Latest / Identity at the Center / #401 - Sponsor Spotlight - PlainID

Transcript

#401 - Sponsor Spotlight - PlainID · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:10
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
I'm pretty good yourself. Good.
0:16
So many ways I thought that we could start this Episode 1 was
0:20
Happy New Year, but I think I'd be far in violation of saying
0:23
Happy New Year since this episode goes live in February.
0:27
But I thought I'd start with a pun because it's been so cold on
0:30
the East Coast of the US. But you know what?
0:32
It's hot right now. Authorization.
0:36
So hot right now. I think we need like the was it
0:38
the oh, what's the movie? It's I'm blanking on it now.
0:43
Zoolander, right? It's so hot right now.
0:45
Author is authorization. Well, I think we should dive
0:49
right into it because we've got a fantastic guest today.
0:52
Yeah, we've got a sponsor spotlight today.
0:54
So these are the folks that helped make this podcast
0:57
available for so many people around the world and definitely
0:59
appreciate that. So it's a fully sponsored
1:01
episode. We're going to get into it today
1:03
with Plain ID and really learn more about their solution.
1:07
I've known Gal, our guests here for at least a couple years now,
1:10
kind of way back 20/15/2016. I feel like maybe it was
1:14
somewhere around that time frame, but a kind of a routine
1:17
mainstay on the identity circuit.
1:18
So if people want to learn more about Plane ID, you can go to
1:21
the website planeid.com/I DAC. That's PLAIN id.com/I DAC.
1:29
So welcome to the show Gal Holimsky, the Co founder and CTO
1:33
of Plane ID. Thank you and it's very nice to
1:37
be here again. Yeah, the last time you're with
1:40
us was way back in episode 218. I thought it was last year, but
1:43
you corrected me in your toy, right?
1:45
It was a couple years ago. We recorded live from Ideniverse
1:48
in one of the many conference rooms.
1:50
And I think I don't know if that was like Mandalay or if it was
1:54
one of the other, you know, one of the hotels that we were kind
1:56
of out there. But we had a great conversation
1:59
around back BAC something based access control, I think I called
2:03
it like star back. So thank you for being part of
2:06
this as well and coming back. So I got to ask your first
2:09
questions like, all right, so why are you back?
2:10
Why are we doing this episode? OK, excellent question to start
2:14
with. So first of all, because I want
2:17
to say that today authorization is a security decision.
2:21
If in the past we struggled with which method to implement and
2:25
even to even if to implement at all, that's no longer the case.
2:29
Today, authorization is a security decision.
2:33
Either you're secured or not and we'll see why is that.
2:37
I mean, that's a pretty simple, simple statement, but it carries
2:40
so many repercussions, right? It's like, OK, authorization is
2:44
really the crux of what identity and access management is built
2:46
around. You got to get it right.
2:49
So tell me a little more about plane ID.
2:51
For people who aren't familiar out there and the, you know,
2:53
billions of listeners and watchers that we have, what is
2:57
plane ID? OK, sure.
3:00
So Plain ID is the authorization company.
3:02
We are focused primarily on authorization, controlling
3:06
authorization, managing authorization, providing
3:09
authorizations. We have been focused in the
3:12
space for quite some time and we work with large enterprises that
3:17
trust our technology to manage and control their authorization
3:21
solution. That is, that's Plain ID.
3:24
And yeah, we'll learn more as we speak.
3:28
We're definitely going to learn more about it, especially sort
3:30
of like how does look in in sort of the real world and how it
3:32
works like architecturally right within an environment.
3:35
I got to ask though, how'd you come up with the name Plane ID?
3:39
OK, so you know how in identity and access management there are
3:44
so many aspects and it starts with maybe something simpler and
3:47
get so complicated. Authorization traditionally is
3:51
considered the most complicated area.
3:54
We wanted to simplify that and therefore plain IDAYID.
3:58
That's a different question, but still we wanted to resonate
4:01
something which is simpler, solving a complex problem in a
4:06
simpler way. Hello, it's a noble 'cause it's
4:09
a hard one to address because I think authorizations get super
4:12
complex sometimes, especially some applications.
4:15
What is it that you think makes plain ID separate itself from
4:19
others that are in the market? Because I know there's a lot of
4:21
different kind of vendors right in the authorization space.
4:24
You guys have been around for a long time at this point.
4:27
What is it that makes your solution unique?
4:28
As I put my jaded see so hat on like all right, create another
4:31
tool in the stack that I have to think about.
4:34
Yeah. So I believe it's the
4:35
completeness of the solution and I'll explain again.
4:38
Authorization, like I said, is the security decision, which
4:42
means it's not a developer's decision, it's eventually a CSO
4:46
decision. The authorization is meant to
4:49
represent what can be done within our technology space,
4:52
which basically translate into what data can be accessed, what
4:57
tools, what APIs, what services can be used, who's making those
5:01
decisions. Someone needs to make them,
5:04
someone needs to govern them, and that's typically
5:06
responsibility of the security. Plain ID places a lot of focus
5:11
on managing and providing visibility into those
5:14
authorization policies as well as enforcing them, providing the
5:19
tools, the means to enforce them across the technology.
5:23
I would say this is one of our major differentiators, our
5:27
ability to see, to capture that whole scope of authorizations,
5:32
not just one side of that challenge space.
5:38
So authorization stretches beyond just people, all right?
5:42
It gets into other things. So I'm curious, this is plain ID
5:44
addressing both, like customer identity, access management, use
5:48
cases, is it workforce? Is it both?
5:51
And then how does it get into non humans or maybe agentic and
5:55
things like that? Yeah, absolutely.
5:57
So first of all, the answer is all of them.
6:01
Why? Because they're all identities
6:03
that need access. That's the bottom line.
6:06
And eventually when you want to walk within your application
6:10
space, data APIs, it doesn't really matter to the data if
6:15
it's an end user, a human who's trying to access, or an
6:18
application user or even an agent user.
6:22
It's a user, an identity that tries to access the data or
6:26
tries to consume the API or whatever.
6:28
So an identity is an identity, by the way.
6:31
It's the responsibility of, you know, all those Ibps to make
6:35
sure the identity is there and it's authenticated and all of
6:38
that. But then what happens
6:40
afterwards? Afterwards those identities need
6:43
the right access for whatever they're doing.
6:46
And in some cases, maybe the combination of identities like
6:50
in the identity earlier there's the agent identity and the end
6:55
user identity. So you know very shortly all
6:58
identities count, all identities need to be authorized.
7:03
Hey, gal. I was so intrigued by what you
7:05
said about authorization having an important role in the
7:10
security stack. I was wondering if maybe you
7:12
could talk a bit little bit more about that and what what it is
7:15
that you're talking about? Yes, absolutely and thank you
7:19
for that question. So you know the market has been
7:23
investing a lot around managing identities whether human, non
7:28
human authenticating identities. So we have all those controls in
7:32
place. So our users are accessing the
7:35
applications or you know all of our technology stack after they
7:39
have gone through multiple multi factor authentications.
7:43
But then what? What?
7:45
How can we control what they can do, what they can see?
7:48
That's where authorization comes in.
7:50
It's like the last line of defence before accessing data
7:55
and accessing all those tools and services.
7:57
And why is it such an important topic now?
8:02
Because the change in the market towards identic flows.
8:07
That's when explosion of explosion of data usage, tool
8:13
usage, API usage happens and no longer traditional controls are
8:18
sufficient. We cannot rely just on having an
8:22
identity or having the identity authenticated.
8:26
Controls must be implemented in the right way.
8:30
So the need for those controls are tripled even then they were
8:36
before. That's why I'm saying it's a
8:37
security decision. Every organization is evolving,
8:41
evolving towards newer technologies, more specifically
8:45
the identic space and authorization is a crucial
8:50
component to secure that. So, Gal, you brought up an
8:54
interesting topic there, Just authentication, right?
8:57
And I realized that maybe we jumped right in because I think
9:00
this is a topic that, you know, authentication, authorization,
9:05
people get confounded sometimes or lump them together.
9:08
And I think you see it even with some of the protocols where like
9:12
the authorization data will get lumped in with the passing of
9:17
the token. You got open ID, you've got
9:19
Oauth. They're different, but unless
9:22
you kind of are an expert in those areas, you might get them
9:26
lumped together. Why is it that you think people
9:29
are? Maybe you could just kind of
9:30
start with the separation of the two, and then why do people get
9:34
them lumped together? Yes, absolutely.
9:37
So first of all, they should be lumped together because it's a
9:40
continuous process, basically authentication, right, Defines
9:44
who you are. But then authorization comes and
9:47
says what can you do? Now if we rely just on
9:52
authentication, it means who I am also carries what I do.
9:58
So I'm walking around with a bag of privileges, which basically
10:03
beats the purpose, right? We are now talking about 0
10:09
standing privileges, which means who I am is just who I am.
10:12
It doesn't mean what I can do. As I walk through in the
10:16
application, as I try to access data, as I try to consume
10:20
services, that's when I need to determine if that is is approved
10:26
for me in the context which I'm working in, right?
10:29
So there must be a very distinct separation between
10:33
authentication, who you are, and then the continuous process of
10:38
authorization. What can you do?
10:41
But what can you do in a specific context which you're
10:44
currently operating? It cannot be predefined, cannot
10:48
be predetermined. How, if it makes sense?
10:52
Yeah, perfect, perfect. Thank you.
10:54
And you know, Jeff and I often say, and not just because you're
10:59
here, right, is that authorization is having a stay
11:02
in the sun. You know, you see the Austin
11:05
Working Group, part of the Open ID Foundation, You see just so
11:10
many more authorization vendors and focus at the identity
11:15
conferences. I see you guys are still the
11:18
lead in terms of kind of like pushing this boundary.
11:22
But I guess my question is, why is it that it's so hot right
11:27
now? And I say that because you guys
11:30
have been around for decades, right?
11:32
I mean, we didn't really get into what year you founded the
11:35
company, but I feel like you guys have been around for most
11:39
of my 20 years in the space. And why is it that right now
11:44
it's getting this special attention?
11:46
Yeah. Well, first of all, maybe not
11:49
decades, but we do like to speak a lot, so we make a lot of
11:52
noise. But thank you.
11:54
I think the reason for the importance of now, why now is
11:58
the moment. It's because the shift in
12:01
technology authorization has always been the challenging part
12:06
of identity and access management.
12:08
And when it comes to traditional technology, it's complex, but
12:13
when we are starting to look at a newer technology, APIs, micro
12:18
services and now the identic space that when it becomes
12:22
easier to implement more advanced controls.
12:26
So that's the reason it's a hot topic now.
12:29
Additionally, has the technology progress as we see again, I'm
12:34
back to AI agents all the time because that's the hot topic
12:37
now, yes. So as we see AI agent operates,
12:41
what does it mean from technology perspective?
12:43
It means a whole lot of little steps that are combined together
12:49
to make something happen. And that means each and every
12:53
one of those small steps in the process need to be authorized,
12:58
not just authenticated, but needs to be authorized.
13:01
And static standing permissions cannot address that.
13:06
That's why the need for a true authorization system dynamic
13:10
context aware is is very very much relevant for this time,
13:16
which we are. So I think people are probably
13:19
pretty familiar with authorization, at least the
13:21
concept, especially when you start talking about humans.
13:23
I want to get specifically into like agentic AI because that is
13:29
the other thing that's so hot right now, right?
13:31
It's is there are this explosion of agents that are running
13:35
around sometimes amok inside of an organization with poorly
13:40
scoped permissions or whatever it may be.
13:43
Can you talk about authorization specifically in the context of a
13:47
Gentek AI and sort of how does plane ID help me address that
13:52
government, solve for it, things like that?
13:55
Yes, absolutely. So there are several aspects to
13:58
consider. First of all, who are we
14:00
authorizing when it comes to the agentic process?
14:03
We need to remember there are several identity types.
14:07
I would say first of all, there is the agent, of course the
14:10
agent, the agent identity, but there was also the end user
14:14
identity always at least, well sometimes just one, but there
14:19
can be two identities to consider.
14:23
So when we are authorizing an action or access to something,
14:27
we need to be able to evaluate both identities.
14:30
Plain idea of course can do that.
14:32
Second, when do we need to apply controls?
14:36
Looking at the full identic flow, we have multiple control
14:40
points to consider. It starts with a prompt.
14:43
So every process starts with a prompt.
14:46
The first control point is at that point.
14:49
Exactly. Can whoever is asking the
14:52
question or whoever is initiating the prompt actually
14:55
do that? According to the security
14:58
controls, in many cases people are talking about guardless.
15:02
Guardless tend to be very operational in nature, but think
15:07
about security guard. Those would be your
15:09
authorization decisions. So again, one the prompt second
15:13
data, an identic flow retrieves data whether it's via RAG or
15:19
whatever other means, right data feeds into that flow.
15:23
What data can be fed in the context of the end user identity
15:28
and the agent identity? Then based on the question, the
15:32
prompt, and the data, at least a process is generated.
15:36
The LLM is suggesting all of that, and then the LLM might
15:40
reach out to tools. You've probably heard of MCP,
15:43
the standard for utilizing tools in the identic space.
15:48
So again, the question is, can the agent at this point of time
15:53
use those set of tools or which tools they can use?
15:56
So we want to put some controls on tools as well.
16:00
And the last part of that is the response and response is being
16:04
generated. Maybe some of that response can
16:07
expose data it shouldn't. So we want to consider masking
16:12
the response plane ID today has the capability to control what
16:16
questions can be asked, filter out the data which is fed into
16:21
the process, control the usage of MCP tools and mask the
16:27
response that is sent back to the user.
16:30
So end to end control throughout the identic flow, and that's
16:34
part of what an advanced authorization solution needs to
16:38
do, cannot be done by just static permissions, needs to be
16:42
governed by policies. So you mentioned the, the, the
16:46
word guardrails and I've heard this a lot.
16:48
And I wonder because is it guardrails or is it more of a
16:53
railroad track? Because guardrails is kind of
16:56
like, all right, it could be a 2 lane highway, it could be a one
16:58
lane highway, it could be A8 lane highway with a lot of, you
17:01
know, swerve in between all that.
17:03
And I wonder do you have, you know, a, a, a different
17:06
definition or distinction between something maybe that is
17:09
from an authorization standpoint is OK, Is it guardrails or is it
17:13
like a railroad track or maybe a roller coaster track, depending
17:16
on you want to perceive that? Yeah.
17:19
I think, I think it's a term is that the market has started
17:23
using it's, it tends to be a more of a technical thing.
17:27
It is very common to implement guardrails for prompt control,
17:33
for output control. So we are, you know, we are
17:38
aligning ourselves with the way the market is currently
17:41
speaking. Basically it's a way to place
17:43
controls. So controls are placed in the
17:46
form of guardrails and they can be placed on the process that
17:52
throughout the process input output data and tools.
17:57
But I agree with the you know, the the the picture you draw
18:02
absolutely. Well, I think, you know, when
18:05
you have guardrails, especially when we're talking about agentic
18:08
and generative AI, you, you almost need some leeway, right?
18:12
Otherwise you kind of lose the benefits of having something
18:15
that's generating that. So I just kind of brought it up
18:17
because I was like, OK, well, I can see some people think out
18:20
there like, OK, well, shouldn't authorization be like a single
18:22
track or you can only do this one thing?
18:25
But I, I guess my, my next question is, is there a right
18:29
way to provide agentic authorization?
18:33
Because you talked about, you know, the question is, can the
18:35
person who is invoking the agent do the thing that you're asking
18:38
it to do? So if I write an agent, does the
18:42
agent mirror my permissions? Should it have its own set of
18:45
permissions? What happens if the agent
18:47
creates its own agent? And now you've got like this
18:51
domino effect of agents creating agents, creating agents.
18:55
How do you track permissions throughout that?
18:57
And is there a right way in your mind of kind of how to control
19:00
that? Yeah.
19:01
So yeah, I think you asked me just, I don't know, four or five
19:04
questions, but I'll try to answer.
19:06
I'm great at that. Yeah, absolutely.
19:10
OK. So first of all, you need to
19:13
consider all identities involved in the context of the operation.
19:18
So if there is an end user identity and an agent identity
19:22
that is currently doing whatever operation in the decisioning
19:26
process, both should be considered.
19:28
You can't consider just one of them.
19:31
Yes, an agent identity has authorization tied to it.
19:35
Yes, an end user identity has different set of authorization
19:39
tied to it. You need to consider that they
19:42
both have more than just what is needed for that specific
19:47
operation. And you know what that leads me
19:50
to? What is the right method to
19:52
control it all all and to manage it all?
19:55
You know how the IEM market likes to create new acronyms
20:00
every year, So we have a new one.
20:02
It's called Intent Based access control.
20:04
No, truly, this is a good. This is an important one to
20:07
remember eventually to do the right authorization in process.
20:14
You need to understand intent, and that means there is a
20:18
specific agent designed for a specific purpose.
20:21
Now, there might be a human who's using that agent or
20:25
another agent who's initiating that agent.
20:28
That's part of the intent. The second part is what are they
20:32
trying to do? And then the last part is why
20:36
are they doing that now? So in order to truly enforce is
20:42
0 standing privileges, truly enforce security controls in the
20:47
identic flow, you need to consider all of those facts, the
20:51
aspects you need and to understand the intent of the
20:55
operation and enforce accordingly.
20:58
So gal, you, I want to come back to intent based access control
21:02
because I think it's a fascinating topic, but I want to
21:05
key on something you said to, you know, to Jeff's question.
21:10
So first kind of the basis of my thought is a year ago we were
21:16
talking about I am for AI and essentially what it boiled down
21:21
to was like authentication to your AI.
21:24
And I was like, that's not very exciting.
21:27
But what you just said there was like, I was like, that's the
21:30
hard part. I mean, that is the really hard
21:33
part where you start talking about controlling what questions
21:38
people can ask. And maybe this kind of blurs
21:40
into the intent. But I figured the way I'd ask
21:44
the question is this is because you've talked about addressing
21:48
it with policy. And I'm wondering, you know, as
21:52
you talk about the solution with customers or potential
21:56
customers, are they presenting the same use cases?
22:01
Are you seeing the same use cases or are people each client
22:05
giving you kind of a a different set of use cases that hey, they
22:11
need to solve and policy solves that?
22:14
Yeah, So really excellent question.
22:17
First of all, I want to say this is across the board, every
22:21
customer I'm speaking with same challenges, they all want to
22:25
adopt agents. They want to enable the
22:28
organization to adopt agents. But then they need to do that in
22:32
a secured way and they need a way to govern all those agents.
22:37
I would even say many considered agent as a new type of
22:42
employees. Remember how I don't know how
22:44
many years ago we had to take care of our human employees?
22:49
And I am struggled around that and we build a lot of
22:52
technologies to solve that. And the, the thing about human
22:57
employees, they do follow some, you know, rebuild controls,
23:01
right? If we see a locked room, we are
23:04
part of an organization. We wouldn't just walk in there.
23:08
That's not the case with agents. That's that's really important
23:11
to understand. Agents are your new type of
23:14
employees, but they're very excited.
23:17
They are like junior excited and employees that are meant to
23:23
please. They are designed to provide you
23:26
with a solution. They will do whatever they can,
23:29
whatever is available to them, they would utilize in order to
23:34
provide a solution. And that means if they have,
23:38
they have more privileges they they should use, they can access
23:42
more data than they should use. They will do that.
23:45
And that would lead to either misuse of capabilities or data
23:50
explosion exposure. Eventually that's that would be
23:54
the reality. So that's why you need to treat
23:58
those AI agent as a new type of employees and apply controls on
24:03
top of them. But also understand that your
24:06
traditional solutions are not sufficient.
24:09
You need to apply the right controls here.
24:12
And back to your question, yes, this is something I'm hearing
24:15
across the board and speaking with a lot of organization, both
24:19
from current customers and potential new customers.
24:23
And they all have the same challenge.
24:25
How do I control all those AI agents?
24:28
How do I control what they do? How do I control what they
24:31
expose? Because data exposure is
24:34
certainly one of the biggest risk in this space.
24:38
Can you, I, I don't want to put you on the spot here, but could
24:41
you give me kind of a, a real world use case where you know,
24:46
people are finding like, oh, you know, applying these policies or
24:50
something I can really do to enhance the security of my AI
24:55
agents? Yeah, absolutely.
24:58
So, you know, let's start with very simple policy.
25:01
First of all, let's prevent exposure of PII data.
25:06
Just start with that. Any, I don't know, Social
25:09
Security number or numbers you don't want to be exposed or
25:13
whatever. Just start with applying that as
25:16
a general rule, mask all PII data from your AI agents.
25:21
Simple. OK, but other controls that I
25:25
see I see being implemented controls such as cross-border
25:30
controls. You want your AI agents to to
25:35
serve your all of your employees in your companies or your
25:38
partners or your customers, right?
25:41
But you want to restrict access to data from different
25:46
locations. Again, cross-border control.
25:48
This is one of the top compliance requirements in many
25:52
organizations. There's so much relevant here as
25:55
well because the same data exposure that you could have
25:59
gotten with previous technologies without a gentic
26:03
are still very much relevant to you.
26:05
If you have like, I don't know, MNPI data, again, exposure of
26:09
data. Don't expose data.
26:11
Take your most critical compliance policies.
26:15
Apply them at the beginning of your identic journey.
26:19
So you mentioned the intent based access control.
26:24
I'm not. I mean it kind of sounded a
26:25
little bit like it could be what you're talking about now or that
26:29
it could be something different. Which is it?
26:32
Yeah. So I think intent eventually is
26:35
a way to achieve that that target.
26:40
It's a way to achieve 0 standing privileges.
26:44
So we I spoke before about 0 standing privileges.
26:47
It basically means you enter the operation with nothing and then
26:52
at each step it is determined what you can do right?
26:56
That's zero standing privileges. How do you apply to 0 standing
27:01
privileges? With intent based access
27:04
control? Which is basically a nice name
27:07
of saying consider everything when you give an access
27:12
permission or reject that access permission.
27:16
Which means they consider the identity, both end user
27:19
identity, agent identity, consider what?
27:22
What they're trying to do, what they're trying to access.
27:25
Why are they doing that Now in this context, that's intent
27:29
based access control. So achieving 0 standing
27:33
privileges with intent based access control.
27:37
Yeah, and it feels like everybody is trying to achieve 0
27:41
standing privileges, right? Because when you have standing
27:44
privileges, if accounts get compromised, it could be very
27:50
destructive in your environment. My concern was your standing
27:54
privileges has always been how scalable is it?
27:57
Do you just kind of go after 0 standing privileges for your key
28:02
applications, maybe for your most critical apps or your most
28:09
critical accounts within those apps?
28:12
What? What do you have to say about
28:14
that? Yeah, I think that's a very true
28:18
question as the, you know, every organization considers because I
28:22
mean, you wouldn't want to change everything.
28:25
So yes, prioritize what you want to start with and then implement
28:30
a call, you know, implement accordingly.
28:33
That's why new technologies are a good place to start.
28:38
I mean, if you, we know we have done in the past bad
28:41
implementations, we didn't implement the sufficient
28:44
controls well, they needed to be right.
28:47
But now we have a chance with new technologies to do that,
28:51
right. So consider implementing as part
28:55
of the development process, as part of the adoption of new
28:59
technologies, meaning identity AI.
29:02
Deploy that with the right controls in place.
29:05
Don't do the mistakes, don't repeat the mistakes we have been
29:09
doing over and over and over again, which means let's deploy
29:12
our identic AI and then let's go back to security and figure out
29:17
how to fix it. Now let's not do that.
29:20
We know what we need to do. We have the market has a lot of
29:24
experience. We know we need authentication.
29:26
We know we need authorization. Going back to it is a security
29:30
decision. Let's make those decisions now
29:34
and start from scratch the right way.
29:37
Yeah, I think you made a great point there.
29:39
So if I was to put it into my own words, it would essentially
29:42
be you might the scalability part really or it's the effort
29:48
to go and do it for everything you've done the wrong way.
29:52
And not because we're we're dumb or anything, but sometimes the
29:55
technology wasn't there. Look, it's evolving quickly and
29:58
we all are under. But if we get that
30:01
infrastructure, if we get it right now and build it in bacon
30:05
as part of the deployment process and our our standard
30:08
security footprint, at least we'll get it right going
30:12
forward. So I think that's a great way to
30:15
look at it. You know, the other conversation
30:19
that often kind of accompanies 0 standing privileges was around
30:23
continuous identity, continuous authentication.
30:27
I wanted to get your thoughts on that.
30:29
Yeah. So I think the way I see that
30:34
and the way the market typically speaks about that continuous
30:38
authentication, continuous identity represents the process,
30:42
the identity. Any identity goes through a in
30:45
its digital journey, which means it always starts with a defined
30:49
identity, authentication and then authorization, right?
30:56
That's continuous because it doesn't end with authentication.
31:00
It's not sufficient to know who you are.
31:04
You also need to know what can you do?
31:06
Can you see this piece of data? Can you access that tool of API
31:11
right? Those are questions being asked
31:14
throughout the process and that's what makes the process
31:18
continuous. It starts with authentication,
31:22
it proceeds with authorization and and you know, that's
31:26
eventually what makes the full process secured.
31:30
I'd like to take this from theory to reality.
31:34
What does it look like when I set up plane ID in my
31:38
environment? Like what does this look like
31:40
architecturally? Is this an app that I run?
31:43
Is it SAS? Is it something on Prem?
31:46
How does this connect to my other stuff?
31:48
Like let's start with OK you've got me hooked gal, let's try
31:52
this out. Like what's next?
31:54
Well, first of all, I'm happy to speak with you.
31:57
Next step, we are a full SAS solution.
32:00
We do have hybrid components. Many of our customers prefer the
32:06
decisioning engine and you know access to data to be localized.
32:10
So those would typically be implemented as hybrid component
32:15
micro services, the design to scale design to for performance
32:21
and security. So setting up the tenant,
32:25
getting all those hybrid components in place and then you
32:27
go for a process of discovery. Once you have discovery done,
32:33
you can see all your ready to use policy elements.
32:37
What would those be? Well, maybe your database
32:40
tables. If it's vector databases, then
32:44
it's all the categories that define the documents.
32:48
If it's MCP or the MCP tools already categorized by the way,
32:53
so it would be easy to authorize them all your identities, of
32:57
course. And then it's just a matter of
32:59
connecting between the two, which are the policies.
33:02
Eventually policies connection between identities to what
33:06
identities can access and adding some conditions on top.
33:11
So you talked about this being a hybrid approach.
33:13
The let's start with the on Prem stuff.
33:16
You mentioned some things that that I have to install in my
33:18
environment to connect. Pretty common, I think for most
33:22
identity tools to have like some sort of proxy tool or
33:25
connectivity sort of server that they can use.
33:28
How does that work? Is it a virtual appliance?
33:30
I set it up and then it's scanning my internal environment
33:35
or permissions. Do I connect it to things like
33:38
SAP? Like how does that work?
33:39
Can't even learn more behind the scenes.
33:41
Yeah. So it's a containerized by the
33:44
way, it's an optional component, right?
33:45
You can do full sauce and it works perfectly, but you can
33:49
also choose that localized component.
33:52
It's a container basically micro service deployed however you
33:55
want, wherever you want, how many you want, by the way.
33:59
And it has the function of a discovery.
34:02
So it kind of scans whatever you want it to scan to fetch the
34:07
elements. We call them assets.
34:09
So those would be all protected assets, feeds them into the
34:13
policy platform and then it supports enforcement and
34:18
enforces data that would typically, and again, this is a
34:22
bit of a technical jargon, so excuse me, but it includes APDP
34:27
policy decision point, VIP policy information point that
34:33
that's the component that connects to the data sources.
34:37
And in the enforcement components, we call them again
34:44
in the regular jargon, PEP policy enforcement point, but we
34:47
like to call them authorizers. And those are components per
34:52
technology. So for API gateways, the cycle
34:55
for your service mesh, whatever library for your development
35:01
platform and so on, we have many of those available.
35:05
So how does this work from like a real time scanning or you
35:09
know, set up right permissions change all the time.
35:11
Are you detecting changes at the of permissions within
35:15
applications and then pulling those into plane ID and then the
35:19
PDP or PEP? And now you're speaking
35:20
language, right? Policy based access controls,
35:22
right? Those different terms.
35:23
We've got a technical audience, right?
35:24
They're probably flying along, but how do you stay on top of
35:28
things that might be changing an environment?
35:30
Is this scanning at real time or is it like once a day, once a
35:33
week? Or is it like on demand?
35:35
It's, it's on request actually. So we have the PIP component I
35:41
mentioned before. It has the ability to connect to
35:44
data sources. So let's say it connects to your
35:46
IGA platform or maybe to your HR repository or maybe to
35:52
certification system or to all, all of the above, right.
35:55
It pulls data in the real time at the time of access.
35:59
So let's say you're trying to access an application or
36:03
database or whatever, right? So we can see that now you are
36:08
defined as an employee in this department and you know in this
36:12
region and make the decision accordingly.
36:16
So it's true real time decisioning process according to
36:20
a set of attributes which are out there.
36:24
We are not replicating any data, not only for caching purposes,
36:27
but that's on the technical discussion.
36:29
So we are just pulling data when the data is needed to make the
36:34
decision. So if I think about this from
36:37
like a, a UML diagram, right, with things bouncing back and
36:40
forth, I'm doing the authentication against my IDP
36:44
and then I pull it back and it's like, OK, now where does the
36:48
policy based authorization component come in?
36:51
Is it as soon as I try to authenticate or is it when I try
36:54
to reach reach a specific application?
36:57
How does that chain of events occur?
36:59
OK, so there are multiple patterns to to follow the first
37:04
pattern. I'll try to quickly review some
37:06
of them. So the first pattern is yes
37:08
during authentication process. So when the IDP creates the
37:12
authentication token, it is possible to reach out to the
37:17
policy decision point to get a list of authorization values
37:25
like claim keys, claim values and so on.
37:28
This would be enriching the token.
37:30
That is typically called a token enrichment pattern and it is
37:34
part of login time authorization.
37:37
So one pattern. Second pattern would be at your
37:40
let's say API Gateway. So whenever there is a
37:43
transaction through the API Gateway, the transaction is been
37:48
is been evaluated against the policy with the addition of
37:53
attributes as much as needed and then the transaction is either
37:57
allowed to proceed or blocked. Another pattern would be an
38:02
application trying to access a database.
38:05
So the application sends a query, let's say it sends select
38:10
all form table, no boundaries at all, no controls.
38:14
We capture that and we add those controls according to the
38:19
policy. So select all from table, but
38:22
where location equals user location or whatever you see
38:26
that's an example. Dynamic authorization can be
38:30
positioned in all of those different locations.
38:32
And there are other patterns as well.
38:34
Didn't mention mention all of them, but we start with very
38:38
coarse grained plug in time to be governed by policy to provide
38:42
decisions dynamically and we go all the way to very fine grained
38:47
at the data level. So low level filtering and
38:51
column masking. I was reading your body language
38:55
there, gal, when when Jeff was asking that question and you're
38:58
like, oh, you want to go deep? And that was a great question.
39:02
I'm sitting here enjoying the whole thing.
39:05
My question is a little less technical, which is kind of from
39:09
what you see with a typical customer approach.
39:13
Is it they want to start off with one application or kind of
39:18
how do they look at like I want to kind of test this and proof
39:23
of concept or you know, I want to get my feet wet before I dive
39:29
completely And so how do people start?
39:33
Yes. So yes, typically with one
39:35
application, maybe 2, but you want to start, you know, small
39:39
because you want to see value as quick as possible.
39:43
Let's say you want to start with an API use case.
39:46
So just get your Swagger file, open API spec, whatever, send it
39:52
over, it automatically maps to the policy elements and start
39:55
enforcing policies. This is, by the way, with no
39:58
change of code. It's so simple to implement.
40:01
And there you go, you have your final.
40:03
Controls at the business logic level, not just at the API
40:07
level. Let's say you want to do the
40:10
same with the data control. So it's a matter of discovering
40:13
data structure, leading that into the policy, what we call
40:18
policy building blocks and start building your policies.
40:22
Obviously some implementation processes are more complex than
40:25
other. No magic in technology.
40:27
I wish they were, but no, that's not the case.
40:30
But we are trying to make it as simple as possible.
40:32
So back to our company name, plain ID.
40:36
We are trying to make authorization as simple as
40:40
possible so they will truly be implemented where they needed to
40:45
be. So can can plain ID replace or
40:49
centralized authorizations similar to how a lot of a lot of
40:53
organizations might use like Active Directory groups, right
40:56
as how they authenticate or I'm sorry, authorize into
40:59
applications. Can plain ID act as that role?
41:03
Or is it more on the policy side and relies on authorizations
41:07
existing within an app? Can I shortcut essentially and
41:10
say, OK people stop building your own authorization and let
41:15
me centralized that and manage that for you as part of my IM
41:18
program? Does that make sense?
41:20
It actually makes sense. And yes, I do want to repeat
41:23
that people, stop building your own authorizations.
41:26
There are authorization solutions such as plane ID,
41:29
Start using them. You don't need to build it by
41:31
yourselves. However, it's not an Active
41:34
Directory on it. And try the replacement, because
41:37
what you, the example which you gave is providing users with
41:42
roles or with group that is always still needed.
41:45
Policies, authorization. In general, they do not replace
41:49
roles. They do reduce the need the
41:52
amount of them, but they do not replace them.
41:55
Think of the role as an addition attribute on the identity, more
41:59
information. Typically the information which
42:02
identity holds is limited to, I don't know, job title,
42:06
department, location and that's it.
42:08
It's not sufficient when it comes to making decisions on
42:12
which data you can access or whatever, right?
42:15
So that's where roles would come in or other ways of enriching
42:21
user data. So those would be all fits to
42:24
the policy. So how do your customers
42:26
typically measure that they're getting what they paid for out
42:29
of this right? How do they measure success with
42:31
the solution? I would assume faster, more
42:35
streamlined, more secure authenticate authorizations.
42:38
But are there other RO is that people look for when they say,
42:41
OK, we've got plenty of D? Here's how we justified the
42:44
spend. Yes, absolutely.
42:47
So there are multiple metrics we can share.
42:50
But you know I want to show one example.
42:52
We have a customer which is a global bank and they implemented
42:57
the whole like online back banking controls with plain ID.
43:04
They used us at the API Gateway level, several API gateways and
43:10
initially, you know, like every new technology, there is some
43:14
resistance, don't know if that's the right solution and so on.
43:18
Today they're at the point where the developer team, the
43:22
application team, they are excited to, you know, send the
43:27
APIs to the security team. Here you go.
43:29
We want to deploy this API just logging to your policy and
43:33
that's it. So it really reduced time to
43:36
market for them. Every new API doesn't need to
43:40
consider who the identity is. Does this identity can see this
43:46
data? Whatever.
43:47
No, they will focus on business logic they had to develop and
43:52
all the enforcement was done by plane ID together with their API
43:56
gateway in a very simplified way and it really helps them in
44:02
provide faster value to their business.
44:06
Well, actually kind of let off the episode, right?
44:08
Authorization is so hot right now.
44:10
So I feel like we need the Zoolander memes, you know, in
44:13
full force here. This has been a great
44:15
conversation and I would definitely encourage people go
44:17
check out planeid.com/IDC, right?
44:20
And check out what is going on there.
44:22
I think you wrote a blog on the intent based access control.
44:27
And so I think that'll be on that page of people check out.
44:30
You know, there's, there's so much to unpack here, but
44:32
hopefully this gives people kind of a sense of what they should
44:35
be thinking about. So I want to end the episode on
44:39
a little bit of a lighter note. We actually started to nerd out
44:43
very, very slightly before we hit record when you mentioned
44:46
that you're into science fiction and reading and things like
44:50
that. And I am as well more on the
44:52
listening side, the reading side.
44:54
And so I want to ask you for either a recommendation for me
44:58
or other people. I know there's a lot of sci-fi
45:00
readers out there. What's the best sci-fi book that
45:04
you've read within the last year or so that people should be
45:07
checking out if they haven't already?
45:10
OK, we'll continue that discussions for sure.
45:13
So I want to recommend an old book, Isaac Asimov.
45:18
So years ago I really enjoyed reading those books.
45:22
I read them in cycle and everything that's happening now
45:27
with the identic stuff made me go back to this to those books.
45:33
The the one I just completed is Cave Caves of Steel, the first
45:38
in the Robert series, I believe. I really recommend reading it
45:43
again and the full series by the way, because it's really nice.
45:47
You know, he saw something that's happening now.
45:51
He saw that years ago. A lot of the stuff that he was
45:55
writing about, I mean, people that are not familiar with us in
45:59
all would probably say this is not sci-fi, what are you talking
46:03
about? But it is, it's truly is.
46:05
It was written like, I don't know, 40 years ago, something
46:08
like that, maybe more. So it's really interesting to
46:12
see the way he thought and how he thought technology would
46:17
evolve, and especially what truly happened.
46:21
And maybe, well, things did not happen as he predicted.
46:26
And by the way, you know what's so intriguing about Tasimov?
46:30
When he wrote the robot series, he actually placed the the free
46:35
robot robot robot rules, right? So he actually defined robots
46:41
with guardrails. By definition, that cannot be
46:46
overcome. Obviously, as it evolved,
46:49
another rule was added. But still, it's really nice to
46:52
to go back to those books. So you mentioned Asimov and I
46:56
and I feel like anything can be science fiction if you put your
46:58
mind to it. But the Foundation series is one
47:02
that I've always enjoyed and and now Apple TV has a series on it
47:05
which I think is great. Not sure if you've checked that
47:07
out yet, but Foundation is is definitely a good one too.
47:10
Have you ever read the Bob Averse series of books?
47:16
Not sure. OK.
47:17
So this is one of my favorite series I think of of all time in
47:21
science fiction. And it kind of follows the story
47:23
of essentially an agentic AI and space exploration and humanity
47:31
and all kinds of stuff. So if you like that sort of
47:34
thing, I'm going to recommend the Bob verse.
47:35
Shout out to my friend Aspen. I know he he's read it as well
47:38
and I think there's like 6-6 books in the series and it's
47:42
really kind of a really cool, I don't know, interesting
47:46
approach. I just really like, I know I've
47:47
talked about before on this show and other episodes, but Bob
47:49
Averse, BOBIVERSE, Bob Averse are the ones that that I would
47:56
check out. Jim, how into sci-fi are you?
47:59
Because I don't I, I feel like you're not so much into the
48:01
sci-fi side of things. Not really I, I feel like I'm, I
48:05
feel like I live in sci-fi or that, you know, in the next few
48:09
years with everything that's happening with AI, how quickly
48:12
it's going, moving toward AGI, everything that's happening with
48:18
robots and self driving cars. Think about it.
48:21
I mean, we're of the generation where we grew up and we actually
48:24
would watch black and white TV sometimes or we had color TV,
48:28
but most people didn't have like color TV's in every room with a
48:32
flat screen. And you know, so I already kind
48:36
of feel like we're living a sci-fi a little bit.
48:39
Now. I do want to send a shout out to
48:41
one thing. So it's not a book that I've
48:43
been reading, but are you guys familiar with Simulation Theory?
48:47
That the fact that we might be living in a simulation.
48:49
Yeah, exactly. I mean, that, like, makes me
48:53
wonder, like, OK, well, things can't be that bad if we're just
48:57
living in a simulation. Well, I mean, it depends on
49:00
simulation. The entire story of the Matrix
49:03
is essentially about living in a simulation.
49:06
And if you follow the Matrix closely, which I do right, there
49:10
were many versions of the Matrix.
49:11
The first was, you know, ideally a utopia, and everyone was
49:15
supposed to get along and the human mind rejected it, so they
49:18
went the other way. So who knows?
49:21
Are we there? I went out for a walk last night
49:23
and there's somebody who has like a bunch of jeeps and stuff
49:27
and they have all these Star Wars stickers and one says Sith
49:31
security. I'm like, I know that Star Wars,
49:34
but I have no idea what it is. And I kind of thought at the
49:38
time it might come up in the podcast today.
49:41
So I just wanted to let you know, like, I'm not into sci-fi.
49:45
I've never seen a Harry Potter movie.
49:48
I've never seen any any of those things.
49:53
Well, first, we're only. Only a SIF deals and absolutes.
49:56
So that's your first mistake right there.
49:58
But shout out to that that bumper sticker.
50:00
I think that's a great one is I'm getting the sense, Jim, that
50:04
like us recording this podcast virtually is about as sci-fi as
50:08
you get that fair. I mean, that's pretty sci-fi,
50:11
right? I mean, could you imagine having
50:13
done that when you were, like, a kid?
50:16
We used to, like, record into tapes and splice it.
50:19
Or you'd sit there and you'd listen to the radio station and
50:22
hit record. When a new song was coming on.
50:25
If it was one that you wanted, you keep recording.
50:28
If it wasn't wasn't, you'd rewind and try to get right to
50:31
the point on the tape. I mean, think about that to
50:35
where we are today. I mean, yeah, we're living in
50:38
sci-fi. Demure and old man, you're
50:40
talking about black and white TV's.
50:42
You're talking about making mixtapes on the stereo.
50:44
Gal, I don't even know where to take like the rest of this
50:46
conversation. Any comments for you gal before
50:51
we close out? No, it's, it was an excellent
50:54
discussion. I'm happy to catch up on that
50:56
sci-fi book recommendation. You know, next time we'll meet.
51:01
But thank you for hosting me in this episode.
51:05
Absolutely enjoyable. Well, we appreciate, Yeah, thank
51:10
you so much for sponsoring and definitely get the get out on
51:12
the website show support for Plane ID, who's showing support
51:15
for us here, planeid.com/IDAC. We'll have links in our show
51:19
notes for that as well as gal to your LinkedIn profile.
51:22
So people who can reach out either with sci-fi book
51:24
recommendations or questions around anything BAC or maybe
51:28
even AC access control at this point.
51:31
Certainly appreciate it. So for that, we'll go ahead and
51:33
meet it for this week. Thanks everyone for watching or
51:36
listening. You can find us on the web
51:37
idacpodcast.com and we'll talk with you all in the next one.
51:43
You've been listening to Identity at the Center.
51:46
We hope you've enjoyed the show. Make sure to like, rate and
51:50
review, and we'll be back soon. But in the meantime, hit the
51:54
website at identity@thecenter.com.
51:58
See you next time on Identity at the Center.