like the Holy Grail right?
16:40
Like I have this, I have this permission catalog that stood up
16:47
in my enterprise and like can't I just like put all of my AWS
16:52
rules in here and then have those roles be auto assigned to
16:56
the people and then deprovisioned after a time?
17:00
And that's all I think possible and some of the big vendors are
17:05
incorporating it. But I think it's it's not a,
17:09
it's not a natural externalization of cloud
17:13
concepts. I think like what's natural to
17:17
externalize from the cloud is authentication.
17:22
So like you can naturally you know, externalize your to your
17:30
IDP and you can naturally externalize to say your group
17:36
memberships and have those carried through over, you know,
17:40
SAML authentication. But when it comes to your like
17:44
roles and your authorization, that's a harder nut to crack and
17:50
I think there's just less less kind of all in When I say all in
17:55
one, I mean like it'll handle all of your, you know, on Prem
18:01
privileged assignments and your in the cloud, you know,
18:08
developer roles. There's just less all in
18:22
Is there authorization concepts? See, I think This is why I
18:27
wanted to get you onto the show because I didn't even feel like
18:31
I asked the question well, but your answer was perfect and
18:35
exactly what I was looking for. You you've really focused in on
18:39
kind of the core technologies of Identity, you know from the on
18:44
Prem world. There are a couple of other
18:47
technologies that you didn't touch on that I'd like to throw
18:51
them out there and just kind of get your take and whether or not
18:54
like how much value you see in them.
18:56
And the first one I'm going to touch on is, you know, kind of
18:59
built for the cloud, the space called Kim or C i.e.
19:03
M cloud infrastructure entitlement management.
19:07
What's your take on that? I mean those those folks are
19:11
trying to solve like the the huge problem of both lease
19:16
privilege and trying to time box privilege assignments around,
19:22
you know, doing that just in time.
19:25
I mean my take is that it's a massively hard problem to solve.
19:29
At some point when you're large enough and you have a large
19:33
enough enterprise, bringing some of that tooling in makes sense.
19:37
And is it? It's probably not going to be
19:40
the same tooling though as your on Prem permission catalogue.
19:46
That's why they have that whole CI space and yeah.
19:53
It's like I said built for the cloud.
19:55
And I think a lot of people are determining whether and whether
20:00
or not they need to be spending money on that.
20:03
The next one is kind of more traditional on Prem tool,
20:08
Privileged Access Management or Pam.
20:11
And kind of it's a, it's always been to me like a bunch of
20:15
capabilities kind of put together in terms of what they
20:18
call Pam. But I'm just wondering like.
20:22
You talk about like traditional Pam technologists say, like a
20:26
Cyber Ark or Beyond Trust or the Delineia Suite, like is that the
20:32
place to start? Is that the place to build your
20:35
privileged Access management for the cloud?
20:38
Likely not. No.
20:40
I mean, I mean the Cyber Ark people will probably you know
20:44
shake their fists at me, but I I don't see that it's, I haven't
20:49
seen that it's moving at the speed that folks need.
20:54
And I'm thinking about like the usages of Cyber Ark being this
20:59
I'm going to everyday then do you this privileged user and
21:08
it's going to be bended out to a small hand handful of your you
21:13
know, your sys admins, your your DAS.
21:19
But now in the cloud who has I'll use airports privilege like
21:24
all your developers like so many people.
21:28
So maybe the first thing to do is to figure out how to have
21:33
instead of having 500 developers needing privilege, maybe the
21:40
first thing to do is to try to figure out how to have zero
21:43
touch production where nobody actually is logging into that
21:48
system. And like the the ways that the
21:52
cloud and privilege identity has evolved has been different than
22:00
it evolved 20 years ago in like the on Prem systems to where I
22:04
don't know that your traditional Pam vendors shoehorn in great.
22:11
Yeah, I mean I think, I think my answer to this or my feeling on
22:15
this has to do with how you went to the cloud.
22:19
If if your approach was like let's lift and shift our
22:23
internal environment and you're doing little virtualization
22:27
where little infrastructure as code, then maybe it's just a
22:34
bunch of servers that you are renting from someone else and
22:39
that model would work. I don't think it's going to
22:42
really help you too much for your console.
22:45
But in terms of like, hey, we're not doing any kind of automated
22:49
management of these server instances and that's what our
22:54
cloud happens to be, then I think yes, traditional Pam
22:58
probably would work in that model.
23:00
If you're doing a lot of automation, you're using a lot
23:03
of, you know, service accounts and you're using Docker and
23:08
things like that, I mean, it starts to chip away at what
23:13
value kind of extending that privilege access management
23:17
would bring to you securing your cloud.
23:21
I think how much, how much effort might go into deploying a
23:26
Pam solution, say for like your server instances, right?
23:33
I worry that somebody might end up missing the forest for the
23:35
trees, because even if you have, you know say a a lift and shift
23:41
style fleet of IAS and that's really all you're using, you're
23:48
missing the entire control plane which is through your most juicy
23:54
target. You might spend a ton of effort
23:57
securing these SSH credentials or just securing this like 1
24:04
jump post ingress, but you've completely missed your entire
24:08
control plan. That's right.
24:11
That's what I was calling it, the the console, but it's really
24:14
more the control plane. Yeah, yeah.
24:17
Which just comes along for the ride, really, no matter what.
24:21
What do you think that those privilege access management
24:24
tools are kind of missing the mark there?
24:26
Is it just it's very hard for a third party product to, you
24:31
know, manage that in a more secure way than kind of comes
24:34
out-of-the-box or? I just think it comes down to
24:37
like when you have a hammer, everything looks like a nail.
24:41
You know, that's they've had a very successful business doing
24:44
this thing. And how do they appear to have
24:47
coverage for this new thing? They have a hammer.
24:50
Let's try to make the hammer work in some way.
24:55
So the last group of technology that I really wanted to bounce
25:00
off you was monitoring technology seem and the new, the
25:08
new cousin ITDR. Do you need to enhance the
25:15
monitoring of the cloud with external products or use what is
25:21
kind of built into the cloud? All right, you got to help me
25:25
out here. Itdr What was?
25:28
Identity, threat detection and response.
25:31
Oh, OK. Interesting.
25:33
So my previous employer, I probably did that.
25:36
We called it Cdr, Cloud Detection response.
25:40
And maybe this is just an evolving girl, right.
25:45
So yes. Do we need new things?
25:47
Yeah. So you're going to need, you're
25:53
going to have the same problems with monitoring that you know
25:56
folks in the soccer always had, which is this data normalization
26:00
issue. But you're going to have it
26:04
times 10 because you're going to have audit logs from likely
26:10
three different clouds and you're going to have additional
26:15
system logs from a number of different IAS and SAS services.
26:22
So with all of these logs comes a ton for data normalization.
26:27
And then what do you do with them?
26:29
Do you dump them in your your Splunk and start adding extra
26:34
zeros to your checks and that's an option that people do and
26:39
they start cross correlating just in one big central
26:42
location? Or do you do the thing that says
26:46
I want to gain insights? I will use air quotes against
26:50
insights at the edge, which means which means that you you
26:55
find the uniqueness and you find the vadnais you monitor in those
27:00
clouds using cloud native monitoring technologies, likely
27:05
from the CSPS because they have the insights as to what uniquely
27:10
you need to look for in that specific cloud.
27:13
And then you pull pull not the logs, but you pull the insights
27:18
to a central location where you can do correlation.
27:22
Personally for larger organizations, it really more
27:24
looks like the latter. And so you in both cases you do
27:29
end up using new technologies, but in the latter solution you
27:34
end up using quite a bit more cloud native detection
27:39
technologies because you're doing that insights at the edge
27:42
thing and and centralizing only the insights.
27:48
We kind of jumped right into a bunch of different technologies
27:50
and I want to take a step back a moment because I think one of
27:52
the things that at least that I've discovered myself
27:54
personally is GCP for example, maybe is not as well known as
27:58
some of the other ones like AWS and Azure and sort of things
28:02
like that. And I think this is the thing
28:04
that a lot of people struggle with is every cloud provider
28:07
kind of does identity or insecurity a little bit
28:10
differently from each other. Totally, yeah.
28:14
I mean, it's it's like a totally different language and we're
28:15
seeing some of these tools pop up where they're like trying to
28:17
be the Rosetta Stone between all three.
28:20
And so I can certainly see, you know, some of the cloud posture,
28:22
management, cloud detection, response, right, all that, all
28:25
those things, they're meant to help, but they don't replace
28:29
true knowledge of how things work, right?
28:32
I mean, you need to know how this stuff works, What's the
28:34
best way to pick up and start to learn things like like GCP
28:38
'cause I think you wrote a blog about this, didn't you?
28:42
Yeah, I mean I put out you know, a basic like one-on-one series
28:48
on my website several years ago and I just, I just refreshed it
28:53
recently. Have you ever had, have you ever
28:56
had the thing where you go back to things you've written a few
28:59
years later and you said, oh, this is garbage?
29:02
Recorded. Yeah.
29:03
Yeah. Yeah.
29:05
So that's that happened recently.
29:07
I put out the 101 series, I think in 2020 and I went back to
29:10
it. I was like, oh oh, this is
29:12
garbage. And so I I I rewrote it well.
29:15
It might not have been garbage at the time though, right?
29:16
Isn't this the challenge with any technology as things change
29:19
over time and? Your.
29:20
Standings and yeah, it's like, OK, well, this is the way it
29:24
used to be. It's time to update it.
29:25
I think that's just a natural refresh, right?
29:28
That's yeah, thank you for thank you for bolstering my
29:31
confidence. I remember just you know kind of
29:35
rage updating it. But yeah I know that's correct.
29:38
It needed to be refreshed because so many, so much
29:41
terminology had changed. And then I think the longer you
29:45
work in a system, the more crispy your understanding
29:49
becomes. And that's, that's what I really
29:53
wanted the 101 series to be, was crisp.
29:58
There's documentation from the cloud providers, you can go to
30:03
their websites, you can read all about their IEM models.
30:07
But I didn't see anywhere where it was just like the TLDR, you
30:12
know, prioritizing brevity, prioritizing you know the
30:17
crispest way you could get your point across and then breaking
30:21
them down into these like minimum bite size pieces.
30:26
And part of it for me was just this like exercise of like how
30:31
few words could I use to give somebody 99% of the picture.
30:37
You know how how little could I write as opposed to how much
30:42
could I write and how much could I tell somebody.
30:44
I wanted to see how little could I write and still give him a
30:47
huge part piece of the pie. There's still a A2O1 series that
30:52
I owe people, but one O 1 in GCP gets you really far.
30:57
So we'll have a link in our show notes to that cattracksor.cloud.
31:00
I think it's as of right now it's like the top thing on the
31:02
list that I remember seeing. But it is good.
31:05
And I think there's a real skill and an art form into.
31:09
You took the word that I was immediately thinking it was
31:11
brevity is how do you get to the point quickly, right.
31:14
Everybody's watched a cooking video where they spend the first
31:17
half hour talking about the history behind the parchment
31:20
that they use to write this recipe.
31:22
And it's like not just get to the facts like I don't care.
31:25
Right. So I appreciate short bits of
31:28
content that are direct to the point.
31:30
Tell me what I need to know. Guess what.
31:32
I'm gonna come back. I'm gonna keep reading and I
31:35
feel like if I want to learn more, sure, right?
31:37
There's other things like that, but sometimes I I just love
31:40
those little bite sized things. So I'm I'm excited to scan it
31:43
over and start to get into it because I think GCP is one of
31:46
the areas I personally just I don't have really any experience
31:49
with. It's been all 80 WS and Azure to
31:51
date. Do you see GCP growing?
31:56
Shrinking? Is it better suited for maybe
31:58
certain businesses and certain applications than others?
32:01
Because I've kind of heard like GCP is great for some things and
32:05
not as great for other things, but like where if I'm out there
32:08
as an IAM person, like where should I expect to see?
32:11
Oh yeah, we're probably going to be using GCP in that type of
32:14
context. Yeah, I mean, whenever I hear of
32:18
somebody using GCPI think are you using it for data science?
32:24
That's really popular in that respect.
32:27
It's really popular for its offerings around like Kubernetes
32:34
and like serverless containerization.
32:36
And it's not as popular for say just like workhorse workloads
32:42
like, you know you need like you know some some VMS, start up a
32:48
load balancer and get a database up.
32:50
Like that's really just like your bread and butter AWS stuff.
32:55
I can't tell you if you know GCP would be competitive, would not
33:00
be competitive. It's just I typically don't see
33:04
them playing in that space as much.
33:07
It's more of the big data data science area that you know if
33:13
you're if you have GCP it's it's in that scenario which again is
33:17
very cool because for me that's impact you know that's that's
33:21
high impact data that needs to be protected.
33:26
So let's give people a kick start here.
33:28
If I guess what is the most important thing that people
33:32
should know when they start to look at GCP from an Identity
33:35
perspective? The one thing that GCP has that
33:42
is not prevalent in AWS is this resource hierarchy.
33:47
This concept of a hierarchical model starts at the organization
33:55
flows down to folders and projects and then underneath
33:58
resources where each of those points on the hierarchy.
34:04
Those positions are attachment points for policy, and then
34:11
policy can then be inherited down the hierarchy.
34:15
That whole hierarchy inheritance model, you know, characteristic
34:23
is the most powerful thing in Google Cloud, and it's the thing
34:28
that people just completely forget.
34:32
It's the thing that's just not in the forefront of people's
34:35
minds, especially coming from an AWS background.
34:40
Is that something that from, you know, your day job as security
34:43
researcher, you're starting to look at maybe those policies,
34:45
attachments and say, hey, something misconfigured, is that
34:49
a valid way or a viable way or a most common way, Like what are
34:52
you looking for in those kinds of areas?
34:54
Yeah, yeah. I mean, that's this is the this
34:58
is the best way to provide scope right To to attach grants to
35:07
attach permissions at a resource level.
35:12
Provides the scope, tells you how far those permissions can
35:17
roam. And because it's not in the
35:21
forefront of people's minds, I think a lot of times things are
35:25
attached, say, at the project level, which is the equivalent
35:29
of an AWS account. And that's conflated with the
35:34
idea of an identity based policy in AWS where you're assigning a
35:40
person a policy and that user lives in an account.
35:45
So these two contradictory models that actually aren't the
35:49
same are conflated with each other.
35:52
And what that results in in GCP is over permission, where
35:57
somebody is provided the ability to, say, administer all compute
36:02
instances because they have their permission attached at the
36:06
project level when it really should be attached at say a
36:10
compute instance. That's actually not a valid
36:12
example because I don't think you can dash that the compute
36:14
instance, but the lowest resource level possible.
36:18
I'll say you know, somebody has the ability to administer all
36:23
buckets because that permission is assigned at the project level
36:31
as opposed to really at the very specific bucket that it matters
36:34
at. Is there something similar for
36:38
AWS? Is that on the road map?
36:39
Would you think you would ever tackle it like that or something
36:41
already exists that you feel like?
36:44
No, it's. It's this lack of a hierarchy
36:48
and this lack of policy inheritance was sort of like the
36:53
part of the EWS original sin. It was, it was the, you know,
36:58
the founding of the founding and creation of their resource model
37:01
just never included that. And and So what they've had to
37:05
do over the years is create these mechanisms to kind of
37:11
create scope. So there's things like
37:14
permission boundaries, conditionals, and then a handful
37:20
of resources. A handful have the ability to
37:24
create attach policies at the resource level as opposed to the
37:28
identity. But now you have a problem.
37:31
The problem you have is now you have two different competing
37:35
models. You have the identity based
37:37
model and then you have the resource based model competing
37:40
against each other in AWS for supremacy and so now you have
37:43
have to have all these complex rules about like which one takes
37:46
presence in which situation depending on which resource and
37:51
things become complicated. Is that the main difference
37:55
between GCP and anybody else or are there?
37:56
Other things you know there are There are 1,000,000 scenarios in
38:02
which they are different. However, it all rolls up to the
38:05
same issue. It all rolls up to the same
38:10
issue of AWS not having the resource hierarchy and AWS not
38:16
having the the policy inheritance model and all of
38:24
subsequently all of the changes that they've had to make to
38:27
their original resource model just sort of craft this idea of
38:30
scoped. You know, I know we've been
38:35
talking about I am so much and I think that securing the cloud
38:41
goes well beyond I am certainly other areas, certainly other
38:46
layers, but I even think it kind of starts with having a good
38:51
asset inventory knowing what you're protecting.
38:55
Do you find that kind of that traditional approach to an asset
38:59
inventory or CMDB that kind of like been popular in the IT
39:05
space for as long as we've been in the IT space makes sense
39:11
given the cloud or is it there's some kind of shift where IT
39:14
actually has to be looked at differently?
39:17
I was thinking about this about like a cloud asset inventory
39:22
because that that actually is a very specific service from
39:25
Google, the cloud asset inventory knowing you know, the
39:29
ability to carry what's in your account, I apologize.
39:32
Now I think my dogs are it's. The best part of the show so
39:36
far? No offense to angry.
39:38
It's all good. I think the Mailman's more
39:42
around and so they're they're wrong with everybody, no like so
39:46
like fundamentally. And I just love getting to like
39:49
the philosophical level, like philosophically like what's the
39:51
difference between these two things because it's really easy
39:56
to have an inventory of your assets in the cloud, the cloud
39:59
at home programmatic. You can make you know a series
40:02
of API calls and you can get a a deadly accurate list of
40:08
everything that's in your cloud. Now, what makes that different
40:12
than your traditional autocom enterprise asset inventory?
40:18
Like, I'm thinking like ServiceNow or something, right?
40:21
Like there's a ServiceNow that tells you what are all the
40:24
servers, what are their names, what are their first names, Who
40:26
hones it. The big difference is, is that
40:31
we're assuming that that list that classic asset inventory on
40:37
Prem. We have every, every reason to
40:39
assume that that's correct. And then that's what the world
40:44
should look like. The world should look like these
40:49
five servers with these five host names and Bob and Jane from
40:54
them. When we pull from the cloud, and
40:57
we pull directly from the AP is. We have no context on whether or
41:01
not this is correct, this is malicious, this is misconfigured
41:06
in some way. There's no context around
41:10
whether or not this is good, bad, or indifferent.
41:15
Yeah, I kind of feel like there's also, I mean this debate
41:18
isn't new for the cloud, but I think is it, is it exacerbated
41:23
by the cloud or that might be not be the right word, but the
41:27
idea around there's logical groupings of things called
41:30
applications, but then behind the scenes it's all these either
41:36
hardware or services and then there's different owners and
41:40
different groupings within. So I think that that's always
41:45
been the challenge though I think when everything's a
41:48
service and everything's logical, it just may be either
41:52
exacerbates or maybe to some extent simplifies it.
41:56
I'm not sure. But I think that's something
41:59
that that debate won't be solved on this call.
42:03
But I saw you speak simplifies it and complicates it.
42:10
I saw you speaking on another podcast.
42:13
And this has been kind of a hot topic within this identity
42:17
community around least privilege versus serious standing,
42:23
privilege versus good old role management over provision roles,
42:28
if you will. And to me, there's a time and
42:32
place for all of those. Do you agree with that?
42:40
Or do you agree with like throwing certain things of that
42:43
stack out the door? No I wouldn't throw any of it
42:46
out the door. It reminds me of Google's cloud
42:53
maturity road map. I think maybe we can include
42:57
that in the show knots Then what they have in that is this, you
43:03
know this kind of crawl, walk, run model.
43:05
And then they describe, I'm, I'm, it's not actually called
43:10
mark one. But say say somebody in the
43:12
cloud is crawling and they describe here's all the
43:15
behaviors that you might be doing if you are say crawling.
43:19
And in that maybe they are, you know, simply provisioning some
43:25
very coarse grained rules and they're walking, maybe they're
43:28
doing some efforts around these privileged around those rules.
43:33
And then when they're running maybe they're going and they're
43:36
doing that 0 standing privilege to do it just in time stuff.
43:40
But it's like all of that's valid, but it's it's about where
43:46
you are in your cloud maturity life cycle.
43:51
And there's a lot of people process technology to get to
43:55
that model of we're only going to provision you just amount of
44:01
access you need for the exact time you need it and then pull
44:06
it back. There's a lot you need to do to
44:08
get to that point. So having this privilege around
44:13
you, you know always on roles is still a very valid place to be
44:19
as your Blues. Seems almost a little
44:21
unrealistic. Yeah, And well, it's it's
44:24
unrealistic if that's the only thing that you think is good.
44:30
I know that like I mean that can be a, you know, like you said
44:34
like a crawl, crawl, walk, run, it can be a goal at some point.
44:39
But you have to balance that out against everything you're doing
44:43
to secure your data and whether or not investments to move from
44:50
all these privileged model to a jet model, whether those
44:53
investments are valid as opposed to say, giddling a handle on,
44:58
say, detection or any other control.
45:03
Yeah, I said. My perspective was all of them
45:06
have their place. I don't think everybody has the
45:09
0 standing privilege infrastructure at hand, but
45:14
let's assume that someone does. I would say you still don't want
45:20
to try to use it like a grenade, right?
45:23
You want to use it like more like a scalpel.
45:26
You know, very specific use cases where super standing
45:29
privileges make sense, least privileged.
45:33
I think it's just another step down from that where it's like,
45:37
hey, you're really trying to do your best.
45:40
I think it's a journey. I don't think it's black and
45:43
white. It's like, you know, if you're
45:46
trying to get to least privilege, the closer you can
45:48
get to that the better. But then there's certain levels
45:52
of privilege which the resources are so low risk, it's like a a
45:59
role probably is good enough. Now The funny thing is when you
46:04
see most IT security policies, it's like we're least
46:08
privileged. All we allow is least
46:10
privileged. And it's like, yeah, it's nice
46:12
to say that, but it's it's not realistic.
46:15
So I I kind of feel like that's like the the hierarchy of needs
46:19
if you will is like 0 standing where it's absolutely critical
46:25
based on risk, least privilege is kind of your in between where
46:28
it's still high risk or medium risk, but it's not maybe the
46:32
highest and it's also not the lowest.
46:34
When I think you're when you're talking low risk, things like
46:37
throw it in A roll, maybe not give it to everybody, but you
46:41
know, like don't lose sleep over it.
46:44
I just want to go back to a 0 standing privilege grenade.
46:46
I think we've stumbled upon a new product here that we can use
46:49
to really clean up environments. Just Chuck that into the cloud.
46:53
I just really appreciated your like breakdown.
46:56
All the three approaches to IEM and I'm thinking about like you
47:02
know the like the owner role in Google and Google cloud say this
47:08
is the owner role. Literally every permission if
47:12
5000 of unless I check probably maybe even 6000 assigned at the
47:17
project level. Your initial blush would be Oh
47:21
no could possibly ever assign this ever.
47:24
There are no scenarios. But then you know you have
47:29
sandbox projects where you you say that it's you know it's
47:35
going to be turned off once it hits $50.
47:38
And this is a sandbox account for a developer to do certain
47:41
things. And you've limited the blast
47:43
radius of this so that yeah, giving them the owner role on
47:47
this sandbox account to have $50.00 worth of fun is perfectly
47:52
acceptable. 'Cause they can always go back
47:55
and ask for for more money to to stop that account.
47:59
Yeah. So other than reading your blog
48:03
and the GCP 101, what are some other ways that people can
48:08
really get up to speed on cloud security?
48:09
I know you and I were talking about some conferences that are
48:12
coming up. You wanna talk about that?
48:14
Yeah, yeah. I'm a huge fan of the Four Cloud
48:19
SEC Conference. It's been going on since 2020
48:23
and was its and unfortunately was its inaugural year and so
48:27
it'll be its fifth year coming up here in June in DC.
48:32
So this conference, I think there'll be 40 some tracks.
48:35
Everything from, you know, classic Builder talks of like
48:38
how do you secure this piece of infrastructure to open source
48:43
projects to we found this crazy hack and it's going to make the
48:47
news and it's going to make the news here.
48:49
So it's like it's really great breadth of the top research and
48:53
this will be the first year that'll there'll be an EU
48:55
version 2. So folks that didn't want to
48:59
make the trip over to the States can find it in Brussels in
49:01
September. I'll be at both and come by and
49:05
say hi and if you're looking for like just some great practical
49:09
hands on cloud security, a friend of mine Rich put together
49:16
the the slaw labs like coleslaw, SLAW and those are like bite
49:24
sized pieces of content around AWS and then practical hands on
49:28
labs that you could do. Sounds pretty cool.
49:33
We focus a lot on identity conferences and I think this is
49:36
probably just the natural extension where you start
49:38
talking about cloud Cloud's not a fad, right?
49:41
It's gonna stick around for a while.
49:42
I'm looking to get a ticket for the one in North America and it
49:45
says it's sold out. It's yeah, you know, it's sold
49:49
out in in seconds, but I think there is a waiting list and in
49:54
the, you know, in the couple days before the conference,
49:57
people do return tickets. So get on the waiting list and
50:03
if you're have the ability to travel relatively last minute,
50:08
you'll be able to get in. So this isn't something with
50:11
cloud security, but I'm on the Eventbrite website and it's, you
50:14
know, it says sold out other events you might like Shrimp
50:18
Blast 2024. So obviously it knows me and
50:23
it's like, hey, this guy likes food.
50:24
Yeah, they know you. You must have some cookies on
50:27
your on your computer. Other than shrimp, I guess.
50:31
Yeah. I just kind of imagine, Kat,
50:33
like, you know, you're at the conference and there's like it's
50:35
like a sporting event, right? Hey, looking for two, looking
50:37
for two. Cloud security looking for two,
50:39
right? Yeah.
50:41
And I think people have also done some, some watch parties
50:45
too. So people who couldn't get
50:46
tickets, they've done some like off site watch parties where
50:49
they will stream the talks. And so you could have a sort of
50:52
a a mini conference feel or just come to Brussels, Brussels would
50:58
be great. Yeah, that's easy.
51:00
I love the idea of having like watch parties because one of the
51:02
things that I run into and cat, I don't know if you're the same,
51:04
but it's like there's too much content sometimes in a
51:06
conference. And it's like you have to
51:07
choose, Am I gonna go see this thing, watch this thing, or am I
51:12
gonna get stuck in a hallway, you know, talking with somebody
51:14
or. Because I want to right.
51:15
Or or something like that. So I love the idea of being able
51:18
to watch it in kind of after the fact.
51:19
So that's always my recommendation for anybody to
51:21
put in a conference is have some way for people to, like, catch
51:24
up for things. I don't know if you struggle
51:26
with that same. Ah, yeah.
51:28
I'm all about the Holloway Con. I mean, I'm lucky if I watch two
51:33
or three talks in the whole conference because I'm just
51:36
catching up with people I haven't seen since the previous
51:40
previous year. You know, I think we all end up
51:43
becoming fast friends. And yeah, and so this is our
51:47
chance to kind of see each other.
51:48
And then we'd watch everything on YouTube.
51:52
All right, well, let's start to wrap up this conversation.
51:54
I'm gonna pause a scenario here for us.
51:57
Jim walked in with a IDAC branded zero standing privilege
52:02
grenade and chucked it into the cloud.
52:05
And identity security is done. Or it's so screwed up now that
52:10
you're like, I'm outta here. Like I'm done.
52:13
What is it that you're gonna do with your life?
52:16
What is your job? Whatever you wanna call it that
52:20
you're quit and say I'm out of this.
52:21
I'm not working on technology. Oh that's a good one.
52:24
Yeah. The the, the, the JIT grenade
52:27
came came in. Yeah.
52:30
I think my, my long standing you know, I've quit technology job
52:36
has always been to start ACSA right to just you know have sort
52:40
of a, you know the intent would be to create a small hobby farm
52:44
and it would quickly get out of hand into chicken and goats and
52:49
quickly get out of hand that I'd have to start ACSA because I'd
52:52
be growing way too many vegetables.
52:55
And yeah, I'm probably just, you know, one small, you know, cloud
53:01
security issue away from becoming a farmer, so.
53:05
So CSA is Community Supported Agriculture or something?
53:08
Else Community Supported Agriculture yes and not not not
53:12
join the CSA as in received vegetables, but grow so many
53:16
vegetables I have to then sell them to my neighbors.
53:20
Yeah, you go to the farmers market.
53:21
I mean, hey, come on down to Asheville.
53:23
We got tons of that down here, I'm sure.
53:25
What would be the, what would be your crop?
53:28
What's your What are you growing?
53:29
Oh, it's always too many tomatoes, yeah.
53:32
We call it Summer of Tomato whenever they start to bloom
53:34
here and then 'cause my wife is. Into this as well.
53:37
I got her a hydroponic garden, so that has really accelerated
53:41
things. So I got her the fancy one
53:42
that's like the tall one that has like the different things.
53:46
And So what she does is she starts them there and then when
53:48
they're too big for that, she moves them out into the soil and
53:52
just is continually growing stuff.
53:54
So things are starting to to appear.
53:58
Well, you're you. You're lucky with your growing
54:00
season, where I still have a good six weeks until I can plant
54:03
anything, but I make I make use of my time.
54:06
Well, the problem is the bears then come out and eat it.
54:09
So you have to be concerned about that, Yeah.
54:12
Wow, I don't have that issue. I just have have have squirrels,
54:16
no bears. But what about you?
54:19
Yeah. Yeah, I want to find out what
54:20
Jim wants to do if he's not doing technology.
54:23
Well, first of all, I want to make a farmers market comment.
54:26
I'm more of a buyer than a seller.
54:29
I like farmers markets. But when I go to one and I see
54:32
them selling like bananas or you know, any kind of fruit that can
54:37
be only grown in like South America, I'm like, no, that's
54:41
not the point of the farmers market.
54:42
That's what we have the grocery store for.
54:45
So I did want to make that comment because that happens a
54:48
lot, at least here in, in Georgia, OK, my rage quit job or
54:56
I shouldn't even call it a rage quit job because I'm taking the
54:58
question a little bit differently.
55:00
So I throw that grenade, and I'm going to assume the grenade was
55:04
so successful. So you admit it that?
55:06
It actually turned into. This is Exhibit A fortune, and
55:10
this is Exhibit A in the defense.
55:12
You're admitting it right here. Yeah, well, I'm only going to do
55:18
it if it's going to be a winner. So grenade is thrown.
55:21
I make millions of dollars and now I can do what I want to do
55:27
and I think what I would do. So I took a class in college
55:32
called sculpting and it was basically how to create bronze
55:38
statues. OK, so most of most of the
55:42
projects were much smaller than statues, but I could literally
55:46
envision how you could build statues or make art, but
55:51
basically 3D art out of bronze. And I love that class.
55:56
I was not a Fine Arts major or anything, but I feel like I
56:01
would want to go back and take that to the next level.
56:04
And I would do it in college because they have all the
56:08
equipment there. So it costs the same as any
56:11
other course. But you have access to a
56:14
bronzing lab. And I mean, you're not just
56:17
going to buy that equipment for yourself.
56:20
And then the other thing I would do is I probably create a
56:22
YouTube channel, 'cause I think people would be really
56:25
interested in learning about this and seeing it happen and
56:29
all that. So that's what I would do.
56:32
I'd become a sculptor and I would, you know, create a
56:36
YouTube channel. But that's technology, YouTube,
56:38
which is fine because hey, whatever.
56:41
So we got a bronze worker, we've got a farmer, I guess for
56:46
keeping it simple. So you guys are looking at
56:49
skills that are like viable, needed by human beings and I
56:55
have none of that. I don't think I could ever get
56:58
out of technology. I I just, I've this has been who
57:01
I am forever man. If I had to do something that
57:04
was not technology, I honestly don't know what I would do
57:07
because I, Jim knows I'm constantly tinkering.
57:10
I mean, we, I spent the weekend video editing and trying
57:13
different tools and all kinds of different softwares and stuff
57:15
like that, trying to, trying to, you know, work on different
57:18
things. Like that's just who I am, is
57:20
like a technology person. I mean, it would be probably
57:22
something with the podcast, but podcast is technology.
57:25
I don't want to be outside, 'cause I don't like hot weather,
57:28
I don't like bugs, I like Wi-Fi, I like air conditioning.
57:32
So I need to find something that's like inside.
57:34
And I'm not artistic, so I'm not gonna be, you know, the next
57:38
great sculptor with Jim and his massive bronze structures as
57:41
testaments to identity at the center in the sky.
57:44
I'm not growing stuff, 'cause that's just not my thing.
57:47
I don't know what I would do. Do you guys have suggestions?
57:49
Like what? What should I do?
57:52
Stunned silence. Without technology, without
57:55
technology, I can't think of anything.
57:58
I I mean without. If it was outside of IAM, I
58:00
could probably come up with like 100 different things you could
58:04
do. I was actually thinking one
58:05
thing that you used to really be into was collecting bags so that
58:11
you could travel with one bag. So I kind of feel like that's
58:15
one of your areas of expertise, hey.
58:17
Now you're talking. But I think also you have to
58:20
sell the bag somehow. And who buys bags in person
58:23
anymore? You buy them on the Internet.
58:25
Yeah, but you got a YouTube channel.
58:26
Let's go with this because I that's a good idea.
58:28
I didn't think about that. I I have a affinity for bags,
58:33
travel bags, other variety things.
58:35
I'm constantly in a search for the one bag to rule them all.
58:38
So yeah, I don't know if it's a tailor or something like that,
58:40
but I I feel like I can design the world's greatest, you know,
58:46
travel bag for me and my purposes.
58:50
So maybe some sort of? To get everything down to one
58:52
bag that you're but you're pretty much there.
58:55
I mean that, but that was your goal for so long and then you
58:58
finally achieved it if. You're traveling and you're on
59:01
flights and you can get away with just sticking something
59:04
under the seat in front of you and you've got everything you
59:06
need. I gotta tell you, it's so
59:08
freeing. You don't have to worry about
59:09
overhead space. You can bore blast.
59:12
Your stuff doesn't get lost. I mean, I never check a bag, but
59:16
I do, you know, say 5050 will have an overhead carry on or
59:19
something like that just because of whatever.
59:20
But yeah, if you can get away with just that one bag fits
59:23
under the seat. Now we're talking, baby.
59:27
Yeah. All right.
59:28
Well, they can't lose that. No, I yeah, I the the quest
59:31
continues. I do have a lot of bags.
59:33
It's kind of hard to see. But I have.
59:35
This is just a small sampling I was looking at here we've got
59:38
12345, probably another closet full of another 30 and I'm
59:43
constantly rotating stuff out. The quest continues.
59:46
Cat is like shocked. She's like, who is this nerd and
59:49
what? Did I get?
59:50
No, I I can't wait to ask you for for for Rex.
59:54
I need some advice. I've got a very important
59:57
gentleman birthday coming up soon who also is obsessed with
1:00:01
bags, but he's really into one very specific brand and I want
1:00:06
to kind of like float that by you.
1:00:07
OK. Yes, we will talk about that, I
1:00:09
am. But no unpaid sponsorships I'm
1:00:11
gonna keep. No, I hey, I would love to be
1:00:13
sponsored by and these these bags are expensive.
1:00:15
I mean, they're anywhere. Like a good bag is anywhere
1:00:18
between 200 and $700.00. Now these are bags you buy at
1:00:22
once and you should be good. And unless you're like me and
1:00:26
you find like the smallest tiny detail that nobody in the right
1:00:28
line would care about. But I do and the and the quest
1:00:30
continues. But anyway, let's talk about
1:00:32
that offline. Let's go ahead and wrap it up
1:00:35
for this week. Kat, thank you so much for being
1:00:37
part of this. We talked.
1:00:39
We're gonna try and get dinner next time in in in the
1:00:41
Minneapolis area here in a couple weeks.
1:00:43
I'm looking forward to that. I will have links in our show
1:00:47
notes to your blog around GCP 101 series.
1:00:52
Also have a link to Trust on cloud trust on cloud.com.
1:00:55
So be able to check out what you do over there as well as links
1:00:58
to the forward Cloud SEC conference so that people can
1:01:01
either get on the waiting list or, you know, maybe just hanging
1:01:04
out on the street and you know, looking for two, looking for
1:01:06
two. And with that we'll go ahead and
1:01:09
leave it. So thanks everyone for
1:01:10
listening. You can find us on the web,
1:01:12
idacpodcast.com, on Twitter, X, whatever you want to call it at
1:01:17
IDAC Podcast and now Mastodon at IDAC Podcast, at Infosec, dot
1:01:22
exchange, Send Gemini a note. And YouTube and YouTube.
1:01:25
Yeah, we're still working on the YouTube channel, so more to come
1:01:28
on that. And yeah, connect with us on
1:01:31
LinkedIn, like subscribe, do all those fun, you know, social
1:01:35
things to help us grow the show. And thanks for listening.
1:01:39
We'll talk to everybody in the next one.
1:01:42
Listening to Identity at the Center.
1:01:44
We hope you've enjoyed the show. Make sure to like, rate and
1:01:49
review and we'll be back soon. But in the meantime, hit the
1:01:52
website at identity@thecenter.com and find
1:01:56
us on Twitter at ID AC podcast. See you next time on Identity at
1:02:04
the Center.