Latest / Identity at the Center / #377 - Sponsor Spotlight - Hush Security

Transcript

#377 - Sponsor Spotlight - Hush Security · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great, You know, every
0:18
once in a while we get a company that is perfectly game for our
0:22
space. And today is that day on the
0:25
Identity at the Center podcast. Yeah, we've got a sponsored
0:28
episode today. So these are things that we do
0:30
from time to time with our friends in the industry.
0:32
Today we've got Hush Security. They are just coming out of
0:37
stealth, I believe is how we're kind of looking at this.
0:39
And we're going to talk with Mika Rabe in a second.
0:41
But to learn more information about them, you can visit hush
0:44
dot security slash IDAC. So let's get Mika on here.
0:47
So Mika Rabe, he is the Co founder and CEO at Hush
0:50
Security. Welcome to the podcast.
0:52
Hey, hi, guys. Thanks for having me.
0:55
Yeah. Thanks for taking the time.
0:56
So this is the first time we've had an opportunity to talk with
0:59
you on the podcast. So let's start with a little bit
1:02
with your background. How did you get into the
1:04
identity and access management space?
1:06
Well, my background, you know, we're going way, way back.
1:11
I was, you know, a computer kid. You know, I was spend a lot of
1:15
time with computers as a growing up.
1:17
This was my passion for a very long time.
1:20
I did some work in this and of course studied in college
1:25
computer science and electrical science and went into the
1:28
industry, you know, right then I've done a lot of development
1:35
roles in my career and then finally moved to product
1:38
management around 2010, did some virtualization stuff, some
1:44
cybersecurity, and eventually I kind of landed with a very, you
1:47
know, unique team. Somewhere around the late 2016,
1:54
there's a company called Meta Networks and I met a lot of
1:57
great peers. We did a very good run with the
2:00
company. We kind of pioneered ZDMA, so
2:03
zero trust network access before that term kind of went popular
2:07
before SSC and Sassy which later came from Gautner.
2:11
We had a very good run and the company was acquired three years
2:14
after. And when we got acquired, we, we
2:17
were, we had a very good hygiene around security and very good
2:21
security by design nature. But the Infosec, the company
2:26
that, that kind of acquired us, wanted us to rotate a lot about
2:29
your keys and basically every, every key that we have around 2
2:33
times or three times to live. And the problem is that, that
2:37
even if you have a very good, you know, infrastructure with
2:40
code and automation and, and hygiene around it, what I think
2:44
is, is always a very, very big problem.
2:47
And it always kind of get pushed to the last Friday of the last
2:50
week of the last month with the last quarter that you're
2:52
actually allowed to do so. And then you spend the night
2:55
doing that and hoping that everything kind of went well
2:57
because there was no tooling around that to make sure that
3:01
you know you're doing it. Correctly.
3:03
And so when we kind of thought about moving out again, the same
3:08
team and the same people, this was one of the biggest problem
3:10
that was still resonating, you know, kind of sitting as a chip
3:13
on our shoulder from the last interaction.
3:16
And we said, OK, this needs to be addressed.
3:19
And so we kind of looked at what other, you know, vendors and
3:23
startups and incumbents were doing in the field and we didn't
3:27
find any good solution that can give you the governance and the
3:31
visibility and basically the operability that this fields
3:37
deserve. So I love the idea of hope and
3:40
prayer and wishes as a strategy strategy when it comes to
3:43
rotating keys. Everybody seems to fall into
3:46
that trap at some point. So he kind of mentioned how, you
3:49
know, Posh kind of positions itself a little bit.
3:51
How did you come up with the name of the company?
3:53
So as as we deal with identity and basically with secrets, and
3:59
so Hush was kind of a fun on, you know, where they didn't we
4:02
we're well making the secrets go away.
4:05
So kind of a, you know, Hush, it's a, it's a kind of a playful
4:08
way of talking about it took us a while to get there, but we
4:12
were very happy when we struck that one.
4:15
And most importantly, the URL was available right?
4:17
So Hush Talk Security is a great URL to have.
4:19
Available for the right place, obviously, but yes.
4:23
So I, I think I mentioned, you know, early on that you guys are
4:25
just kind of coming out of self. I get that right, Because I, I
4:28
think you guys are a little bit relatively new to the scene.
4:29
Maybe it's not kind of right away, but tell me a little bit
4:32
about that journey coming. You know, I guess coming out to
4:35
the public and saying, hey, here we are and here's what we do.
4:38
Yes. So we've been working, you know,
4:40
for for a year now on this product which is destructive.
4:45
I think it's very unique in the industry that hasn't been a
4:49
platform that that or solution that is doing what hash is
4:52
doing. And so we were excited the bit
4:55
to keep it the secret at the beginning.
4:56
But then later on we will really wanted to kind of brag and tell
5:00
the industry and the world what we're doing and that there is a
5:03
way to do things differently, which actually makes security
5:07
people happy and operation people happy, which is very
5:10
rarely the case. And so, yeah, we did come up out
5:15
of sales, launched a product and the company a week ago, a lot of
5:19
fun, fair. And that we're, you know, happy
5:22
and excited for the next, the next chapter, you know?
5:25
So Mika, we hear that term stealth all the time.
5:28
Can you kind of explain to me what, what it meant to be
5:31
yourself? Does that mean that, you know,
5:34
you guys didn't have customers that you're working with or like
5:37
you're building the product? How does that What does stealth
5:40
mean? It means a lot of thing, but but
5:42
for us, it means that we wouldn't, we didn't want to tell
5:46
yet what we're doing and the way, the novel way that we
5:49
approach things. So we first of all, we did the,
5:52
you know, a patent, we're still have a patent pending for the
5:55
way that we address identity for machines.
5:59
And then we kind of there was a lot of competition in the space
6:03
and a lot of them are kind of in, in my mind, they are kind of
6:06
missing the target. They are doing a very tactical
6:08
thing, a very short sighted thing that that can help in the
6:12
short term. But but you know, thinking about
6:14
how to reduce the technical debt and how to go into a better
6:18
approach. And this is something no one has
6:20
done yet. And so we kind of wanted to keep
6:23
that, you know, hushed for, for some time.
6:26
And then once the product is ready to go out with, with a ban
6:29
in the meantime, that doesn't mean that we can acquire
6:32
customer. We do have for paying customer
6:35
and, and several more, you know, and, and our pipelines.
6:38
And now we can actually expand, you know, the, the, the, the go
6:44
to market. And this is exactly what this
6:45
launch is about. Oh yeah, I'm biased, but this is
6:48
a great way to to launch anything.
6:50
It's coming out of the podcast, so you know, you'll have
6:52
thousands of people that are kind of tuned in for this.
6:55
I'm going to put my jaded CSO hat on here.
6:57
And you mentioned the competition.
6:58
You know, there's a lot of products in the IM space and you
7:02
know, the the hard question that I always like to ask is, So what
7:06
makes you guys special? Like what is it that you think
7:09
that's hush apart from others that are looking to approach,
7:12
you know, the same or maybe similar problems in the space?
7:15
So I think first of all, most out of vendors addresses
7:18
visibility only, right. And so this is very important
7:21
definitely for seesaws in a lot of in a lot of companies.
7:26
They want to understand 1st and see where the problem is, where
7:29
where the bodies are buried, so to speak.
7:32
And but then the next part of that is that you actually need
7:35
to a mediate that. So if your solution you know is
7:38
the one that opens 500 GLT because this is not what seesaws
7:42
are are actually looking for. So the first thing that sets us
7:46
apart is that we are looking for remediation or prevention of
7:50
those problems, right. Not only to show them we do have
7:53
a comprehensive way of, of discoverable and visibility, but
7:58
what we are looking for strategically is to change the
8:01
way that things are done and to help our customers basically
8:05
avoid those problems, right? You can think, you know, other
8:09
companies have done that in the past, for example, you know,
8:12
crowd Psych and Sentinel one developing an EDR writing, then
8:15
building a better antivirus, right?
8:18
So a jump or you know, just shifting the way that that the
8:21
solution is being done can, can yield much better result.
8:26
And I think strategically, this is exactly what Tash is going to
8:30
do. The other side, the other part
8:33
of the vendors that that we are actually competing against is,
8:36
is in a way the votes provided right The the one that actually
8:41
was safeguarding the secrets up until now.
8:43
But the secrets have have grown in such a scale that votes are
8:49
not keeping up with that pace. The era where static secrets
8:53
where you know, fuel and and and the rotations were, were were
8:58
very far about are long gone. And with the scandal we have
9:02
today, definitely with the Gente kind of coming in and tearing
9:05
through the roof of that, we need a better solution and one
9:10
that addresses the scale and is future proof.
9:13
Yeah, I mean, I'm, I'm glad you brought that part up about the
9:16
vaults. I mean, like I said in the
9:18
intro, I love the name Hush Security.
9:20
And when I first heard about it and that you guys are taking on
9:24
secretless access management, I thought this is totally like in
9:30
that space of managing secrets faults or getting a new twist on
9:36
it. But I also thought this sounds
9:38
like a play on non human identities.
9:41
And I'm wondering if those kind of get confounded what you guys
9:44
are doing with the secretless access management and non human
9:47
identities. And if they do get confounded,
9:51
what is the difference between those two?
9:53
It's a good question. I think the term non human
9:56
identities is kind of somewhat abstract and and a little
10:00
confusing. But the idea behind it is
10:03
basically static keys that machines use when they
10:08
authenticate or create trust with other machines, right?
10:11
And so every time in one machine needs to talk to another,
10:14
definitely if it's not in the same, you know, namespace or
10:17
even in the same data centre or physically or virtually, it
10:21
needs to establish some kind of trust.
10:23
And this trust, there are many ways to do that, typically an
10:26
API key or or a certificate or a username, password and so forth.
10:30
So I think the term NHI kind of refers in to to all of those,
10:35
but there is a confusing element to it because because it talks
10:40
about identities and well as well and secrets are not always
10:44
identities. Sometimes there is the identity
10:46
of the machine, which is one thing and then there is a
10:48
secret, which is another. So I'm a little bit resenting
10:53
that that that term, but it's accepted in the industry.
10:57
And for me it talks about basically legacy static keys
11:02
enabling machine to talk to another machine.
11:05
Yeah, I definitely hope I didn't offend you with that comparison.
11:09
But you know, I think, yeah, I think the non human identities
11:13
is a good umbrella term. It incorporates a lot of things.
11:17
That's kind of what I'm trying to get at, which is what is the
11:20
problem that your clients are trying to solve.
11:23
And I'm wondering, you know, with that description, are there
11:26
certain types of clients that use this?
11:28
So in other words, organizations do a lot of custom development?
11:33
Or can you use this with pre packaged software as well?
11:37
Basically, there are a lot of approaches that you can take in
11:40
order to, you know, improve your posture with regard to non human
11:44
identities. But there is there are no good
11:47
tools that takes you all the way.
11:49
So there are kind of the separate places where you can
11:52
kind of improve a certain element of what you do.
11:56
But up until now, there are no tools to do it.
11:58
The vaults, you know, themselves, they become a little
12:01
smarter over time. So they can do some more thing.
12:04
They can give you more auditability and so forth.
12:07
The NHI, you know, visibility has become a little better.
12:11
It's not perfect yet, but but it is getting, getting there.
12:16
But eventually the, the work to actually in, in the case of
12:20
legacy stuff, right? So where you can, you need to go
12:24
into a better solution. For example, when you walk in a
12:27
cloud native environment like let's say AWS, you're using ILM
12:31
words, you're using policy to manage access and trust between
12:34
machine. And that works great.
12:36
It has been working for I think more than a decade in the same
12:40
way. But when you're getting outside
12:43
of AWS, right, you have the workload in AWS that needs to
12:46
talk to a SAS, for example, that system doesn't apply anymore.
12:51
And so you're stuck with this kind of legacy way of, of doing
12:55
it. And today there are no, there
12:58
are no good tools that can help you do that with breaking
13:03
without breaking the legacy world.
13:06
I think there has been several attempts to do so.
13:10
For example, Spiffy is one of the standards that is trying to,
13:14
to, to kind of make a, a revolution here.
13:17
But I believe that Spiffy is not yet is that a big is, is that
13:22
backed by enough? Sorry, it's not backed by yet
13:27
enough big players in the ecosystem and there is not
13:30
enough momentum behind it. And so if someone can take the
13:35
the elements of Spiffy and the principle of it and apply it in
13:38
a way that doesn't break your, your code and your and your
13:42
business, then I think this is exactly what what we're trying
13:45
to build and what needs to be built.
13:48
It's interesting because a lot of what you're saying and
13:51
Spiffy's, you know, I think back to our episode with Felix Catons
13:56
and he just came on to talk a lot about different approaches
14:00
for machine identities in the authentication space and Spiffy
14:05
and that's kind of a cross cloud platform, whereas what you have
14:09
is a lot of proprietary solutions.
14:12
Think that Google's solution for vaulting is based on Spiffy, but
14:17
for the most part it's proprietary solutions.
14:19
You guys are approaching it differently and you're also
14:24
taking on the on premise to software as a service, which I
14:28
think is should be kind of clear to everybody.
14:31
Like that's a problem that, you know, how are you solving it
14:34
today, right? Unless you're kind of building
14:36
your own solution, it's pretty hard to solve.
14:39
So I'm, I'm kind of thinking that I might have answered my
14:44
own question from the next question, but it's why is this
14:47
hitting now? Why are people trying to solve
14:50
this problem now? I mean, it seems like the
14:54
problem's been around forever, right?
14:56
So why is it coming home to roost?
14:59
Yeah, I think it's, it's an excellent question.
15:02
We've been using, you know, API keys and and secrets and NHI
15:05
basically since then. The invention of software in a
15:08
in a way the issue with that is that when we used to work in
15:13
monolithic, you know, on Prem that was manageable.
15:16
It was very few of those because all the software was kind of
15:19
packed and neatly together and trust between those companies
15:23
were inferred or or assume. But as we kind of transform to
15:28
the cloud, right and and if now software is physically and
15:32
virtually in different places in the world, now you need to
15:35
establish trust between them. And so we needed a lot more of
15:39
those NH is and if you take into consideration that after that
15:43
came the infrastructure is called in the automation kind of
15:47
revolution, then all of those are scripts and and tools that
15:51
needs more, even more of those keying and, and artefacts.
15:55
And so it kind of grew dramatically back then.
15:58
And now as as we discussed before, we are entering the the
16:02
agentic area and agentic by definition need a lot of very,
16:06
very wide access into everything SAS as your, your data centre,
16:11
your cloud and so forth. And so we are on the verge of
16:15
another very, very big surge. Interesting.
16:17
And I think This is why now is the time that companies and
16:22
vendors and analysts are kind of saying, OK, this is, you know,
16:25
it's going to break very, very soon if it hasn't broken
16:28
already. And look, for example, just what
16:32
happened with this sales loft drift incident that happened
16:36
just a few weeks ago. The company was able to
16:39
exfiltrate sales, loft AWS account and from there they're
16:45
extracted O OS, which is basically another type of NHI is
16:49
a is a is a kind of a static key.
16:51
And they stole seven hundreds of those from everyone in the
16:55
industry. And I'm talking about, you know,
16:57
Titans as well as small companies like Palo Alto and
17:01
Cloudflare and and you know a lot, a lot of others, which has
17:04
a very good security minded product.
17:07
So you can say that, you know, this is something that like an
17:10
oversight of something like that.
17:11
It it's a proof that the architecture and the system is
17:15
completely broken, right? So that the proof is, is that
17:20
someone broke all the the big security companies in the world
17:24
and that means that the architecture is failing us.
17:28
So we need to move into something that works a little
17:31
bit. Yeah, Yeah.
17:33
No. I mean, it's a great point that
17:35
you're bringing up. Thinking from the practitioner's
17:40
perspective. I'm, I'm wondering, it almost
17:45
sounds like the case is being made that obviously there's a
17:48
transition period, but this being is the case that I won't
17:53
need a separate secrets fault in the future.
17:56
If I'm going down this hush route, do I eventually just
18:01
eliminate the secrets fault? I think that's a very good
18:05
assumption, right? So as I said, look at look at
18:09
what happened. I think it's a very it's a very
18:11
good example and a very good metaphor.
18:13
Look what happens in the human space, right?
18:15
When I want to access Salesforce today, my company Salesforce
18:19
when I 10 years ago, I used to go to the my admin, it would
18:22
create a username and password for me in Salesforce.
18:25
He would send that to me, which is, you know, something that is
18:28
risky because how do you send that through an e-mail, through
18:30
an SMS, through whatever means that that's the first risk.
18:34
And then it's my responsibility was to keep those username and
18:38
password presumably in one of those password, you know,
18:41
manager that we used to have like 1 pass or LastPass or and
18:45
so forth. And hopefully that that is
18:48
enough. But today the situation is
18:51
completely different. I when I want to access
18:53
Salesforce, I'm asking my admin and it's putting forth a policy
18:57
saying mija can access Salesforce.
18:59
And the only thing I need to do is go to Salesforce and just log
19:02
in with my IDP, whether it's Google or Octa or Ping or or
19:07
Entra or Microsoft. And so this is exactly the, the
19:11
kind of past we want to, we want to take the, the machine access
19:14
through. We want to write policies rather
19:16
than deal with taking a key, sending out to engineering,
19:20
putting that in a vault and pulling, pulling it out of the
19:23
vault when we need it. So, yes, so, so in my vision, in
19:27
my view of the world, when you're using a system similar to
19:32
what we're developing, you don't need to vote anymore.
19:35
We had Darren Rolls on the podcast recently and he talked
19:38
about, you know, for, for the big incumbent firms, they're not
19:44
as motivated to innovate. I, I think what I'm hearing
19:47
about from you is like true innovation potentially shaking
19:51
up the industry. I think this story resonates
19:57
really well with practitioners, architects.
20:01
Technology leaders as they kind of understand, well, this is a
20:05
game changer, don't get on board.
20:09
It's a little bit of a different cell.
20:11
As you move up the chain of command within organizations,
20:14
you get to that C-Suite and you know, the people who all went to
20:17
the budget, if you will. So I think that's one of the
20:21
things that with your perspective clients, you're
20:26
really going to have to help make that case.
20:29
And have you already thought through that problem?
20:31
I mean, what is the business case that you coach your
20:35
prospective clients through to make to people who are not the
20:39
techies, who are not hands on and and love them to technology?
20:43
I think eventually the, the, the thing that resonate most well
20:48
with those guys is, is the value that, that you bring to them,
20:51
right? They will not do anything that
20:53
doesn't hold a, a very good value for the company and for
20:57
the way they work. So if we're keen, if we can
21:00
reduce the risk for them, reduce the labour that they need to do,
21:04
reduce the, the, the, the cost of ownership for managing volts
21:08
and for managing the processes around around the sea, managing
21:12
access reviews and so many other things.
21:14
If we can just reduce that and produce that in a very simple,
21:18
automated and invisible way, I think this is where they're
21:23
going to buy it in, right? Because it will resonate because
21:26
of the great values that that the product brings to the table.
21:31
So it's one thing to get the executive buy in.
21:34
Great, now I've got it. I was just saying work.
21:37
You know, what's the, how does the platform go about
21:40
identifying these machine accounts and setting up whatever
21:44
it is, you know, if it's a graph database or some other thing,
21:47
right. To say, OK, here's all the
21:48
accounts that exist. The environment, that's the
21:50
visibility part of it. But how does this actually work?
21:53
How do you go about collecting that information from someone's
21:56
environment? Right.
21:58
So we have multiple ways of doing that.
22:00
The first of which and then the most trivial one, one that is
22:04
actually used by other vendors as well is that we we're
22:07
basically connect to, with with AP is through to our customers
22:13
infrastructure, to our code repositories, to our, to their
22:16
success. We scan and we read everything
22:18
that we can, the metadata about the the non human identities or
22:22
the secrets and the keys that they have there.
22:25
So we get that and that brings us the initial kind of a
22:28
database or inventory of what we have.
22:31
That stage on it's own, it's mandatory part of the journey,
22:36
but it's definitely not the last because first of all, there is a
22:39
lot of noise around this or a lot of stuff that we scan that
22:42
is not relevant for our customers.
22:45
And then the the second thing is that if you read only the stuff
22:49
that you know about, then by definition you are missing all
22:52
the stuff that you don't know about, right?
22:54
And so to that end, we developed a set of, of runtime technology
22:59
sensors very lightweight that we can deploy with our customers.
23:03
And that gives us observability of every authentication and
23:07
every interaction between machine that happens within the
23:09
customer environment, whether it's cloud or on Prem and so
23:13
forth. And so that is the first step
23:16
for us. It's first to understand that
23:18
the world that the universe of the of any choice for the
23:22
customer produce the report from that first of all, the
23:25
comprehensive audit log and second of all, a posture for
23:29
each one of them so the customers can address the
23:31
critical stuff that they have. And this is for us only the
23:35
beginning, because this will allow us to kind of transform
23:38
this customer into a policy based approach.
23:41
So we take that, we do the mapping right, we do the
23:44
baselining of everything that they have and then we can move
23:48
that thing to a policy based approach where the customer only
23:51
manages from this point and on only manages policies rather
23:57
than secrets. So sounds like the end goal here
24:01
is to get that inventory, whether it's on Prem or cloud,
24:04
I'm assuming, and then turn to PBAC, right.
24:08
Policy based access controls through that, Yeah.
24:11
Are there other methods of access control that maybe apply
24:13
here? Can we use things like
24:14
attributes? And I don't know if I wouldn't
24:16
want to go role based, I would wish that my worst enemy.
24:18
But, you know, help me how I guess how configurable or how
24:23
flexible is the model to say, you know, policies are good for
24:26
this, but maybe there are certain machine accounts or
24:29
machine identities or whatever maybe that can't be managed that
24:32
way. Maybe it's a different way to
24:33
manage it. So first of all, we address the
24:36
identity and attestation of the identity very, very closely.
24:42
We use Fifi as as the base of our attestation technology,
24:46
right. So this is, you know, already
24:48
proven in battle and has been widely used in internally as as
24:53
we discussed before, but we use that as a way to attest the
24:57
identity. So first of all, to check which,
24:59
what is the machine, you know, and and this goes to a variety
25:03
of ways of doing attestation. But this problem is already
25:06
solved by spiffy, which is which is great and it's already
25:09
available. The second part of it is is to
25:13
to pair through a policy to pair the right key for that identity.
25:17
And on top of doing that we can also put some conditional access
25:22
into it, right? So for example, is the machine
25:24
compromised? We can take that information
25:26
from other vendors like Cal Styke or Wiz or OCA.
25:30
So we know if that if that workload is coming from a
25:33
machine that is OK green lighted or maybe the other way around is
25:37
being compromised. We don't want to allow it to
25:39
access acidic data. We can take other conditional
25:44
access our rules like you know the time of day, the geography,
25:48
the IPS and so forth. And so we are kind of adding, we
25:52
are, we are building a very strong identity and then adding
25:55
some conditional access rules and then after that, you know,
25:58
we've kind of elevated all of the all of the security several
26:02
notches up already. When we talk about the product
26:08
itself, right, Hush, I think about machine identity
26:10
management. It has a bunch of different
26:12
components to it. There's the account life cycle,
26:14
authentication, right, authorization, logging, kind of
26:16
everything that goes along with it.
26:18
Does this cover all of that or are there areas that you tend to
26:21
focus on specifically or maybe doesn't matter depending on the
26:25
data you can get? I would assume right, maybe
26:27
there's more data for a cloud platform versus maybe an on
26:29
premise platform. Speak to me a little bit about
26:32
when we talk about machine identity management, like what
26:35
are the areas that we're specifically covering here?
26:38
I think there's definitely differences between, you know,
26:40
cloud, which is a lot more, more, more drain and structure
26:43
than the and systematic than legacy system like Contra and V
26:49
sphere and so forth. In the cloud.
26:51
And definitely in modern environment like Kubernetes,
26:54
we've got a lot of information, a lot of attributes, a lot of
26:57
identity hints that we can use and we leverage that.
27:02
And, and that kind of tends to go down as you go into the, into
27:06
the older stuff, right? And so if it's a virtual
27:09
machine, then we use a different set of, of attributes.
27:12
If it's going to on Prem and, and, and virtual machines that
27:15
are there, you know, we have a different way of, of dealing
27:18
with that. So it, it gets better as the, as
27:21
the, as the environment is more modern and we typically work a
27:27
lot faster and better there. But we do support legacy
27:31
environments as well. Yeah, in in to your questions
27:35
about authentication and authorization and so forth.
27:38
So we cover most of those layers in, in, in one way or another.
27:43
So first of all, authentication for sure, because we are the
27:45
facilitator of authentication and we can also cover some
27:49
aspects of authorization because we can provide different keys
27:52
with different scopes for which one of those workloads.
27:56
So we cover an aspect of that as well.
28:02
Yeah, I'm sorry, there, there was another part of that
28:04
question. I I missed it.
28:08
No, I think you cover cover it all.
28:10
I think it put us on a data, right.
28:12
How, how much data can we get for this stuff?
28:14
And maybe that is, is, is that a minimum bar to be able to
28:19
utilize a platform like this? Do I need a certain level of
28:23
data for this to run or stand this run in like a simple
28:26
vaulting format where you know as much as we, you know, dump
28:30
down on it. Sometimes there is some value
28:32
that we set in some sort of shared vault.
28:35
So no, no, no minimum here, as long as we have one workload.
28:40
It could be as simple as a script, you know, running in
28:42
Bash or Python that is trying to access another machine.
28:47
We will see that and we will address that and we can control
28:50
the way that it's done. We can govern that and we can
28:52
give it, apply the right identity to it and the right
28:56
secret. And if it's allowed, we will let
28:59
it pass. Then it could be as as as
29:03
complex as a, you know, very complex environment with
29:06
multiple clusters of Kubernetes and databases and interconnects
29:11
on top of meshes, you know, like NTNS and so forth.
29:16
Basically we are agnostic to that.
29:18
At the end of the day, we are looking at very strong data
29:21
identity of the corner and then at the service of trying to
29:24
access and we find and match the right key to it if there if if
29:29
it's allowed. Mika, I'm kind of wondering how
29:35
your clients are to measure success.
29:39
In other words, how do they know that they're succeeding?
29:42
And then, of course, how do they communicate that to the leaders
29:46
of their organization that the money's being well spent?
29:49
We're actually making progress. And what what is progress?
29:54
What does progress look like? What does success look like?
29:58
So first of all, visibility for the first time they have an
30:02
entire view of all their environments and the way that
30:05
secret is being consumed and used.
30:09
Basically success looks like lower, lower time to remediate
30:16
less incident, full auditability and basically the ability to to,
30:23
to create additional and new at scale the workload that are
30:28
accessing and trusting addition other machines.
30:30
So basically machine access, it's scale very, very easy
30:35
compared to how it's done today, which is cumbersome, labor
30:38
intensive and and very risky. So continuing on with the the
30:45
kind of the thread that Jeff was pulling on the how, how do I
30:50
take of security and roll it out in my organization?
30:54
Like where do people start? What is the the first building
30:57
block and then where do they take it from there?
31:00
Are you, I used to say to the customers that when you have the
31:03
right people in the room, then it's very easy to do it right.
31:06
You need the the guys with the permission to, to the
31:08
infrastructure, to the sauces that you have.
31:10
And if you have all those guys, you know, lined up, which is
31:13
sometimes hard to do in very big enterprises, then it's very
31:17
easy. You can connect whatever we do
31:20
the the connector that we have to your SAS, to your IS, to your
31:25
infrastructure, to your databases and we start scanning
31:28
everything minutes after that. You already have very good
31:31
results. So the initial, the initial
31:34
scanning then to deploy the the London technology, again, it
31:39
kind of depends on the environment.
31:40
And basically you're deploying a sensor.
31:43
So it's very easy in some environment like Kubernetes in,
31:46
in other environments like Z, NS or compute, there is a different
31:50
approach to that. A lot of ways to do it, some of
31:53
them is some of them a little, a little less.
31:56
And then once you do that, once you deploy everything, then you
31:59
start seeing the real, the real picture kind of taking place.
32:04
And this is very dependent on the size of your, of your
32:08
operation, right? And so for example, if there's
32:10
an authentication event that happens only once a month
32:13
because you're rendering like a digest, monthly digest, then you
32:18
need to wait for that for that monthly event to occur.
32:21
But all the other stuff, millions of other authentication
32:25
event that's happening every minute, you will start seeing
32:28
those right away. And that that would be the
32:31
initial start of of this of the process where you see the report
32:35
and you see the posture and everything that you need to know
32:38
from the discovery phase. And then on top of that moving
32:41
into into the ponces and just there is nothing else to do
32:47
after that. It's basically to sit and wait
32:49
for any unders to come your way, seeing that someone is is
32:53
actually doing something that they shouldn't.
32:57
Let's pick on that a little bit. So you you use a very
33:00
interesting word to me, which is scanning.
33:02
So you're scanning the environment.
33:04
When you're scanning the environment, what are you
33:06
looking for? I'm looking basically for every
33:11
machine that is talking to another machine and within that,
33:14
what secret is being used when they talk, right?
33:18
And so, so basically we're, we, it's a combination of scanning
33:22
and monitoring. We do some agent scanning.
33:24
So we scan your code base, for example, your Git repository,
33:28
right? So we want to know if you put
33:30
any hard coded secret there. So this is scanning domes,
33:33
scanning your collaboration up like JIRA and Teams and Slack
33:37
and so forth. But we also monitor and observe.
33:41
So that's the runtime part of what we do.
33:43
We look at every authentication event that happens.
33:46
We, we look at the identity of the caller.
33:48
We do, we look at the identity of the of the service that they
33:51
are calling and we are taking the the map of everything that
33:56
happens basically around that happening that with the metadata
33:59
coming from the from the engine test scanning, we get a very,
34:02
very distilled inventory. We don't the right information
34:09
in it. That's very interesting.
34:11
So I can, I can totally get what you're saying now with
34:15
visibility and you have a good picture of what's going on and
34:20
you start to identify where you have weaker controls from an
34:25
identity and access perspective. Now you can report on that.
34:30
What else can you do? Like eventually that the
34:32
practitioner has to go about remediating that, right?
34:35
So what's the approach then? Is that like the next level
34:39
within the Hush platform? Yeah.
34:41
So, so some, some of our customers, they only interested
34:47
in the discovery pump, right? Some say, so they say, I just
34:49
want to know where I am. I want to make sure there are no
34:52
risks. So if there are, I want to
34:54
remediate them. But my argument, and I think
34:57
Felix made, made a very similar argument when you, when it was
35:01
on your podcast, is that using those kind of of, of keys and,
35:06
and NH is this is the wrong way because of the, of the scale of
35:11
where they are today. Just trying to chase and
35:14
remediate the stuff that you have is just is, is not
35:17
scalable. And it, and it, it, it's
35:19
definitely not a way to build a complex environment like today.
35:25
And so we do have that part as well.
35:27
And we give that in where some of our customers, you know, this
35:30
is where they are. But what, what hash is really
35:34
doing and how we really want to change the way that that
35:37
software is being done is that we want to move you away from,
35:41
from needing to remediate that. Because once you don't use NHI
35:45
or static keys anymore, you just use policies, then everything,
35:50
all the risks attached to those NH is, is going away with it.
35:54
And that is the narrative, that is the vision that that we are
35:57
bringing to the market and to the industry.
36:02
And I think there's 11 sentence that Felix said that that kind
36:06
of strucks me very well. It was kind of funny.
36:08
It said friends don't let friends use NHIS, right?
36:12
Like this is this is not the way you want to go.
36:14
You need to, you need to move, you know, the way that you think
36:18
about software and the way that you that you manage access.
36:22
Yeah, normally I book our guests, but Death hit a Grand
36:25
Slam with getting Felix on the podcast, and that's definitely
36:28
one that got a lot of attention. You know, with all that said,
36:34
you know, the visibility, it does seem like look, I mean, I
36:38
get to see so perspective of, you know, just to make
36:42
visibility because I think it's very hard to solve a problem
36:46
when you don't know what the problem is.
36:48
But then you've got this next level of actually remediating
36:52
problem. Going back to my earlier
36:55
questions about like how do we communicate our success in the
36:59
organization given those factors, given all that, can we
37:04
attach, you know, metrics to any of that?
37:07
Can we set long term goals and then show progress towards those
37:12
in terms of like OK, Rs and things like that?
37:15
Seems to me like that's goals and objectives and, and hitting
37:19
those, that's the language of the C-Suite, you know, 2 point O
37:24
if you will, or like that's what people are talking today about,
37:27
which is objectives. It seems to me that all this
37:33
data that you're creating, this visibility, this ability to
37:37
remediate in progress over time, that speaks exactly to achieving
37:42
those objectives. I think that's spot on.
37:45
You know, eventually the, the sea level, they want to see, you
37:48
know, some kind of KPIs, right? And how do you achieve them?
37:52
And so things like, you know, fixing the problems, like
37:59
reducing the time to fix an incident, that's definitely
38:02
something you want to do. The time for fixing an identity
38:06
related breach, I think I read somewhere is around something
38:09
like around 40 days. So you have a problem, you need
38:11
to fix that. That takes 40 days in in the way
38:15
that we envision Nano one identity future is that you
38:20
don't you don't have that time because you're not even using
38:23
the same language or the same construct to to manage it.
38:26
So you want to reduce that to zero.
38:29
You want to reduce the number of incidents that you have and of
38:33
course you need to reduce, you need to improve the posture and
38:36
reduce the risk that you have within your environment.
38:39
So the first thing, for example, that we do, we scan everything
38:42
and we show you the, the amount of risk that you have.
38:44
For example, you have, you know, where the key that is being used
38:48
in, you know, hundreds of or 10s or hundreds of environments.
38:52
And we've seen that. And so this is a very big risk
38:55
because if one of those environments get compromised,
38:57
that means that all of your infrastructure get compromised.
39:00
So we show you that and we show you very easily how you can
39:05
overcome that and remediate that if this is on what you want or
39:09
move to a parallel system where those risks doesn't exist at
39:13
all. You know, Jeff and I are
39:15
identity practitioners at heart and I think, you know, all this
39:20
data, having it, it might cost some sleepless nights.
39:24
That'll what'll really 'cause the sleepless night is knowing
39:27
you have a problem, but not knowing how big the problem is.
39:30
That will just give you anxiety. So I mean, listening to
39:35
everything we've talked about, I think there are a lot of our
39:38
listeners who are interested. They want to learn more.
39:42
How do they learn more? Definitely using the link that
39:47
you can provide. They're going to #security
39:51
sending us a notes, pinging us on LinkedIn.
39:55
Many ways to come to us. We have a great good marketing
39:58
would be happy to jump on a call, you know, explain and walk
40:02
out walk through the solution and also give some free
40:06
assessments so we can check the posture on you know what are
40:09
what they have today and just for them to to see.
40:15
What are the risks that are lurking in their environment?
40:18
And it's so often that we go into a colon and and the other,
40:22
you know, the guy on the other side said, no, no, no, we are,
40:25
we are completely, you know, very hygiene here.
40:27
We, we keep everything in the vault.
40:29
Nothing is, is out. You know, we know where
40:31
everything is. And then you scan it and they're
40:33
like, OK, so maybe I don't have anything.
40:38
And I used to, I used to say the beginning of the journey that I,
40:41
I'll give you a butter of Scotch if we don't find anything, you
40:45
know, as you said, but and I haven't given any, any battle
40:49
for the last year within this journey.
40:53
I'll think about those Scots. I don't really have an
40:55
environment for you to say, but you know, I know that you guys
41:01
are setting up a URL hush dot security slash IDAC, like the
41:06
podcast name. I know you're going to have some
41:09
something out there. I don't know if you want to
41:11
reveal what that's going to be now, but if folks go out there,
41:16
there will be something that they can get started with,
41:18
right? Absolutely.
41:21
So whenever you reach out to us and through this link, we can
41:25
jump on a call and we can, we can have our team give you a
41:28
complete assessment of your NHI posture and you know, happy to
41:34
take it on. Awesome.
41:36
Now you guys, do you guys do the conference circuit?
41:40
We will. We're we're studying with
41:42
Gartner IIM conference in in December and we've got some
41:49
other ones lined up as well. Well, we'll definitely see you
41:52
in Gartner. So that'll be a good time to get
41:54
the official fist bump of gratitude for being on on with
41:57
us. So Mika, this has been the easy
42:00
part of the podcast. The hard part is now I have a
42:04
very challenging question for you, and that is pancakes or
42:07
waffles. Pancakes or waffles?
42:11
Definitely pancakes about hesitation, this kind of kind of
42:16
memory, right? Yeah, without hesitation.
42:18
And I'm seeing my mom, you know, it's it's it's the weekend in
42:22
the mornings I wake up, she give me she serves up some fresh
42:25
pancakes. What what more sweet memory than
42:29
this? You can ask well before, right?
42:32
Well, and and they're just delicious.
42:33
So I, I have thoughts on this. Let me go to let me go to Jim
42:37
first, because I have a feeling he thinks he knows what I would
42:39
pick. But Jim can take or waffles.
42:42
I don't think you can go wrong with either one, right?
42:44
I mean, I I'm a huge fan of both pancakes and waffles, but I will
42:50
say I do think that waffles are meant as carriers of butter.
42:56
They serve no other purpose but to put butter in your mouth in
42:59
large quantities which. A bottling delivery.
43:02
System a butter delivery system. Thank you.
43:06
You're going to go with waffles, and I think you're going to say
43:09
the same because they can be paired with one of your favorite
43:13
meats. Yes.
43:15
So yeah, I'm, I'm a big fan of chicken and waffles, but I'm
43:19
going to shock you and I'm going to say pancakes.
43:22
And here's why It's very difficult to find a good waffle.
43:27
You can get good pancakes pretty much anywhere.
43:30
It's much simpler, I think to prepare.
43:33
It's more consistent. That's what I'm looking for.
43:35
But a very good waffle. And I'm, I'm more of a Belgian
43:38
waffle myself meal, maybe some bacon bits in it, maybe, you
43:42
know, some, some walnuts or pecans on tops and syrup.
43:45
And of course, you know, some fried chicken.
43:47
Chicken and waffles is my favorite.
43:48
But because it's so hard to get right, I feel like pancakes are
43:54
a safer bet. But I'm like you, I don't
43:57
discriminate. I will eat either.
43:59
The correct answer is both, of course.
44:01
So we all failed this one. But I'm going to go with
44:03
pancakes purely just for the consistency factories.
44:05
I feel like we can get those pretty good anywhere I go.
44:08
Does that shock you at all, Jim? No, not actually, not that you
44:13
give them the full explanation. And you said both was the right
44:16
answer. I mean, I'm, I'm in your lane,
44:19
man. I will say this.
44:21
One thing we left out of this whole conversation was, you
44:25
know, pancakes. Are they buttermilk pancakes?
44:27
You could get chocolate chip pancakes.
44:29
You could get blueberry pancakes.
44:32
I will tell you, I had this experience where I was in Big
44:35
Sur, CA. I mean, one of the most
44:37
beautiful places that I've been on this earth.
44:40
And I found this little bed and breakfast kind of place like
44:44
just off the side of the road and they had blueberry pancakes.
44:47
And one of my projects in retirement is to go going to be
44:54
to find this place is the best blueberry pancakes I've ever
44:57
had, fresh blueberries. And I say the blueberry pancake
45:01
was 50% pancake and 50% blueberry.
45:06
So Mika, where do you fall on that?
45:07
Do you like a plain pancake, or do you put things into your
45:11
pancake like chocolate chips or blueberries?
45:13
Definitely a plain, plain pancake kind of guy.
45:16
This is the basics. You don't mess with that.
45:18
You you give it, you maybe put some, you know, chocolate on top
45:22
of it and some ice cream. But the pancake you need to make
45:25
it, you know, basic and and as it should as it should come.
45:31
I'm with you on this button. I, I am not a chocolate chip
45:33
pancake, a blueberry pancake. Just give me a good pancake and
45:37
some nice Maple syrup, maybe a little bit of powdered sugar.
45:40
You know, I like to eat healthy. So if I'm going to have my
45:42
pancakes, I don't want butter on there.
45:44
It doesn't need it. I, you know, I don't need any
45:48
anything else. You know, it's, it's, it's a
45:49
health food. As long as you don't put the
45:51
butter on it. That's the way that I kind of
45:52
approach you. I'm, I'm kind of a purist in
45:55
this. And the same way with security,
45:57
right? You need, you need to do it the
45:59
right thing, the right, the right course.
46:02
And you know, it's the same with pancakes, man.
46:05
Yeah, if the product is good enough, you don't need these all
46:07
the other shiny things like chocolate chips and blueberries
46:10
etcetera, right? It should be a stand alone food.
46:14
That can live on its own. That's.
46:15
My my thought. Right, very well put.
46:18
I was OK with what you said. Like you said, no butter and no,
46:22
no butter. Like we're not friends with me
46:24
anymore, Jeff. It's just too much.
46:27
It's it's, it doesn't need it. You know, the butter doesn't
46:30
really add anything for me. I just need a syrup delivery
46:33
mechanism. And that's what the pancake is.
46:35
It's the, it's the delivery truck for, you know, a, a nice,
46:39
you know, I'll say like a vanilla Maple syrup.
46:41
That's that's pretty good. That's what I'd go with.
46:43
But Jim, if you do find that BNB, I'd be happy to to get that
46:47
that address from you. So to to me.
46:49
I, I wanted to close out. That was the hardest question.
46:52
You passed by the way, by by picking, you know, pancakes and
46:55
a plain pancake to boot. So, you know, congratulations.
46:59
We're going to have links in our show notes, not the pancakes,
47:01
but to your LinkedIn profile, but also to hush dot security
47:04
slash IDAC so people can go check that out.
47:07
Mika, thank you so much for spending time with us today.
47:09
Any final thoughts before we wrap up?
47:10
No, I think I'm excited, you know, first of all, to, to talk
47:13
to you and I've been listening to you for a while.
47:15
So definitely feels like a serene in a way.
47:19
I'm happy to for you guys to have me and I'm excited for the
47:23
next chapter of fashion, you know, bringing our mission to to
47:27
the industry and changing the way things are done.
47:30
Yeah, I'm looking forward to seeing you at Gartner as well
47:32
and seeing how things progress from there.
47:34
So we'll go and wrap it up for this week.
47:36
You can find us on the web at IDAC podcast.com.
47:39
Like subscribe to all best fun stuff, you know, share with
47:41
friends, share with enemies, doesn't matter.
47:43
As long as they're liking subscribing, watching or
47:45
listening, that's all we care about.
47:47
So with that, we're going to leave it for this week.
47:50
Thanks for watching and or listening and we'll talk with
47:53
you all in the next one. You've been listening to
47:57
Identity at the Center. We hope you've enjoyed the show.
48:01
Make sure to like, rate and review, and we'll be back soon.
48:06
But in the meantime, hit the website at
48:08
identity@thecenter.com. See you next time on Identity at
48:14
the Center.