Latest / Identity at the Center / #265 - IDAC Sponsor Spotlight - Veza

Transcript

#265 - IDAC Sponsor Spotlight - Veza · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:26
Oh, not so bad yourself. I'm doing great man.
0:29
We're here doing another sponsor spotlight episode and that these
0:33
are fantastic and I'm really excited with the one that we got
0:37
today. I mean you know we we've, I
0:40
think we kind of hit the jackpot in terms of what we're going to
0:43
talk about today is a company called Visa.
0:47
I don't want to steal the Thunder of the show, but I guess
0:49
if you if you saw the the title of the podcast, you know already
0:53
we're talking to Rich from Visa. But it's like this up and coming
0:59
company, right? And it's like it can't be
1:02
ignored for sure. And to me, it's just like, wow,
1:06
like, we're going to talk about so many great things today.
1:09
Yeah. So I guess you've already
1:10
spoiled it. We're talking with Vasa, but
1:12
want to make it clear, right, this is a sponsored episode.
1:15
We actually work with our sponsors on these and kind of
1:17
come up collaboratively of how we want to develop a show that
1:20
we think will be entertaining, informative, but also get us you
1:24
know deeper into specific viewpoints, specific solutions,
1:27
something that we try to stay away from on our normal shows.
1:31
But this gives us an opportunity to talk with you know, really
1:33
smart people and really ask specific questions that are
1:36
maybe more product focused than we normally would where we're
1:39
really talking big ideas, maybe stuff like that.
1:42
Not that we want to talk big ideas here, but gives us, give
1:45
us a little more specificity. We can kind of talk through
1:47
things. Yeah, I I didn't want to give
1:49
away the identity. What I really wanted to say was
1:52
we got the man with the golden pipes back on the show excited
1:57
to to hear, just to hear him talk because like he has like a
2:00
Grover Washington type of voice. Yeah, definitely good pipes.
2:05
So today's sponsor is Beza. They're the identity security
2:09
company. They think that they've cracked
2:11
the code on cybersecurity's hardest question.
2:13
Who can take what action on what data?
2:16
Question mark. Let's find out more with our
2:18
guest. His name is Rich Dan Leicher.
2:20
He's the chief strategist at Vasa.
2:22
Welcome back to the show, Rich. Thanks, Jeff.
2:24
Thanks Jim. It's it's great to be here.
2:26
And now I was just, I was just all the time when you were
2:28
talking and on my intro, I was hoping my voice wouldn't crack
2:31
right out of the gate here. Well, see, that's The thing is,
2:34
I do the editing so I can insert little imperfections if I need
2:37
to, but I'm not going to do that because I'm absolutely jealous.
2:39
You've got a great you've got great radio pipes, as they like
2:42
to say in the Fizz, right? Thank you.
2:44
As long as as long again as you don't, you don't tell me I have
2:47
a face for radio, then I'm good. Now Jim and I have that covered
2:51
for sure. We have faces for radio and
2:53
voices for a silent movie is what I like to say.
2:56
Rich, you've been with us before.
2:58
You were with us in Episode 231 back in September of 2023.
3:02
We had a conversation about authorization.
3:04
We also found out really about your kind of background there.
3:06
So tradition would have, we would ask that question.
3:09
But we've already asked you that.
3:10
How did you get into the identity?
3:12
We want to hear that story go back to episode 231.
3:14
Why don't we get right into Vasa itself.
3:18
Jim mentioned sort of you know, where you guys are kind of
3:20
coming up and really you know, making a lot of impact on the
3:23
market, making a lot of noise. What specifically is driving the
3:29
momentum around Vasa and how does that success reflect your
3:33
unique values? Yeah.
3:36
Thanks Jeff. And by the way it's it is great
3:37
to be back on the show. I really did enjoy the last time
3:40
and so it's it's nice to be here again.
3:43
But around with the Vasa I think one of the things that that that
3:46
really is striking to me as I sort of look trying to you know
3:49
trying to be with an outside eye, side eye and and look at us
3:53
is that I think it really does come down to customers.
3:56
I think that's that's certainly my gauge for a great company is
3:59
like who's actually buying, who's actually using, who's
4:01
getting successful and getting value from the products.
4:03
And I think that's been one where I've been really, really
4:05
proud of what we've been able to do here.
4:07
Just some really great companies and some really passionate
4:10
champions. And so that's that's definitely
4:12
part of I think what also makes people out in the market makes
4:16
Seesos, Seesos you know listen to other Seesos like that is
4:18
typically how how things sort of get bought, how things spread
4:22
and I think I think we have been doing a really nice job there.
4:25
The second big thing I think is really that it's a pretty
4:31
innovative idea and a concept. And I think I, you know, and I
4:34
always try and make sure I'm not, I'm not, I'm not selling
4:36
myself too much here, but I really think, you know, I have,
4:39
I've been an identity for a while and I think you guys have
4:41
certainly been an identity for a while.
4:43
And one of the things that I've noticed is that a lot of the
4:46
players are just are, you know, they're kind of the same players
4:48
you would have seen and expected, you know, 15 years
4:51
ago. And I think, you know, the Octa
4:52
sort of came in, but that was back in 2009, that Octa started.
4:55
And so I think the identity hasn't had a tremendous amount
4:58
of innovation over the last decade and 1/2 and I think it's
5:02
been, it's been ripe, it's been ready.
5:04
And so I think actually coming in with I think what is a pretty
5:06
different approach in in really trying to go deep into
5:10
authorization into this question of who can and should take what
5:13
action and what data. I think is, you know, I think
5:16
people respond to that and people have been hungry because
5:18
and I think everybody knows that identity is a is a big thing
5:21
that needs to be really addressed.
5:23
So for people who aren't familiar with DAISA, I guess
5:26
let's set, let's set the table for folks you know, we've
5:29
mentioned authorization. We've mentioned the question and
5:31
and the answer, right? Who can take what action on what
5:34
data? What is Beza's sweet spot?
5:37
What do you guys do? Yeah, I think you know from a
5:41
from a value proposition, I think fundamentally the most
5:44
important thing that we do is we help customers get to the
5:48
reality of least privilege, right.
5:50
If I think about like what you know, like from a security
5:52
perspective, like what's important that I think is, is
5:55
absolutely critical. Sometimes it's through
5:58
governance processes like access reviews.
6:00
Sometimes it's by having a tool that a security engineering
6:03
person can go and actually look and find the biggest violations
6:07
of least privilege to go and to go and fix them.
6:10
But I think fundamentally it's that it's that preparation for
6:13
the next breach. Because it's just, you know,
6:14
that always resonates with me when I hear people talk about,
6:17
hey, it's not a question, question of if it's a matter of
6:20
when the next attack happens, the next breach happens.
6:23
And I think really getting your organization ready, tightening
6:27
down, privilege, tightening around access, especially
6:30
privileged accounts, that's like so critical.
6:32
So fundamentally like that's how I think about the value that we
6:35
provide. I mean it's a very competitive
6:37
market. You've got a lot of incumbents
6:38
in this space, You've got upstarts and I guess you know,
6:43
how do you separate yourself from others in this place?
6:46
What's the core factor or thing that makes Vasa really stand out
6:50
in your mind? Yeah, I think that it really is
6:53
starting at the data model. Like when I think about the
6:56
product and I think about the platform that we've built around
6:59
identity security, it's pulling together all this information
7:03
about what we call is the reality of authorization.
7:06
So it's pulling in user information, group information,
7:10
role information, decomposing all that morass of A WSI AM and
7:15
Azure RBAC, but then also going deep into the service level to
7:20
pull out granular system level objects in all the services and
7:25
things like local users, ACL level permissions.
7:27
So really going and putting together a pretty unique data
7:31
set into into a graph and you know not just mapping those
7:35
entities but the relationships between those identities.
7:37
And I think that fundamental data model is, I mean it's it's
7:41
a beast as you can imagine like that that is the really a tough
7:45
problem to solve. But then once you have that, the
7:48
things that you can then start applying that to you around
7:51
actually creating products based on that data model are really,
7:56
really interesting. And you can do things that are
7:58
sort of traditional like IGA types of things like
8:00
provisioning and life cycle management.
8:03
You can do it in very different ways.
8:04
And that's one of the things from a, you know, I'm a product
8:06
guy at heart. And so that that kind of stuff
8:08
gets me excited when you can sort of go and attack those
8:10
those things that have been around forever, but do it in a
8:13
dramatically different way that provides and solves problems
8:16
that have been around forever. Yeah, Rich, I mean that really
8:20
resonates with me. Anytime you've here of a new
8:25
vendor, you've tried to, in your mind compartmentalize, OK, where
8:30
did I fit them, right. And I think the area that vases
8:33
in the closest to is governance. But I I feel like it's kind of
8:38
like a gloss over just to say governance, right.
8:41
It's like so much more than that, right?
8:44
It's being able to drill down more than I've seen really
8:48
anywhere else. But talk to you about kind of
8:52
the the strategy of Visa in terms of the road map.
8:58
I came up with the term the anti convergence strategy, right?
9:02
And there there's a lot of IM players out there today who are
9:08
really in the strategy around convergence, right?
9:11
Whether you like it or not, that's the route they're going,
9:14
which is to bolt on additional IM capabilities so that
9:20
customers can kind of go one place to get everything.
9:23
Your strategy is a lot different, right, which is to
9:26
kind of take this piece of the marketplace and really like
9:31
provided a solution with differentiation, right?
9:35
Am I right in that? Am I wrong in that?
9:39
And then can you elaborate on it?
9:41
Yeah. No, I think I think you're
9:42
absolutely right in that Jim because one of the things that I
9:46
notice also it it plays into this sort of this whole tension
9:50
and sort of you know difference in the market.
9:51
When you look at sort of the you know big legacy companies versus
9:54
start-ups you know and and certainly the approach of a big
9:57
legacy company and pick Microsoft, pick sale point pick
10:02
Cyber Ark or whoever you you want sort of in identity and the
10:06
general strategy is there. I need more stuff in my bag to
10:09
sell right. You go out and you want to say
10:11
like hey, I, you know, I know people spend money on this and
10:13
here are some budgets and I'm going to go use my, you know,
10:17
my, the connection to the to the customer to go sell more stuff
10:20
and get a bigger share of wallet.
10:21
And so it's all about you know creating that portfolio whereas
10:24
typically start-ups that's where frankly most of the innovation
10:28
starts And and that's one of the challenges here is like when we
10:32
started when I joined the company I was like man I hope
10:34
there's a market but I don't know there's a market because
10:36
it's so it it is so different and that I think I think it is
10:39
true. It's not like we could go and
10:41
say hey you know we know a bunch of people spend money on this
10:45
kind of solution because there is no, there was no type of
10:47
solution like this before. And so I think it is you know,
10:49
really deep diving on authorization on and answering
10:53
this question is a, it's a bit riskier because there's not an
10:57
obvious market that this is sort of functionality that cuts
10:59
across access management and the players like Optic cuts across
11:03
Pam and the cyber arts of the world that cuts across IGA as
11:06
you pointed out in governance put cuts across SSPM, you know
11:10
SAS security posture management and data access governance with
11:13
Veronis and all these different things.
11:15
You know, authorization is something that's been sprinkled
11:17
across all these different security markets.
11:20
And no one has really before taken a comprehensive approach
11:24
and say I'm going to solve that problem and I'm going to go deep
11:26
in that. And I think that's what really
11:27
makes Mesa different. Yeah.
11:29
I mean, I think it makes sense for the company's strategies
11:32
where they're in one spot like access management and to move
11:37
into privilege or move into identity for the exactly the
11:40
reason you talked about, which is how do they take those
11:43
existing relationships and build their company, right?
11:47
But I think what you guys have done is built the better
11:50
mousetrap, but it seems like your strategy is to build an
11:52
even better mousetrap, right? But it does seem like that
11:56
mousetrap can be leveraged in certain areas, right?
11:59
Because I think a lot of what you're talking about today, what
12:02
we're talking about currently is taking access that exists and
12:08
being able to analyze it. What if you provision only the
12:11
access that a person needs? What?
12:13
What are your thoughts there? Well you're you're you're you're
12:17
you got a good crystal ball there Jim because that's that's
12:20
exactly actually what we we've been moving in And so we we've
12:22
thought about this in sort of a three stage approach from a
12:25
strategy and we've started with the first stage is kind of
12:28
visibility is like hey we just need to really understand what
12:32
the reality is so we can show people and people could start
12:34
using that data And then we moved on to OK now how do we do
12:38
remediation that's Step 2. And so now I can see but now how
12:42
do I fix, how do I see what's wrong, how do I see where the
12:45
biggest risk, you know most highly damaging potentially
12:49
damaging instances of over privilege exists.
12:52
So I can go fix them, but then you go on to stage 3, which is
12:55
absolutely, as you point out, it's around control, it's around
12:58
provisioning. How do I make sure I actually
13:00
create the right level permission out of the gate?
13:03
How do I actually create those accounts either on birthright
13:06
events, on, you know, joiner, mover lever types of things or
13:09
when someone is asking for access because they need
13:12
additional access to do their job, That's where the magic
13:15
happens. And then making a virtuous
13:18
cycle. Right now when you think about
13:20
all these, you know, this, this, this grand access life cycle
13:24
when for instance, you're in access reviews and you're
13:27
saying, hey, somebody, you know, somebody has access, they
13:29
shouldn't have, we should take that away.
13:31
Well, how did they get that in the 1st place, right.
13:33
Because they had to, they had to get provisioned somebody either,
13:36
you know, fulfilled a ticket or there's a birthright policy
13:40
that's wrong. And you know, just because you
13:42
found 11 instance of it, is that the only instance of it?
13:46
Is it where there's smoke, there's fire or is this, you
13:48
know, something that's relevant for the whole group?
13:50
Is there a whole role that's over permissioned or you know,
13:53
there there's something broken? And sort of how do you take
13:55
those little instances that you find and rather than just
13:59
fixing, fixing those at a little granular level, how do you sort
14:02
of take it and actually build intelligence into that to sort
14:05
of fix the overall root cause of those processes that are that
14:08
are broken? So I want to take the
14:09
conversation a little away from theoretical and more into the
14:13
real world. I was poke it around the Beza
14:15
website, beza.com, there you go. There's a plug.
14:19
You've got some really impressive logos that are kind
14:22
of scrolling through there and it makes me kind of wonder, you
14:25
know, beyond right, the logos we've got there.
14:29
What are there any indications of?
14:30
Are there specific types of challenges that Beza is best
14:34
suited to solve? Where?
14:36
What is that actual sweet spot that we've got here?
14:39
Yeah. And you'll, you'll find there's
14:40
a, there's a range of them, right.
14:41
And so it's, it's funny how you know every company's struggling
14:45
with something that's that's often a little bit different.
14:47
So in some cases it's around sort of struggling with
14:51
identities, right. And so it's not just human
14:54
identities, but often. One good example here is machine
14:57
identities and service accounts, right.
14:58
They might be trying to, you know, sort of broaden the
15:01
definition around governance to include things like that.
15:05
It might be instances where they're they're actually seeing
15:09
that typical role based access control doesn't work for them
15:12
right? That they're trying to manage by
15:14
groups and roles. And you know, and this is the
15:18
the canonical classic example is you've got a role that's named
15:21
read only and guess what they're right privileges embedded in
15:25
there. And so you know, and what you
15:28
start to realize is that you're not really doing role based
15:32
access control. You're you're managing by names
15:36
of roles and descriptions of roles, right.
15:38
And so the and the reality is that you know, hey, what does
15:42
this role actually do, you know, does does being a member of this
15:44
role and being able to assume this role actually allow this
15:48
person to go blow away my customer database as an example
15:52
And he said, wow, I wouldn't want that and I hope it doesn't,
15:55
but I don't know. And so this is one of the things
15:58
that when you start to pull on that thread, it it's it, it
16:02
becomes obvious that a new solution is required.
16:05
And sort of like the way that different customers pull on that
16:08
thread can vary. Sometimes it's an auditor that
16:10
sort of figures it out and starts asking lots of
16:12
uncomfortable questions. Sometimes it's the CISO
16:14
themselves. And you know, it's like
16:16
following up out of a breach where you know, it's only in
16:19
asking these really concrete questions and understanding how
16:23
limited all the existing tool sets are that, you know, a CSO
16:27
or somebody or some executive of the company realizes that there
16:31
needs to be a different way. So I was going to ask a follow
16:34
up question here around, you know these are relatively large
16:38
companies, right, well known. I'm going to have to imagine
16:40
that they already have tools in this space for Identity and
16:43
access management, probably a number of them.
16:46
Which leads me to the question of how do you get somebody who
16:50
has already got tools in a space to say, oh, hey, you know,
16:53
you've got this new tool, it's called VASA.
16:55
We should take a look at it and then actually get in to some of
16:58
these organizations. I mean, how do you establish
17:00
that trust, that confidence rate and say, hey, this is something
17:05
that we've not been able to achieve with the tool sets that
17:07
we have and Vasa is solving for us.
17:10
This specific thing or these specific things, maybe there's a
17:12
variety of them. How do you, how do you even get
17:14
into that conversation with the Cesos, with the other folks who
17:17
are making those decisions on their investments?
17:20
Yeah well the the nice thing is that let most Cesos are very are
17:24
are interested in new technologies.
17:26
So you know so even if you're if they're saying hey you know
17:29
maybe I'm not going to buy anything but they want to know
17:31
what's going on. And so that's that's always you
17:33
know something where you can especially if it's something new
17:36
and something that they they haven't seen a lot of tools
17:38
around it's you know they they generally are are interested and
17:44
and then it's sort of a question of like hey how does this map
17:46
into something that's on my key priorities for the next year,
17:51
right. So you know when you actually
17:52
get down to okay like you know are they going to actually buy
17:55
the product or not. It has to obviously be relevant
17:57
for something that they care about and and that's one where
18:00
you know it, it can again it it varies, right.
18:03
And and I know one of one of our customers we were in the in the
18:07
first meeting and and actually we're having the conversation
18:11
and it was sort of you know we're dancing around it.
18:13
It was kind of, you know, kind of interesting, but we saw
18:15
something written up behind him on his whiteboard and it was
18:19
just, it was just the word China.
18:20
And we said China, what's that? And he started describing some
18:25
of the problems that he was having with managing access to
18:29
box folders. And so it was both the problem
18:32
of having data from because they they had operations
18:35
internationally. And so it was both from the
18:37
example of data from people in China.
18:40
So you know PII of Chinese nationals being accessed by
18:43
people outside of China and the reverse that there were some
18:46
some sensitive things that if you were a Chinese national you
18:49
shouldn't get access to and just be able to manage that right of
18:53
like you know this, this cross-border issue with a
18:56
particular place where they had a lot of data that was important
18:59
to them. And so it was you know and so
19:01
that turned out to be a key use case for them.
19:04
And so again you know when you when you talk to all these
19:08
different customers, it can vary.
19:09
Sometimes it's GitHub, sometimes it's Salesforce, sometimes it's
19:12
Snowflake, sometimes it's AWS, Azure, GCP, sometimes it's
19:16
custom applications. And this is this is 1 where that
19:19
that was true for our very first customer and they they were
19:24
trying to do it because they had built a on top of their SAS
19:27
platform, a help desk application, right so custom
19:30
custom app. But for all the people who were
19:32
helping their customers resolve tickets, right and resolve
19:36
issues and you know help desk folks are you know there are a
19:41
lot of them. They have a fairly high tune
19:42
over. They're not always the highest
19:44
paid and highest level. You know you got a lot of
19:46
analyst level people and this Cesar wasn't sure what the help
19:51
desk people had had access to. When you know when they're able
19:54
to actually you know get into a customer tenant and and and get
19:58
a pretty deep access, that was the number one thing that they
20:01
were concerned about. So it really varies from
20:04
customer to customer sort of. You know what the area is that's
20:07
most important, but so much of it result revolves around that
20:11
core theme that we've been talking about, who, who has
20:13
access to what, and should they have that access?
20:17
So Rich, you've been doing a lot of videos lately, and I saw
20:20
video on LinkedIn with you and your founder and CEO Tarun
20:25
Thakur. So hi Tarun.
20:28
And he said something. I'm going to quote him here,
20:32
knowing who can take action on what data is the biggest
20:36
identity challenge. So I wanted to break that down a
20:38
little bit because I think when we talk identity, it's not
20:45
always brought back to the data that you're protecting the data
20:49
and and knowing who has access to what data is being important.
20:53
So why is Why use the term data? Why?
20:57
Why is that the important differentiator?
21:00
Yeah. For us it really comes down to
21:02
the overall priorities of an organization.
21:06
And when you think about, you know, everybody talks in
21:08
security by the crown jewels that more the most frequent
21:12
thing there is the data are the crown jewels.
21:14
Like why are you protecting it? It's not really because you need
21:17
to protect the servers. It's not because the
21:18
infrastructure is that valuable because it's all dynamic, right.
21:20
It's all in the cloud. Like I don't really care that my
21:24
infrastructure is protected except that I need to protect
21:27
the data that's running on that infrastructure, right.
21:29
That tends to be the number one thing and obviously there are
21:32
there are exceptions to that but when you go and have the board
21:35
level conversation when you're talking to the CSO that that has
21:39
been a strongly resonant theme is that I want to protect my
21:44
data why are we doing all this why am I doing security at all.
21:47
And and that that's the the been the piece that comes out is is
21:51
most strongly and and something that you know that gets board
21:53
level attention that you know every and everybody knows if you
21:56
if you have a breach around the data that you know that makes
22:01
the paper right that's that that's the thing that really
22:03
gets gets nailed. So it's it's really around that
22:05
resonance of being able to connect it to a real business
22:08
goal that everybody understands. Yeah.
22:10
And I know your role, you're not the the frontline like cold
22:14
calling people. We might run into this objection
22:18
which is well we do our back so we don't, we don't need this,
22:22
right. I think this kind of discussion
22:28
really goes to OK level beyond our back towards a more data
22:33
centric approach, right. Do you see that like is like
22:37
people think RBAC is at the right level of managing?
22:42
Security, I think most everybody does RBAC, but when you point
22:47
out some of these natural flaws, and I think one of the one of my
22:50
favourites to talk about this with is with reference to access
22:53
reviews because everybody's sort of gone through it.
22:55
If you're a manager, you, you know, at any companies of size,
22:59
you've done an access review. And so you've gone through and
23:02
done all these things where you said, hey, this is, you know,
23:04
you know, here's Fred, he's on my team and here's all the stuff
23:07
that Fred has access to. And is that right?
23:10
And I asked this question again. You know, I remember back to,
23:13
you know, one of the one of the Csos or one of my organization.
23:15
I said, you know, I said, hey, how, what's your experience with
23:18
that? Like, you know, is that a good
23:20
experience for you? And he said, yeah, half the time
23:23
I don't know what I'm clicking yes to.
23:24
And I like that is a very, that's an extremely common
23:28
experience is that people are saying yes, but it's kind of
23:33
meaningless. It's this whole idea of, you
23:36
know, compliance theatre or security theatre, right.
23:39
People are going through the motions because you have to,
23:41
right? You've got to have access
23:42
reviews, that's you've got to check that box.
23:45
But wouldn't it be great if you could actually do that and and
23:50
do that compliance process, spend the time, ask everybody
23:54
who's managing to spend the time and actually improve your
23:57
security posture at the same time?
23:59
Wouldn't that be great? Is that too much to ask?
24:02
And we don't think it is, in that you can actually do these
24:04
all you know that that's the real reason you're doing access
24:07
reviews is you want to restrict access.
24:10
You want to make sure that only the people who need it are
24:13
getting access. And if you don't give people the
24:16
right information about what that really means, you're asking
24:20
them to do an impossible job. And this, this is the thing that
24:24
I think is so fundamentally broken with most of these
24:27
processes is people doing these things that they know don't
24:29
really help, and there's a better way.
24:32
Let's talk about the the principle of least privilege,
24:35
because I kind of feel like least privilege and RBAC pull it
24:41
opposite ends of the of the string you've got.
24:44
RBAC where it's saying we need to establish these roles is
24:49
going to give certain levels of application level access.
24:56
But when you're talking about an enterprise, I mean think of how
24:59
many systems and how many roles within those systems that you
25:02
have to manage amongst potentially hundreds of
25:05
thousands of of your workforce. Now if you were to do true least
25:10
privilege to every one of those systems and to the data, doesn't
25:15
it become unmanageable? Absolutely right.
25:19
So the way I would look at it is, I don't know if I'd say
25:21
they're at polar opposite ends of the spectrum, but I think
25:25
that you know least privilege everybody agrees with in
25:27
principle. Like I've never heard anybody
25:29
say Nah, I don't believe in least privilege like it's it's
25:31
you know everybody agrees it's the right idea.
25:34
It's really a question of how do you implement it.
25:36
And so RBAC is sort of is the way I see is like most every
25:40
organization at some level has implements RBAC as a practical
25:44
way to get to least privilege. But even within that, the
25:48
challenge is how do I get the right roles, how do I even
25:52
assign the right roles. And so I'll I'll give another
25:54
example here. One of our customers actually
25:56
uses VASA as a provisioning intelligence tool.
26:00
What I mean by that is what they have is that they have a process
26:04
around Snowflake. And so when a developer who's
26:07
doing their developer job needs access to something in
26:11
Snowflake, maybe a table in Snowflake, and they submit a
26:14
ticket and they ask, hey, I want to get the access to this.
26:17
So the challenge this organization had before Vasa was
26:21
they had all these rules in Snowflake and they didn't know
26:23
which rule to provision. Because that's the question is
26:26
like, how do you know what rule best conforms to least
26:29
privilege, the role that gives them access to that table that
26:31
they need and as little else as possible?
26:34
That's an incredibly hard thing to answer, right, because
26:38
there's no tool could actually see what does this role do in
26:42
Snowflake, really what does this give access to?
26:45
And so by using Vasa, they actually were able to implement
26:48
that. So simply saying, hey, now I
26:50
know what role to give, right. And by doing that, they and they
26:54
and they actually measured this. So they have, they had an
26:56
internal process where they were actually looking at the total
26:59
exposure and the total risk from all the different permissions on
27:03
Snowflake. When they introduced Vasa after
27:05
a year of doing this process, they were able to reduce the
27:08
total number of permissions, the total risk on snowflake by 80%.
27:12
So that's by just knowing what role do I grant because they had
27:17
no way to know before. So you know, so Vasa can
27:20
absolutely and almost always does We actually make our back
27:24
better, right. It's not that we replace our
27:26
back and this is also one of the themes about how we work in
27:29
general is that we really, I think I've done a nice job of
27:34
meeting customers where they are.
27:35
We don't force you to go take a different architecture.
27:38
We're leveraging all the existing authorization schemes
27:42
in the native systems that you're already using.
27:44
But we actually tell you what it means and help you fix what's
27:47
broken. OK, Rich, so help me out here.
27:49
Does Visa tell me what a person has or on the other end of the
27:56
spectrum, who can do some action on my data?
28:00
Which one? You can go both directions
28:03
right? So so this is this is the beauty
28:05
of having a graph is you can start from you know for us the
28:09
person is on the left side of the graph.
28:10
And by person I mean might be a real person or might be a
28:14
service account. But then I can traverse through
28:17
and say all right this person is linked to a group and that group
28:21
might be a nested group that then connects to a role.
28:24
That role might be hierarchical then that goes into maybe I'm
28:28
going to go through a bunch of different policies in in IAM,
28:33
but then all the eventually I'm going to get all the way down to
28:36
a resource in that target system and an action that can be taken
28:41
on that target system in the end.
28:42
So one of the big innovations as well that we've also built in
28:45
here is this idea of effective permissions in that we do a
28:49
translation. And so we don't just give you
28:51
the raw permissions that are in the system because often times
28:55
it's very hard to understand what those things mean.
28:57
But we'll actually say, hey, does this mean you can create,
29:00
read, update or delete the language of CRUD, right.
29:04
And so you can do that on this object and of course you and
29:08
then you can go the other way as well.
29:09
And that's one of the beautiful things about the graph.
29:11
You can say, hey, my customer database, a resource in this
29:14
system in Snowflake or you know, Bitbucket, you know, I, I have
29:20
AI have a repo in GitHub. I want to see everybody who has
29:23
access to that thing, right. You can go the other way.
29:25
And so it's a it's a very flexible kind of data model.
29:29
Yeah, I think that's important is like you can go either way.
29:32
And then one of the nuances I picked up on what you're just
29:34
saying, you can start in the middle.
29:37
You can start with, hey, I want to see what this role or this
29:40
group does or can do. And I think that's important.
29:45
You know, there's this debate in the identity community around
29:50
least privilege or if you just like take a beeline to 0
29:54
standing privilege. But The thing is, like, even if
29:58
you go to the 0 standing privilege route, eventually you
30:01
have to put it on to a user. And if you don't really know
30:05
what it does, then you're just like saying, all right, well,
30:08
we're going to trust you with this machine gun for 15 minutes
30:12
and hopefully you use it as intended.
30:15
That's that's exactly right. Now that's that's great insight
30:18
because that's that's always one of the things that makes me
30:20
scratch my head is like you know 0 standing privilege and doing
30:23
just in time is great. I mean that's a that's an
30:25
important aspect. But you're still granting
30:27
access. And if you're if you're sort of
30:29
going to you know all just in time privilege like you know the
30:33
number of approvals that have to go through magnifies you know by
30:37
by whatever that is by whatever factor you want to pick.
30:40
And then those approvals just get rubber stamped right.
30:44
And so you're always have, you know there's always a a you know
30:47
sort of a balance there because the more approvals you do and
30:50
and force through a sort of a just in time provisioning
30:52
system, the less attention that gets paid to each of them.
30:55
And so you, you always want to be judicious about that and say
30:58
hey maybe there's some people who should never get access.
31:00
I don't care who approves it. I don't care if their manager
31:02
says it's OK like you know, Fred should not be able to blow away
31:06
the customer database. Like I don't care if somebody
31:10
says it's OK. But it's Fred.
31:11
Come on, I mean. I'm sure there's someone out
31:15
there whose name is Fred who's really his.
31:18
His ears are steaming right now. He's not happy with what we're
31:21
saying about him. No, I know.
31:22
I I feel sorry. Just Fred things.
31:25
I'm sorry, Fred, when you're out there.
31:29
There was a video that we saw around Intelligent Access and
31:35
one of the things that it covered or one of the things I
31:37
emphasized was covering all systems.
31:40
So all right, I've got my skeptic cat on now because I've
31:43
been through enough of these appointments where there's
31:45
always an asterisk or something. Is it really all systems meaning
31:52
legacy systems as well modern systems, SAS, non SAS?
31:58
Help me understand what the coverage looks like here and
32:00
what's what's realistic from AI guess from that coverage or
32:04
integration perspective. Yep, that's a a great question
32:07
and you're right to be skeptical because that is all that that is
32:10
always the that is always the the devil's in the details and
32:13
the reality is for some systems that we cover natively their
32:17
cloud that have well formed AP is integration can be very, very
32:21
fast, right. And so you know the on the on
32:23
that example for I know of at least one customer where they
32:27
were able to fully deploy Vasa in about 30 minutes because they
32:31
were all cloud. And the SISO who happened to be
32:35
our server customer champion there happened to have admin
32:39
level privileges for all the systems that we were worried
32:41
about. So I won't comment on that but
32:44
that was the reality as it sometimes is And so he was able
32:47
to go set up the read only roles that's sort of one of the
32:50
necessary pieces you want to you want to make sure that BEZA has
32:53
least privilege that we only have access to the stuff that we
32:56
need to do the job and the and fulfil the use cases that you've
33:00
bought the product for. So it was it was very
33:02
straightforward and that was and then we're off to the races In
33:06
other cases where for instance the custom application or if
33:10
it's an on premise application that doesn't have good Restful
33:13
APIs right then we've got to figure out a different way to
33:17
get the data into the Vasa system and that can take some
33:20
more work. And so an example here is one of
33:23
our larger customers that's using us for access reviews
33:27
integrated in about the first, I think it was about the first
33:30
four months or so about 60 different custom applications to
33:34
do access reviews on, right. And so that took some work.
33:36
But still I would say if you've if you've ever gone through an
33:39
IGA deployment and tried to do it, getting 60 custom
33:42
applications in four months is a pretty good clip of things.
33:47
And so that's that's sort of the the longer end.
33:49
And the other thing I'll say is that from even on premise
33:53
systems, we have a couple of customers that are all on Prem
33:57
right zero cloud. And so they actually that was
34:00
actually one that was surprising to me because I remember asking
34:03
this I was we were at one of these one of our company
34:05
meetings and I asked the questions like hey how are we,
34:08
how are we doing on the on Prem is that is that real?
34:10
Because I was, I was wondering myself over how it actually
34:12
worked in reality And and they were like, yeah, we got a couple
34:15
customers that are fully, fully on Prem.
34:17
And I was like that's really fantastic because that gives me
34:21
the confidence that they can actually get the value out of
34:23
Visa even though they don't have any any cloud infrastructure at
34:26
all. I think that's a really
34:29
important distinction and maybe you know I'm not going to try
34:33
and take over iveza's marketing, but that is an area that I
34:36
typically see a lot of struggle with is hey you know what on
34:40
Prem is on Prem we're not even going to try it man.
34:43
We're going to focus on the cloud and SAS based applications
34:46
and things like that because we know that they are having you
34:50
know connectivity, they've got integrations, right.
34:53
All the stuff's there. But you know I guess maybe
34:56
something to think about to go to market is hey what is you
35:00
know we can handle the on Prem stuff too which I think is such
35:03
a missing link for a lot of things in this space.
35:06
So I'm happy to hear it. What I'm not happy to hear about
35:09
is 30 minutes to install something, get things
35:12
configured. It's going to put people like me
35:14
out of a job for integrating IGA.
35:17
But I think that's that's another thing too, right, is how
35:20
quickly you can get in there. Now 30 minutes I think you
35:22
mentioned was a Seeso who had admin access to things which,
35:26
you know, say what you want about Seeso's.
35:27
A lot of them do like to have their hands in the pie.
35:31
What is a normal, I guess, integration timeline look like?
35:34
Is it days, weeks, months? I mean, it can't really be 30
35:37
minutes all the time, but what's a what's an average deployment
35:40
look like? Yeah, I'd say you know on
35:42
average you know it's going to be in the term of weeks and
35:45
that's also because you know usually what happens is and and
35:50
we certainly encourage this is the, you know the the key to
35:52
success is to start start small. So start with start with your
35:55
cloud, start with something easy and get some wins right that and
35:58
that's always the thing to you know to actually build momentum
36:01
to build knowledge with the system and understanding with
36:04
the system. So you know it, it sort of, you
36:06
know, it depends how where you draw your boundaries and where
36:08
you draw your lines. But you know, usually customers
36:11
will start with something in the cloud, get it going quickly, get
36:15
some wins and then they're off to the races.
36:16
So from from a from a deployment in you know in you know a week
36:20
or two, that's not unreasonable 'cause that's your approach.
36:22
But if your if your goal post is you know got 1000 on Prem
36:25
applications that are fully customized and on mainframes and
36:30
AS4 hundreds that will that will take longer.
36:35
AS400 green screens, They're giving me a flashback.
36:38
So it's of our prior life. The other thing that I thought
36:42
was interesting was this idea of covering all identities.
36:45
So I'm guessing that means human and non human machines, service
36:50
counts etcetera. I guess how do you, how do you
36:52
make sure that you've got all the identities, types I guess
36:57
covered and making sure you've got the right correlations in
36:59
place to say, Oh yeah, this is Jeff and not AI version of Jeff
37:03
or some machine or service account that Jeff is using to
37:06
run an application. Can you walk us through a little
37:08
bit about how that works? Yeah.
37:10
And I think it's it's really that you know, I think I and I
37:13
think the thing I'd like to to really emphasize here is that
37:16
the, the thing that I've seen that is pretty different is also
37:20
just the way that service accounts have been treated,
37:22
right. And that and that you know
37:23
obviously there's there are you know solutions out there that
37:26
will go after service accounts. But typically the world of
37:29
identity has sort of hasn't really treated those as sort of
37:34
you know, full partners if you will, where you know like you
37:37
know typically the, you know the service account types of
37:40
processes have been around the Pam world, right.
37:42
It's been in like Yep, you want to get your, you know your
37:45
secrets and your certificates into the into the secrets vault.
37:48
Yep, that's great. But in terms of doing things
37:51
like governance around service accounts over like, hey, you
37:55
know, I want to do an accessory not around people but around
37:57
like hey, you know, do we know what this, what applications the
38:00
service account is actually attaching to and is it right.
38:04
And has the person who developed a service account and created
38:07
the service account, do they still work at the company and
38:10
you know, who who owns the service account?
38:12
Those are the kinds of questions that we typically see are
38:16
missing. And that's actually one of the
38:18
things that I think has been most attractive with some of
38:20
our, you know our really large customers especially in the
38:24
financial services side that's sort of where they're headed now
38:26
where they there's you know it's actually around this sort of
38:29
machine identity service account governance processes that's sort
38:34
of the forefront of that. Where they're saying Yep, we
38:35
want to do the same kinds of things we do with human based
38:39
HR, system based access reviews, but we want to do it, we want to
38:42
do it on service accounts. And so I think that's the big,
38:44
that's the big biggest missing piece.
38:46
I say it's not necessarily the technology which is which is
38:49
great and I think the technology is an important piece of that.
38:52
But the fact that now that most customers have sort of treated
38:55
it operationally and from a process standpoint as something
38:58
outside as something not identity based.
39:01
And I think that that's something that's pretty that we
39:03
see changing, which is great. Rich, I have to key off that
39:06
because it, it feels like secure or yeah, securing machine
39:12
accounts, non human accounts, it's kind of like the bane of
39:15
all of our existence these days. They're starting to outnumber
39:19
human accounts, if not already. Do you find that your customers
39:24
are coming to you to solve that problem?
39:26
Like that's the problem they need to solve?
39:28
Are they starting there? Many, many are.
39:32
Yep. And this is, this is something
39:33
we were you know and it like I mentioned there's you know it's
39:36
it's a pretty broad set of use cases that people key off.
39:39
But definitely that service account coverage is a big deal
39:43
for a a for a number of customers.
39:46
And I think you know this is, this is one of the things I know
39:48
and if you you mentioned the the Microsoft breach, that's
39:51
certainly one that comes to mind here as we start to see attacks
39:57
that are sort of well documented and well publicized that focus
40:00
around as the Microsoft one did a legacy Oauth application.
40:04
Had had the ability to go get elevated privilege and that was
40:08
it, you know instead of that Oauth app and that's that
40:10
service account linkage was key to the attack factor, right,
40:16
that that was really the key part of that.
40:18
And so when as we see more of those things, I think I think
40:22
customers are going to start to realize how critical that piece
40:26
is and say, yeah, we got to get you know our security tooling
40:29
that covers those things as well.
40:30
We can't just worry about people as we've traditionally defined
40:33
it. Now it has to.
40:34
We really do have to get to that because it's it's not only is it
40:37
as you point out, Jim, it's a, it's a huge and more rapidly
40:41
increasing surface area in terms of the number of accounts, the
40:44
number of machines there. But also the fact that most
40:48
security tooling I think hasn't emphasized that in the same way,
40:51
especially on the Identity side. So I just wanted to key up for
40:56
something else you just said there.
40:57
So you talked about that Microsoft breach.
41:01
So you wrote a blog. I read the whole blog, then I
41:04
watched the video, and then I realized that the whole blog was
41:06
basically the video. So either read the blog if you'd
41:09
like to read or watch the video if you're like me and you don't
41:12
like to read. I just wanted to point out
41:15
something. So it was you and Tarun were
41:18
talking and you guys went out of your way to compliment
41:23
Microsoft, right? Because I think that one of the
41:27
things that they did that really needed to be recognized was that
41:31
they came out, they were honest about the issue, they documented
41:35
the issue. You know, it wasn't the best
41:38
look, right? Because I think it was
41:40
essentially something that didn't have MFA enabled, right?
41:44
But rather than try and sweep it under the rug and wait till
41:47
somebody finds out and try to ignore the issue, they were
41:51
proactive. Absolutely.
41:53
I I still give them props because it's like those things
41:56
are so valuable for certainly for me.
41:59
But I think it's. I think it's true for the entire
42:00
community to really understand what went on and you know, and
42:04
this is the same same deal. You know and maybe, you know, I
42:10
don't know if I'd give Okta quite as many props in terms of
42:13
their transparency over the last stuff.
42:14
But you know they the information has gotten out there
42:17
and and it's it's eventually gotten there around the role
42:21
that inbound federation played in The MGM breach.
42:24
You know that. But but again that when I
42:26
compare sort of the outward response for Microsoft and Okta,
42:30
you know, that's that's why I sort of do give Microsoft props
42:33
because they were, you know, they were very forthcoming, had
42:35
a lot of really good detail. It was like, wow, this is, you
42:38
know, I really understand how this thing worked, you know,
42:40
maybe not fully fully, but you know, 80% of the way there I
42:43
got, you know, it was, it was very useful and actionable in
42:46
terms of sort of how that all went down.
42:49
I always find it a struggle and a challenge to figure out when
42:52
do you make disclosures like that?
42:54
Because I think there's a rush to Do you tell people right away
42:57
and not know the full story or do you wait so you have the full
43:00
story and then tell people and there's all I don't envy anybody
43:04
who has to disclose information like that because I think you're
43:08
really caught in a rock and a hard place.
43:10
You're already in trouble cuz you had an incident and now it's
43:14
well, what if we release information too early?
43:16
It's not correct, right? Is it better to release early
43:19
and then have to make corrections, or do you wait
43:22
until you know a little bit more what's the right balance?
43:24
The longer you wait, people get suspicious and they're like,
43:27
well, why didn't you tell us sooner?
43:29
You know, it's it's a difficult balance and I don't envy any
43:31
organization that that gets put in that position, that's for
43:33
sure. Yeah, my gosh, I, I, I, I look
43:37
at the the Cesos that are at my our our customer organizations
43:41
like that is a tough tough job and it is it's no joke.
43:46
So I I agree that's really, really challenging.
43:49
And it's also interesting because although it's not
43:51
certified what I'd say like our primary use case, but it's one
43:54
that I think is going to be a really interesting one for us
43:58
for Vasa actually in the future is actually starting to bring to
44:01
bear this whole question of you know who has access to what, but
44:04
do it in the context of post breach investigation.
44:08
So you know, so you know, you know in in the security
44:09
operations team, 'cause this is one of the things that I've,
44:12
I've definitely heard is obviously the gold standard is,
44:15
you know, I want to look at the activity.
44:16
I want to look, OK, you know, I had a breached account.
44:18
I'm going to go check and look at the logs and see, you know,
44:21
what did this account access, you know, after this time and,
44:24
you know, time and date. But the the challenge that I've
44:27
heard from Csos is really that, hey, you know, logging is great,
44:31
but a lot of times logging isn't turned on, right, because it's
44:35
expensive and it's a lot of memory and people charge you,
44:38
you know, left, right and Center for it.
44:39
And so sometimes it just never gets turned on.
44:41
And sometimes when it's turned on, it doesn't quite give you
44:45
the right information, right. It's not enough to really
44:48
understand what went on. And so you end up having some
44:51
big gaps. And so you can never just rely
44:54
on logging, you know, after an incident like you've got to keep
44:57
going, You've got to dig deeper. And so, you know, if you think
44:59
about sort of a set of concentric circles, you know,
45:02
the first one you go do is like look at the logging and look at
45:04
the activity. But then the next you want to
45:07
say, well, what could this account have touched?
45:09
Like what were the permissions for that account?
45:10
And that's one where Vasa is extremely powerful and I'll I'll
45:15
throw in one one other product pitch and then I'll stop.
45:17
But we also do leverage the activity monitoring as well.
45:21
So you know, so now it's actually pulling both of those
45:23
things into a single platform, not just the activity of who
45:26
accessed what, but also who could access what and having
45:30
those two things together I think is going to be a really
45:32
powerful use case for our post breach forensic security
45:36
operations in the future. Well, it must be rid of my mind,
45:39
'cause I was kind of thinking here as talking as like a tool
45:41
like this would be really handy for a forensic, you know,
45:44
investigation. I guess it's better to have it
45:47
before the incident happened so you can capture the activity of
45:51
what's happening. But even afterwards, being able
45:54
to do that diagnosis of, OK, well, here's the account.
45:57
Now at least we know the account that got popped or whatever
46:00
phrase you want to use, right, That that, that caused the
46:02
breach, What else could it have touched, I think is really
46:04
interesting. So you kind of stole my Thunder
46:06
there. So pitch away that was.
46:08
That was where I was headed anyway, from a question
46:10
standpoint. Nice.
46:11
We're we're on the same page here.
46:13
That's good we are. So I want to wrap up a
46:15
conversation with a lighter note because that's how we typically
46:19
will end our our shows. The last time you were here, we
46:22
asked questions around longevity because that was something that
46:25
I think you know, you've got some interest and we talked
46:28
about what's the most interesting thing you've learned
46:30
about longevity. If you want to know more about
46:32
that, again go back to episode 231.
46:35
But I want to stay in that same vein, right?
46:36
Try to stay with interests. This one I think is a little
46:39
more fun, Maybe thought provoking and rich.
46:43
I'll ask you first, the fountain of youth or the wisdom of age?
46:48
If you absolutely you could only choose one, which would you pick
46:54
and why? It it is a a fantastic question
46:58
and I think you know it depends on you know what we how old I am
47:04
when you when you ask this questions because I think one of
47:07
the beautiful things about getting older has been
47:10
appreciating the wisdom of age more.
47:12
And, you know, I I also think about, you know, as you as I've
47:17
gotten older, I just, I there's a level of comfort and
47:22
confidence and just, you know, knowing who you are is just a
47:25
wonderful thing. And you know, I I think about it
47:28
because I've got two teenage boys and just, you know, the
47:30
challenges of being a teenager and thinking that everybody is
47:33
staring at you. It's like it's so mentally
47:36
traumatizing. It's tough.
47:38
Being a teenager was really rough.
47:39
And you know, as you get older, you just start to care less and
47:42
less and and This is why you see so many old guys walking around
47:46
with Plaid pants is they just stop caring.
47:48
And there's a there's a beauty to that that I've really
47:50
appreciated. So I don't have my Plaid pants
47:52
yet, but I aspire to that. So Plaid Pants is how we know
47:57
that you've picked the the the wisdom of age.
48:00
That's. Right.
48:00
That's when. That's when you know I'm on, I'm
48:02
on the, the, the, I've, I've reached the, the, the final
48:05
stage of development. Jim, how about yourself, Which
48:09
one do you pick? Fountain of Youth or Wisdom of
48:12
Age and. I I don't think anybody could
48:16
have said better than Rich right there.
48:18
I mean, seriously, like every thought I was having on this
48:21
topic, you just hit all of them. And I actually feel like I'm
48:27
happier now at 50 than I was at 40.
48:30
And I remember having the thought I'm happier now at 40
48:34
than I was at 30. And I'll bet you it goes all the
48:36
way back. And I have two teenage boys as
48:39
well. I've got a 19 year old who I
48:43
love him to death, right? It's like he's working a job,
48:47
like manual labor and making like under 20 bucks an hour and
48:51
he's talking about going and buying like a $40,000 truck.
48:55
And it's like as a 50 year old, you just look at that and you're
48:59
just like, my goodness, kid, what are you thinking about?
49:03
You have zero debt right now and it's like he can't wait to get
49:06
into debt. And what he doesn't realize is
49:09
once you get into debt, you're in debt for the rest of your
49:11
life. Because like, yeah, you know,
49:14
you're just, you're always running credit cards, you get
49:17
ahead financially and all that, right?
49:19
It's not like you're living paycheck to paycheck your whole
49:22
life, but you've always got payments, right?
49:25
Most people, most of us, all have a mortgage and maybe a car
49:28
payment, etcetera. What would be ideal?
49:33
I know this is cheating with this question would be youth,
49:37
physical youth, but also keeping your your wisdom.
49:44
No, I mean that's that's absolutely, 100% cheap.
49:47
I mean, that's what everyone wants, right?
49:49
I mean, there's there's TV shows that, you know, vampires live
49:53
forever, you got altered carbon, which you've never seen on
49:56
Netflix is fantastic. I love it.
49:59
Same idea there. I've heard that Warren Buffett
50:01
said that he would give up all of his money to be like 21
50:05
again, so I'm not going to go. Does he retain the knowledge?
50:10
That he's gained. Because I think it, I think, you
50:12
know, 45 to anyway, I'm only 50, so I can't speak beyond this too
50:17
much with experience anyway. But I think in that range.
50:22
I'm happy with where I'm at. Like, I don't like all the signs
50:25
of aging, but I'm really like happy with my life.
50:29
I'm happy with the person that I am.
50:30
If people don't like me, I really don't care.
50:33
And I can't say that when I was in my 20s, like I really cared
50:36
what people thought of me. What about you, Jeff?
50:39
You know, Rich, I I couldn't disagree more.
50:43
I I wish I was still 20. I could almost dunk a
50:46
basketball. Yes, I used to be able to.
50:49
If you look at me now, it's like there's no way that that dude is
50:51
getting any more than six inches off the ground.
50:53
No, I'm just kidding. I think, you know, I think you
50:56
hit it right on the head. I mean everything you just said,
50:58
same thing, you know more confident more comfortable with
51:01
who I am, the knowledge that I've gained, you know Now if I
51:05
could pause time, I think that would be great.
51:08
I'm I'm, I, I think Jim you hit as well too.
51:11
Like I'm happier now than I was five years ago, 10 years ago,
51:13
etcetera. And I had some great times.
51:15
Look, I feel like I've LED a great life.
51:17
I've had a lot of experiences, a lot of fun fun stuff that I've
51:20
done very fortunate in that regard.
51:22
But yeah, I don't think I would trade youth for the wisdom
51:26
that's been accumulated over the years.
51:28
So I feel like we're all, I don't know, maybe this is an old
51:31
hat question. If you ask a younger person if
51:34
they would ask, you know, answer it the same way but it feels
51:36
like we're all on the same page except I'm not going to wear the
51:38
Plaid pants. I would still feel too
51:40
self-conscious about that. I felt like a real nerd wearing
51:44
my Apple Vision Pro on a flight last week.
51:47
And I did return it by the way, but that that experiment is
51:51
over. But I have not felt that
51:53
self-conscious in a very long time putting that thing on.
51:56
I'm like, I know I'm going to return this, but I got to try it
51:58
out, see what's like. And yeah, you you totally, you
52:01
totally hit that question on the on on the head for me as well.
52:04
Awesome awesome. Well the the you know just as as
52:07
we as we leave with parting thoughts.
52:09
I think Jim I think if you if you convinced your your 19 year
52:12
old son you know the really the the beauty and and and all the
52:16
the benefits of a 15 year old minivan.
52:19
I can I can hook you up here I've got something.
52:23
But if he's got a Mustang, I handed him down my.
52:25
My old might be a bit like. Frazee Mustang and not good
52:30
enough. He's a.
52:32
Senior Mustang. It's a nice car too.
52:33
I mean, I wish I'll tell you what I had a the the cheapest
52:37
Chevrolet car that you could possibly have.
52:39
It only had three cylinders in it for an engine and I was
52:42
thrilled to have it so. What?
52:45
What Car was that? A.
52:46
Mustang is good. Well, I'm not going to tell you
52:48
because that's a secret question, man.
52:49
But you'll have to. Type.
52:50
Guess it. I love it.
52:52
Yeah. So I mean it's not going to be
52:55
hard that hard to guess and I think I've changed all those
52:57
answers anyway. But if you Google three
52:59
cylinder, it would have been my guess mid to late 90s.
53:03
Was it a Yugo? Did you have a Yugo?
53:05
No, it was a Chevy. Oh.
53:07
OK, it was a Chevrolet brand, let's put it that way.
53:10
So there's the the trivia for folks.
53:12
Did you have to crank it up before you drove it?
53:16
Look, I've heard you. You can't make fun of me because
53:18
I've heard every single joke. Nothing that you're going to say
53:22
I've not heard before about that car.
53:23
But you know what? It was my car.
53:25
It gave me freedom. I could get wherever I wanted.
53:27
Jeff, Jeff, this this car is your these are your Plaid pants
53:30
right here. That was my Plaid pants.
53:33
I'm glad I outgrew it. Now I'm very happy in my
53:35
electric vehicle. And yeah, life moves on.
53:39
Let's go ahead and leave it there.
53:40
That was a whole lot of fun. Rich, thank you so much for
53:43
coming back with us and having a conversation.
53:45
I hope folks will go out and check out beza.com beza and
53:48
really check out what you guys are doing.
53:52
I think you guys are doing some really remarkable stuff.
53:54
And I think there's a lot of applications that, you know, at
53:57
first glance, me, it was like, oh, OK, it's this.
53:59
I was like, oh, wait, there's so much more.
54:01
We'll have links in our show notes for people to check out.
54:04
Want to connect with you, Rich? Ask you questions?
54:06
Argue with you politely about Fountain of youth versus, you
54:11
know, wisdom and age and things like that.
54:13
We'll also have links to Vasa's website as well, so you can
54:16
check them out. And yeah, we'll go ahead and
54:19
leave it there for this week. Thank you again so much, Rich,
54:21
for taking the time with us. Jim, as always, thanks for your
54:23
time and thanks for everyone for listening.
54:25
You can find us on the web, idacpodcast.com or on Twitter or
54:28
X or whatever it's called by the time you listen to this at IDAC
54:32
podcast and we'll leave it there.
54:34
Thanks everyone. And we'll talk with everyone in
54:36
the next one. Thanks much.
54:39
You've been listening to Identity at the Center.
54:42
We hope you've enjoyed the show. Make sure to like, rate and
54:46
review and we'll be back soon. But in the meantime, hit the
54:50
website at identity@thecenter.com and find
54:54
us on Twitter at IDAC Podcast. See you next time on Identity at
55:01
the Center.