Latest / Identity at the Center / #198 - Identity BCP and DR for the Cloud with Muli Motola

Transcript

#198 - Identity BCP and DR for the Cloud with Muli Motola · Identity at the Center

0:09
You're listening to the identity of the center podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast, I'm Jeff and that's Jim.
0:28
Hey Jim hey Jeff, how are you? Not so bad.
0:31
You got like this, you know what eating grin on your face right
0:34
now. This is the way most episodes
0:36
start though. He's like, usually I think
0:38
you're just like, you're like, looking at me or they?
0:40
All right. When's he gonna start talking
0:41
here? As we kind of get our hit the
0:43
tape, you know, to start it well.
0:45
So it's also how my brain operates.
0:47
I sit here, and entertain myself with, you know, maybe a movie
0:50
clip, or something. That's just running in the
0:52
background in my head. All we wait for the recording to
0:56
start. So today, it was the movie back
0:58
to school. I've ever seen that Rodney
1:01
Dangerfield. It's been a while, right?
1:03
Is this the one redoes the triple Lindy dive?
1:05
Yes. Yes that's the movie.
1:07
But the part that that entertain me just now was he has to sit
1:12
down and take an exam for each of the classes he's in and the
1:17
English composition English literature teacher Professor
1:21
really dislike some a says I only have one question for you
1:27
and he breathed a sigh of relief in 26 parts, so that's kind of
1:33
the the opening that I was going to come up with today.
1:36
These are think about disaster recovery and this conversations
1:41
going to go 26, different directions.
1:43
But think about Disaster Recovery or what the cool kids
1:46
call business continuity planning, right?
1:48
And I was thinking of all the different places I've worked and
1:52
all the Business continuity, Disaster.
1:55
Recovery plans that I had done and all the time.
1:58
I spent doing tape backups and you know that, fortunately, I
2:03
actually never had to enact one of those.
2:07
I never had to actually take the plan and run.
2:10
I mean, that's a good thing, right?
2:11
I think that's like, buying life insurance and then never be able
2:15
to cash it in. That means you lived a long
2:17
life. So be happy.
2:18
Don't be mad that you spent the money on life insurance and but
2:23
what I was About, was that I had a next door, neighbor, who
2:28
worked for a company called Marsh McLennan, right?
2:31
And he was the it window system administrator at the, the Twin
2:37
Towers in New York, and God bless him on the day of 9/11,
2:44
his trait. They're trained in front of his
2:46
broke down and he wasn't able to get onto Manhattan Island.
2:51
You know, for his normal work day and unfortunately his
2:55
building took a direct hit and he worked for like 250 people
3:00
and like 230 of them died like there was just a small handful
3:04
of people who survived but as the it administrator what he
3:08
would tell me was his days became restoring systems and
3:15
going to like funerals are remembrance events afterwards
3:20
here. As the 26 parts are.
3:22
Here's one of the 26 cars. Here's where I go.
3:23
It was going with. This was you know then I started
3:26
thinking about what was I doing on 9/11?
3:29
I was an IT administrator but I think it's always an interesting
3:32
question to ask people. What were you doing on 9/11?
3:36
Because I think it in, you know, it kind of dates you, you know,
3:40
you can be like, well I was in third grade and I was doing x y
3:45
z but I wonder job. I'm not sure I ever.
3:47
I never asked you that question. What were you doing on 9/11?
3:52
Yeah, and thanks for starting us off on a very uplifting note
3:55
here, appreciate that. I was, let's see.
3:59
I was working for Walgreens, I was working as part of the
4:01
service desk or help center as they called it.
4:03
And you know, this this was a building that didn't have
4:07
Windows or really outside Communications too much but the
4:10
word kind of trickled in and, you know, several of us were
4:12
kind of going back and forth in between support calls where we
4:15
could, and, during breaks and stuff.
4:17
Kind of out to the parking lot to listen on someone's AM radio.
4:20
E0 WBBM 780 in Chicago, you know, what was going on and kind
4:25
of listening, it, kind of play by play there.
4:27
So it's definitely kind of a surreal moment.
4:30
And I don't think at least for me, you know, took a while for
4:33
sort of like the gravity of what happened to kind of hit because
4:36
they think there was just so much conjecture and kind of
4:39
waiting for facts and stuff to kind of come out as like what
4:41
exactly happened here. But yeah, I mean, that's just, I
4:44
was in The Help Center. I was a service desk, you know,
4:47
agent like anyone else taken printer my printer.
4:50
Work calls and you know my pill pack thing won't work or my
4:54
Baker cell doesn't you know deposit drugs into the right
4:57
thing. Like all kinds of stuff and the
4:59
dreaded as400 questions which I absolutely hate it.
5:02
I could not stand trying to troubleshoot as400.
5:05
Yeah. Yeah.
5:05
So my my, I was also a Windows administrator and/or, you know,
5:13
network engineer whatever you want to call it, it wasn't just
5:16
confined to Windows, but I was working in New Jersey about 40
5:21
miles from New York City and yeah we just someone had
5:26
mentioned a plane flew into the World Trade Center at first.
5:31
I kind of like said okay well I was thinking of like some small
5:34
stuff so I'm like all that. That sucks.
5:37
Then you're a second one crashing.
5:40
Really. Oh my gosh.
5:41
So anyway, I guess, you know, in the context of the show, I don't
5:44
want to drag us down to 911 around too much weight.
5:46
It's you laid down but you know, First off, everybody's got their
5:51
story for that but second off its kind of the disaster that no
5:55
one ever expected to happen, right?
5:58
But it's kind of like, I remember, building these
6:00
Disaster Recovery plans and it was always like well what if our
6:03
data center got hit by an earthquake or something it was
6:07
kind of like you know you'd have these conversations you think
6:11
almost like that could never happen.
6:15
But then you can have like, a targeted event like that.
6:18
That who knows, maybe something like that.
6:20
Could happen. So Disaster, Recovery planning
6:22
to me, is always been something that we do.
6:25
It's like the insurance policy that you hope you never have to
6:28
cash in. And so that's I know that's
6:31
going to be the topic we talked about today because now, we're
6:34
in a whole new world with the cloud.
6:37
You hope for the best plan for the worst, right?
6:40
And I think there's like right now it's like, okay well let's
6:42
go to the cloud. We don't have to worry about
6:43
that anymore wrong but still things.
6:47
You've got to kind of figure out for that.
6:48
Kind of thing, we are going to talk about BCP and Dr. Business
6:54
continuity, planning and disaster.
6:55
Recovery for identity infrastructure.
6:58
In the cloud. We're going to introduce Our
6:59
Guest here in a minute. I do want to remind people that
7:02
we've got a few different conference coming up.
7:04
We've got Gartner's, I am Summit Jim, you and I will be there on
7:08
stage, you know, having conversations with Enrique and
7:11
Becky and maybe hopefully putting Into I'm not hopefully
7:15
but trying to in a in a good way put them into a uncomfortable
7:18
position and ask some kind of tough questions around how
7:22
Gartner Works. Maybe we ask them what they're
7:23
doing on 9/11. Yeah, yeah, let's see if I know.
7:27
Thanks, Jim. So we got Gartner coming up,
7:31
that's in March, it's in Texas. It's earlier this year.
7:33
So get your tickets. Early Compaq.
7:36
The audience, you know, for our session will be very cool to
7:38
have familiar faces and listeners out there.
7:40
I'd like to figure out how we can get some listener questions,
7:43
you know, if you've ever Ever wanted to ask a Gartner person
7:46
anything and I mean like just about anything, you know,
7:50
sending the gym and I on LinkedIn.
7:51
Hit us on Twitter at idac podcast or Mastodon at idac
7:56
podcast at infosec dot exchange and I hate the man in The Mask
8:00
done names. I think we're looking to kind of
8:03
crowd source and I thought right now is that we kind of bounce
8:06
back and forth between a question that you and I kind of
8:08
come up with and something that may be a listener or listeners
8:12
maybe have a theme that they want to get Something answers
8:14
like that. So if you've got ideas for, you
8:16
know, ask a Gartner analyst anything Senator way, you know,
8:20
will be the filter and make sure we don't put our own careers in
8:23
Jeopardy as far as process. But you know, that's that's
8:26
coming out. We also got a Denver's, I think
8:28
you and I are trying to make it out there in may as well.
8:32
And then we've got the European identity, Cola, and Cloud
8:35
conference. That's also, I think it's later
8:37
and actually, no, that's earlier in May and identify racism, like
8:40
late May. Yeah.
8:42
You know, the thought of I was having was like, you know, how
8:45
you always come up with a list of, here's the 20 conferences,
8:48
I'd like my company to spend money to send me to, he said,
8:51
well, what's your number one? I always say we should list the
8:55
European identity conference because, you know, I've never
8:59
what other opportunity will we have to, you know, go to go to
9:04
your for this job, right? We're pretty much us bound.
9:08
Yeah, or North America. North America bound?
9:11
Yeah, I mean, you know, it's expensive to go anywhere these
9:13
days. There's always limits and
9:15
budgets and stuff like that. So you always have to
9:16
prioritize? I'm trying to figure out if we
9:18
can get out to our essay or not. We'll see kind of see, but
9:21
plenty of stuff going on, but why don't we get to our main
9:23
topic. We've spent the last nine
9:26
minutes waxing poetic about sad events a.
9:30
So let's talk about how do we recover.
9:33
You know, I'd any infrastructure in the cloud.
9:34
Let's talk about BCP, let's talk about Dr. And to help us with
9:37
that conversation. We've got muli mottola.
9:39
He's the co-founder and CEO at accents.
9:42
Welcome to the show. Moving Hey, Jeff, Jim, thank you
9:45
for being here. Your, I was hoping to have a
9:49
hilarious discussion but you started with 911.
9:53
So let's see how it goes from here.
9:56
Yeah, thanks Jim. Appreciate that.
10:00
Why don't we start with sort of your identity origin story.
10:03
I'm always curious when we have someone on the show for the
10:05
first time, how they actually got into the, I am world.
10:08
Is it something that you chose, or did it Choose You?
10:12
Well funny because I do relate to the 911, a story, my first
10:19
real. It job was I was at EMC walking
10:24
for EMC and specializing get backup storage disaster
10:28
recovery. And awards also consultant for
10:31
business continuity and disaster processes.
10:35
And one of the stories that we had regarding 911, was that
10:42
actually to Stories, interesting, and related to us
10:45
to our topic. The one is around, the, a guy
10:48
that was sick at home. While his entire team was
10:51
walking one of the buildings and and sadly, they all, they all
10:58
they were hitting the in the crash and he had to walk alone
11:03
to recover the entire company, it because there was nobody to
11:08
help him. So the other stories, Is around
11:13
the company that invested tons of money for Disaster Recovery
11:16
planning. They had a full storage walking
11:21
in one of the buildings and another storage replicated and
11:25
sink to the second. On the other building so they're
11:29
back up within the second building directly that I think
11:32
that stresses the importance of having a geographic spread so
11:36
things. So we actually a team see we had
11:39
a lot of lessons learned from that event Consulting, companies
11:44
on how to build a red just recovery plans.
11:47
And what we can also learn that is a disaster.
11:50
Recovery is not a tool or a hardware or software.
11:57
M. It is actually the good old
12:00
people processes and tools that are required in order to provide
12:06
a good solution and all of them are quite providing a requires a
12:13
lot of thinking, he gets a good analogy and it kind of draws
12:16
parallels, right with identity and access management.
12:18
It's not just a tool. It's kind of like zero trust.
12:20
Even though apparently zero trust is solved by one tool for
12:23
blood reminders. You're joining us from a
12:27
conference that you're at. Are you in Israel right now?
12:29
We're somewhere else? Yeah, actually I am a bit
12:33
exhausted from three days in the Tel Aviv and my voice is also a
12:38
bit broken. I my company exhibited showcased
12:45
in cybertek tlv. It's a conference that I think
12:50
it's the 15th time I ain't I'm participating it in various hats
12:55
and starting from the data was at EMC.
12:58
And in actually, it's, it's kind of a closed circle around around
13:07
my career here in the starting from him scene, from MCA, moved
13:14
to several other companies at the corporate of, EMC, RSA, and
13:20
VMware. And once Del Hotel, EMC, me and
13:27
the pain. Of mine.
13:28
We decided that we want to have a break from the all the
13:31
cooperate walk and decided to open our own consulting firm
13:37
this consulting, firm. And that's the maybe what
13:40
relates to identity management. We actually help companies to
13:46
analyze the risk going out to the cloud.
13:49
So we went to Banks and insurance companies.
13:55
Printing companies, building the helping the Management team
13:59
built the risk analysis around moving to Cloud.
14:03
That's was part of the government requirements from
14:05
these companies and they had to make this study so we did it for
14:08
them. And the funny thing is that with
14:12
all our knowledge around infrastructure architecture data
14:16
centers and network and storage and compute and everything.
14:19
The first thing that came up and actually took over 80% of each
14:24
report was identity management. So we couldn't I can't explain
14:31
more every step of the of the report had somehow related to
14:38
identity management. How do you authenticate a person
14:43
from a cloud service? Using his local data center as
14:48
usual as well as your wasn't there anymore.
14:52
And yet active directory identity, the solutions were
14:57
Video. And this is why we decided to
15:01
take a look at the market or what are the products that are
15:05
kind of doing that in that moment and where were, you know,
15:09
EMC guys. You know, corporate guys, we
15:12
knew all the Microsoft and Symantec and all these big
15:16
Solutions. But then somebody told us a
15:18
loose took, there is a small company called doctor from
15:21
Silicon Valley and it looks like they're doing something very
15:24
cool. Maybe you can choose to check it
15:27
out. Out so we check them out and I
15:30
immediately fell in love and I'm telling you, Jeff, I hadn't
15:34
practiced, technical stuff that time for almost six years.
15:40
I was pre-sell sales, engineer and sales account executive and
15:45
consultant. When I saw OCTA, I immediately
15:48
fell in love, and I told my pal condition.
15:51
We're pivoting. The company will be coming
15:53
system integrators for walked up and I am the CTO.
15:56
I To be the implementer. And then that's what happened
16:03
going forward. Seven years, we had many
16:07
customers in is about the bigger system, integrator.
16:10
Actually, for a octane Israel, and I gained a lot of experience
16:14
working with the product. I became hooked a consultant,
16:17
and I was part of the team that OCTA for OCTA, created, in order
16:23
to build the consultant exam, don't shoot the messenger, I did
16:29
plan some nasty questions and so that was my experience with
16:35
identity management and now you're with a company called
16:38
accents and Gartner listed. You guys is a cool vendor for
16:41
2022. So I'm curious what that process
16:43
looks like. I guess for people who aren't
16:45
familiar with accents, you know, how did you parlay?
16:48
And I do it's--it here, but, like you parlay, this sort of
16:51
act expertise into something new.
16:53
Give us the 32nd. Maybe, 60.
16:56
Second long, elevator, right pitch around, kind of what you
16:59
guys are. To solve it.
17:01
So, we're part of this seven years Implement in octave.
17:04
I figure that this product is becoming more and more Central
17:07
to the company's it and actually not only be identified this and
17:19
OCTA when companies started really strategically move the
17:23
cloud. Actually, it stopped being just
17:25
a security product and it has become the sure where the
17:29
company meets is the only places everybody meets and the
17:34
centralized place that manages everything or the access to the
17:37
company resources, and the problem that we identified is
17:42
that it also is a single point of failure and as a single point
17:47
of failure, we try to understand how we can help customers and
17:52
ourselves a system integrators back then to overcome this
17:56
situation. We also Defy the problem that
18:01
the super admin of the system is so strong, yet, it's just a
18:06
user's password and MFA and we did thought that it's not so
18:14
hard to trick somebody to lose that.
18:17
So the use case of a super admin losing access to its
18:21
Administration Board of okhta. You can really annoyed me and
18:26
and and day I saw that need to solve it.
18:29
So access is a spin-off company that we built in order to solve
18:35
the problem. First of all, to protect the
18:37
data weekly knocked out by providing an air gap based
18:40
solution and secondly, ability to recover the data.
18:45
If somebody is taking Leo maliciously and made changes
18:50
into the system, or in a very, very bad, use case where an
18:57
attacker is actually gaining control.
18:59
Roll over your admin dashboard and you can't access is back.
19:02
Our solution allows to actually recreate your entire akhtar on a
19:06
secondary tenant providing disaster.
19:09
Recovery for this SAS critical suspended for So, let's talk
19:15
about Dr. And disaster, recovery and BCP business continuity
19:19
planning. I guess, for those who aren't
19:21
familiar, let's just start with, you know, at a very base level
19:24
because I think it's more than just a technology rights people
19:26
and process. How do you define disaster
19:30
recovery? And then how do you define
19:32
business continuity planning? Where we essentially saying the
19:34
same thing? Which is two different sides of
19:35
the same coin. Oh no, that tone, actually, when
19:40
I was a consultant to DMC there was NGO called the ITIL.
19:47
And these guys were training it, managers how to manage their it
19:52
infrastructure. And one of the biggest chapters
19:55
of ITIL whoever was certified in ITIL, and I, suddenly had to do
20:03
this, to do it as part of my job in MC was business, continuity,
20:08
business continuity, is the let's say, Michael Solution.
20:15
That companies have to possess every IP old company need to
20:20
have it as part of their ordinary and daily job and
20:24
dusted. Don't need to be somebody that
20:26
is responsible for it. So, business continuity is an
20:29
organizational, it's a business process, it's not even a
20:33
technical process, we think business continue.
20:36
And it's, of course, related to the fact that business provide
20:41
needs to provide New continuity of service, both to support its
20:47
customers and to support it, stock owners and and the
20:53
investors. And so they can make sure that
20:58
the company continued continues doing money and and not just
21:04
brakes suddenly without any plan to recover.
21:09
We think business continuity, there are processes that are it
21:12
related? And him within the it related
21:17
processes, there is a special chapter called disaster,
21:19
recovery process. Which disaster recovery process
21:22
is a use case, we think business continuity which is let's say
21:28
natural disaster includes natural disasters or very big
21:32
disasters like Cyber attack and ransomware attacks which are
21:38
probably disastrous to to the business.
21:40
Yeah I think you've done a really good job of, you know,
21:43
highlighting The importance that this discipline is not just
21:48
about tools, right? But at the same time we are
21:53
Geeks and we are, you know, the identity of the sender podcast.
21:56
So we do want to talk tools a little bit and as far as I'm
21:59
concerned, one of the biggest things is change.
22:03
What we do when it comes to Disaster Recovery as it people
22:09
is. You know, the difference from
22:12
having the on I'm Prem technology where we built the
22:17
servers. We controlled the server's.
22:19
We could back them up to now we're relying on cloud services
22:22
and more specifically software as a service where it's more or
22:27
less a black box. So I'm I'm wondering, you know,
22:31
maybe I just answered it but you know, what's the difference, can
22:36
you talk? Can you highlight some of the
22:38
differences between the old way of doing it?
22:42
Which by the way, is still Feel the way we do it and a lot of
22:46
Enterprises maybe 50% is still on pram technology but now the
22:52
cloud is introducing all these new things.
22:54
This black box concept. Well, I'll give you an example
23:00
and I'm looking at it and they use case 11.
23:03
So if in let's say we have a critical system like like
23:08
identity management system like OCTA and this system holds the
23:12
entire Privileged and access to all the resources and
23:18
organization and admin mistakenly.
23:22
Click on a button, he didn't meant to click.
23:25
And that exposes, I don't know contractors to the netsuite
23:31
financial application where they can now access it and see.
23:35
I don't know, Financial aspects of the customer this situation.
23:39
This use case has a technical problem.
23:43
Somebody He did something wrong and it has an effect on issues
23:49
that are not that technical. It's might be privacy issues
23:54
like the even non-compliance issues and financially things
23:58
that were exposed. That might even hurt the
24:00
business from our perspective. As it admin, this is an
24:05
operational mistake, it's a Miss configuration caused by an
24:09
abortion, a mistake. Maybe it's even can happen
24:11
because of the leg in the in the, in the prowl.
24:14
And it happened before there is a leg.
24:18
You click something green, sure. You click it again and that's
24:21
that sends a put request into the into the system which
24:26
actually deleted the entire group and that's the effect on
24:33
that aspect with respect to business continuity.
24:37
Probably the business has some commitments, the business has
24:41
commitments either too. Is the stakeholders or where
24:45
customers and he needs to recover this situation back, and
24:49
go back to business as fast as possible.
24:53
Usually that's being done. By recovering the data
24:58
recovering the data or recovering the action that has
25:00
been done. Then maybe you have a backup of
25:05
the last configuration. Maybe it's a terraform script
25:08
that was run and you need to hunt the next day.
25:10
Last surgeon. Again, this it includes.
25:14
First of all, the ability to do the change and it includes a
25:17
process that that required to be followed in innocent that the
25:25
other scenario might be a malicious attack.
25:27
A malicious attack on the organization might be the risk
25:34
of damage might be from 0 to 100 from small change.
25:40
That might be you know somebody reached into an main account and
25:44
change some other user and Gabby privileges to a specific
25:48
application. I don't know.
25:49
And without user, he's gaining more information from the end
25:54
application, without anybody noticing, so that's, that's one
25:58
tactic, second tactic, it's to run some welding.
26:00
Tell system that situation you're actually losing control
26:07
of the entire organization. So the question is, what can you
26:13
do in this situation? Do you have a plan for this?
26:16
Have you planned this? And and I think that's the main
26:20
question here. If you have tools for this, if
26:23
you have DIY tools for this, or you build a third-party shove
26:28
the shelves, tool for the rest doesn't matter.
26:30
First of all, you need to plan for this situation, you need to
26:33
think about it. And you need to train your
26:36
people in acting in this kind of Since which something that we
26:42
don't see it. Not?
26:44
Yeah, I think you're highlighting a couple of key
26:47
points for me. One, is that at the center of
26:49
any business, continuity and Disaster Recovery plan is the
26:53
ability to access systems. So, I am is going to be at the
26:57
center of any, you know. I am maybe not like at an
27:02
Enterprise level, you know, I was thinking when you were
27:05
talking about business continuity that the most simple
27:08
level if you were running a restaurant, Restaurant.
27:10
Right? And all your computer systems,
27:12
went down, maybe have a backup process and I remember thinking
27:16
through okay well you know, maybe it'll take a while to get
27:19
our IDP online or IGA system online, so could we do local
27:26
authentication, things like that.
27:27
So to me identity is, you know, got to be part.
27:32
It's got to be one of the major use cases you take on from
27:37
business continuity perspective. I also think, you know, being
27:42
clear about what your use cases are, was your other point that's
27:48
incredibly right? As well.
27:49
I was thinking back to my system engineer days and you get that
27:53
ticket escalated like, hey, deleted this important
27:56
spreadsheet. Can you go and restore it?
27:58
So you go find the tape and restore this spreadsheet.
28:02
That's not. Does that show recovery, right?
28:04
That's recovery. From someone stupid error, you
28:07
know? And it did take down the
28:08
Enterprise and Might be the pencil.
28:10
Could be a disaster for that one person.
28:13
Oh, yeah. Yeah, baby.
28:14
There was just addressing. Yeah, yeah.
28:18
Yeah. It could be it could be very
28:20
important for you to get this free sheet back.
28:22
However is not part of your Disaster Recovery plan.
28:25
So but you know identifying the use case because I've been
28:30
thinking about this is you're the one of the main reasons that
28:33
we wanted to have you on the show is Jeff and I have been
28:35
going back and forth on is like okay.
28:38
Well what would Pin, if you know, especially malicious
28:43
attacks, we talk about these rents and work Crews and really
28:46
what they specialize in is blocking you from being able to
28:51
access your own information. So maybe they get in and take
28:56
over all of your domain administrator company because
28:58
they wipe out your entire user directory.
29:01
Maybe they go in and wipe out all of your configurations.
29:06
So I think the use cases of like, you know, identifying How
29:10
you're going to deal with all those different scenarios is key
29:14
and specific to those use cases, what is realistic where you can
29:19
have a tool to restore from? And you know, like I would
29:26
imagine you can't restore passwords right?
29:30
You know because I don't think you can backup passwords would
29:35
you want to or you might not even want to do my naughty?
29:38
You certainly want to Wouldn't want to be able to back them up.
29:41
I would say these, are you back them up?
29:43
Now, you have another instance of that password that can be
29:46
broken somewhere else, but let's put that aside.
29:49
I would think, you know, there are certain things that
29:52
technology can only take you so far because when we talk about,
29:56
you know, directory of users, we talked about configurations when
30:00
we talk about certificates and things, that would be you know,
30:08
maybe part of the the secret. Sauce that you can't even get
30:10
to. And I think this gets that black
30:12
box concept. You know, what is realistic for
30:17
the IM practitioner to say, okay this is what I can use
30:20
technology for in this is what I need to have documentation that
30:25
I'm going to manually, do some steps to get back in business.
30:29
So you raise the so many Goods, the topics.
30:33
And and I think the first thing that resonate with what we said
30:39
is a Send it, they asked a lot for from customers and so every
30:44
customer knows his availability service level, right?
30:51
You're usually also published his, you want to be five nines,
30:55
four, nine, three nines. By the way, we have a
30:59
newsletter, we call it five nines was like that, that means
31:03
my availability, but, do you consider access to your system
31:08
as part of this availability? Or if I jeopardize the access to
31:11
your system is it jeopardizing the the way that you calculate
31:14
your availability. And and I can and I can ask him
31:19
it the opposite way if you can't access your service.
31:23
Even if it's working, is it available?
31:27
So so this is why we focused on identity management.
31:31
Although business continuity might need other aspects to
31:35
protect and be able to recover identity and access management.
31:39
Even touch the key and the only gateway to Modern organizations
31:44
that's the that's the real infrastructure and everything
31:47
built on is built. On top of it.
31:49
Everything from the applications to them, device management, to
31:54
the network and zero tourism infrastructure up to the cloud
31:58
and access to the service itself and and all the all the
32:01
engineering and everything. So a protecting identity and
32:05
access management, I think that's was the top priority and
32:09
and First thing that you need to recover.
32:11
If you even if you're looking at a robust business continue you
32:15
have process and I think also that the 16 year old guys from
32:23
lapses and and the Gang from octopus.
32:28
I've identified this problem how easy it is to bypass an admin
32:34
which is protected there are under credentials and MFA and
32:38
whatever by a A proxy server. And, and that puts the entire,
32:45
the question around. What can we actually prevent a
32:50
bridge for identity and access management?
32:54
Or are we doing best efforts? And then we need to think about
32:59
what's happening in the day after.
33:02
And and when we, when we thought about the day after and what is
33:05
required in order to recover the system credentials, weren't Even
33:10
question because a day after mean, first of all what you're
33:13
going to do? We have to ask everybody to
33:15
reset the password. So yeah why do I need to keep
33:20
these password but but the benefit even if I could and I
33:24
and I can't so I can't read this information from this us
33:27
provider. It's kind of that tabletop
33:30
exercise, right? It's like going through and
33:32
saying okay playing through the chess game of all right.
33:36
Here's the situation but it would by the way the day Doesn't
33:40
mean you went home and slept for 8 hours and came back?
33:44
No day. After it's like, oh my gosh,
33:46
we've been working all night and now, the sun's coming up and
33:48
we're still working. But yeah, you know, and brought
33:54
up for me, I wanted to, to raise a question from one of our
33:57
listeners is name is Ravi and Ravi asks, what should he do to
34:02
prepare for the possibility of an outage and three different
34:06
types of outages several hours several days?
34:09
Or even forever. In other words, what is
34:12
realistic for the I am practitioner to consider as
34:16
possibilities and within the the realm of SAS or ideas ID as a
34:23
service. And one of the things I want to
34:26
raise is like a lot of time in the disaster.
34:29
You don't know how long it's going to last, right?
34:31
So so one of the scenarios could be that your IDP has gone down.
34:37
You don't know when it's going to come back up.
34:39
But then The other scenario might be, you know, your you got
34:44
owned, you know, it's not coming back, you know, that you're kind
34:48
of on your own. So I want you to kind of just
34:52
give us your thought process there on that question from
34:55
Robbie. So that's a great question.
34:59
I don't know what's the size of the company.
35:01
It's robbing folks it and but that's it.
35:03
Relate a lot to to what's the environment that he lives in and
35:09
the City. Use cases that you might
35:11
consider as that dangerous or risky for the company.
35:14
So the company won't die if the there is an outage in with the
35:20
cloud provider for a couple of hours.
35:22
Yeah so usually if it's let's say if it's a Workforce so most
35:29
of the sessions are still open and you have mobile apps for
35:33
mobile apps. Doesn't need that doesn't
35:35
require authentication in each log.
35:37
In there is like a lifetime of Of the token, which can continue
35:43
and move. Most of the time, you wouldn't
35:45
even feel feel that unless you need to access to a new
35:48
application via browser. That's that's that's usually the
35:52
thing longer outages, It's Tricky.
35:58
So why is the outage so long have been have the event of
36:03
being preached? For example, or I don't know his
36:06
data center fell down and he couldn't get It up, and that's a
36:11
real question. And, and honestly today, at
36:17
least at accents, we do not focus on that scenario, but we
36:22
are thinking about it. So if I'll take it as one level
36:29
down in outage of, the vendor means an outage might not even
36:36
out of the of the entire vendor might be.
36:39
Sin or a region that went down and you're part of it.
36:44
There is no failover between other regions, for example, and,
36:47
and, and that's something that the vendor needs to take care of
36:51
it. And he means they need us.
36:52
Like most of them are taking care of partial, outages of
36:57
their own data center. The problem that we see in the
37:03
Market at the moment is that none of them is giving a
37:07
solution for the And level outage.
37:11
So at the vendor level or Multiverse multi-tenant level,
37:17
they're given a solute. They have backup and Disaster
37:19
Recovery, data plans all these, okay, but when it comes to, the
37:24
tenant level, you as a customer, as part of the tens of thousands
37:28
of consumers that the vendor has, they don't bring any
37:32
solution. And on top of that, they also
37:35
signed you on the contract called terms of service which
37:37
has a clause called shall dispense.
37:39
We model the shared responsibility modern States
37:42
clearly that they are responsible for lots of things
37:45
but you're responsible on the data and configuration and
37:49
identities and devices within the system.
37:53
And and this is where we saw that we can help customers
37:57
because they don't have tools to do it, but they are obligated
38:01
for that aspect. Yeah I think the shared
38:05
responsibility models is absolute key.
38:07
To kind of think that. Okay, we've outsourced the
38:11
application so we don't have to worry about it anymore.
38:14
It's going it's just we just handed it off to somebody else,
38:17
it's way too immature to and from an information security
38:21
standpoint even there's responsibility that goes back
38:26
and forth in terms of kind of okay you know at the very basic
38:30
level, usually think of okay, the they The SAS vendor may be
38:37
responsible for the controls that the authentication process
38:41
is going to work. But if you set your passwords at
38:45
six characters and someone breaks your character or breaks
38:49
your password string, that's on you right?
38:53
And so yeah I think that's that's very key.
38:58
I'm wondering, you know, because not everybody's on OCTA.
39:04
And there may be some organizations that are out there
39:08
evaluating Solutions. Now in terms of Disaster,
39:13
Recovery in terms of business continuity, one of the questions
39:16
that they should be asking, you know, including a vodka in terms
39:22
of, you know what they what those vendors providing this
39:25
space or how they approach. This problem when they're
39:29
evaluating, which company, should we go with in the future?
39:34
Let's agree to take a look at question 2.
39:38
And I, when I, when I started the company, most many people
39:42
ask me. Hey, why are you investing so
39:44
much heroic? The can bring a team of 10
39:47
people and copy what you doing a couple of months and your
39:51
business is that. And then I was talking with the
39:55
founder of Shea. Another Israeli startup called
39:58
on Becca on backup, specializes in Providing backup and recovery
40:06
for Salesforce and they became unicorn couple of years ago
40:10
already and I wanted to learn from his experience of
40:13
protecting its us product. And these showed me an article
40:19
that was issued last think two years ago, where it was the
40:28
third time that sells Force, Ooh, store GA a backup solution.
40:38
And they pulled it back, it was the third time, they pulled back
40:41
their solution and and and the newsletter headline was is sells
40:48
for backup, Enterprise ready. And I think that is especially
40:56
say to to know how to build an Enterprise ready, backup
41:00
solution and business continuity solution, and Disaster, Recovery
41:04
Solution because it's more than a tool, To understand it's a
41:09
process and you need to understand the experience of the
41:12
use of building a process of a disaster.
41:15
So some of the experience that we bring is not only from OCTA
41:21
or EMC on all of us served in the in the arm and we have some
41:28
kind of combat experience. And as an officer, you know that
41:34
when you need to take decisions, you need to have a clear.
41:37
Understanding of the situation, and this is why we built into
41:40
the product and a war room, an investigation and war room, that
41:45
allows you to quickly and easily to identify the environmental
41:51
effect of the change. And that's something that I'm
41:56
not sure that the identity management system company would
42:00
think of when they will provide a backup solution for the
42:03
system. So anyhow evaluating And or
42:09
capabilities of having a backup or not.
42:11
I don't think the right question is does he have this feature?
42:15
But does his apis provide the entire information you need?
42:20
In order to recover? That's a good question.
42:23
I would ask because we did some analysis for the vendors and I
42:26
would not State here who's better than who, but some of
42:30
them are very have a very short list of apis that allows us to
42:37
extract. With the data that is required
42:39
in order to provide a good backup for their system.
42:43
And so, if to answer your question, I think the API is
42:49
maybe the key Point here, when evaluating a vendor.
42:52
Yeah. The, the API also, I think
42:57
getting a sense for whether or not The vendor, the identity of
43:03
the service vendor considers disaster.
43:07
Almost like you're asking a silly question.
43:10
Why would we ever have a disaster right?
43:13
Or if they really thought through it?
43:14
Because like, enterprise software, it's not about like,
43:18
okay. I think if, if I heard that
43:22
Microsoft wasn't thinking about it is that, you know, how they
43:25
would react to a disaster That would, that would keep me up at
43:28
night. I think Microsoft is kind of
43:30
landed at the too-big-to-fail stage and sure they are
43:35
geographically dispersed but, you know, there are some things
43:39
that go beyond their control of them, I would be hopeful.
43:42
So, I guess my question to you is, you know, have you found
43:46
that as you've talked to sass and identity as a service
43:51
vendors are where you hear about things.
43:53
You mentioned the on backup friends.
43:57
Of yours. Do you find that the vendors are
44:00
welcoming to having Disaster Recovery Solutions?
44:05
Be brought into the marketplace for their software.
44:09
So putting me into the car live here.
44:12
Welcome to the identity to Center podcast a tough question.
44:16
You know. Well I think that's a business
44:21
question. It's not a technical question
44:23
here company, which is IP old. I don't know if they would be
44:30
interested in having their own capabilities being, and the
44:35
effort being invested in something that will not improve
44:38
their lives. But the revenue line and and
44:44
disaster business continuity, usually the cost rather than
44:49
their revenue generator also em, unless we proved differently, by
44:54
the way, maybe we can provide them Dancers, what happens today
44:59
is that all the compliance companies, the Auditors in for
45:04
soak two socks is kind of compliance questions.
45:10
They start to ask the questions, the right questions like up to
45:14
now, they ask the nice questions but now they're starting to ask
45:18
the right questions. So I've seen many, customers
45:20
saying things have changed in the past, they were asked a and
45:25
what are the critical systems You have I see octave.
45:28
You have a backup for doctor. So do you say?
45:30
Yeah, okay. Does backup yourself so I have a
45:33
backup to a doctor. That was okay as regarding to
45:36
the auditor. But now starting to ask the
45:40
tough question. Can you recover your doctor and
45:45
and and suddenly we get more and more calls from customers and
45:48
then we actually get water and smoked hours or so.
45:51
So that means that they're okay with having us on board and And
45:57
I'm getting more and more calls from other than those, with that
46:01
are interested in, in our solution.
46:04
And by the way, there is another Israeli company, very, very good
46:07
called simplest. That is doing the same for
46:10
active directory and now 40 active directory also.
46:14
So, we're now baby steps, but they're really mature in doing
46:20
so. And and I feel that Microsoft
46:23
also embracing them. So, This is how the sentiment
46:29
from the market that I 2 and I can look at it as like, okay,
46:33
this probably check the box. Yes, we can back it up.
46:36
Yes, you know, it's whatever restore it how good it is.
46:39
Debatable. Kind of pens.
46:41
I mean, I'm trying to put into, you know, terms that maybe my
46:44
feel right. I can play World of Warcraft
46:46
without mods. Do I want to play World of
46:48
Warcraft? A lot mods.
46:49
Know, or, I can drive a car that doesn't have a radio.
46:52
Do I want to drive a car does? Everybody know?
46:54
I think there's levels of survival.
46:57
Well, that really only the organization can answer to say
47:01
what is acceptable for us. And I think this is where not
47:04
only the technology, but the people in the process, it's
47:06
really important to have table top exercises, right?
47:10
If you've never really executed your Disaster Recovery plan, or
47:14
your BCP plan, or whatever it may be, you know, you hope that
47:18
you never use it, but you also don't want to go into it and
47:20
say, oh, okay, we've we have it looks good on paper, but it
47:25
didn't work in the real world, right?
47:26
So, I think the importance of having tabletop exercises to
47:30
kind of walk through. Here's what would happen,
47:32
etcetera, I think a lot of companies discover that there
47:36
are issues that creep up over time or they didn't account for
47:41
his part of that plan. So I think it's important to go
47:42
through that and you mentioned some Paris.
47:44
We've had Gil Kirkpatrick on with us because episode 110
47:49
seems like ages ago but yeah, they have a very good product
47:52
that looks at active directory, right?
47:54
For the backup. Respect the same way you're
47:56
looking at from OCTA. Aah.
47:57
And it's an interesting spot to be in because they think I
48:01
wonder where things are going now.
48:03
Right? Where everyone is moving to the
48:04
cloud or says they want to move to the cloud at.
48:07
What point, you know, what is the future for BCP?
48:11
And Dr. Look like for those types of services, whether it's
48:14
ass or some sort of platform as a service or whatever, maybe
48:17
I'll give you my two cents right now.
48:19
I feel like it's going to be good.
48:21
Enough is probably where built-in Dr. Wind up, but there
48:28
will be a spot where it's not good enough, certain
48:31
organizations? Or there are circumpolar.
48:33
Certain components of that shared model that you
48:35
referenced, which I don't think a lot of people really realize
48:37
is like, oh well, doctor goes down.
48:39
They'll bring it back up and we'll be good like, no, no.
48:41
There are things you need to do whether it's octopus, Inc, for
48:44
Drac, Microsoft's, you name it. Whatever.
48:47
Maybe there is always something that you as the tenant holder.
48:52
The customer the client, whatever you want to call, it
48:54
will have to restore. And I That's where these sort
48:58
of, you know, value-added Services can really add a lot of
49:01
value to say is that something that we want to take on
49:03
internally as a, you know, as a core competency or is there a
49:07
solution that helps us Bridge? You know, that gap between the
49:11
two? I'm curious from your
49:13
perspective having been in the space where do you see things
49:15
going? So Jeff I think that the Joe
49:19
Cool worked. So being prepared for this
49:21
situation is something that you need to work on and it's
49:24
continuous walking again. It's not only a tool tool can
49:28
bring you a lot of efficiency in doing that but being proactive
49:34
with repelling to a Cyber attack like this, I think it's critical
49:38
and and when you start thinking on the on the on the sand box
49:42
around the how this situation goes all the questions start to
49:47
pop up. So how long do I allow myself to
49:51
be down? How much data do I need?
49:54
In order to recover to appropriate?
49:57
Time which is sufficient for me to continue working.
50:03
How how, how much, how many times I need to train my people,
50:08
for this kind of scenario. They need to be trained right
50:11
there. You can't just fall into the
50:13
situation and be ready to react. We all want, peace of mind.
50:18
Yeah, so Peace of Mind comes if you prepare, not if you and I
50:24
feel at the moment that many customers Don't want to hear the
50:31
truth and if they don't hear it, they not they don't need to plan
50:36
for it and and the ones that are more let's say ready to listen.
50:44
And it's not like in situation where we have the early adopters
50:49
here, it's not early adopters. It's people that are more
50:52
experienced. For example, one of our first
50:54
customers here. He immediately got into a role,
51:01
he was an IT manager of an on-prem company, very secured
51:06
cyber company and then he moves doing company which is basically
51:11
not cyber making project management tools.
51:18
But yet his first decision was I want a backup of all my stress
51:22
environments. So you just chop out of the
51:25
Shelf with every could and started doing.
51:27
Processes in order to back up by themselves, the rest of the
51:31
critical information, but they felt is critical.
51:34
So I feel that the at the moment, people are doing
51:40
whatever they can if they are serious enough and take this job
51:45
seriously. And, and, and do-it-yourself is
51:49
quite hard and for that, I want to relate to what you asked
51:52
about the SAS and where it goes. So as opposed to backing up
51:57
story, Each local level backup or even even file level backup
52:09
or database backup or is virtual server backup in such.
52:14
We don't really know what happens the see, it's a black
52:18
box. It's the closed guard are
52:21
whatever and we need to guess and we have only what the pain
52:26
do provide us. Using his rest API facility.
52:31
So the job is how you need to know the system.
52:35
Intimately Because backup is only one step, you know, we used
52:40
to ask people understand, you can back up at.
52:44
Can you recover in order to recover?
52:48
It's a totally different question to recover.
52:51
You need to have the enough in data and to know that this data
52:56
is consistent, maybe you have data, but it's not consistent.
53:00
Maybe you have from one point in time, out of the data and a
53:04
partial from other point in time, then, To be
53:07
interconnected. There is a sequence in writing
53:10
back into the API, the data in order to recover.
53:14
So you need to be very intimately aware of whatever SAS
53:18
product you're protecting. This is why I don't see
53:23
companies like producing. Hey, I'm a platform that can
53:27
back up all the sauce, blood flow that that you work with.
53:31
Because first of all, there are endless as platforms and you
53:34
need to know them intimately. So so we Actually had to reverse
53:38
engineer their database in order to be able to keep the data
53:44
consistent. And, and with all the required
53:51
information is, that is required in order to recover.
53:54
So, this Market currently been slowly Consolidated using mma's
54:03
that's what's going on at the moment in the market.
54:08
And I guess it will take time until you will see
54:11
conglomerates. It is imagine a really important
54:15
distinction I think is the difference in backup and
54:17
recovery and I think that's something we've been talking
54:22
here now for like fifty five minutes, and I feel like that's
54:24
the Nugget, you know, it took us 45 minutes to get there.
54:27
There's one thing people out there should be listening to its
54:30
that particular part. Yes, you can back up, but can
54:33
you recover? It doesn't matter if you can
54:35
back up, if you can't also do the recovery.
54:37
So I think I feel like that's where we should probably like
54:39
and the conversation because I don't think we'll get better
54:41
than that. But I wanted to, you know, ask
54:44
Jim you're really started off on a downer.
54:46
I feel like we have brought it up a little bit, but let's try
54:49
to pull it all the way back up and end on a lighter.
54:51
Note, moly, we were kind of talking beforehand and I gave
54:55
you a couple choices on what we wanted to go with the kind of
54:58
end on a lighter note. And the one that we're going
55:00
with is this will be questioned for almost two answers.
55:03
Imagine you can instantly learn any language.
55:07
Which would you choose? I'm going with her.
55:08
And why the movie will you go first?
55:11
Yeah, well I come from both of the world which is let's say
55:18
that's the origin of the culture and one of the first cultures
55:23
that actually started to write and tell stories with the it was
55:29
an Empire called Assyria or a shoe in Hebrew as we call it.
55:36
And, actually, they brought Tile rash semi-cooked language into
55:40
life and Hebrew by the ways is is like kind of a subsidiary of
55:45
that day language and they have stories that you tell your kids
55:52
today. But in a different flavor they
55:57
invented everything, they invented all the Legends event
55:59
and all the all the stories of the religious acts and
56:05
everything. And One of the things that I
56:08
would love to do is to be able to read their in their origin
56:12
language, whatever they wrote its power.
56:14
By the way, if you're an archaeologist you it's one of
56:17
the mandatory languages you have to learn so that was my dream
56:22
which never came true. Jim, how about yourself, what's
56:25
the language? You like to learn.
56:26
So I'm going to be boring and pragmatic about this.
56:30
I've traveled a fair man outside of the country and every place
56:34
I've gone. I wish.
56:36
Oh, you know, I'm in Hollywood. And I wish I could speak Dutch
56:39
or I'm in Belgium or France and I wish I could speak French, or
56:43
I'm in Germany. I wish you could speak German
56:45
or, you know, in Asia. I haven't done with that much
56:48
traveling in Asia, but in South Korea, all I wish I could speak
56:50
Korean. That's, you know, a couple of
56:53
those languages. I would have no hope of ever
56:56
learning, but I took Spanish in high school.
56:59
I know some words, I noticed that in structure and I'm
57:02
confident that given enough time and effort, I could master that
57:07
Language. So the other part of the
57:09
pragmatism of it is, you know, I go to Mexican restaurants like
57:14
all the time, they're very common in the US there's a fair
57:18
amount of Spanish-speaking population in the US and I feel
57:22
like I'd get to actually use it. Plus a lot of my favorite
57:26
vacation, destinations our Spanish-speaking area.
57:28
So I'm going to go Spanish. I know it's a boring answer but
57:34
yeah that's my pick super boring super utility.
57:37
In I admire anybody who can learn more than one language, I
57:41
haven't figured out English yet and that's my primary language
57:44
is my hats off to anyone who speaks more than one.
57:47
Even decently that's fine. I know a few Spanish swear words
57:51
from working in restaurants. So I feel like I've learned
57:53
enough Spanish there and I'm going to come up with the stupid
57:57
funny answer. I'd like to learn like Elvish or
57:59
Klingon or some like that. So I can spot my fellow nerds
58:02
out there and have some time getting the thumbs up from the
58:05
way these he's with me on that one.
58:07
Something completely like useless but a unique skill,
58:12
right? I guess would be the look at it
58:13
if you really want to call it a skill.
58:15
But Jeff, you have the universal translator.
58:17
I mean, what do you, you know, I've tried all over the world
58:20
with Google Google Translate so, you know, got that.
58:24
There's here. There's earphones now that will
58:26
do live, you know, translation for you and to your language.
58:30
Technology is awesome. It is, it's just going to keep
58:32
getting better but, okay, I feel like that's a better a better
58:35
way. We can kind of leave things.
58:37
I believe you've been really generous of time.
58:39
Really appreciate being part of this.
58:40
We're going to show notes in our links, in our show notes, you
58:43
know, for folks that connect with me on LinkedIn for more
58:46
about accents. It's a c c.
58:49
SE n e. Well we do it /.
58:52
AC CE SE n. SE dot IO and movie.
58:58
I got one quick question for you.
59:00
There's two s's that are capitalized and the rest aren't
59:03
is there a story behind that? Well, first of its actions was a
59:08
male's of access and sense like to make sense of all the access
59:13
that we learned about. And when I saw that there are
59:16
two assets and then said, maybe we're talking about SAS, right?
59:20
And SAS used to write it like S Campbell, msaa.
59:24
And cupola is. So I kind of vague keep that but
59:29
my marketing Ting saying it's to it.
59:32
It's not going well with the with the papers.
59:34
So hey Jeff and I work for a company called a denture be for.
59:38
I was there for nine years and everybody missed are a lot of
59:42
people mispronounce it and there's a whole story that you
59:46
try to explain to people and they would look at you even more
59:49
confused than when you started this story.
59:52
So yeah I think you stick to your guns man.
59:55
We made it. You know I'd entropy was from
59:57
like 0 6 to He said like 15 years yellow and then they got,
1:00:03
we got bought out by participatory and that's a story
1:00:05
for another day. So so yeah.
1:00:07
Alright, let's go ahead and leave it there for this week.
1:00:11
Emily. Thanks so much for being with
1:00:12
us. Jim, thanks for your time.
1:00:14
You can find us on the web. We're at idac.
1:00:17
Podcast.com. We're on Twitter at idac
1:00:20
podcasts, Ron, Mastodon at idac podcast at infosec.
1:00:24
Got exchanged starting to see more people on Macedon.
1:00:27
Actually, starting to follow the, follow the show there,
1:00:29
which is pretty cool. And you can always connect with
1:00:31
Jim and I on LinkedIn again, the call out there is for, if you
1:00:34
could ask Gartner analyst anything and I mean anything,
1:00:38
send them our way on any of those channels and we'll try to
1:00:42
include that. As part of our thought process
1:00:44
of Riley, why design this this Gartner show that we're going to
1:00:47
be doing so and don't get that. Like And subscribe button that
1:00:50
helps us out, immensely, especially since we really don't
1:00:53
have a marketing budget and everything is here is word of
1:00:55
mouth. So share with your friends and
1:00:57
enemies. We don't care who you share to
1:00:59
us. Long as they're listening,
1:01:00
that's cool with us. So, go and leave it there for
1:01:02
this week. Thanks everyone for listening.
1:01:05
And we'll talk with you all in the next one.
1:01:07
Thank you, Jeff, and Jim. Thanks for listening to the
1:01:12
identity at the center podcast. If you like what you heard,
1:01:15
don't forget to subscribe and visit us on the web and identity
1:01:18
at the center.com.