Latest / Identity at the Center / #108 - About Passwordless with Kurt Johnson

Transcript

#108 - About Passwordless with Kurt Johnson · Identity at the Center

0:09
You're listening to the identity of the sender podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:29
center podcast. I'm Jeff.
0:30
And that's Jim. Hey, Jim.
0:32
Hey, Jeff, how are you? Oh, not so bad yourself.
0:36
I'm good, man. I was, I've been given thought
0:38
to podcasts. I listen to a lot of podcasts
0:41
outside of recording this podcast with you.
0:45
And I'm wondering what is your favorite podcast?
0:47
Other than identity at the center of course.
0:50
It's, I'll be honest, I don't listen to a lot of podcasts and
0:54
I barely listen to this show because one I record it, right?
0:58
So I'm here, I'm present for the conversation, I know what
1:00
happened, and then I edit it, which means I'm usually
1:03
listening to the show like three to four times.
1:05
So when I do listen to a podcast and it's the only couple that I
1:09
listen to right now, with any type of regularity, it would be
1:13
Conan O'Brien needs a friend and it's usually something around,
1:16
you know, comedy and him talking to folks and, you know, just
1:18
being Conan O'Brien himself and then the other one that I like
1:21
is I'm a big fan of Anthony Jeselnik.
1:23
So Anthony Cecil neck and Greg Rosenthal have a comedy podcast,
1:30
slash whatever is whatever you call it called the Jeselnik and
1:34
Rosenthal Vanity project Jr. VP So I listened to that you
1:39
know with with some regularity every at least every couple of
1:42
weeks or so. What do you listen to?
1:44
Well, I'm a big fan of the, the risky business podcast with
1:49
Patrick gray. I think, you know, if you're a
1:51
nerd in this space, you've got a, you've got a tune into that.
1:54
That it comes out every Tuesday, that's a fantastic one, where
1:59
they just pretty much talked about the infosec headlines,
2:02
mostly about companies that have gotten ransomware recently.
2:06
And then, of course, I'm a huge baseball nut.
2:09
So, I listened to the baseball America podcast, I listened to
2:14
one called 30 with murdie murdie, being a Yankees
2:19
broadcaster. There's some other identity and
2:24
access management As your podcast, I like to listen to
2:26
like the hybrid identity protection podcast, shoot,
2:33
there's a few others, there's one that was put out by the Sea.
2:38
So over at Microsoft called security unlocked.
2:43
And then there are a bunch that are put out by NPR which are
2:47
really radio shows that have become podcast as well.
2:51
Like This American Life Freakonomics, X hidden brain.
2:57
So those are just I would Marketplace.
2:59
Of course I in those are I don't listen to all of them every week
3:03
but that's kind of my listening list.
3:06
That's a pretty healthy list. I mean for someone who doesn't
3:08
listen to podcasts, you just named off like 700 different
3:11
shows. Yeah, well I'm hoping that
3:15
somebody can find a nugget there and but I definitely recommend
3:18
the the risky business podcast and anybody who's listening to
3:22
us on a regular basis. Also should should be tuning
3:25
into that. Right on.
3:28
So why don't we change this podcast over to may be talking
3:31
some identity? I think, you know, as we're kind
3:34
of talking with our guest that will introduce here in a second,
3:37
we were kind of looking at ideas on where do we take this episode
3:41
and we settled on the past present and future of strong
3:45
authentication, which I think is an amazing title.
3:47
If we do say so ourselves and the person who helped us come up
3:52
with that title, his name is Kurt Johnson, he's the vice
3:54
president of strategy and business.
3:56
Development at Beyond identity, and want to welcome you to the
3:59
show. Kurt Thank you very much.
4:02
Nice to be here. Jeff, Jim, great to see you.
4:04
Yeah, thanks so much for joining.
4:06
So the company that you work for Beyond identity Beyond
4:09
identity.com, it really plays in the strong off game.
4:13
So I'm really excited that you're here to kind of help us
4:15
understand. You know, what is strong off,
4:18
what does it mean? And maybe putting you know,
4:20
helping us understand what are the differences.
4:21
Maybe even the space because I think there are some things to
4:24
kind of consider around that. But as this is the first time on
4:27
our show we like to find out our guest origin stories when it
4:30
comes to Identity and infosec. So maybe you can kind of recap
4:34
you know your your career from a from a from our perspective.
4:38
At the identity level. How did you get into the
4:40
identity space? It's something that you chose or
4:43
did it choose you? Oh he definitely chose me has a
4:46
bit of an accident in a bit of an evolution at the same time
4:49
because I started in identity before we were even calling it
4:52
identity management. I actually spent years as an
4:55
industry analyst I was working with a company called meta group
4:58
that's now part of Gartner and One of the areas that I was
5:02
covering was the whole it service management and help
5:05
desk. And so, I was getting calls from
5:07
clients all the time around. What could we be doing to reduce
5:10
the number one called my help desk?
5:12
Which was password resets. And this company chorion was on
5:15
my radar as an early stage startup who was doing
5:18
self-service password reset. So I was digging into them to
5:20
see if this was real and really became focused on the whole Self
5:25
Service initiatives. And how do you reduce the burden
5:28
and pain for these poor help desk agents and people And as I
5:32
was kind of getting deeper in this and watching Korean kind of
5:35
just the launch itself from its early Beginnings, it kind of hit
5:38
me as well. That if I kept being an analyst
5:40
I probably would be one the rest of my life.
5:42
And I was kind of tired of being the Roger Ebert.
5:44
Wanted to be a Steven Spielberg, get my hands dirty on building.
5:48
So actually joined Curry on right when they were about 12
5:50
people. And as we started to evolve,
5:53
from password resets and talking to help desk people about this
5:57
great tool, that could reduce their calls as we were getting
6:00
deeper into the sale. Is cycle the security people and
6:03
cisos in particular, going, you're doing what with
6:07
passwords? So, tell me a little bit more
6:09
about this because, nobody's touching that is.
6:11
So, as we realized, we had to shift our sales strategy, to
6:15
really, appeal to the security side, and show this as a better
6:19
way of doing it than kind of people, right?
6:21
And sticky notes. And all of that and we were
6:23
looking at automating other tasks and doing this hitting the
6:26
joiners, movers lever. So built one of the first
6:28
provisioning systems. So we were doing all of His
6:31
provisioning and identity governance and administration
6:34
before we were calling it and then finally we started to see
6:37
identity management emerge and that's where we really started
6:41
branding around the term identity management when the
6:43
regulations and governance came along around who had access to
6:47
what we had this great system that was setting them up
6:50
modifying them and turning them off that we now had a basis of a
6:53
governance solution before we were calling it.
6:55
I never knew my identity governance and administration so
6:59
I spent 15 plus years of Curry on watching.
7:01
It from its early stages, we ended up selling it to a PE
7:04
company was involved in some tuck and Acquisitions and
7:07
actually merging it with core security which was time for me
7:10
to leave after that amount of time.
7:13
And I actually went over to a fin tech company, early stage, 5
7:16
person company doing, electronic payments and we were doing great
7:19
efficiencies and reducing cost and pain.
7:22
But I realized I really miss security.
7:24
I miss dealing with companies that were solving real problems
7:28
that you know, they were coming under attack and how Help their
7:31
businesses keep going. That after we sold this fin tech
7:35
company after a couple years, I immediately went right back into
7:38
security and joined an email security company focused on
7:41
cloud, email, security and anti-phishing.
7:44
But realized, I was missing the identity side of the house as
7:47
well. And it was great to be back to
7:49
security, but I always kept my eyes open.
7:51
And what was going on with the identity world.
7:53
And I think it was the in Glazer that said it's me one time, he
7:56
said, you know, identities, like the mafia you can leave but you
7:59
really can't. Do you think you We but it
8:01
brings you right back and I got this call about this company in
8:05
stealth mode that was looking to do.
8:07
Some really interesting things around eliminating passwords and
8:11
I had to listen and it was pre-revenue.
8:16
So to be part of a stealth company sound incredibly
8:19
intriguing, the co-founders are Jim Clark and TJ, German lock
8:23
and Jim. And TJ just have this incredible
8:25
history of starting companies and, and building them into
8:30
absolute name. Like Silicon graphics, and
8:32
Netscape and at home networks and WebMD, and to be part of
8:37
working with alongside them to start this company, and then
8:41
frankly to get back into identity, really kind of Drew me
8:44
in. So came back in around, January
8:46
of 2020 and, you know, I'm back. So, I feel like somewhere out
8:52
there. There's like this identity
8:55
Boogeyman, and they like, left the identity horse, head in your
8:58
bed. So, when you thought you were,
9:00
you're out, All of a sudden you wake up and I up now, I'm back
9:03
in, I'm back into security, never mind.
9:05
And this is how we know each other.
9:06
So we actually go back, you know, this makes me feel old
9:10
like 15 years or so, because I was actually a customer of
9:12
Korean at one point and, you know, I'm absolutely one of
9:16
those people was like, all right, we're having trouble with
9:18
passwords, right? And this is pi like the early
9:19
2000s and Koreans. One of the companies we reach
9:22
out to and ended up kind of, you know, going with going with them
9:25
and helping us with a variety different things.
9:26
So we kind of go back from that perspective.
9:28
So it's always fascinating to kind of think.
9:31
About where where you might be, you know, decades later and the
9:35
relationships that get made. And, you know, this is why I
9:38
think you never burn Bridges, right?
9:40
Andrew, try to put yourself off in a into a professional mode so
9:44
that because you never know what's going to happen.
9:46
And especially I feel like in the identity space is such a
9:48
tight-knit group, where, you know, we see a lot of people who
9:52
move from organization to organization but, you know, it's
9:55
always ever-expanding but there's a lot of familiar faces
9:58
that you'll see over time, you know, the longer you stick in
10:00
the business. So Always great to see folks
10:02
from Korean and or I should say the band formerly known as
10:05
Corian. So we were still have it today.
10:08
I was at identify verse few weeks back and it was like old
10:12
home week. You know, just seeing all these
10:14
all faces different companies. Perhaps.
10:17
But yeah, it really is. And it's been interesting to
10:19
watch to is identity, and has really become far more prevalent
10:23
and Security in the early days, it was kind of like, you felt
10:27
like the outsider, but now it's like we're sitting at the cool
10:30
kids table in the cafeteria. Yes, darn straight, I love it.
10:34
So, I've been hearing that the passwords been dead for four
10:36
years now, I think like Bill Gates said, like a decade ago,
10:39
it was dead and we keep hearing every year that it's dead.
10:41
And I think that's really kind of where we're heading now,
10:43
right? Is this really?
10:44
It's not dead. It's really the strongest
10:45
indication play. So, when we talk about the past
10:49
present and future of the fun ocation, it probably makes sense
10:52
to kind of start with the past and understanding, you know,
10:55
where have we been? And we all know passwords suck,
10:58
where are we now and then, what's next?
11:01
East right, maybe maybe can kind of take us through that Journey
11:03
a little bit here to kind of level set the conversation for
11:05
folks who are listening. Yeah, it's amazing to think it
11:08
was kind of being the early 1960s that passwords were first
11:12
introduced at MIT and working within kind of these data center
11:16
environments and they served a purpose to enable more controls
11:20
and security around access. But then when we hit the 1980s
11:24
and said our co-founders, Jim Clark and TJ Journal up, you
11:27
know, Jim was the co-founder of Netscape, and Jim was the Our
11:31
gym was the founder of Netscape and TJ the CEO founder of at
11:37
home networks, which was the first Broadband provider to the
11:40
home and the two of them play a large part on making the
11:44
internet accessible to like everybody and passwords just
11:48
exponentially grew and proliferated to the hundreds of
11:52
thousands even Millions. So, by the time, the 90s came
11:56
along, that's where the focus was all on.
11:58
Well, we have to make them harder and longer and And higher
12:01
entropy to make them, you know, rotate them more frequently in
12:04
expire because as more passwords came or password theft came, so,
12:10
yeah, you really look at passwords and you talk about how
12:12
much they suck and they suck for just about everybody except for
12:15
the attackers, right? Cuz because you don't have to
12:18
break in anymore, you can just log in and password reuse and
12:23
misuse and getting stolen left and right.
12:26
I mean, we've really just created this environment where
12:29
the vulnerability and risk is Other than ever before and so
12:33
then we've kind of moved into the Band-Aids.
12:36
So we created password manager. So you could at least have one
12:39
place to go and let them recycle and move your passwords.
12:42
But how did you access the password manager?
12:45
Well, with the username and password so now the compromise
12:47
could open the door to even more attack.
12:50
So Along Came are good friends, multi-factor authentication, and
12:53
two-factor authentication, which the idea was that this plurality
12:59
of security measures could hopefully increase the overall
13:03
security but really what we saw was a significant increase in
13:07
friction for the end-user waiting for a code or needing a
13:10
second device or on my phone. I had a have a folder prior to
13:15
Beyond identity with a bunch of multi-factor authentication
13:19
application. So where do I use authy?
13:21
Where do I use? Microsoft authenticator a few
13:23
Salesforce authenticator over here.
13:25
So, you know, it's no doubt we've seen the adoption of MMA.
13:31
Be so low. I think 451 the research company
13:34
says around 50 percent adoption. IDC told us it was closer to 30%
13:39
and their eyes, which is significantly.
13:42
Less than any other security functionality like firewalls are
13:46
intrusion detection or even endpoint, which is hitting 90%
13:50
plus. And why is that?
13:52
I mean, the friction and experience for end users, as I
13:56
said, is painful, and they're also complex and expensive to
13:59
deploy. So even where you see there,
14:01
Deployed. It's often just for a subset of
14:03
users or capabilities, you know, maybe just for remote access
14:09
maybe just for our privilege. So I think as we've created this
14:13
environment where we're putting more and more of these multi
14:16
factors, it's kind of where we are today.
14:19
This this world of whack a mole has to stop where the
14:22
overwhelming majority of attacks are still based on stolen and
14:26
misuse credentials. The world economic forum's that
14:29
over 80% and Verizon is Over 60% but name your number.
14:33
It's a lot, right? And as I said attackers, don't
14:36
need to break in. They just log in and if this
14:39
critique vulnerability of this credential is being used.
14:42
As a matter of fact, valid credential misuse is that the
14:45
source of these attacks. So it is real passwords that are
14:49
getting stolen and misused and guests and you know it can't
14:53
continue you know the reality is were as vulnerable as we've ever
14:57
before. So with traditional MFA, you
15:00
know, The password still there, it's still exist as part of that
15:03
equation. And we created this Band-Aid to
15:06
deal with what's become an open wound in organizations.
15:10
And, you know, maybe you don't use the password, you're using a
15:13
magic link or something else or an SMS, but now these are coming
15:17
under attack. So are they more secure?
15:20
Sure, but does it really slam the door on credential attacks?
15:24
Not really? And as matter of fact, it's
15:26
opened the door to other kinds of attacks.
15:29
So you know, we have removed SMS and then also on SIM card
15:33
swapping took place. We have email links but email
15:35
gets compromised we had the attackers doing these push
15:38
attacks where if you hit the organization which with enough
15:41
notifications and pushes with an OTP somebody's going to click.
15:44
Yes that's me. So we've done all this and
15:48
create greater user friction than ever before.
15:51
Clearly we know we have to change, right?
15:54
And so that's why, I think where we are today, we're seeing the
15:56
rise in early password list initiatives, you know?
16:01
There's the Fido Alliance. There's a lot of things that are
16:03
trying to bypass the password and I think we all have to agree
16:07
the password has to go, which is creating rise in these new
16:11
approaches but at the same time really are we eliminating
16:15
passwords or we just kind of making them you know, less part
16:19
of the equation. So today, you know, you start to
16:22
hear more, you know, we've been talking about identity is the
16:25
new perimeter for a while. Now can't really call it the new
16:28
perimeter anymore because we've been talking about a Enough that
16:31
that statements even become commonplace to.
16:34
But if you think about it, I believe that even the notion of
16:37
a perimeter is wrong. It's the idea that things inside
16:41
We Trust, while those outside, we do not and authentic, I heard
16:46
this used, I think by 451 research as well that
16:49
authentications is like a bouncer at a nightclub, but once
16:52
you get past the door, you could do whatever you want inside the
16:55
club. So it really is forming to, you
16:58
know, that's where we are. Where do we need to?
17:01
To get to, and that's really leads to what's next.
17:05
And what does this ideal solution?
17:07
Look like, which was really behind the beginnings of our
17:11
company? You know, when we started to
17:13
look to form Beyond identity, we looked out in this environment
17:16
and all the pain and the friction for end users, but also
17:20
the vulnerability for organizations.
17:22
And when we looked at what does Modern authentication look like,
17:25
we know it had to eliminate passwords, we know you have to
17:29
pass itive, leave a Date the users in the devices, they're
17:33
on, you need to make it easy for users to gain access and not
17:36
create friction in that process. While at the same time, reducing
17:40
it, and support costs. And that kind of leads to kind
17:43
of the beginnings in the thoughts around things like
17:46
zero, trust and really kind of where we are.
17:48
You know, bottom line, regardless of who you are, where
17:51
you are, what device you're on, what you're doing.
17:54
You should be going through an identity system to authenticate
17:57
and authorize what you're doing, but I think it needs to move.
18:01
Move more to like a toll booth rather than a toll bridge, which
18:04
is where we are today. Push everyone through a VPN,
18:07
check the traffic, check the devices, it's not wrong, but
18:11
it's very hard, very expensive. And you don't have to do that to
18:15
really get a good understanding of who the person is and the
18:19
device they're on and what they're trying to do to create
18:23
stronger authentication. So we need to move to an
18:26
environment without passwords making it easier.
18:29
And the big part is that it's not a And done, it needs to be
18:32
continuous. You can't just look once and let
18:35
that person in. But you need to be kind of
18:37
looking at what's going on on a continuous basis with the
18:40
ability to take action and deny that authentication.
18:43
So, you know, we talked a lot about, you know, where we're
18:46
going and, you know, the bottom line is, you can't have zero
18:48
trust. If you still have the password
18:50
and if you do, you're already starting with a fail.
18:53
Yeah. I think that the passwords, an
18:55
obvious weakness, right? I mean, we used to call it a
18:59
cottage industry to to get these credentials and sell them on the
19:03
dark web was reading an article prior to starting.
19:06
This recording is the headline article and dark reading.
19:09
The average cost to buy access to a compromise company $1000.
19:15
So that's not even a cottage industry, right?
19:17
That's a thrift store. That's, that's Walmart, you
19:21
know, or a blue light special for going out and getting access
19:25
and included in that is thousand dollars.
19:28
Gets you credential to a VPN or two?
19:31
RDP. So if you're not at least using
19:33
multi Factor, we said this a million times on the show, you
19:36
need your absolutely need to be using multi Factor but, you
19:40
know, to kind of play on what Kurt was talking about is, you
19:44
know, with that zero, trust methodology or mindset?
19:47
It's, you know, everything's happy cover.
19:49
If you can, you can't just think about it from your external
19:53
points of Entry. But, you know, Kurt, I think
19:57
you're, you know, you gave a really good overview about the
20:01
Past present. Future.
20:02
Think the future is your trust. Your trust is also right now.
20:07
But, you know, I think and I think, look, if you're listening
20:11
to this show, you probably already are like, okay guys?
20:13
Yes, you you've beat this into us, we know the password socks,
20:17
right? If not a is not a strong enough
20:19
control in this day and age, and I think everybody would say, if
20:25
I could flip a switch and get rid of the password, I would do
20:27
it. But it's It's hard, right?
20:32
Or maybe you're going to tell me.
20:33
It's not hard, but I'm thinking. Okay, I've got an Enterprise.
20:36
I've got hundreds of systems, I've got different entry points,
20:41
I've got some new technology. I've got some Legacy, I've got
20:44
Cloud applications. Do I need to be pastoralists or
20:50
do I need less passwords? Yes, it's a great question and I
20:54
think it's, I saw a survey that said that the average businesses
20:59
are as 191 passwords. And I was challenging that on a
21:04
road show, we were doing with C so event and all of them started
21:08
talking up going. Oh yeah, I looked at my password
21:10
manager, and I've got 300 or, I've got 290, and I think some
21:13
estimates are so for 300 billion passwords.
21:16
So passwords have Truly, I mean, this day and age, kind of
21:19
launching a company during a pandemic, which wasn't really
21:22
part of our original Playbook. But a lot of things in
21:24
perspective, but I think the rough analogy is that passwords
21:29
are a virus. You know, they have spread like
21:31
crazy and 300 billion of them out there, you can't just wipe
21:35
them out overnight, but at the same time we need to, you know,
21:40
we need the herd immunity. We need people to be taking the
21:44
steps to the approaches on what you can really do.
21:47
And I I think that's where the term password lists and the
21:51
industry has a number of different kind of players
21:54
approaching this and we really are trying to distinguish
21:58
between password less as one word versus two words or
22:02
password Dash less. And that password list isn't
22:05
just avoiding the use of a password.
22:08
You know it the term is meeting a broad set of things but we're
22:12
not trying to just eliminate it from the end user side.
22:16
I mean, the whole definition of a password as part of shared
22:18
Secrets, right and shared Secrets, there's that one person
22:21
and the other side know it. So if the individual knows it
22:24
and it matches what sitting in the database of a system or a
22:28
directory, then we will bless that but that gives you the
22:31
opportunity of tacking either side.
22:34
So if you just kind of eliminated from the end-user, it
22:36
still exists of there. It's still something that can be
22:38
stolen. They can get at it.
22:40
They can use it for another account where it's being reused.
22:43
And even if you make a more difficult password that He'll be
22:48
entered in a phishing attack as well.
22:50
So I think it's important we're we're we're talking about this
22:53
that the opportunity and the capability to truly eliminating.
22:56
The password does exist, but you really want to look at what are
22:58
you replacing it with? And if you can look inside the
23:01
architecture and Stevie that a password, still exists anywhere
23:06
could you real, you know, or that still a vulnerability or,
23:10
or did you replace it with something such as asymmetric
23:13
cryptography or public keys and binding them to the device and
23:17
carrying thing that with your identity, I think this was our
23:21
thinking behind starting Beyond identity in the first place.
23:23
It's about eliminating the password, but finding that
23:28
device and identity leveraging existing proven technology
23:32
around asymmetric cryptography and digital certificates, but do
23:36
so, in a way that you can make, this government level security
23:39
available for the masses and make it easy to deploy, which
23:43
has not traditionally been the experience of many, who dealt
23:46
with pki or it'll certificates, but that capability does exist.
23:51
We need to really look at how we can apply that part of.
23:53
It was when we even launched our solution, we give the password
23:57
list authenticator away for free because that's just piece of the
24:00
equation. Let's do our best that we can
24:03
actually help eliminate the passwords out there and really
24:06
eliminate them from the system. But with 300 billion of them out
24:09
there, we know that's going to be a pretty big task could take
24:11
some time. So I think there's a lot of
24:14
different kind of definitions around password lists and
24:17
especially when it comes to kind of the, the different vendors
24:20
that are out there, right? So you're one of several that at
24:23
least that I know of and I'm sure there are others that I
24:25
don't know, of when it comes to strong as education and trying
24:28
to remove the password. Is there a common approach that
24:32
vendors in this space kind of look at as far as okay?
24:37
Is it really eliminating the password or is it obfuscating
24:40
the password somewhere behind some sort of?
24:42
Hidden layer that it still exists but maybe you're just not
24:46
a you know not aware that it's there.
24:49
How do I guess? As an industry perspective, how
24:52
our password list companies coming at it because then I
24:55
think what I like to talk about next would be okay.
24:57
So, you know, why are you special, right?
25:00
What's the difference in the way that you guys are approaching
25:02
it? Yeah, I think it's part of the
25:06
concern. I mean, obviously because
25:08
passwords are so horrendous, the idea of password list, Is a
25:13
catchy phrase. It's hate to say buzz word but
25:16
that's truly kind of what it's becoming and I think it's, it
25:19
makes it challenging for those looking at potential solutions
25:22
to really distinguish between them because there is a lot that
25:27
an organization has to do to really understand their goals
25:31
and initiatives. But also what the capabilities
25:33
because there are a bunch of password list Technologies,
25:37
which I would just say are ways of bypassing them and using
25:40
something instead of a password But that password, absolutely
25:44
still exists. And you know magic, links SMS,
25:47
all of those are ways of kind of avoiding a password.
25:50
I look at my banking application that I use on my iPhone.
25:53
I use face ID to get into it but they're still a password,
25:56
they're all, it's really in the passwords.
25:58
Even taking place in the authentication sequence.
26:01
That's starting with face ID. So that's where I was saying
26:05
before. We really have to look at the
26:08
just making it less visible or less used by the end user.
26:12
Versus absolutely eliminating it all together and make part of,
26:17
even the naming of our company Beyond identity was like it has
26:20
to go beyond just the password list angle.
26:23
But since a lot of it is just the bypass it from the user
26:26
experience. As far as saying you really have
26:28
to look at into the architecture.
26:29
And can we truly eliminate it? And that's been our goal is that
26:33
we really want to eliminate the passwords and all the risks and
26:36
vulnerabilities that go with that.
26:38
But doing so in a way that makes it a true secure authentication
26:42
capabilities. Eddie make that government level
26:44
security available to the masses and that was when we were kind
26:48
of looking at the market, you know, it, when we first went out
26:51
there, we had a lot of debate to not even call ourselves password
26:54
list, because we didn't want to be just lumped in with a bunch
26:57
of kind of convenience Technologies for on users.
27:00
Yes, eliminating friction for the end user and improving.
27:03
The experience was absolutely Paramount to what we were trying
27:06
to do but the purpose and the goal was really to create a
27:10
security solution and really bring that that to the realm of
27:14
identity. Not just to kind of Change it in
27:18
the sequence for the end users. So I really think that's you
27:21
have to take a look at that from an architectural standpoint.
27:24
Are we really eliminating them or we just kind of not making
27:28
the end-user use them as often. So I think it's really
27:31
interesting because you know I see a lot of these Technologies
27:34
kind of you don't come across are at least my view of it and
27:37
you know asking us to look at it and provide thoughts, Etc.
27:41
And that's one of the first Quest I usually ask is.
27:42
Ok. So where's the password, right?
27:44
Because usually there is still a password somewhere.
27:46
So if I'm listening and hearing what you're saying, it's your
27:50
actually eliminating the password, there is no password
27:53
in play which immediately piques my interest, so I guess help me
27:57
understand. You know, we definitely, you
28:00
know, try not to do commercials for any specific product.
28:02
But I think this is an important distinction here, where I'd like
28:05
to understand the approach that you guys take from a product
28:09
perspective when it comes to Beyond identity.
28:12
And going, truly password lists, how do you do that?
28:16
Yeah. So really what we did was we
28:19
took a look out there and really looked at how could we take
28:25
battle tested proven technology and extend that down to the end
28:29
user and their device in the expend, the authentication
28:32
experience. So coming back from, you know,
28:35
our founders with Jim when he founded Netscape, that was the
28:39
first creation of SSL. You know, the little lock in the
28:41
browser to hair agama. Who's the father of SSL?
28:44
Sits on our Advisory Board? I had been working with Jim back
28:48
in that day as is Marty Hellman of diffie-hellman Fame and when
28:52
you really looked at these core technologies that are in place
28:55
and over the last couple decades, really haven't changed
28:57
that much. SSL is now TLS encryption but
29:00
still using x.509 certificates and that is how all I mean,
29:06
that's what secures trillions of dollars of transactions.
29:09
Every day on the web, that kind of in the old way, we have the
29:12
user have a password to access these machines.
29:15
But the machines use certificates.
29:16
Gets to interact with each other.
29:18
Technically private Keys verified through certificates to
29:22
validate that when you made a purchase on Amazon with Paypal,
29:26
that it was really PayPal on the other end that Amazon was
29:28
communicating with. And so we looked at taking that
29:33
technology and really just extending that down to pull the
29:37
end user and their device into that chain of trust.
29:40
And that what we recognized was that you know, kind of back in
29:45
the old days, it was kind of a Quest ask for anybody to want to
29:48
be a certificate Authority for every end-user out there and
29:51
frankly there was no place or nothing to do with a private
29:55
key. But come today, where you now,
29:58
have these devices that have the TPMS and secure enclaves, which
30:04
provide a perfect and secure way of housing that private key.
30:09
And we've created this notion of a personal certificate
30:11
Authority, where every end user could be their own CA without
30:14
knowing, what a CA is, or Even does.
30:17
And so, we're not Reinventing any cryptographic protocols or
30:20
algorithms, we're using these time-tested proven capabilities
30:25
to pull that end user and the device into the equation and the
30:31
process is that the end user gets the Beyond identity
30:35
authenticator on their device. They register that initial
30:39
profile and basically what you've done is, created a
30:41
certificate chain, where the identity is the root of that
30:44
chain and the devices are just different Things on that.
30:47
So what that does is allow the end user to extend that chain
30:52
with various devices. And no one device is dependent
30:55
on the other. So unlike traditional pki, where
30:58
you remove one node and all the children, go along with it, this
31:01
allows you to prune that tree and extend that chain, you lose
31:04
one phone. You can use any other device to
31:06
extend that and create a extension of the certificate
31:11
chain, on a new device without calling it help desks or
31:15
administrators. And so being on that device
31:19
offers a lot of interesting aspects, you know, we can
31:22
actually interact with that device to assess the trust of
31:26
the device. At the point of log n, and by
31:28
being on the device, it can speak to the security of the
31:31
device itself. When that end user is logging
31:35
on, you know, by anchoring the key in the hardware, you
31:39
eliminate the mobility of that key.
31:41
As a credential, can't leave the device.
31:43
It can't be ported from that device.
31:45
We disrupt the Roll movement or disrupting valid credential
31:51
misuse by housing, it in that security p.m. but recognizing
31:55
one of the benefits of passwords was the portability that you can
31:58
be used from any device and still have that happen.
32:02
We brought all of that down to the Beyond identity solution.
32:06
So leveraging standards like x509 and TLS creating a notion
32:10
of a personal certificate Authority, making it easy for
32:13
the device itself to authenticate.
32:16
And thus, it's the analogy is, it's like, airport, security,
32:20
you have to show an ID. So we know it's really Jeff for
32:23
its really Jim. We then still have to go through
32:27
the intro of the metal detectors.
32:31
Do the same thing with authentication.
32:32
Make sure it's you make sure it's your device, but make sure
32:35
that device is trustworthy at the plate of authentication.
32:39
So Curtis a conceptual of ones and some of those PK is of quite
32:43
frankly goes a little bit over my head.
32:46
So, Is definitely very technical conversation, right?
32:50
But at a conceptual level, you mentioned The Binding of a
32:54
device. So, how does The Binding of a
32:55
device to a human improve? Or strengthen?
32:59
That authentication experience. Yeah.
33:03
When you really look at it that the device itself as opposed to
33:07
just being familiar like oh I've seen Kurt use this device before
33:11
or it's part of a database, the strength of actually binding and
33:14
identity in a device together. In my opinion, kind of becomes a
33:18
building block of of zero trust. You know you verify the
33:22
identity, you actually bind it to the device that it's trying
33:25
to access and then that can be transmitted and carried with you
33:28
throughout the Journey of the transactions.
33:31
If you look at most two attacks today, they're really hitting on
33:35
those two factors, right? They're either trying to
33:36
compromise the identity and pretend they are.
33:40
Somebody. They are not really through
33:43
stolen passwords or other even attacks on MFA.
33:46
They're going after the device itself, whether that could be
33:49
malware or, you know, laying ransomware down through that.
33:53
So, most zero, trust initiatives that we've started today are
33:57
kind of looking at the various components, a single-threaded
34:00
indicators of risk, you know, is this Kurt.
34:03
But what if Kirk's trying to access from a computer in the
34:07
library? That's covered in malware and
34:10
don't know who's been used it before or it's my kids laptop
34:14
with Tick-Tock and everything else on it and do.
34:16
Know if that thing's been compromised.
34:18
So you also have often seen a lot of organizations, especially
34:24
3 went to the whole work from home through this pandemic,
34:27
really focus on mobile device management.
34:30
MDM or end point detection and response EDR tools because they
34:35
needed more visibility into those devices and what was
34:37
coming in or pushing them through the VPN.
34:40
But many of those are very intrusive technologies that go
34:43
beyond in enable you to really see a lot The information and
34:47
data on those devices. In frankly, putting cameras in
34:50
dressing rooms can cut down on shoplifting, right?
34:53
But do we really want to have that as a mechanism for
34:56
security? Some people feel the same way
34:59
about these. I don't want this on my personal
35:01
device. So, you know, from our
35:04
perspective, it was like, let's bring these factors together and
35:10
really completely change the notion of having just looking at
35:15
the security posture. Juror is disk encryption on his
35:18
firewall enabled. Is it a personal device or a
35:21
corporate device? Is that been jailbroken?
35:23
Is it that malware running on it?
35:25
But bringing that at the point of authentication.
35:28
So that's why I was saying it's like the airport analogy.
35:31
I know it's me. I also know it's my bag and I'm
35:34
going to screen that bag. But unlike airport security, I
35:38
want it to be done without friction.
35:39
So from an end-user have launched an app, this runs in
35:42
the background making sure passes all that but we can
35:45
actually At the point of authenticating verify that only
35:51
a laptop with disk encryption enabled can access patient data.
35:54
And if it's personal device, maybe it just should get office
35:57
suite or email, but I wanted to be a corporate device of
36:00
corporate managed device that has more of this secured
36:03
lockdown capability before accessing AWS or, you know,
36:09
GitHub or any other more sensitive applications.
36:13
That's really is kind of where we need to evolve this too, and
36:15
that's what we feel. So when we can really kind of
36:17
make those one and bind those together, it's a lot different
36:21
than just looking at them as individual statistics and then
36:23
you can look at things like the location in the network, you
36:26
know, if I know it's Kurt's device and it's trustworthy at
36:28
the point of authentication. Do I really care if it's coming
36:31
from a Starbucks that I haven't seen before?
36:33
Because I have good high assurance.
36:35
And let's look at the rest of the indicators from like a
36:38
behavioral analytic standpoint. So what somebody's doing is it a
36:43
risky action? Is it looked a typical than what
36:46
they do then Yeah, but it's like them re-verify or let them step
36:49
up the authentication. So I do believe there's all the
36:53
aspects of kind of really looking through the broad zero
36:55
trust but this notion of really kind of bringing that identity
36:58
and the device together as one, we just feel greens, such a
37:01
higher level of assurance that then doing that in
37:06
authenticating with the asymmetric cryptography and
37:08
certificates, and not a password.
37:10
The end user doesn't even know what's happening behind their,
37:12
you bring. It's one of the rare times we
37:13
can bring higher level security and better.
37:16
Our user experience at the same time.
37:19
I feel like this is an area that couldn't exist, you know, a
37:23
decade ago. I feel like this is an area
37:25
where the modern advances in technology.
37:28
And the, you know, the sheer power of computing, right?
37:31
That you have at your fingertips, at these days,
37:33
right? Is your phone might be the most
37:36
powerful device you have, you know, in your, in your entire
37:40
life, right? It might be stronger than even
37:41
your computer. And when we start talking about
37:44
cryptography and being able to act, as you know, certificate
37:48
Authority, Like this is this is the type of stuff you weren't
37:50
going to see on your old you know, Blackberry or Windows
37:54
phone or things like that. And you know, I think this is
37:57
where the zero trust part comes in as well, right?
37:59
We're talking a lot, a lot of things you just described are,
38:01
you know, typically what I see like under conditional or
38:04
adaptive authentication rules, right?
38:05
Taking a bunch of different signals and then figuring out.
38:09
What do you want to do with that information, right?
38:11
Is it safe? Do you re you know, do you meet
38:14
the level of assurance that you want and maybe there's different
38:17
levels of assurance? Yeah, I'm fine.
38:19
I'm trying to get to the cafeteria menu, who cares.
38:21
Right. But would it be wide open?
38:23
But if I'm trying to get to the secret sauce for or the, you
38:26
know, the recipe, for KFC chicken, right?
38:29
Maybe there's a few few more Hoops.
38:30
They need to jump through before to get to that.
38:32
So I think it's interesting that I feel like the, the advances in
38:38
the technology space have definitely enabled this because
38:41
I go back to the original statement.
38:42
I says, well Bill Gates said the Passover is dead like 10 years
38:44
ago but I don't think it really could have been.
38:47
I think what he meant real is, you know, the Password is really
38:49
hidden behind something else, right?
38:51
Biometrics, you know, whatever it may be.
38:54
So I think that's kind of where I've seen the industry go, but
38:57
I'm also a little bit of a skeptic.
38:58
So, you know, I hear all this cool stuff.
39:01
I want to go password less but I also hear from a lot of
39:03
different vendors and I think this is where the distinction
39:05
comes into. So you know, Microsoft, you
39:08
know, touts password list through Windows.
39:10
Hello, you know, Apple has it through their various mechanisms
39:13
of teach it, touch ID and face ID and if I'm a skeptical C, so
39:19
You know, I guess the question I'm going to ask is, ok.
39:21
So what is the value proposition here?
39:24
Why do I need an ad on a syndication product?
39:27
Like a scoreless, when Microsoft or octave or ping or whoever?
39:33
Right is telling me they already have this as part of their
39:35
solution, is that something that you can kind of help me
39:39
understand that context. Yeah, absolutely.
39:42
I think obviously with the risk and vulnerability of passwords,
39:47
this is an industry-wide movement to reduce that risk as
39:51
much as we can. And everybody kind of trying to
39:54
get into to help support. That is a good thing though,
39:58
that's where I was saying it's but it goes beyond that, you
40:01
know, just the elimination of passwords, it's a critical
40:04
component to it but this notion of zero trust and device
40:11
Evidence and security posture are critical aspects, that take
40:15
that Beyond just kind of an authentication experience.
40:19
And I think that's kind of been our different approach from a
40:22
lot of the philosophy that you shouldn't have to have to pick
40:25
up a second device in order to log in and even that of does
40:28
avoid a password. Yeah, that's great.
40:30
But we can bring that even one step further in our goals and
40:34
initiatives out there as an industry being on that device
40:38
gives the additional benefit of a better use.
40:41
Our experience then you're right.
40:43
We before we had TPMS and enclaves of these devices that
40:46
really wasn't possible or as secure.
40:49
But take, we saw this, you know, with with apple back in the
40:53
tragedy of the San Bernardino shootings, they wanted to get
40:56
access to the PIN code to get into that iPhone.
40:59
And Apple was like, we can't do that.
41:01
So the device security built in taking that but then kind of
41:05
extending that through broader means was really kind of what we
41:10
felt was. Was where the industry needed to
41:12
move to. So yeah, you there are, you
41:15
know, free features. You can get with a lot of these
41:17
vendors and in my belief, a free feature can be a lot like a free
41:21
puppy and really understand a lot of them require MDM or EDR
41:25
to be in that equation, to give the device security, or you have
41:28
to stand up your own certificate management system, or they'll do
41:31
it for you, which comes at a cost, and that's not easy.
41:33
So, really kind of where our thinking in the goal was, was
41:37
that? Yeah, you can Leverage The,
41:41
Enclaves and TPMS to really enable the private key.
41:44
But the notion of a personal certificate Authority, how can
41:46
an end-user do this without knowing they're doing?
41:49
It is a critical ingredient. So I think as customers of these
41:53
vendors it's great to see what kind of features they have.
41:56
But the reason we felt that we could create a company and
42:00
create a premium offering is its 100% focused on the delivery of
42:04
the most secure authentication experience possible.
42:07
Stop credential based attacks right in there.
42:11
Tracks but make it a better experience for the end user so
42:16
and don't do this just for the specific systems of that vendor.
42:20
But in a hybrid environment and our philosophy was that the
42:23
approach we're taking binding identity and the security
42:28
posture of that device bringing that at the point of
42:30
authentication. Our first foray was doing this
42:33
for the workforce and we didn't want to replace the identity
42:36
providers. We made it.
42:37
So we could integrate directly into OCTA pain Forgerock
42:42
Microsoft and working just as a delegated identity provider, to
42:47
interact with that system, which means it doesn't disrupt.
42:49
You don't have to change what you've done in those systems.
42:51
You don't have to configure apis to make this work work with that
42:56
environment. Then we took it through custom
42:58
to customers as well and customer logins through
43:00
interaction with Siam or even an SDK that can be embedded into
43:04
the app. So we can provide this secure,
43:06
easy form of authentication. Freakish frictionless,
43:09
authentication for Customers and end users.
43:12
So you're bringing up some some really good meaty topics which I
43:18
think are the things that, you know, our listeners that I am
43:22
practitioners. There were people who are
43:24
evaluating and procuring and then having to deploy
43:29
Technologies like password, listen, their environment.
43:32
And so, we had Martin kupenga on the podcast last week and we
43:36
talked about the POC process was the right way to conduct a POC.
43:41
Not just Zeke something like the leadership cam Compass or the
43:47
magic quadrant just take the solution.
43:50
That's you know, ranked the highest in that analysis.
43:53
It's really you know that can be a guide, right?
43:56
That can be a data point but you need to conduct some kind of
44:00
proof of concept. And so what I wanted to ask you
44:04
is I mean I'm sure in your role. You've been involved with a lot
44:07
of proof of Concepts where companies are evaluating
44:12
pastoralists and what's your takeaway.
44:14
And you know, some of the best ways to do that.
44:17
What have you, where have you seen?
44:18
Where a customer's just doing it right there.
44:23
There there really evaluating pastoralists on the right way.
44:26
They're asking the right questions.
44:28
Whatever versus what's the wrong way to do it?
44:32
Yeah. And I think part of its really
44:34
going in to understand what your goals and initiatives are we
44:37
were talking about this before password, plus means so many
44:39
different things that That you're not going to find a
44:42
laundry list of like RFP responses or checkbox items
44:46
because if the systems are meant for very different things, one
44:49
just to do multi-factor, authentication one to provide a
44:53
full secure authentication experience.
44:56
It really is going into it with your eyes open to what are you
44:59
really trying to accomplish here and Belief that our goal is to
45:04
really truly eliminate that password is really going to
45:07
provide the better long-term experience really understanding.
45:11
Where does that occur in? Can that occur?
45:14
So going into it, there's there's two sides to this, you
45:16
know, we want to improve the security.
45:17
We also want to reduce the user friction and make that a good
45:21
experience, and those have to be critical components of the proof
45:24
of concept and you need to test this.
45:27
What does it take to deploy the solution?
45:29
Do you have to make configuration changes to your
45:31
system? Teams or API changes to the
45:33
applications, that you're authenticating to how easy can
45:36
it get stood up? We challenge them to time us
45:39
from the point. We start to the point we finish
45:41
and see how quickly we can actually integrate into that
45:44
system and not cause any disruption to your current
45:48
environment. But also with the policy itself,
45:51
as I mentioned, bringing that device security into it is
45:53
something very unique that most solutions aren't doing is that
45:56
something important to you? And how do you want that to
45:59
occur? What policy makes sense really
46:01
thinking through your Organization on.
46:03
Where do we want to be more restrictive?
46:05
Versus where do we want to be more open with that access as
46:08
well? And the most important pieces
46:10
testing this with end users and I say probably the most
46:14
uncomfortable or awkward pocs or where only the IT people are
46:18
testing it and it's the security people testing it.
46:21
It's like put it in front of your end users who are the
46:24
people who are your challenging call the help desk a bunch and
46:27
see how easy it is for them. Because when you change the user
46:30
experience, especially at the point of Of authentication,
46:34
you're going to have it. That's changed Behavior, that's
46:37
impact. And so even when it's easier, it
46:39
can also be somewhat disruptive. We actually saw this through
46:43
kind of some of the user experience testing we were doing
46:45
early on because the whole notion and idea is that you
46:48
launch the application and the redirect and the authentication
46:52
and the price, the public he gets issue signing.
46:54
It's a private key. None of that visible to the end
46:56
user. They don't have to pick up our
46:58
app or pick up a second device. So they were opening the app and
47:01
all they were knowing if they were In and they never enter in
47:03
a password. So, that calling saying, hey,
47:05
something's wrong here. Somebody's in my account.
47:07
So, we actually had to create some graphic showing that
47:09
something's happening behind the scenes here.
47:11
It's doing something so, you know.
47:13
Oh, okay. I feel comfortable that was
47:15
authentically almost. Brought it too far.
47:17
So really understanding that user experience is just a
47:20
critical piece and testing this with the right users we love the
47:23
pocs because we feel once we take the password away from an
47:26
end user is going to be real hard to give it back if they
47:28
don't want to move forward. Yeah, no it absolutely.
47:32
And that's I think a step that organization's needs to do more
47:36
as organizational change management, really thinking
47:39
about the impact, the customer experience that they're creating
47:43
weather. Even for internal users.
47:45
I remember when I first got into, I am the mindset was.
47:50
Okay. What is the difference between?
47:52
See, I am and I am, I'll see. I am you have to have a really
47:55
good user experience. But for employees who gives a
47:57
hoot, I think that mindset is shifting a lot because Think
48:02
tools are better now, right? And that becomes a
48:04
differentiator but, you know, I you've been great with your
48:08
time, but I did want to ask one more question, which is, you
48:11
know, selfishly from a consultant perspective, right?
48:15
I'm still getting asked about self-service password reset.
48:19
Hey should we be looking for a solution or how do we approach
48:23
self-service password? Reset to me it seems like the
48:26
answer ought to be. Why even if you haven't gotten
48:30
there yet? Why go there?
48:31
Why not? Just go right to Pastor list.
48:34
So can pass wordless be his substitute for self-service
48:39
password reset and if so, what are kind of are, there are
48:43
trade-offs, I mean, can is, it is a good substitute for
48:47
password, self-service? Password reset.
48:50
Yeah, I think it's, you know, we often say, hey, you can't steal
48:54
a bike if the bike doesn't exist.
48:55
So the password doesn't exist, you can't steal it.
48:57
But the yet also don't need to reset it anymore.
49:00
And so it's actually kind of a True benefit that often prompts
49:06
a lot of these organizations is that as much as they built.
49:09
Many of these tools to do self service reset.
49:11
It still is a major problem for these help desks.
49:16
So yeah, if you rip that out all together you've got nothing left
49:19
that needs to be reset. So absolutely can change the
49:23
game. And I think part of it is as
49:26
we've looked and, you know, you were asking before it's how
49:28
we're different, you know, certainly logging on to
49:30
corporate resources. Logging onto consumer.
49:33
Resources are important. You nailed it Jim.
49:35
There's been this mindset with well with our employees we can
49:38
get away with a lot more. We can make it more painful but
49:41
even that hits a level at some point but we're seeing it with
49:44
other things. Like you know we're seeing us
49:46
being asked to integrate with like the Cyber arcs and
49:50
psychotics and Beyond trusts of the world for privileged access.
49:53
So why should we be pulling these things?
49:55
Out of a vault with MFA as well? If we can truly authenticate
49:58
that experience and the new area we've been getting into is even
50:01
with the Ups that you have developers who are signing code
50:05
and interacting with these git repositories all the time and
50:09
they do them from account. So you have Daffy Duck 123.
50:12
And you don't know who that is. And obviously with things like
50:15
supply chain security and we saw it with the solarwinds attack
50:18
that you want to make sure, you know, who is signing code and
50:22
what device they're doing it from.
50:23
So we have applicability there, but believe me, you want to talk
50:26
about an environment? You don't want to make friction,
50:29
is your developers who are writing code and sign.
50:32
Encode in. So kind of looking at all these
50:34
different use, case scenarios the level of user friction is a
50:38
critical component to it, but yeah, let's let's finally
50:42
stopped the calls to the help desk and customer service for
50:45
forgotten passwords. Or how many times have you
50:48
gotten something from some service that said hey our
50:51
password database looks like it may have been stolen.
50:53
We don't know if your stuff has been but we were strongly
50:56
recommend. You change your password so we
50:58
create that spiral all over again to something new I have to
51:02
Amber that I'm bound to forget as well.
51:04
So yeah, the best way of eliminating.
51:07
The problem is truly eliminating, the problem, right?
51:11
That's a great answer. So Kurt, you've been super
51:14
generous with your time. We always like to wrap up each
51:17
episode on The Ledger note, right?
51:20
Talk about something fun. And so we, when we were
51:23
pre-gaming for this episode, you mentioned, you're from Boston,
51:28
obviously, that's my favorite or maybe not.
51:30
So obviously but that's my Everett donut shop, which is
51:33
Dunkin Donuts, right? That's where it started in
51:35
Boston, and I recommend it to Jeff that we could have an
51:39
entire episode on doughnuts and so maybe we will do that at some
51:43
point in the future. Let me know I'll be there donut
51:46
at the center. Don't consider donor holes but
51:52
I'm also I'm from Augusta Georgia, right?
51:54
That's the epicenter of golf. I think of the golf world and at
51:58
least one once a year it is and you Cindy, you're an avid
52:04
golfer. So I wanted to ask you, what is
52:07
the best part of your golf game? And what's the worst part of
52:10
your golfing? What, what what gives you hope
52:14
that? What keeps you coming back to
52:16
the course? And then what is it?
52:17
That tells you you're never going to be a scratch golfer.
52:21
The greatest thing about golf is even when you're doing terrible
52:26
all day long, you have that one great drive and it just gives
52:29
you confidence. You can come back and think
52:31
through Ooh, working on my game. I've really might driving has
52:35
gotten much better and off the tee.
52:37
I'm feeling far more comfortable than ever before and it's the
52:40
old, you know, drive for show putt for dough.
52:44
I can't putt for anything to save my life and I watched these
52:47
Pros analyze, these greens and squatting down and yeah, I'm out
52:51
there squatting down, staring at them and don't have a freaking
52:54
clue what they're actually going to do.
52:55
And I'm like, why did my putco that way?
52:57
And it really started looking into it and just you know the
53:01
worst thing you can do. Your golf game is go to a
53:03
start-up because there's nothing you need to do than play more in
53:06
a start-up doesn't really help you on on doing more of that but
53:10
I just realize how many strokes I'm spending on the green and
53:13
three puting that it's why I don't and but I'll go back to
53:17
the range and just start hitting long balls again and feeling
53:20
really good about myself. So it gives me the confidence
53:22
that hey, I can do this but then when you really get down to it.
53:26
Yeah that's that's where it when you look at the pros and just
53:28
that big huge book, They're carrying in their back pocket.
53:31
I could never imagine Having one of those but you realize the and
53:33
that's what I love about the game, right?
53:35
It's out there. What the environment been to
53:38
Augusto, which is like, probably one of the greatest places I've
53:41
ever been to, in a gust, a national to see it, how
53:45
beautiful it is your Outdoors, you're interacting having good
53:48
communication and good time with friends and even the frustration
53:52
part. So you can kind of get past
53:54
again, but yeah, if I could learn how to putt and just save
53:57
so many of those Strokes, I think I could probably do a lot
54:01
better than just going. Back to the range and trying to
54:03
hit bombs, probably you. Jeff.
54:05
Yeah. I was listening to Kirk here
54:06
and, you know, I was listening on it's like, yeah hitting good
54:08
drives and can't Putt and I immediately thought of Happy
54:11
Gilmore. Yes.
54:13
So that you know, that he was the king of the master drive,
54:15
you know, I don't golf anywhere near as much as I used to.
54:19
And I actually took lessons when I was much younger in my, I
54:22
guess mid to late teens but I would say the strength of my
54:27
game is the 7 iron. That is the club that I can.
54:31
I can nail. L just about almost every time I
54:34
cannot hit a wood or a driver to save my life.
54:37
And it shows because that's where my lessons ended, I
54:40
learned how to hit irons and we were working our way up to the
54:42
woods and I stopped taking lessons and I never actually got
54:45
to, you know, the the driver, you know, the 3-wood 5-wood
54:49
etcetera, those sort of things. So I struggle mightily any of
54:53
those clubs. Yeah.
54:55
I'm okay of putting, I guess, you know, not perfect at it, but
54:58
I'm also not looking to beef but give me a 7-iron.
55:01
And, and a Cough afternoon and I'm all over it.
55:05
What I love is that combination of physical and thinking there's
55:08
a lot of thinking in it, but you talk about the lessons, it's
55:11
incredible. How much different advice you
55:13
can get that? You could just drive yourself
55:15
crazy that these little tiny nuances, can completely mess up.
55:19
A something that worked really well in the past.
55:22
So, yeah, I'm always debating, do I go take another lesson?
55:25
But I do my best to try to stay away from YouTube because I just
55:28
learned to many different things that never seemed to work.
55:31
A lot of Ting ideas, Jim. What about you?
55:33
But your golf game? Well, a lot of what Kurt was
55:36
saying was resonating with me. But I think I to Thoughts with
55:41
everything was one Topgolf. I've really enjoyed.
55:45
I think that's a fantastic time. And you're drinking beer, while
55:48
you're golfing to me. Is just that's the way to do it.
55:52
The second thing, just talking about a Augusta National and
55:56
professional golf in general, made me think back to the mass
55:59
of humanity following Tiger Woods as Went from hole to hole
56:03
and whatever you think of Tiger Woods, right?
56:06
The guy was the best golfer that I ever saw play.
56:10
I mean, you know, the way he could perform in the clutch was
56:16
just unbelievable, and I think that takes a special rare
56:22
individual who can have all the pressure in the world.
56:25
To you have to perform right now and to be able to do it almost
56:29
like podcasting. Almost almost yeah well I feel
56:35
I'm working with the Tiger Woods of podcasting here with the two
56:37
of yous flattery will get you everywhere.
56:40
So thank you very much and I think that's like actually an
56:42
excellent spot where you can leave it for this week before we
56:46
go any final thoughts. Kurt for folks who are listening
56:48
out there and you know, they're they're interested in password
56:51
lists, you know, what are some? Some key takeaways that they
56:54
should take away from this conversation.
56:55
Yeah, I think really looking at it from the notion as we were
56:59
talking about before password list versus password Dash, Us.
57:02
Let's get the herd immunity. Let's truly look to eliminate
57:05
these and frustrate the fishing thrush.
57:09
Frustrate the credentials stuffing.
57:11
Attackers by really eliminating that threat.
57:13
But, yeah, I'm a big believer in the, in the notion of zero
57:16
trust, we need to know the identity, the device, the
57:19
network, the location, the behavior.
57:21
But let's pull two of those identity and device together
57:24
bring those signals at the point of authentication.
57:26
And then the rest of the wrist signals we can look at from a
57:29
true behavioral analytics, to kind of assess.
57:31
Risk. I think we're moving in the
57:33
right direction and the bottom line authentication.
57:36
No longer can be the bouncer letting you in or keeping you
57:38
out. It needs to be continuous and
57:41
taking a look at these signals on a ongoing basis, is the only
57:44
way of really truing reducing the risk of their, it's okay to
57:47
get smarter and password list is a way to get smarter.
57:50
So good, thoughts there, Jim. How about yourself for this
57:52
week? I mean, it's it's what I talked
57:55
about earlier with the company's being compromised credentials
58:01
being sold for $1000. It just shows you the mass of
58:07
the massive scale of which is being done.
58:10
Pastor has to die. It's the only way that these
58:13
credentials are being sold for $1000, is that it's the simple
58:18
seamless off of people who've reusing passwords or using.
58:24
Common passwords. He's got a it's just an
58:27
insufficient control for your organization.
58:29
So, multi-factor authentication is step, one, getting rid of the
58:34
password is Step 2 and if you can go write this up to all the
58:37
better for you multi-factor. One of those doesn't have to be
58:41
a password, so let's like get away from thinking that it has
58:45
to be password. Plus something better, let's get
58:48
the password out of the equation.
58:49
You can still hit multi-factor but you don't need a password to
58:51
be one of them. That's a great point, right?
58:53
Password is Is not part of the MFA definition.
58:56
It's just something. So that's a good one to go.
58:59
That's a good way to end on. So why don't we go ahead and
59:01
leave it there. If you'd like to learn more
59:03
about Beyond identity, you can find them on the web at Beyond
59:06
identity.com. If you want to learn more about
59:09
us on the podcast itself, visit our Spanky new website that's
59:12
been redesigned and updated with all of our fancy new logos
59:16
identity at the center.com and you can also hit us up on
59:18
Twitter at idea. See podcast I'll have some links
59:22
to all of our LinkedIn. In the show notes as well as a
59:25
link to that article and dark reading that Jim had mentioned
59:29
about how cheap relatively $1000 for compromised company to get
59:34
their passwords. Please do not use that for a bad
59:37
things a thousand dollars in Bitcoin is like you know .000
59:42
three-point now and it just changed again and it just
59:46
changed again and stop trying to follow it.
59:50
All right we're gonna go and leave it.
59:52
Appreciate everyone's time this week.
59:53
Thanks. So much for joining us.
59:54
Kurt Jim thanks, as always. And for folks are listening,
59:58
thanks for listening, please like, subscribe rate, share,
1:00:01
whatever it is, share it with a friend share with an enemy don't
1:00:04
care as long as it gets shared, get out there with our folks and
1:00:07
we'll talk with everyone in the next one.
1:00:13
Thanks for listening to the identity at the center podcast.
1:00:16
If you like what you heard, don't forget to subscribe and
1:00:19
visit us on the web and identity at the center.com.