Latest / Identity at the Center / #417 - Sponsor Spotlight - Elimity

Transcript

#417 - Sponsor Spotlight - Elimity · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:16
I'm really good. Excited about today's episode
0:19
and excited. This is kind of a transition
0:23
into the EIC conference because we're going to talk to a friend
0:26
who we will see you there, get to spend time with him and his
0:29
colleagues and hear his story a little bit more today.
0:33
Yeah, it's an exciting one. We got a sponsor spotlight with
0:35
alimony today. And so we're going to be talking
0:37
with Martin in a second. But we this is a little bit
0:40
different because we actually threw axes with them last year
0:43
in Berlin. We had a great time and they
0:45
had, you know, they, they put on a great event that we that we
0:47
went to and had a good time with it.
0:49
So one of those rare times where it's like, yeah, we have thrown
0:53
bladed things at walls together. Does that make sense, Jim?
0:57
Oh yeah, we've we've definitely delved into playing with weapons
1:01
together. I like playing with weapons.
1:04
Playing with weapons and the thing that I have to, I think I
1:07
gave you a shout out on this last year, was you're
1:10
surprisingly good at throwing axes.
1:13
Well, you know, I'm a I'm an athlete.
1:14
What can I say? You know, may not look like one,
1:17
but I guess I had the body of an axe thrower.
1:19
I don't know if that's a confident or not you.
1:21
Still have the caveman instinct somewhere within your DNA.
1:26
Which is ironic considering I don't really like to go outside.
1:29
So maybe a cave with AC and Wi-Fi I would be most
1:32
comfortable in. Exactly.
1:34
Exactly. All right, so today we do have a
1:36
sponsored episode. It is with a limiting and you
1:39
can find them on the web at ELIMIT y.com/IDAC.
1:44
So we'll have that link in our show notes as well as kind of
1:46
everywhere where we kind of post this out.
1:48
But let me go ahead and introduce Martin Dekat.
1:50
He is the Co founder and CEO of a Limiting and also an excellent
1:53
axe thrower. Welcome to the show, Martin.
1:55
Hey guys, thanks for having me. Yeah.
1:58
So I'm looking forward to seeing you here in about a month or so
2:00
when we hit Berlin for EIC. But let's talk a little bit
2:04
about your background in identity.
2:06
How did you get into the world of identity and access
2:09
management? Is it something that you chose
2:11
or did it choose you? It's a good question.
2:13
I I would say it chose me. So to give a bit of of my
2:17
background, I'm an engineer by education.
2:21
Belgium University did a master in computer science and then a
2:24
PhD on access control. So spend a couple of years
2:27
working on on policy based access control, if you will.
2:30
So made some scalable engines for Xakamol if if that rings a
2:34
bell or the OPA engine these days.
2:38
But it was at the at the very entrepreneurial university here
2:41
in Belgium. So I was continuously challenged
2:43
to to build a venture out of my research.
2:46
And in that process we really saw, yeah, policy based access
2:49
control is nice. The application are maybe quite
2:52
narrow, but the main challenge that all I am practitioners were
2:56
just complaining about and just literally saying, oh man, it's
3:00
basic understanding of who can do what within their company.
3:04
And so eventually we started a liberty on on that promise, on
3:08
that premise. So that problem of trying to
3:10
make sure that you've got the right access in place.
3:12
Tell me a little more about kind of the limited origin story and
3:16
you know, what were some of the other problems maybe you're
3:19
going to solve or is it pretty much focused on that?
3:21
It really started with with that.
3:23
So our first customers were really big enterprises also in
3:27
the banking sector. So these are companies of 30,040
3:32
thousand employees. They they had an IGA, they have
3:35
a very extensive IGA deployment. They had a privileged identity.
3:39
So a Pam solution they had signed, they had all these,
3:42
these, these components in practice and still you have all
3:45
of these IM practitioners. So some of these companies had
3:48
70 people in the core IM team. And then all of these role
3:52
owners, application owners, team leaders that are just asking for
3:56
OK, but now who is connected to these entitlements to these
3:59
technical roles, to these business roles?
4:01
And, and the solution back then was the things that we've seen
4:05
is just insane Excel macros on data put in, in a SharePoint
4:09
every day and all of that. And so we started providing them
4:12
a better solution, started them providing with a better
4:15
alternative. So identity analytics.
4:17
And then gradually you saw that this evolved into what I like to
4:21
call provable control. So it wasn't just on top of an
4:24
IG anymore, but really any application bringing that
4:27
together, answering the question, hey, across all of my
4:30
applications in, in SharePoint databases, Active Directory,
4:34
enter ID, the cloud on premise, who can do what, where are the
4:39
risks? You can run security controls,
4:41
remove those risks on your access review.
4:43
So really everything that you need to show that you're on top
4:45
of things. That's how things evolved from
4:47
really that identity analytics part to what we know call
4:50
identity visibility and intelligence.
4:52
Yeah, I think we're probably going to get a lot into IVIP or
4:55
IVIP, I'm not sure quite how we're pronouncing it at this
4:58
point. But let me ask you about the
5:00
name of the company limiting. How did you come up with that?
5:02
And you know, tell me the background of of that itself.
5:05
I get asked this question so many times and I wish I had a
5:08
cool story to share here, but but to be honest, we're just a
5:12
couple of engineers. We wanted to a name that could
5:14
be pronounced and for whichthe.com was still
5:17
available. So we just used one of those
5:19
domain name generators that said, yeahthe.com, the.net, the
5:22
dot B is all available. And eventually based on some
5:26
words that have association with IM, we, we, we landed on the
5:29
liberty. We kind of like it.
5:31
I'm going to pick up on what Jeff was talking about.
5:33
So this IVIP or IVIP, you tell us which one is kind of the,
5:38
the, the right catch phrase. What does this stand for and
5:41
what are kind of the core components of IVIP?
5:44
IVIP and by the way, I also don't know how to pronounce it,
5:48
but I pronounce it as IVIC. It's, it's an acronym coined by
5:51
Gartner, I think some of last year and it it's really
5:55
identity, visibility and intelligence platforms.
5:58
So I would summarize it as it's the more recent evolution in the
6:03
IM space and the core variation, if you will, is really a laser
6:07
focus on visibility, not automation.
6:10
So you look at identity and access management as a data
6:13
problem and not as an automation problem.
6:16
And that means that the core components are that you you
6:18
really should look for including all relevant IAM data.
6:21
So users, permissions, roles, relationships, activity,
6:24
configuration, all of that's from all of the critical
6:26
applications of an organization. Put that into one big identity.
6:32
Data graph is typically the the, the data model that you see that
6:35
IV players use. So it's fundamentally more
6:38
detailed and just a flat list of entitlements that you see in
6:42
many Igas. And then you put easy analytics
6:45
on top of that. And then the core value of that
6:47
is a rapid integration, very fast, very short time to value.
6:50
And the value is really a visibility, removing risks,
6:53
understanding who can do what and then do something with that.
6:57
Yeah, I think you you've kind of laid out why it's important.
7:02
But something has happened in the last few years that has now
7:06
made IVIP. It's on the tip of everyone's
7:08
tongue. Everybody wants to know about
7:10
it. I am spent around for 20 years,
7:13
right? Why is it that now this topic
7:17
has become? Hot.
7:19
Yeah, I would. I would really say so.
7:21
We've been at the center of that whole evolution and the thing
7:23
that has changed in the last five years, I would say is that
7:27
security really has become a much stronger driver for
7:30
identity and access management. So these days with identity
7:34
first security and all of those movements, you we know, we all
7:38
know that you just, you can't neglect the role of IAM anymore
7:41
in a security landscape with cloud and SaaS and all of that.
7:45
Identity is just such a big part of the attack surface of an
7:49
enterprise. So you have to take control of
7:52
this part. And no scissor wants to be that
7:54
scissor that was hacked because of stolen credentials of someone
7:57
who left two years ago. And so you really see that if
8:00
you think about actual risk in your enterprise, then user
8:04
access risk or identity related risks is a part that you cannot
8:07
neglect anymore. And, and on top of that, you see
8:10
that regulations are really driving this this forward even
8:13
harder. And just to name a few, sock 2
8:16
ISO 27,001 are required more and more in the industry for
8:20
actually doing business. And they all mentioned things
8:23
like like access control and, and user access.
8:26
And they have things like CCPA in the US and this two Andorra
8:29
in the EU and CA in the Middle East.
8:31
So they all force companies to take control of all aspects of
8:35
cybersecurity. And that means, amongst other
8:37
things, knowing and controlling who can do what.
8:40
And, and in my experience, you see that very strongly because
8:44
we started in the financial sector, always highly regulated,
8:47
always very security aware. But now these days we, we have
8:50
customers in insurance, manufacturing, SAS companies,
8:53
healthcare, all of those sectors.
8:55
And that that's just because cybersecurity is, is a need for
8:59
any sector, any company of decent sizing, any sector these
9:02
days. You mentioned the large
9:04
financial institutions and my experience with large financial
9:08
institutions is they're usually solving problems before product
9:12
spaces develop and replace their kind of their way of solving
9:17
these problems. So was that the case with IVIP
9:20
where people were organizations already kind of coming up with
9:24
solutions and what were they doing before IVIP became a
9:28
product space? Yeah.
9:30
The things that I've seen people do in practice, you wouldn't
9:34
believe. Yeah, probably you have the same
9:35
experience, but just just to name a few of our of the things
9:39
that our first customers were doing.
9:41
So for example, a very mature company, very extensive IGA
9:45
deployment and then the same use case that you see in many of
9:48
these very large financial institutions.
9:50
You have all these people, like all owners, application owners,
9:53
experts helping the business with, with access reviews and
9:55
all of that. And they were all asking
9:57
information about IGA data. Tell me who is linked to the
10:01
entitlements in my application to which are all and so on.
10:04
And, and really the, the plumbing I've seen in companies
10:06
in practice, just the example that I said before, a huge Excel
10:10
sheet put on SharePoint with the daily Cron job and then all of
10:14
these people building macros on top of that so that they can get
10:17
the information that is relevant for them specifically.
10:20
It's just insane or our companies yeah, you always have
10:23
some forces admin that is tasked with writing PowerShell scripts
10:27
that have to run every day or even manually every month and
10:30
then combined it with all the reports.
10:32
So yeah, clearly, please, please all stop doing that it's not
10:36
sustainable. And some of the better approach
10:39
that I that I have seen is also with the very large enterprises
10:42
is some of these actually build specific data links specifically
10:46
find and access management. And that, that clearly is a very
10:50
good approach. But yeah, I've only seen it
10:53
being done in the very large, the largest of large security
10:58
teams and, and, and IM teams out there.
11:00
So probably only doable for the top 0.1%.
11:03
And, and IVIP really is. So those really are products
11:07
platforms that wrap that in an on the shelf product offering.
11:10
So you don't have to think about building your own Azure Data
11:13
Lake or whatever technology you prefer yourself anymore.
11:16
That's a great answer because I think the keys that jumped out
11:20
at me is it's very bespoke solutions, people building their
11:24
own, we're building their own solutions and then having to
11:28
operationalize it. And I think as somebody who's
11:31
been an identity for over 20 years and then an IT for over 25
11:35
years, my first, the first thing I think about whenever we're
11:39
putting together a bespoke solution, sometimes those are
11:42
what's necessary is how are we going to operationalize this?
11:47
If it comes back to crime jobs, if it comes back to individuals
11:52
updating things, I say that's not sustainable.
11:55
So great answer on that. I want to bring up kind of what
12:02
I think the doubters will say. And I, I'm skeptical of the
12:07
doubters honestly, because with a lot, a lot of what you've
12:10
already covered, I think this is outside of anything that
12:13
currently exists. But I think the doubter
12:16
perspective is like, hey, we have IGA, can't IGA do all these
12:20
things already? Aren't these kind of core
12:23
capabilities of IGA? What do you say to that?
12:26
Well, that I understand the the doubt the question, I get it.
12:31
And especially in the early days, we were compared to, to
12:34
Ijs a lot. And, and I can really understand
12:37
that if you invest that amount of effort and that amount of
12:40
money into a project and, and, and the deployment of the
12:44
typical sizes that you see, then you expect these platforms to
12:47
provide some, some insights into, in into who can do what as
12:51
well, of course. And so in practice, you see all
12:55
these platforms as as good as they can be.
12:57
I really like and I, I adore what they do, but they're not
13:02
analytical platforms and their analytical capabilities are
13:05
pretty limited. And that's why one of the first
13:08
things that we were pulled towards is deploying this on top
13:11
of an IGA. But in practice, if especially
13:14
now these days, you see that it has become a completely
13:17
different beast. It's not just an analytical
13:19
component on put on top of an IGA, but it's really if you're
13:23
looking for security value, if you want to have insights in who
13:26
can do what in any application that is interesting or that is
13:29
relevant in your application, in your organization, then you want
13:33
that to be fast. The different value is, is it's
13:36
about time, time towards visibility, time towards
13:39
understanding to have that understanding you also from a
13:42
technological point of view, I'm, I'm, I'm a technology guy
13:45
myself. You need a different data type.
13:47
In my opinion. It's not just a flat list of
13:48
entitlements. That's why all of the IVIP
13:51
players or IV players that I know, they all work with, with
13:54
this concept of a, of a data graph and identity data graph.
13:58
And then you link stuff like Active Directory and IGA enter
14:01
ID, file share, SharePoint database systems, local admins,
14:05
workforce identities, non human identities, all of that.
14:09
Those are all things that you want to to bring into one big
14:13
overview so you can apply controls and that and that has
14:15
grown into something completely different than what an IGA
14:19
provides. So can we tease out a little bit
14:22
more about, you know, when we talk about graph databases and
14:27
you know where IGA is typically been looked at in the in the
14:30
past at least and probably still today is like, OK, this is here
14:33
is who has access to what? How is an IVIP solution better
14:39
or more additive to what I'm getting out of an IGA?
14:42
You mentioned graph databases. Why is that data construct
14:46
better than just, well, here's Jim and here's the account he
14:49
has and here's the permissions assigned to that account.
14:52
What? What does that enable having,
14:53
you know, more intelligence around that?
14:55
Deeper depth and a wider breadth, I would say so and and
15:00
again, it's it's a different type of problem that we're
15:02
solving. To be clear, I'm not dissing on
15:05
an IGA at all. The problem that they solve is
15:08
you want a two way communication.
15:09
You also want to provision, you want to synchronize over time.
15:12
And in that sense, in that case, I would also choose a simpler
15:16
data model that just makes it easier to to provision back to
15:19
AD to provision back to target applications and that the data
15:22
model makes sense there. But if you're asking like like
15:26
many of our customers these days, SharePoint is, is a is a
15:30
critical application in many organization.
15:32
That's because of the copilot deployments.
15:34
If we're going to run Copilot with some kind of credential,
15:37
then let's make, let's make sure we understand what that
15:39
credential connects is that type of thing, that question just by
15:43
itself, it's, it's Active Directory to enter ID to
15:46
SharePoint with, with groups with, with, with SharePoint
15:49
roles, with access to specific files, to specific sites and all
15:53
of that. And that amount of complexity,
15:55
that amount of detail that you need to answer that to give
15:59
those insights. It's just different than a flat
16:00
list of entitlements. And so in that sense, detail,
16:04
more detail, the ability to ingest a lot more different
16:09
authorization types and because you can tweak the data model
16:12
more in the platform, in the IV platform and all of that just
16:16
leads to a vastly faster deployment time.
16:19
That's what it ends up with. So it sounds like there's
16:21
definitely overlap right between like an IVIP would tell you and
16:24
what a standard IGA solution would tell you how any, I think
16:29
you mentioned running that you've seen this, right, You run
16:31
IVIP sort of on top of the rest of your IM infrastructure, which
16:34
would include IGA. How do you make the decision to
16:39
make sure that you've got, you know, you're not competing or
16:42
duplicating efforts where you can?
16:44
Are there things that are like out of scope for an IVIP that
16:48
people should be aware of? Definitely maybe we should do an
16:52
IV project owner session specifically on this question,
16:55
but at least my view is clear answer.
16:58
Automated televisioning, that's for me that's clearly out of
17:02
scope for our for our product and and I mean automated
17:06
remediation maybe. So writing back to the systems
17:09
for which we get to get information for which we ingest
17:12
information. Yeah, makes sense if you're
17:13
running controls on top of that information, if you see
17:17
potentially orphaned accounts, if you want to update metadata,
17:20
if you want to revoke a role or a group and Active Directory or
17:23
at whatever source that that we import.
17:25
And it makes sense that you can click a button and it's actually
17:27
fixed in the, in the source system.
17:30
But anything that goes beyond that, like full workflow engines
17:33
with all models on top of that, synchronization jobs and so on.
17:36
You know, I'm, I'm, I'm really not going to, going to repeat
17:40
all of what has been built in, in the sale points and the one
17:42
identities and the model of the world.
17:44
They're, they're much better in, in that part.
17:46
They're great at what they do. The the focus of an IFAP is
17:49
really visibility in getting data in there as fast as we can,
17:54
providing analytical capabilities, building
17:56
intelligence on top of that. That's just completely different
17:59
than a a provisioning engine. So it seems to be like a, a, a
18:02
wise or maybe a scalable way to do this would be deploy an IVIP
18:07
and then let that collect all the information and then rely on
18:12
your, you know, orchestration components, right?
18:14
IGA, Pam, whatever it may be to then do the interactions with
18:19
those different systems, right, Joiner mover, Weaver
18:21
remediation, etcetera. But what IVIP sort of be the
18:24
brain that says, here's all the information.
18:26
Is that a fair characterization? Yeah, I think it definitely is,
18:29
yeah. And it's actually it's a
18:31
combination that we that we're seeing more and more with our
18:33
customers. So it depends a bit on on where
18:36
you start. But if I'm talking about those
18:38
organizations that, that come at this, this problem from a
18:41
security angle, the scissor says, yeah, we have to take
18:44
control over user access as well.
18:46
And they don't have an idea yet. Then it makes sense to integrate
18:50
all of the sources that I said before for the first time
18:53
typically and then look at where there are risks, remove those
18:57
things and, and really see this as a as a preparation for an IGA
19:01
deployment maybe. And then then you see that this
19:04
is used for the, for the control, the, the insides, the
19:07
the governance in the breadth of the, the, the whole landscape of
19:10
IT applications that the company has.
19:13
And then some of these choose to evolve this into a full IGA
19:17
deployment. Completely fair.
19:20
And all those choose, yeah, we're going to do the the
19:22
provisioning just for a selective core amount of core
19:25
applications with maybe something like an entire ID or a
19:28
lightweight provisioning engine and then combine those two in
19:31
that way. So there are many variations,
19:32
but the the core right now is that you've pulled apart these
19:35
things into separate products that you can deploy the one
19:39
before the order and in any order that you want to do that,
19:42
it completely makes sense and any combination that you want to
19:44
do that all fine. So we've got now like this IVIP
19:47
system that has all this data in it.
19:50
We're we're collecting data from where is it from systems?
19:54
Is it from cloud? Is it sort of like everything?
19:56
Do I connect like an HR platform with like people data coming in
20:01
like how does that work? Well, honestly, all of the
20:03
above. So we, we haven't seen one
20:07
single customer that is the same as as another one.
20:10
But there is there is some commonality of course.
20:12
So if there is an IGA, then definitely that is one of the
20:17
first things because it it contains a treasure trove of
20:19
information already. You don't want to repeat all the
20:21
connectors that don't have already been made.
20:23
So we take that up if it has a Pam a bit the same.
20:26
And then it, it really depends on where the customer wants to
20:30
go. So we always ask, hey, tell us
20:33
your top five, top ten, top 20 amount of systems from the
20:37
perspective of it contains information about who can access
20:40
what. So 9 out of 10 that starts with
20:42
Active Directory and enter ID. And then it kind of depends
20:45
which kinds of infrastructure are critical to their business.
20:48
So some of these run applications themselves, then
20:52
access to the admin database, so the service, the cloud
20:54
infrastructure, all of that. Others do development
20:58
themselves, so GitHub, GitHub, Azure DevOps, all of that.
21:01
Some run OT environments where you want to have access to
21:04
machines, to production lines and all of that.
21:06
Whatever is important, that's what you want to get in there.
21:10
And the HR system makes a lot of sense, especially for the
21:12
workforce identity, because the, the the data model that we
21:16
advocate is really put the workforce.
21:18
So the the the employee central from the HR system and link all
21:22
of the accounts of the different systems back to the employee as
21:25
as good and as well as you can to, to have that identity data.
21:28
Grab the dancers who can access what right now.
21:32
And then of course, for other types of of identities, the non
21:35
human, maybe the agentic identities in the future.
21:38
Yeah, that, that's different type of identities that also fit
21:41
in that same broad data model. So I was going to ask you about
21:45
how this how this extends to, you know, non human identities,
21:48
workload identities, whatever we want to call the non people part
21:52
of it. But I think he kind of answered
21:53
that. So let me, let me ask you
21:54
another question because I was thinking of this use case and
21:57
you know, I'm sure Jim was kind of thinking the same thing as
21:59
this. Seems like this would be really
22:00
handy in a situation where I have like a merger or an
22:03
acquisition. Because what I typically see is
22:06
like, OK, we're let's say we're buying a company, right?
22:09
We're acquiring something. You take over, you know, their
22:12
instances of all their stuff. And then maybe at some point you
22:16
figure out how you want to consolidate infrastructure.
22:19
Maybe it happens, maybe it never happens.
22:21
But it seems to me like there's a, a very good use case here as
22:23
well. If I have an IVIP that can see
22:26
both organizations, see all the identities, human and non human
22:30
across both. Now I've got sort of a control
22:32
point at the top that tells me who has access to what for both
22:35
of the organizations. Is that fair?
22:37
That's completely fair. It's actually a use case that we
22:40
see a lot and and also other variations of those use cases.
22:43
So you, you have the, the use case that you just said where a
22:46
company is acquiring another company and you want to have
22:49
rapid insights in that and, and, and then maybe clean up and
22:53
prepare the integration of the two systems, the two
22:55
infrastructures indefinitely. But at the same time, you also
22:59
have that similar use case in very big multinational companies
23:03
where, where the, the central, the the headquarters HQ says,
23:07
yeah, we want to control what the people in the US and and
23:10
Sweden are doing. Maybe.
23:12
But we can't really force them to work in the same way because
23:15
they've always been a bit independent.
23:17
But at least we should trust but verify, you know, so we're not
23:20
going to force them to use the same IGA system, the same
23:24
onboarding flows and all of that.
23:26
But at least from a security perspective, from a governance
23:28
perspective, from an IM perspective, you want to know,
23:31
are they? No identities that should be
23:34
removed. Do they actually do their lever
23:37
process correctly? Who exactly has admin
23:39
privileges, at least from HQ? Sorry, respect.
23:44
If you want to know that you want to have that control
23:47
without maybe putting too much barriers in the way that they
23:50
work. And it's all variations of those
23:52
use cases that drive IVIP. You know, in other use cases
23:56
coming to mind, I was just thinking about EIC last year and
23:59
Martin Koopinger talked about the identity fabric.
24:03
I just feel like IVIP would play a tremendously useful role, this
24:09
identity fabric concept. Have you guys thought about that
24:12
at all? Yeah, completely.
24:14
Yeah. So it's, it's, it's very similar
24:16
and plays a very big role in the in the vision behind identity
24:19
fabric. Because the the whole idea there
24:22
is that there's this control plane, like Jeff said, that is
24:26
on top of all the identity components that you might have,
24:29
all the repositories, all the the systems that are involved
24:32
there. And you see signals from one
24:35
system trade directions in another and, and, and this
24:37
really becomes a living thing. And all of that starts with with
24:41
visibility. And it's, it's really very
24:44
similar to to, yeah, a couple of weeks ago I was at at Gardner, I
24:48
am in London and they're Nathan Harris, one of the analysts of
24:50
Gardner, one of the guys behind IVIP and talked about where or
24:55
why they see this as a separate new thing.
24:58
And it talked about visibility, intelligence and actions that
25:01
you build your actions on intelligence and intelligence on
25:04
visibility. And that's exactly the same in,
25:07
in, in, in that concept, you want to build your actions, your
25:10
active components on top of something intelligent and that
25:13
has to have visibility on all the needed data.
25:15
So, yeah, very, very clearly related vision there.
25:18
Yeah, I'm, I'm really glad you laid out that last part with the
25:22
stack of visibility, intelligence and actions,
25:25
because I think when I talk to identity leaders, I mean, I hear
25:31
this, it's like, let's cut right to the actions.
25:34
And it's like, well, if you take action and you don't have the
25:38
right information or you have a limited scope of visibility,
25:42
then you're, you know, not starting from the right place.
25:46
You know, visibility is very important, and then you can
25:49
build intelligence on top of the visibility.
25:52
At the same time, I'm also hearing from you that there can
25:57
be specific use cases that you don't have to wait until you
26:00
have full visibility to get start getting some value out of
26:05
it. And that starts leading me to
26:07
think about, you know, how organizations typically go about
26:12
IVIP, right? Because everybody wants to start
26:15
and get that either that low hanging fruit or they want to
26:18
show value quickly. And I'm wondering what is the
26:23
typical scope of scope and size of the IVIP deployment when
26:29
people are wanting to test it and get value out of it.
26:33
Is there typical or is each one like a snowflake?
26:36
It's. Pretty unique every time because
26:39
no organization is the same, but the concept behind every
26:43
deployment of a limity is always that we first ask the manager,
26:47
the the CISO, the IM owner in charge, Adm manager, what are
26:51
the most critical applications or systems in your organization?
26:54
And it really depends on the business that they do, on the
26:57
architecture that they have and and and one of the strengths of
27:00
a limity is really that the platform specifically built to
27:03
quickly incorporate just any application with a very
27:06
extensive data model or extensible data model.
27:09
And then you work in iterations. But the first iteration that the
27:12
top five, let's say is pretty similar.
27:15
I called them before, mentioned them before.
27:17
It's Active Directory and Tri D and IGA, a Pam and HR system.
27:20
And then you grow really into those, those maybe more specific
27:26
areas of the organization like databases, development
27:29
environments, cloud environments, file environments
27:32
or data environments like a SharePoint, like file shares, OT
27:36
environments and all of that. And you bring everything there
27:38
together. And then the first goal is
27:40
really to have that, that, that visibility for the core security
27:44
team and, and often, well, in, in my opinion, one of the the
27:49
coolest parts or moments in any deployment of limited insights
27:52
is the first time that we get to demonstrate our platform with
27:56
their data integrated. The first time that these people
28:00
see that in the platform often is also the first time that they
28:03
just see this data integrated in in any case and they immediately
28:07
know. But look at look at this guy
28:09
Martin or Jim and look at his accounts see see see I knew that
28:14
this guy shouldn't be there anymore.
28:16
He left two years ago and I knew it wasn't it wasn't removed and
28:19
can you look man still admin rights in that cloud
28:21
environment. I know it and now they can make
28:23
it tangible, quantifiable. And those are the, the, the,
28:27
the, the most fun parts of any deployment.
28:29
The moment that it starts taking a life of its own that you see
28:32
that these people get these insights, they can start working
28:35
on that they can ask them manager, see, this is the things
28:38
that we have to fix. That's that's when you really
28:40
see this, this, this deployment start living, Yeah.
28:45
That sounds like an exciting moment when you can show
28:48
somebody like, hey, in the 1st 5 minutes, we added some value,
28:53
right? We identified some heavy duty
28:56
accounts that shouldn't be. I'm just wondering, like in it,
28:59
whenever I hear integration, whenever I hear connecting
29:02
systems, I think of, oh, that could be a bread, a bread box,
29:09
or that could be a wheat field. So what is it?
29:12
How do you connect systems and how big of an effort usually is
29:17
it? In in many different ways.
29:19
So for US, one of the the key things in our engineering, one
29:24
of the key values that the product really provides is the
29:26
fact that it's minimizes this effort to integrate
29:30
applications. And that means that like any of
29:33
of the IV players out there, we have this out-of-the-box
29:37
library, a library of out-of-the-box connectors where
29:39
it's just configuration to import data like from enter ID.
29:44
It's just a credential and, and an enterprise application and
29:46
that's it. But the, the coolest of the most
29:49
important applications are mostly not, not out-of-the-box.
29:53
And so there, yeah, all the variations and the, the things
29:56
that we've done in practices, we, we always try to think along
30:00
with a customer, whatever is the reason or the, the, the manner,
30:04
the, the approach that works best for them.
30:07
And for some cases it's, is it the SAS application then through
30:10
a Scheme API, hopefully we see that standard growing in, in the
30:14
market is definitely something that we see more and more has
30:17
the downside most of the times that the scheme API doesn't
30:19
really provide all the details that you would want from it.
30:22
So then the question becomes, should we do something more
30:24
dedicated if we don't have that connector yet?
30:27
If it's an on premise application, is there a
30:29
database? Is there maybe an export
30:31
functionality? In the worst cases, the the
30:34
craziest things that we've done, and this by far is, is the
30:37
common case. It's not something that we want
30:40
to do too much, but it's, it's even a robot protest automation.
30:43
So RPA on top of of browser and so on.
30:45
If it's really critical, you want to automate it and then
30:49
variations with CSV files sometimes and, and all of that.
30:53
But that, that's where you want to stay away from.
30:55
You really want to go for the automated import.
30:58
And then you look at AP is database integrations and, and
31:01
all of that. And the, the cool thing about
31:03
the, the idea of just collecting data is we, we ask an
31:07
application owner, right? Show us the application, show us
31:11
how you manage users in this application.
31:13
What concepts are in there? Those are the things that you
31:16
want to see in a limited insights as well.
31:19
If it's about users that have permissions into components or
31:23
modules or I don't know, whatever concept that the
31:25
application uses, those are the things that people will
31:27
recognize. That's the information that you
31:29
want to see in a limited. And then we just see, OK, where
31:32
can we get that information? Is there a clean API?
31:34
Then we get it from there and in a couple of days.
31:37
And that's really the the amount of effort that we're talking
31:39
about. It's just reading information.
31:41
We have a team completely dedicated to writing those
31:44
integrations. And now we DI definitely
31:47
customers can just do it themselves.
31:49
So it's it's if because it's just getting data, it's a much
31:53
easier analysis than the two way thing that you see in IGA and
31:57
showing the speed for days or weeks of an integration, not
31:59
more than that. Yeah, that's you brought the
32:03
CSV. That's what I always called the
32:05
lowest common denominator. Any system, any system can now
32:09
put a CSV. So you can pretty much integrate
32:13
to any back end if you go all the way to that.
32:16
But that's never the ideal scenario.
32:18
You want something that's more real time, a web service
32:21
connector or you know, as you mentioned, anything that is
32:25
specifically written as a out-of-the-box connector that
32:29
makes the technology side real easy, the political side, that
32:34
technology can't solve that issue for you folks.
32:37
So, you know, I wanted to go back a little bit to this
32:42
implementation. So the idea of, you know, how do
32:45
people typically start their deployment?
32:48
But I want to think maybe intermediary term like
32:50
intermediate term like 6 to 12 months.
32:53
And I want to know from you like what does success look like at
32:57
that point? OK, cool question.
33:00
I would say a customer has been as a deployment that a customer
33:05
has been successful for us. If after a year they say, yeah,
33:08
there are limited because of we using unlimited insights, we've
33:12
passed this ISO certification or at least this part.
33:15
And so that the access control part of ISO or a new SISO or or
33:19
or whatever reason, whatever they wanted to control, they
33:22
succeeded in in in proving that they're in control.
33:26
And if you ask about 6 to 12 months, eventually that's the
33:30
value that we want to give our customers.
33:32
But in most deployments we look at at value at at far shorter
33:35
time. So it's really about the top
33:38
five systems that I said before this, this should be in there in
33:41
a couple of weeks. And after one month, typically a
33:44
partner or ourselves, we we apply security controls things
33:48
like you have all the data together.
33:50
Then in our system you define variations of looking for
33:53
orphaned accounts or maybe who all has administrative accesses.
33:58
What about separation of duty findings, data quality issues,
34:01
all of that. You put that in there as quickly
34:03
as possible. So you can really remove
34:05
critical findings also within this time span of weeks or a
34:09
couple of months at the most. And then afterwards, yeah, you
34:13
see this these deployments growing.
34:15
I I would say in, in two ways. So on the one hand, you, you
34:19
grow in the amount of, of systems that you integrate.
34:23
You start with your top five, you go to the top ten, you, you,
34:26
you maybe sort the systems based on the amount of value compared
34:29
to the amount of effort and so on.
34:31
But then secondly, also you grow in the, the people involved in
34:35
this project. Typically the, the first people
34:39
that really use a platform like ours is a, is a security team or
34:43
a core IM team. If the company has that.
34:45
And it's people that are interested in who can now do
34:48
what and then understand the complete picture of all the the
34:51
roles, the groups, the permissions, the entitlements
34:53
and that and so on. And then if you start applying
34:57
these controls to that, at some point you see that these people
34:59
cannot make decisions completed them by themselves anymore.
35:04
You have to include line managers, application owners,
35:07
site owners, data owners, whatever the governance set up
35:11
of an organization is in order to decide can an account
35:14
actually be removed? Can we revoke groups from a
35:17
certain account and so on. And so that's how you naturally
35:20
see this grow from, from something that is used by a
35:24
selective amount of people into something that does, it somewhat
35:28
resembles access reviews, the same RE certification flow.
35:31
You include these people with very specific questions for us
35:34
from a clean up perspective. And then afterwards you grow the
35:38
next phase of maturity is that that these customers grow into
35:41
more structural governance. I like to to to call it where
35:44
you define ownership. You do regular reviews, maybe of
35:47
a bigger scope, not just of the findings of the security
35:50
controls, but maybe all of the accounts of a people of of of a
35:54
of a team lead, maybe all of the administration accounts and so
35:58
on. So it release it's growing step
35:59
by step and at every step in that, in that way you, you
36:04
improve risk, you lower risk, you improve your security
36:06
posture. Yeah, I think one thing that an
36:09
identity program leader needs to do is be able to talk metrics,
36:15
be able to talk ROYI think that requires some planning early in
36:20
the process. Like this is what resonates with
36:24
our leadership because I think a lot of you know, the the benefit
36:29
the security team is going to know like, hey, and you can
36:31
usually measure that and how quickly you can fall asleep at
36:35
night. Like I am not up worrying as
36:38
much anymore about, you know, our key systems we keep talking
36:42
about, but how do we talk about this in terms of ROI and metrics
36:49
to our leadership, to the people who approve the identity budget?
36:54
Yeah, in this case, some of the the more internal metrics of of
36:58
this, this, this project is the scope of the deployment, the
37:01
coverage of the critical systems and all of that.
37:04
But I think the eventual the, the the ultimate KPI there is
37:08
actually what you just mentioned.
37:10
It's it's Peace of Mind. It's it's provable control.
37:13
It's it's the fact that you know that an auditor will approve on
37:16
this way of working. Just if you say if you have a
37:19
full deployment of of a limited insights and you will be able to
37:22
say yeah, we have central visibility.
37:25
We have centralized all the data from our core application into
37:29
this one platform. We have our security team
37:31
looking at the data. There are controls automated on
37:35
top of that, they get notified if new accounts are found, if
37:37
new members of of critical groups are created without us
37:41
knowing. All of these things are are
37:42
actively being monitored. We run our access reviews, our
37:45
recertification campaigns. We include the necessary people
37:48
and you can even prove that you have processed all the changes
37:52
that come out of this process that that's in in total is is
37:57
what I like to call the provable control and that's the Peace of
37:59
Mind. That's the fact that you can say
38:02
as an IM leader or as a security leader, yes, we have things
38:06
covered here. And that's when you know this
38:09
piece of the, I don't know, whatever framework that we're
38:13
using, we have that covered do. You guys have any like case
38:16
studies or things like that there people can go and check
38:19
out and obviously, you know, plug the website
38:21
againrightalimony.com/IDAC, but do you have things like that
38:25
where people's like, OK, you know, this sounds great.
38:28
You know, let me hear from like a customer or, you know, client
38:31
story or things like that that that people can check out
38:33
Definitely. You already mentioned our
38:35
website so that that's also where I would would point people
38:38
towards. There are things like companies
38:40
of of several thousands of employees that really have to do
38:43
a lot with the small security team up to companies of 10s of
38:47
thousands of employees with IM teams of of 10s or hundreds of
38:51
people that want to strengthen their internal controls.
38:53
So all of these variations, all of the companies that we can
38:56
mention are mentioned on our website.
38:58
We got pretty deep into IVIP today and my last question for
39:01
you here is, I feel like it's still being somewhat understood
39:06
by the market and you know real identity practitioners out
39:08
there. What's one thing that you wish
39:12
more IM practitioners understood about this whole identity
39:17
visibility space that we've been talking about today?
39:19
I would say actually that people just know that there's a
39:23
solution for this, that that a thing like IVF exists.
39:28
So really just just stop thinking about Excel or Power BI
39:32
or all of these things about doing it yourself.
39:35
I would say if you're an I am manager, if you're a scissor, if
39:37
you're a security practitioner and you get to the point that
39:40
you think, hey, but but now who can actually do what within my
39:44
organization or which accounts actually exist or which do we
39:49
have any risks lying out there waiting to be misused?
39:51
And please don't waste your time with these manual PowerShell
39:55
scripts or all of the things that we have been doing for far
39:57
too long. Just know that there is now a
39:59
category of tools that can give you these answers with little
40:03
overhead. Know that we have your back and
40:05
that there's a much more scalable and sustainable path
40:09
forward than doing it manually. All of that.
40:12
I think that's such a great point to make because, yeah, I
40:15
think awareness and understanding and just knowing
40:17
that, hey, there is a tool for that.
40:19
It's kind of like, I always point back to I, I like Marvel.
40:22
And so Hawkeye, whether or not he's a superhero is is up for
40:25
debate, but he has an arrow in his quiver for everything.
40:29
So it's almost kind of like Batman has a toy for everything.
40:32
Just understand, like, hey, I, we don't necessarily, we might
40:35
not need to build this. Maybe it's the right solution,
40:37
maybe it's not. But just being aware that, hey,
40:38
these things exist is fantastic. Is this something so eliminate
40:43
itself? Is this focused on the EU
40:44
market? Is this something that's
40:45
available worldwide? How do people around the world
40:49
kind of, you know, take advantage of what you guys are
40:51
bringing to the market? Right now, we started in the EU
40:54
markets definitely, but we see especially the last two years
40:58
traction from just all over the Western Hemisphere, I would say.
41:01
So by naturally we're being pulled into the US also Middle
41:06
East, very strong attention there, I would say because of
41:10
very similar reasons as in as in Europe, there's very strong
41:13
regulation there from the the last couple of years,
41:16
specifically from Saudi Arabia if I understand it correctly.
41:19
And that really just forces people to think there we need
41:23
control and we need to show that we that we're in control.
41:26
And then the perfect opportunity for us is that say a bank and
41:30
insurance company, financially financial company, highly
41:33
regulated company, 5000 people, it has to do something fast.
41:38
That's where people come knocking on our door.
41:41
Very cool you guys. I mentioned, you know, we we met
41:44
at EIC last year in Berlin and you guys are kind enough to
41:46
bring, you know, some beer for for both of them myself, I know
41:49
Jim, you know, downed it relatively quickly.
41:53
But you were sharing a story when we hit, you know, before we
41:55
hit record kind of getting prepared for this episode.
41:58
Give us the behind the scenes of sort of your alimony branded
42:02
beer and maybe next. Steps yeah, OK so yeah, yeah,
42:07
it's a cool story so we now have our limited beer and.
42:11
And it actually all started with us thinking wouldn't it be nice
42:14
if if people would come over at our booth and we could share a
42:18
drink and it would just be a nice atmosphere and people
42:21
started talking to each other You, you, you, you, you stand
42:23
there a bit longer than you normally would just to meet
42:26
other people and so on and so now we have our own branded beer
42:29
which. Which people like, which I'm
42:32
happy for because it's actually a beer chosen by a whole team.
42:34
We went to a micro brewery in Belgium.
42:36
We let everyone taste what they like and then decide and voted.
42:40
So it's really something that represents a liberty.
42:43
But actually before that, so you had the beer last year at EIC,
42:47
the year before that we, we just had that ID just before EIC and
42:51
we didn't have time to, to make our own beer yet.
42:54
So, So what we did is we just bought, I personally bought 20
42:58
crates of a very good Belgian beer that I'm not going to call
43:01
by name right now because of what I'm going to tell you.
43:05
We put a sticker on it of a liberty, which is, I know,
43:08
somewhat grey zone, but people liked it.
43:11
They know the beer. We didn't hide the fact that it
43:13
was that beer. Everyone could recognize it and
43:15
it's a good beer. So people really said, Oh, Dad,
43:17
we we like this. It's it's a good, it's a good
43:19
way of keeping us here. And it was all fun until the
43:22
guys from that jewelry were at our boot.
43:24
And then when we then posted a picture of the beer with our
43:29
label on it on LinkedIn. The day after, I got this nice
43:33
and very formal e-mail from the legal department.
43:36
I think it's it's still the e-mail with the most capitalized
43:39
words that I've ever received. So we formally apologize.
43:43
We've never done it again. And then we went creating our
43:45
own beer. That's the story behind that,
43:48
yeah. I can understand that.
43:49
I'm going to guess that some of those words rhymed with like E&E
43:53
cysts or something along those lines.
43:55
Yeah, yeah, yeah. You know the e-mail?
43:57
Yeah. Jim, what'd you think of the
43:59
beer last year? And I guess, you know, hopefully
44:01
we'll get some more samples this year.
44:03
You know what, Jim? Tell me about the beer last
44:06
year, since you're a connoisseur of that space and I am not so
44:09
much. Well, I wouldn't call myself a
44:11
connoisseur. Maybe within our podcast team of
44:15
me and you, I'm more of a connoisseur than you are a beer.
44:20
It was a what I would say is like a classic Belgian beer.
44:25
You could there's just a certain taste that maybe it's the hops
44:29
or maybe it's the, the, the, the yeast that's used.
44:34
I mean, the, the classic story and I was talking to Martin
44:37
about this yesterday is that Belgian beers are very low Cal
44:42
specific. Often monasteries are where
44:45
they're created and they're created in the basements of
44:48
these monasteries that where they've been brewed for hundreds
44:51
or even over 1000 years. And they don't have to add the
44:56
yeast to the the beer. It's in the air.
45:01
And it just, there's something about a Belgian beer for me that
45:06
you just know when you're drinking it.
45:08
But the difference between a Belgian beer and like a German
45:11
beer, a German person told me, Oh yeah, the Belgians, they put
45:15
fruit and flowers and stuff like that, and their beer and German
45:19
beer is just like XY and Z is, you know, it stays more kind of
45:24
in, in his version of it, more true to what beer should be.
45:28
But me personally, I enjoy the variety of Belgian beer, like a
45:33
a cherry beer or something like that.
45:35
I'm like, yeah, let me try that. And usually I love them.
45:39
And this one is, by the way, very close to the monastery
45:42
beers that you mentioned in terms of types of beers in the
45:46
monasteries. You have this double sculpt
45:48
that's typically a very brown beer.
45:50
The one that we chose for is a triple, meaning that it's a sort
45:54
of way of brewing it with lots of herbs in it as well, giving
45:57
it a very specific flavour. Also a bit more alcohol than a
46:00
typical pint of beer, but very strong flavour.
46:02
And, and that's what we like. That's what we decided to go for
46:05
and have have had very good recommendations, a very good
46:09
feedback on that. So happy to hear that the rest
46:11
also enjoys it. Yeah, that's the other thing I
46:13
forgot to mention was that, you know, you drink 1 Belgian beer
46:17
if you think it's equal to like an American Coors Light or
46:21
something. No, maybe it's equally an
46:24
alcohol to like two or three Coors Light.
46:26
So be careful. So I guess the the danger now is
46:30
right. We've set up this beer for
46:31
success. I hope you have enough Martin at
46:34
your booth and you don't run out.
46:36
We continuously add more. So there you go.
46:40
Don't worry, don't worry. Well, I appreciate you coming on
46:44
the show. Definitely appreciate Liberty
46:46
sponsoring the podcast. You know, your support is why
46:49
we're able to do go and do things like EIC.
46:51
So definitely appreciate that. I want to plug the website
46:53
again, go to olimity.com/IDAC to get more information.
46:57
That's I'll have the link in our show notes, but it's ELIMIT
47:00
y.com/IDAC Martin, let me give you the final word before you
47:05
wrap up here. What if you know what is
47:08
something that you want Somebody who listened to this episode,
47:11
what should they take away from this conversation?
47:14
Know that if you're interested in knowing who can access what
47:17
within your organization, if you have an IJ, whether you have an
47:21
IJ or not, if this is something that really bothers you right
47:24
now that you're that you're crunching on, just come talk to
47:27
us. Come talk to one of our
47:28
competitors. I don't mind if we can help you.
47:31
Open here to help you. Happy to help.
47:34
So I'm going to have a link in our show notes for everything we
47:36
talked about today. We'll have a link for Martin you
47:38
on LinkedIn so people can reach out either with IVIP questions
47:42
or maybe beer suggestions or maybe a review of the beer if
47:45
you have it at EIC, you know, give Martin feedback after the
47:47
fact. You can find us on the web, IDC,
47:50
podcast.com, connect with Jim and I.
47:52
It's how we, you know, interact with everyone that's out there.
47:55
And yeah, we'll go ahead and leave it there for this week.
47:59
Thanks everyone for watching and are listening.
48:01
Thanks to everybody for sponsoring and we'll talk with
48:03
everybody in the next one. You've been listening to
48:08
Identity at the Center. We hope you've enjoyed the show.
48:12
Make sure to like, rate and review, and we'll be back soon.
48:16
But in the meantime, hit the website at
48:19
identity@thecenter.com. See you next time on Identity at
48:25
the Center.