Latest / Identity at the Center / #172 - IAM in the Cloud with Jay Klauser

Transcript

#172 - IAM in the Cloud with Jay Klauser · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:24
center podcast. I'm Jeff.
0:25
And that's Jim. Hm.
0:26
Hey, Jeff. How are you?
0:28
That's a bad yourself, good. Hey, I'm wondering.
0:30
Have you ever heard of a show called Game of Thrones?
0:33
Now what's it all about? Oh, it's really wild.
0:36
Anyway, there's this one episode where there's a scene with a
0:40
think? She's the queen Cersei.
0:42
Yeah. And she has to walk through the
0:44
crowd and everybody's yelling. Shame shame.
0:47
I don't know. Exactly.
0:48
It's burned into my conscious right.
0:50
So anyway, I had a meeting yesterday with Mike angle from
0:54
one Cosmos and he was, he had the idea of who should have the
0:58
authentication Wall of Shame. And, you know, the identity of
1:02
the sender podcast said, certainly one cause was there
1:05
not about throwing people under the bus, but we were going
1:08
through kind of some of his great examples.
1:11
Would go in the Wall of Shame. And let's just say, one was a
1:14
top Airline, and we talked about this on one of the previous
1:18
episodes, right? Like their multi-factor
1:21
authentication is Is what is your dog's name?
1:25
Yeah, yeah, it's stuff. Like that is like, that's not
1:28
good. That is not up to Modern
1:30
standards. Yeah, I love to use this
1:34
opportunity to call out United every time I can because as a
1:37
former United flyer now that I've moved to North Carolina,
1:41
that is not really a viable option for me, I always and have
1:45
de tested the way that they do their multi-factor because it's
1:49
always just knowledge-based and they have favorites and That
1:53
list favorites change stop using favorites, if you have to
1:57
default back to a knowledge-based authentication,
1:59
please don't use favorites because they're just they're
2:03
just terrible questions. What and I think what the you
2:06
know to add insult to injury? I think the password policies
2:11
now like a 16 character password, which is probably
2:15
appropriate for an Enterprise but for a consumer site like
2:19
that's really painful. Yeah.
2:21
I mean I get why right? I am stronger passwords but all
2:24
that, all that means is that it's going to be a longer
2:27
password and more probably more numbers at the end to sort of
2:30
differentiate. Yeah, it's funny.
2:32
You bring that long. That's what they got.
2:34
Because I've had actually a couple people reach out to me
2:36
this week colleagues asking about sort of the guidance for
2:41
password changes and this put out guidance, I want to say in
2:46
2017 as part of 863 be to stop changing passwords randomly.
2:52
So Like oh, we change our passwords every 90 days, and
2:55
they have to minimum of eight characters.
2:57
Three of four complexity write a script thing at all.
3:00
It is. But something must be going on.
3:01
There must be some sort of Assessments being done for some
3:03
of our clients and three different people reached out to
3:06
me saying, hey, what do you think about changing passwords?
3:08
And I will publicly say my answer here, I think it's
3:11
stupid. I don't think it adds any value,
3:13
the only reason and I agree with nist and and Microsoft on, this
3:17
is the only time you change passwords is when you know that
3:19
there has been a compromise of that individual password Having
3:23
people change it every 60 days, 90 days year, whatever it is,
3:26
just because it doesn't make any sense in it.
3:29
It's terrible for the user experience and a my, my sorting
3:33
recommendation for an IM practitioners like don't try to
3:37
roll your own. I am password policy policy, you
3:44
know, in other words like, oh, we're going to do 16 characters,
3:46
but we're still going to make cheap.
3:47
People change their password every 90 days, and we're going
3:51
to require You know, all this different stuff, but we're not
3:54
going to do the, you know, dictionary checks.
3:57
Because we don't have the technology in place, like that's
4:00
roll your own. So if you get compromised, you
4:03
can't point back and say we follow the best practice and I
4:07
think you really need to be able to be able to point back and say
4:11
this is the practice we follow which was the nurse guideline.
4:15
Well fortunately though right this is the year, the password
4:18
dies again so you know will this is like take 12.
4:22
I think of the password, I'm but maybe we're getting closer.
4:25
We'll see ya password discussion, fatigued.
4:29
Hey, the other thing I wanted to mention so good friend of ours,
4:32
Arturo Cordoba, who was the? I am lead.
4:38
When we did a project way in the past, anyway, he moved to the
4:41
United States and Arturo and I are meeting up this weekend.
4:47
I haven't seen him in a few years.
4:48
He grew up in Mexico and the only Americans.
4:52
You station that he had was TBS. So he became a huge Atlanta
4:56
Braves Sam back when they stunk really bad.
4:59
Well they're really good now and he lives in North Carolina and
5:02
he's coming to visit me and then we're going to go to a land of
5:06
Braves game tomorrow. So shot out to Arturo.
5:09
I know he still listens to the show and looking forward to this
5:13
weekend. Yeah.
5:14
Our truest good people really smart.
5:17
Yes, that'll be that'll be a lot of fun.
5:19
It's always cool. Like you kind of peel back the
5:22
curtain right? We do identity Consulting during
5:24
the day, but every once in a while, right?
5:26
You'll just hit it off with a client and, you know, you become
5:30
friends rather than just, you know, a client relationship, you
5:33
know. And that terms in Arturo,
5:36
definitely fits into that category.
5:37
So very happy for for him. Even if you are going to go see
5:41
a baseball game. Well hey that's what Arts core
5:44
and I like to do. Yeah.
5:46
That's that's totally cool. We got some other things that
5:48
are going on. We've got the authentic a
5:51
conference is coming up in Brr you and I will be there, maybe
5:55
doing some podcasting, we're hoping we're working with our
5:57
friends over at Fido to help us get that set up.
6:01
We've also got Octane and November so we'll be in San
6:04
Francisco for that. Still figuring out how that
6:06
might potentially work, but the idea is to May refer some
6:09
episodes. So if you're listening and
6:10
you'll be at either of those events, you know, definitely hit
6:14
us up on LinkedIn. We'd love to fist bump or say
6:16
hello or even, maybe sit down and have an identity
6:19
conversation of some sort, put it on, put it in the books.
6:22
So to Peek. Yeah, absolutely.
6:24
I mean, it is always great to, you know, especially people
6:27
listen to the podcast and kind of have some thoughts or some
6:30
recommendations, you know, we'd love to hear them or, you know,
6:33
like you said, just meet in person.
6:36
Yeah, I can't say that we will act on the recommendation or
6:40
maybe we may disagree. But we're happy to take it under
6:43
advisement and make make adjustments as needed.
6:47
Should we get to our main topic today?
6:48
Because I think we wanted to talk through identity and access
6:51
management for the cloud. And why are we go ahead and
6:54
introduce Our Guest? His name is Jay clauser.
6:57
He's the head of global sales engineering and Tech alliances,
7:00
with bright of, welcome to the show.
7:01
J job. Jim, thank you so much.
7:04
Appreciate you having me on today.
7:06
Yeah, thanks so much for joining us and this topic that we're
7:09
going to get into identity for the cloud is something that
7:12
we've hit on a few times in the past.
7:13
So I'm excited to go through sort of this conversation with
7:17
you is one of the experts in this area, but before we get to
7:20
that, we always like to find out the origin.
7:23
For the, I am Heroes of the world that are out there doing
7:26
the work day in day out. How did you get into identity
7:30
access management? Is it something that you chose
7:33
or did it choose you? Yeah, that's a good question.
7:36
I mean, to be honest, I kind of chose identity and access
7:40
management. You know, my kind of expertise
7:44
in history. Is it really started on more of
7:47
them that endpoint security, right?
7:50
Understanding the risk there and And and then kind of moving more
7:54
into the zero trust network access space right?
7:57
And so you know really really was interested in getting into
8:03
both identity and Cloud Eye-Fi. Really felt like you know as I
8:06
looked at and a new skill and a new area to grow my expertise.
8:11
And moving into both of those is really the future right?
8:15
Because you know zero trust network.
8:17
Access is at the foundation of the zero trust movement.
8:21
But I feel like the The goal lines.
8:23
Moving a little bit in the managed network is becoming less
8:27
and less prevalent in really cloud and identity is where 0
8:32
trusses is going to be the future of being implemented.
8:35
And and so I found bright event because it kind of met both of
8:39
those needs, right? It was really looking at Cloud
8:43
native Cloud forward Technologies as well as, you
8:48
know, providing a new way of managing Identity in the cloud
8:54
right in really looking at separating out that
8:57
authentication and authorization which I kind of find it akin to
9:01
a zero trust, you know framework right.
9:03
You kind of think of the data plane in the control plane and I
9:06
think of authentication as the data plane and kind of Bride of
9:09
or authorization as the control plane.
9:12
So yeah I chose it actually and I'm excited to be in the space
9:16
out. So you mentioned bright, if we
9:19
had John Morton on oh about a year ago or so, I would have
9:22
been Episode 1 15 October 21 2021 when we had that
9:28
conversation, but for those who aren't familiar with bright, if
9:31
what is, what is bright of do. Yeah.
9:33
Thanks, you know, so, yep. John's agreed to colleague of my
9:37
love working with tan. He's no our field CTO.
9:40
So we're continuing to grow. And really what bright of does
9:43
is is, you know, we provide a unified privileged access
9:48
management or really just access management, you know.
9:52
Platform for the broader Cloud so that is, you know, the
9:56
ability to both through. Visibility understand the
10:01
identity landscape across Cloud Solutions who has access to what
10:05
what are the the identities in the entitlements out there and
10:08
more importantly, what what of those which of those identities
10:12
have standing privileges are standing act.
10:16
As because that's really the Ritz, you know, where the risk
10:18
and lies. And so, in the end, what we
10:22
really Customers to do is Implement a just-in-time
10:26
ephemeral access model across a broad set of cloud services,
10:30
right? Reducing that standing act us
10:32
and really with a goal of getting 20 standing access where
10:36
possible and then also obviously like will touch on some of the
10:39
things today just you know really embracing and adapting to
10:44
fitting in with the way the cloud works from it.
10:48
You know an automation standpoint has really been key
10:50
to that but in the end it's really about Out, you know,
10:53
needing business needs while. Also improving security through
10:56
just-in-time ephemeral access across those cloud services.
11:01
So, we have this concept of of, I am in the cloud or going to
11:04
get through, and we've touched on topics, like Keem, Cloud
11:08
infrastructure and title at management and dream, which is
11:12
dynamic resource and title, and access management.
11:14
We talked with gal, disc in from awesome eyes back on episode
11:18
number 98 about the Keen topic, we talked with Paul Fisher from
11:22
Cooper here. Hold on episode 1 36.
11:24
So that was a March earlier this year. 2022.
11:28
So we've got Keen. We've got dream I guess just to
11:31
kind of help level set Y is managing identity in the cloud
11:35
different compared to maybe you know on premise or application.
11:39
Yeah, premise type environments. Yeah good question.
11:42
I mean I think it starts with just how things operate in the
11:46
cloud, right? Fundamentally the cloud was kind
11:49
of born out of, you know, Deb Ops and Deb said God.
11:52
Sand. And I think, you know, when you
11:55
look at the cloud, it's it's very fluid right in it of
11:59
itself, a lot of cloud services are ephemeral.
12:02
Meaning that you know, services are spun up there short-lived.
12:05
And so, you know, along with that the different Cloud
12:10
providers have have built out their own identity, and access
12:15
management mechanisms or constructs wherever you want to
12:17
say in. That's why it's so difficult.
12:22
I think to try Translate the on-prem concepts and some of the
12:25
on-prem tooling to adapt to the cloud.
12:28
Because again, you know, in the cloud, you know, that the
12:33
resources are short-lived. So the identities that go along
12:36
with those are also sure lid and then you know more and more as I
12:41
mentioned that you know how AWS works with things like role
12:45
assumption and permission boundaries is fundamentally
12:48
different. To how gcp works or Azure work.
12:52
Works with managed identities. And so it's been really I think
12:56
of challenge to adapt, kind of traditional thinking about kind
13:01
of who has access to what on-prem to who has access to
13:06
what in the cloud many with the, you know, the as code I think,
13:10
mindset in framework. Now, it's what has access to
13:13
what, right? I mean, it's not only humans
13:16
week that, you know, very much, if not more of the identities
13:19
that exist are now moving to work.
13:22
And to machine identities. And so I think it's just it's a
13:26
New Concept and it's difficult to to you know, have a single
13:30
expert who understands how these different I am controls and
13:35
capabilities work across the different cloud services,
13:39
whether that's infrastructure as a service, you know, with gcp
13:42
Azure, you know, an AWS or even, you know, kind of these new
13:47
cloud services that are being built into applications.
13:50
You know, things like Snowflake and data as a service.
13:52
Soare, you know, you know, servicenow Haka, so on and so
13:56
forth. So it's just different, right?
13:58
And it takes a lot of time to understand that.
14:01
Yeah, that was the episode we did with John.
14:03
We called. We said the cloud is different,
14:06
right? So, that was the title of that
14:08
episode. But I'd like to take us kind of
14:11
Back to Basics and started the very foundational level.
14:15
So if I'm a see so your organization that is either
14:19
adopted the cloud or is in the process of Adopting the cloud.
14:24
I'm looking at this Cloud infrastructure as an extension
14:29
of my it environment and over time I've made investments in
14:33
other, I am technology. So it acts as manager, you know,
14:36
our single sign-on and IGA tool are privileged access management
14:41
tool. Why can't I use those tools to
14:45
manage the cloud infrastructure just like it did my on-premise
14:48
infrastructure and or maybe they have questions better ask like
14:52
How far can those tools? Take me and where, where can
14:56
they not get me? Yeah, really good questions.
14:58
Um, I mean I think it starts with what we just touched on.
15:01
It's fundamentally different. And so you know, understanding
15:06
and having tooling that fits in with the way that the cloud
15:11
works, I think is important to that, right?
15:13
So it doesn't mean that there's, you know that there's let's
15:17
let's abandon any of those tools and you know many companies have
15:22
put in Very, you know, comprehensive IGA programs and
15:30
solutions, it's really about making sure whatever you choose
15:33
integrates with those Solutions right and extends those
15:36
Solutions. And I think that's a big piece
15:38
if you kind of look at cloud and why it's different, you know,
15:43
you talk about, you know, that that integration Network,
15:46
everything kind of is very much API native, it's very
15:50
extensible, it's very easy. So, So, I don't think that, you
15:54
know, as an IM team looks at getting their, their hands
15:58
around the cloud. It's not, let's abandon what we
16:00
done. It's, let's look for
16:02
opportunities to find, you know, tooling or solutions, that can
16:05
enable us to meet the needs of that development team, right
16:11
without interrupting their productivity.
16:13
Because I think what I've seen is that in many ways, the cloud
16:17
just kind of took off, right? That developers were doing their
16:21
own thing and The unfortunate reality is sometimes the
16:24
identity and access management team wasn't really plugged into
16:28
what was happening there, right. And so they built out this very,
16:32
you know, comprehensive and very automated workflow and Pipeline.
16:39
And like you're saying now, Jim, now all of a sudden, the
16:42
identity team is being charged with making sure, you know, it's
16:45
properly managed. And so that I think is, is the
16:48
balance in the challenge. It's, you know, how can we
16:52
integrate Rate, our current identity ecosystem, whether
16:56
that's an authentication or ID P.
16:58
RI GA, you know, maybe our current Pam for certain things.
17:02
But how can we Implement that? I'm sorry, keep that while
17:08
adding on the dip. You know, the proper solutions
17:11
to meet the needs of those developers.
17:14
It meet the needs of the business.
17:15
Ultimately. Right.
17:16
Because if we Implement something that interrupts what's
17:19
happening on that you know, devops pipeline.
17:22
That's delivering, you know, Revenue generation that's going
17:26
to be a challenge, right? So it's about looking at an
17:29
extending I think the current identity and access management
17:32
programs in integrating, any solution that you have to meet
17:38
the needs of those developers. Yeah.
17:40
That makes a lot of sense to me. I mean, when I think about the
17:43
cloud infrastructure I think, okay, the scope is also
17:47
different especially I mean, if you kind of look at the cloud
17:51
and say we're going to lift And shift what we have.
17:54
We're not going to step into the future, we're just going to host
17:57
it and made of us or in as your Google Cloud.
18:00
We're not going to change the applications.
18:02
We're going to keep all the same tears and in plays then probably
18:07
you can get more out of your traditional, I am tools because
18:10
they don't have to do that. However, if you're moving to,
18:13
you no more modern architecture using containers, if you're
18:17
using that, that pipeline, you talked about or infrastructures
18:21
code, you Start introducing a much greater need for what you
18:25
talked about earlier which is the machine identities.
18:27
I think that the I am tools that we have today do a really good
18:31
job at managing the human identities.
18:34
It's these machine identities and platforms that you know,
18:39
with the human identity we're looking at an authoritative
18:41
Source like who is the human being the carbon-based.
18:45
Life-form is some people like to say that we're trying to manage
18:50
their access whereas these He's machine, accounts are being spun
18:55
up by application platforms, you know, like a terraformer.
18:59
Something is just creating the account that needs while it
19:03
spins up. The infrastructure with takes
19:05
what it destroys the infrastructure, the ideas that
19:08
would destroy the account that's completely foreign to what we've
19:13
had you know, ten years ago or how we managed it in the past
19:17
traditionally speaking. So let me turn this into a
19:21
question because I think Does human versus machine.
19:24
Identity is really the biggest Crux of the issue.
19:28
Maybe even just start with what is a machine identity.
19:31
How do you define a machine identity and then add any flavor
19:36
to anything? I just said, yeah, I know, it's
19:39
good question. I don't know that.
19:41
Anybody has the theater The Uber, right?
19:44
Definition of a machine identity.
19:45
I do think it's a little bit, you know.
19:49
Different terms are used, right? You have the, the RPA.
19:52
Pays for robotic processes, you have, you know, workloads you
19:56
have containers, you have scripts, right?
19:59
And in so you know, if you have all these different names, I
20:04
mean I looked at a machine identity as you know, you know,
20:08
I think any one of those and actually I was we were all like
20:11
Gardener I am and I think I'm going to do a shout out back to
20:15
that is, you know, it was in one of the, one of the sessions
20:18
about machine identities and it was kind of like anything that
20:23
You know, is basically a workload is code, you know, is
20:28
is really, you know, non-human and non not a device.
20:32
So it's kind of like they bucketed machine identities
20:35
into. There's two kinds of machine
20:36
identities devices, right? That's like, you know, my phone.
20:39
My BM now. Those are pretty well defined.
20:42
But then, I think the flip side of that are all of the
20:45
programmatic processes, right? The workloads that the
20:48
pipeline's, the, you know, the robotic processes, all of Of
20:52
that. And it's really like you said,
20:54
it's a it's a, you know, it's a it's a process that gets run
21:00
programmatically and it doesn't have a necessarily a human on
21:04
the other side executing it right?
21:07
And I think there's fundamentally different
21:09
challenges from the identity side around that, right?
21:12
Like with humans the you know the pattern of usage is much
21:18
less predictable because we're humans were doing different
21:20
things. Right?
21:21
Important thing when you talk About identity and managing.
21:25
These machine identities is is much more around the
21:28
observability. Right?
21:29
What is it doing? Is it doing something different?
21:31
Because it's a machine, it should be doing the same thing
21:34
for the most part. It's, you know, it's
21:35
understanding its understanding that as an important factor in
21:40
securing that identity much more than, you know, looking at, you
21:44
know, you know, the having that extra MSA or whenever right.
21:49
It's, it's, it's a, it's an interesting space.
21:51
And then, you know, No, kind of bad as we talked about, I think
21:55
the day ultimate goal is really to get machine identities to
21:58
start using, you know, ephemeral credentials, things like, you
22:02
know IDC instead of a token Ray and and or you know generation
22:08
of a session token and STS token, when they need to connect
22:12
because you know, ultimately anytime you have standing access
22:16
keys on these machine identities, it's a massive risk
22:20
because again, it's not associated with human, it's
22:22
hard. Find the owner of that machine
22:24
identity sometimes. So you know I think those are
22:27
some of the how I there's probably much more gym than what
22:30
you asked about, how do I Define it, but I think that's kind of
22:33
how do I Define it in? Also, what our, why is it
22:36
fundamentally different way of thinking about them?
22:40
And why is it posing a challenge for the traditional?
22:44
I am teams who are now being charged with, you know, managing
22:48
and controlling these identities, you know?
22:51
It's a it's a It's just a New Concept to learn about and
22:55
understand J. When I was talking, what kind of
22:58
introduced the idea? I was talking about, you know,
23:01
the sea so perspective that, hey, the cloud is really just an
23:05
extension of my it environment. Another words are another way to
23:09
look at it is, I've got certain business objectives to achieve.
23:13
I need to do this compliant, you know, I have to be compliant, I
23:18
have to be secure, not only in my internal data center, but
23:21
also my cloud data. Enter or by my cloud
23:24
infrastructure, whatever you want to call it.
23:25
Sometimes people correct me when I call it a cloud data center is
23:29
a so different, but my business objective is kind of the same
23:33
and then when I, you know, kind of put on my controls hat.
23:38
I think about detective controls and preventive controls.
23:43
I kind of feel like this, you know, team technology is really
23:46
helps us on detective side, identifying accounts that are
23:50
over-provisioned roles that are Not being used things like that
23:54
accounts that are not being used that potentially can go out
23:57
there and just acts that access, right?
23:59
But that's happening as, you know, months after its kind of
24:04
like, the accounts been sitting there and over-provision state
24:08
and, and the issue with that from again, C.
24:11
So hat. Trying to make my environment,
24:14
more secure Rich. My business objective is no,
24:20
I've got an expended attack surface.
24:22
All right so what can I do preventatively to make sure I
24:27
don't have over provision to counsel in the first place or
24:30
where the tools or processes that I can put in place.
24:34
So one, you know, am I right? In terms of where Keen fits in
24:39
and then from preventive Sandpoint?
24:41
What's the best solution? Yeah, no I think you're
24:44
absolutely right on Keen, right? That's really where we're team
24:47
was born. It was about understanding,
24:50
right. The entitlements in The accounts
24:53
in really being able to not only visualize, but, but better
24:57
understand and have some recommendations about how to
24:59
reduce that over privileged in that risk.
25:03
I think dream really kind of brings the preventative side of
25:07
it. It's, you know, it's Sookie, Ms.
25:09
That first step. It's I need to understand right
25:13
and that's really important for these identity teams, right?
25:16
I need to understand what's out there so that I can move towards
25:21
kind of that dream. Space of the dynamic resource
25:25
entitlement, they removal of these, you know, standing
25:29
accounts, as you said, they came side, you know, is important to
25:33
understand what's out there, but by the time I understand what's
25:37
out there and I've done my 90-day, you know, assessment of
25:41
this, you know, privilege or account.
25:42
As, in bit used, that's 90 days of potential risk.
25:46
Whereas a dream says, okay, let's start actually moving to
25:50
and it doesn't happen overnight, right?
25:52
Nothing. Happens overnight.
25:53
But let's start moving to an idea where we're dynamically
25:56
provisioning access in it with a short-lived credential or
26:02
through privilege elevation. There's different ways to do it,
26:05
but anytime we need to provide an identity access to a
26:09
resource, let's do it in a dynamic.
26:11
And in a short-lived or an ephemeral fashion because as you
26:14
said, then your risk, you know, factor is dramatically reduce,
26:19
could you don't have these singing accounts and it and
26:21
that's a pretty big Challenge in devops right developers whether
26:25
they like to do they like to develop right well it's part of
26:28
that, right? It's you know there's a lot of
26:31
these in keep this is why Keynes important is a lot of these for
26:35
Finn to counts out there. All right we'll provision in a
26:37
kennel will run the job. Will develop something.
26:40
Maybe even if it's under Deb environments, you know they're
26:43
still valuable data, they're still risk there.
26:45
In those environments that are well managed and and so that's
26:48
where I think team and dream kind of coming together gives
26:51
you Both sides of it, right? And ultimately getting to that,
26:56
that idea of, you know, the dynamic provisioning of access
27:02
rather than the traditional, you know, even even when you talk
27:05
about the traditional just in time, you know, a lot of times
27:08
it was we're going to worry too V an account that has standing
27:12
Privileges. And when you need it just in
27:14
time, you kind of check it out and you check it back in.
27:17
But in the end that account, lived permanently and it was
27:20
provisioned permanently, right? Rain is really about getting to
27:24
the point where either the account is a is dynamically
27:27
generated and expired or the permission is Diet.
27:31
You know, is just in time elevated and then removed at the
27:34
end. There's no standing privilege to
27:36
compromise, you know, in the end and you know, yeah.
27:40
I think the the, the Crux of the problem here is the
27:44
over-provisioned account. I think if you're in this
27:48
scenario where you've got a lot of over-provision accounts, or
27:52
Be looking at some kind of cleanup process that needs to
27:55
take place but if you don't have to Evergreen processes in place
28:00
to prevent it from happening again, you're going to be in a
28:03
lifetime of cleanup mode. I think again, kind of when you
28:08
think about over-provisioning the existing, I am tools should
28:11
be able to do a large part of, you know, for a human beings
28:16
preventing over-provisioning. Right to do the things necessary
28:20
to stop rubber-stamping of Access to enable managers
28:25
understand and remove access to users, no longer need, but it's
28:30
these machine identities that when they get over-provisioned
28:34
it's very it's a new ballgame, the Ballgame.
28:38
And I think, you know, I think the scenario where you're just
28:43
going out to the cloud. Now, you're lucky, you can get
28:45
in front of this and you can start to say to your developers,
28:49
like, hey, let's set up a partnership to make sure.
28:52
Sure that we don't end up in the state where we have over
28:55
provision accounts all over the place.
28:57
Unfortunately, a lot of times projects been up like, hey, we
29:00
have to move our entire data center to the cloud by the end
29:03
of the year. So it's lifting shift City and
29:06
GSD, just get the stuff done and we'll clean it up later.
29:11
And that's where you end up with so much, over-provisioning
29:14
problems. But I want to get to this
29:16
question around, you know, it's really the developers that, you
29:21
know, in my view Or my experience of working with my
29:25
clients, who, you know, I've gotten to the cloud and now have
29:29
all these over provision accounts.
29:31
It's primarily, you know, developers have driven the drive
29:36
to the cloud and kind of left. I am behind a little bit.
29:40
So they, I am practitioners now, saying, where do we fit in?
29:44
And so I'm almost wondering, like one is, do you see the same
29:49
phenomenon happening and to like Like how do the C.
29:54
So now get his his or her arms around this this issue and, you
30:02
know, create move to that partnership and not slow down
30:06
development but get a more secure and compliant
30:09
environment. Yeah, it's a really good
30:12
question and I think you're spot on right.
30:14
I mean the cloud just kind of took off and you know, so you
30:17
mentioned the, the identity team and it's not that the developers
30:21
are don't Of an iron security. It was just, you know, I think
30:25
that that the way the identity team was was engaged with was,
30:31
you know, not until after the cloud had already been well
30:35
matured and most of these organizations.
30:37
And so I'm definitely seeing today that, you know, that the
30:42
ccos role is is a you know, it's more of a partnership at least
30:46
where I'm seeing successful implementations you know of
30:50
security and identity. And In Cloud its approach much
30:54
more from a partnership with security and the devops team.
30:59
I do feel like you know, been in several situations where you
31:03
know the security team really loves rate what, you know, the
31:07
idea of going to Dynamic resource entitlements and just
31:12
in time, ephemeral credentials, but it absolutely right to be
31:16
successful. You have to get that devops team
31:19
engaged in onboard, right? That Kind of the think the idea
31:24
of, you know, security, I remember back in when I first
31:28
started my career, I was just, you know, an internal architect
31:31
and it was like, you know, the security team you'd go and
31:34
present Your solution and, you know, hope and pray that that
31:38
security team would bless it. Like they were the authority,
31:41
right? I think Security in my opinion
31:44
has changed, whereas, you know, security is front first and
31:48
foremost, but it can't be at the expense of productivity.
31:52
Of those developers. And so you know, I do think that
31:58
being able to, you know, partner with the devops team, right?
32:03
I've even seen situations where where the large organizations
32:09
have actually started to merge somebody from the devops team
32:13
into the identity team, right? Because it is a leap, It's A New
32:16
Concept and into into kind of, you know, accelerate the
32:21
learning in the Option of identity practices in the cloud,
32:25
they take it actually a cloud, you know, as sorry.
32:28
Who knows how the cloud Works. Naturally brought them over to
32:31
the identity team. So I'm starting to see this kind
32:34
of, you know, um, definitely collaboration and in in
32:39
Partnership from security and identity with the devops team,
32:43
because if if an identity or security team tries to go in and
32:48
I think impose their will on the debates teens these days, I'd
32:52
Seen it fail several times, right?
32:54
So I do think it's important to understand, as you said, the
32:57
business objectives understand how those Dev Ops teams are
33:02
working and ensure that what you put in place either makes our
33:06
life easier, right? That's the best case or at a
33:09
minimum. Does it complicate what they're
33:11
doing while improving security? Yeah, I think it's a, it's a
33:16
delicate balance. If you are now trying to, you
33:22
know, if you're the, I am practitioner, you haven't been
33:25
fully involved or your the sea. So do you do really, you know,
33:30
this this Cloud infrastructures kind of like, take it off
33:34
without your oversight. What you don't want to do, is
33:38
just try to go in and heavy-handed and like, say stop,
33:42
right? I think the other thing is like,
33:44
what works in the Enterprise for human identities?
33:47
Might not be the right solution in the cloud, especially for
33:51
machine identities, right? Just so I think you have to take
33:55
a caution approach tonight. I don't think the only answer is
34:01
that you just have policy and you just make sure that the
34:03
policy is being followed. Even though I think that's the
34:06
What you're trying to accomplish.
34:08
I think you can do more, but I think you have to proceed with
34:12
caution that you don't take processes that work.
34:16
Well, for human provisioning for Enterprise services that you
34:21
have control over in in your traditional, it infrastructure
34:26
at, then, heavy handedly say hey if you want a machine Identity
34:30
or you want to create a roll, open up a service now.
34:33
Ticket. And then five days later, maybe
34:35
you'll have it or maybe Be somebody will pooh-pooh it.
34:38
Like that is just going to the extreme other end and it's going
34:42
to, you know, kill productivity. So that's, that's my feeling on
34:46
it. Is that you've got to try to
34:48
find that right balance and wade into the pool, especially if
34:53
your organization is a lot further, along in there in the
34:56
cloud Journey. Yeah, yeah, that's right.
35:00
On in, you know, you think you touched on like earlier
35:03
terraform right? Like I think it's as important.
35:06
As you're looking at solutions for kind of managing and
35:10
provisioning identity and access in the cloud, it's as important
35:14
to ensure that the solutions you're going to propose or bring
35:19
to the table, really sit well with the kind of infrastructure
35:24
as code. Write automation it.
35:25
You will find, you know, when you talk to devops engineers and
35:31
you know, you talk to, you know, Sr, he's those guys only want to
35:35
touch a console. Like you told they have to go
35:37
somewhere and log into you know into a web browser somewhere in
35:41
Click a mouse, it's like Kryptonite right?
35:43
They love to automate, they love to script.
35:46
So I think as you look at these tools, it's making sure.
35:51
Even if honestly Jimmy - it is a human user, who wants to get
35:55
access to a resource in the cloud, right?
35:57
Making sure that even provisioning that access in an
36:02
ephemeral aesthetic sense. Making sure it Integrates well
36:07
with the tools, they're using whether that's python or
36:10
terraform or you know, a CLI, AWS CLI G, she'll like making
36:16
sure that that the way that they access those resources and
36:20
utilize the identity that you're providing, has to be very much,
36:26
you know, integrated with the tools are using today from an
36:29
automation standpoint, this concept of of this ephemeral
36:32
Identity, or at least permissioning it.
36:35
It sounds all awful. Like zero standing privileges,
36:38
which is what John Wharton. Last time he was on the show,
36:41
kind of talk through, is it the same thing or is it an
36:44
evolution? I guess, you know what I'm
36:46
looking for? I guess, part of my question is,
36:50
what are the solutions? Because we've talked an awful
36:52
lot about. Here's all the problems, right?
36:54
So how do we fix it? I think the idea of having zero
36:58
standing privileges makes a lot of sense, but I would imagine
37:00
there needs to be technology back.
37:02
Ending that to actually make that a reality.
37:05
Or is it just another script? They that that runs and then
37:09
takes it away immediately. After you end up with like, you
37:11
know, a whole bunch of different scripts, doing very specific
37:13
tasks, which could be probably a nightmare challenge, but I'm
37:16
wondering if that if that ephemeral linkage, 20 sending
37:20
privileges holds up workers something else to it.
37:23
Yeah I think it's good question. I think it's fundamental.
37:25
I mean honestly I think zero standing privileges to goal and
37:29
ephemeral credentials is the mechanism to get you there,
37:32
right? They had the ability to generate
37:35
an ephemeral Credential, what does that mean, right?
37:39
It's you know a developer you know, needs access whether it's
37:43
human or non-human developer or workload needs access in Amazon,
37:48
you know, to get to an S3 bucket, let's say to scrape some
37:51
data, or to post some data, right?
37:53
Rather than having a credential that has static access, that is
37:59
long-lived, okay, that can be compromised, it's moving that
38:04
that 20 standing privilege saying.
38:06
We'll give you the mechanism. The end of summer roll generated
38:10
credential when needed but in the end, right?
38:13
At the end of the time that you're done with a credential,
38:16
it's expired. So I look at it as they're
38:18
they're they're at into each other, right?
38:20
Zero standing privileges to goal that is the the ultimate state
38:24
of, you know, not being able to, you know, compromise standing
38:29
privileges by cheating that to the mechanism of a platform that
38:34
can provide and generate a femoral.
38:36
Tools that make sense? Yeah, yeah, I think so.
38:39
And I think it leaves me space. The second part of my question
38:41
which is all right, so I'm sold right.
38:44
Let's go to zero standing privileges but I've opted very
38:47
automated your scripting environment and I'm wondering.
38:51
What would that look like in realize that sort of scenario
38:54
where yo containers may rise and fall based on scalable
38:59
workloads? Or you know, whether it's just
39:02
in time provisioning or privileged access management
39:04
like those, those sorts of things.
39:06
Hi. You see that sort of zero
39:08
standing privilege idea come to come to life.
39:13
Yeah, I mean it's really integrating, right?
39:16
The you know as part of the pipeline integrating the you
39:21
know the interaction with the platform.
39:24
In this case, what started while bride of right?
39:26
It's about right integrating? Almost, bright it into your
39:30
pipeline, you know, when I need access when my job or my
39:34
workload needs access to a particular resource, Search
39:36
across multiple clouds and that's really where it gets
39:39
difficult, right? And when you have to have a
39:42
solution that needs to reach into an access multiple cloud,
39:46
service providers, you know, data as a service providers like
39:49
snowflake so on and so forth. Right, what that means is
39:53
instead of them having it, you know, in access to you in gcp,
39:57
that gives me access to a particular project that gets
40:01
either hard coded or honestly, even, you know, even vaulted
40:06
where you Do is instead instead of having the call to, you know,
40:10
go to the bolt to get it, you can actually make a call to a
40:13
solution like braided to say, hey, you know what?
40:15
I'm running my job, right? I you can use things like oh, a
40:18
DC or workload Federated identity to connect a pride of
40:22
in. It says hey I need access to run
40:24
this job. Give me this profile which gives
40:26
me access to you know this project to do these things,
40:29
right in that case, right? Friday will generate that
40:33
credential real time pass it back.
40:36
Back through code to the workload.
40:38
And now it's along its merry way, right?
40:40
So it's really just enabling those devops teams and those
40:46
developers, whether again, they're doing it through their
40:49
own scripts as a human or restore workloads having a
40:53
mechanism or a framework where they can, you know, get a
40:56
credential generated. And then, you know, we take care
40:59
of, you know, essentially removing access when the job is
41:03
done, right? So there's no standing access at
41:06
all the It seems like a very Dynamic sort of Shifting
41:09
environment. Certainly, an interesting
41:12
approach to kind of put in place for managing that acts.
41:14
As I think it's I think it's a cool idea.
41:16
I'd love to see set of more organizations to take advantage
41:20
of that especially for some of those automation use cases where
41:23
you can kind of set it and forget it and the Securities
41:26
built-in. It makes a lot of sense.
41:27
So I think it's I think it's certainly a good approach to
41:30
think about at least consider, if you're out there kind of
41:33
managing, especially multi-cloud environments where you are
41:36
having to Translate between weight as your does, things gcp,
41:39
does things AWS, you know, x, y z, whatever cloud is out there.
41:44
There there's, there's that translation layer.
41:47
I know that we are running short on time and I want to make sure
41:50
I'm respectful of that. But it wouldn't be a show.
41:53
If we didn't get into something silly towards the end and you
41:56
and I are Chicagoans or at least I am former since I haven't
42:00
moved there, but we were talking a little before he recorded, I
42:02
noticed that I actually lived in the town next door to you.
42:07
For years. And you know what?
42:09
A small world it is. But here's my, here's my my
42:12
challenge to you Jay. So Jim is the odd man out here,
42:15
he is not familiar with the Chicago, area's as you and I
42:18
like be. And what I want you to do is
42:22
sell Jim and others who are listening not familiar with the
42:26
draw of Portillo's. And why is it just so popular
42:32
for Chicagoans and I think probably want to start his?
42:34
What is Portillo's for people who are on?
42:36
During, and why is it that it was the first meal that I had
42:40
when I flew back into Chicago, for first and meetings, after
42:44
having been away from from the area for a couple months now?
42:47
Yeah, well, that's a great question and I am a huge
42:50
Portillo's fan as you are. I don't know, honestly, many
42:53
people in the Chicago area or many people that have visited
42:57
the Chicago area. I've introduced super till has
42:59
who are not big fans of Portillo's, you know, and it's a
43:04
really good question. I mean, I think, you know For
43:07
till has, it's good way to put it.
43:09
It likely is the best, I won't. I guess we could call it fast
43:13
food. It's got a kind of drives
43:14
through right, but it likely is the best fast food around at
43:19
least in this area and, you know, it's just such an
43:22
experience, you know that anything from the Italian beef,
43:28
you know, and I love the way that that you can get a
43:32
choose-your-own-adventure there, you know, you go in and you get
43:35
your beef and They have everything from a beef and
43:38
cheddar on the course, Allah, which is, it is a treat every
43:41
once in awhile there just to their their, their traditional
43:44
Italian beef, but you can get it.
43:46
You know, I think I can remember the exact terms.
43:48
I think it's like dipped wet in something else, but it's like,
43:52
do I want a splash of the others you on it?
43:54
Do I look the entire sandwich actually dipped in the odds you
43:59
and then, you know, so it's just an amazing sandwich to begin
44:05
with that's what I recommend. You're going to go there the
44:07
first time, there's a lot of other good stuff there to
44:09
burgers are great as well by the way, but but then you I think
44:13
that the thing that gets everybody else if your chocolate
44:15
cake fan right there, chocolate cake is to die for.
44:18
So I always make sure whenever I bring, you know, my colleagues
44:24
into town, or my family into tone, it to make sure that they
44:28
not only try the Beast, right? You can but also the chocolate
44:33
cake to the point Jim where you can get a chocolate cake shaped
44:36
Eight, right? No, I actually take bits of that
44:38
chocolate cake, and, and blend it into the shape.
44:41
So, it's a, it's a really great experience.
44:45
And, you know, just, uh, I actually have had people where,
44:49
you know, colleagues will come in will be doing meetings
44:51
downtown Chicago, and it's like, you want to go to this nice
44:55
steak house, or do I go to purtill O's and it's like, let's
44:58
go to Portillo's right? What's that tried it?
45:00
So it's a it's a lot of fun and that the last plug on maker
45:04
Portillo's is there. I've through efficiency is the
45:08
most amazing thing I've ever seen.
45:10
They will probably have 30 40 cars in the Drive-Thru and, you
45:14
know, normally you would be like throwing your hands up and go
45:16
somewhere else they had they got about seven or eight people work
45:20
in that line and it's the most efficient thing you ever seen.
45:22
You will get through that wearing probably faster than a
45:25
typical drive to that had six people in it.
45:27
So it's really good experience. Really great sued, I started to
45:31
see they've moved out of Chicago.
45:33
So they're going in Arizona, and kind of where a lot of the
45:35
Chicago transplants are going. Sadly, they are, they're moving
45:39
on. But if you're here, you gotta
45:41
try it. And you're right.
45:42
Jeff? What?
45:42
People come back. It's one of the first meals that
45:44
hat. So that chocolate cake is
45:46
absolutely legendary, absolutely, 100%.
45:50
I've heard a rumor and out of his true or not.
45:54
That really, what makes it so good as they used mayonnaise in
45:56
it. I've heard that it's some of the
45:58
kids see if it does just like the Chicago folklore that you
46:01
get into when we start talking about.
46:02
Yeah. I guess / to Lowe's is like it's
46:05
like fast. Casual I guess, but as I guess
46:07
it's described as like Chicago Street food, Italian beef
46:10
sandwiches hot dogs, hamburgers, fries onion, rings, you know,
46:13
cheese dip, all the healthy things that you want in your
46:17
life. Jim based on that descriptions.
46:22
What are we thinking? And do you have something
46:23
comparable? And well, you gotta in your
46:25
thinking is this episode of the identity of the sender pot
46:30
gracias, mi amor, you lie Portillo's.
46:33
And what came to my mind, first off.
46:37
Audio Only podcast, but if you can see the look on Jay's face
46:41
when he's talking about, purtill owes, you have to go there like
46:44
you would you'd be sold I'm completely sold.
46:48
I want that chocolate cake. Yeah, I mean it sounds great and
46:53
I don't think we have anything at that level at in Augusta
46:56
Georgia but we do have is a lot of good food here.
47:02
I would say the best place. I've been for food is Las Vegas
47:05
but they have really good food. In almost in most cities you
47:09
have really good food but I definitely wouldn't next time
47:12
I'm in Chicago. I'm going to, I'm going to try /
47:15
tillers, it doesn't know. And the other thing that made me
47:18
think of was remember that Saturday Night Live skit where
47:21
they're like bears and they would always like, oh, heart
47:25
attack. Heart attack.
47:26
Okay, I'm all better. Now, that sounds that sounds
47:30
about right? For sure.
47:31
I think, you know, having been away now for a few months,
47:35
Portillo's is so good and so efficient and so consistent,
47:39
like you said this, every this this episode not brought to you
47:41
by portals but we're definitely fans at least j&i you could
47:45
actually get purtill has shipped to your house.
47:47
So, one of my brother sent me Italian beef, kind of kit that
47:51
has like the Italian beef near the, the the fresh French rules
47:56
for to make the sandwiches, the, I'll do all that kind of stuff,
47:59
and you can also get the chocolate cake ship too.
48:01
As well. And I discovered in my
48:03
investigations of you know how can this be?
48:06
Is they actually have a Portillo's 365 subscription
48:11
because here we are 20 22. Everything is the subscription
48:14
where basically every month you get something shipped to you
48:17
from purtill owes it could be. Okay, could be like a hot dog
48:20
hamburger kind of, you know kit. It could be the Italian beef.
48:24
I mean, what a time to be alive, right?
48:26
Yeah I'm getting a subscription to death though.
48:28
I mean, I just bought a truck and it's like they were 25 bucks
48:32
a month for their app. I'm like, you got to be kidding
48:36
me. Software is eating the world and
48:39
twenty five dollar sounds like a pretty good deal.
48:41
For some of the stuff that it's not that that I use.
48:45
Alright, let's go ahead and start to wrap things up.
48:47
Ju been really great with your time but what I give you kind of
48:49
a final, let's just take pass around the room real quick here.
48:52
You know, what are some final thoughts that people should take
48:54
away from our conversation about identity and managing those in
48:58
the cloud and anything else it won't pull away or should we
49:01
just Keep talkin purty lows, that's fine too.
49:03
You know either way is good for me.
49:05
But now we'll yeah I mean you know I think I think its first
49:09
off and you had a whole episode on this with my colleague John
49:12
but you know, it's okay to accept identity in the cloud is
49:15
different, right? And that's that's good to
49:18
recognize up front and, you know, I think it's important to
49:23
embrace that and you know want to as an identity team want to
49:28
learn about that. You know, I've seen multiple
49:30
ways to Achieve that, as I mentioned, you know, I've seen
49:33
groups kind of meld and you know, come together and we're
49:37
adding Cloud expertise to an identity team, you know, has
49:41
helped. But I think that, you know, if
49:44
you want a successful project of, you know, from an identity
49:50
team, being able to understand and control a meet your goals
49:55
of, you know, protecting identity in the cloud, I do
49:59
think going in and Partnering with that devops team, right?
50:04
Is a really going to be a really important part of that, right?
50:07
And, you know, starting with, you know, understanding a little
50:11
bit of how they work and how to meet their needs.
50:14
And then again, in looking at both, we talked about it that
50:17
the visibility side understanding.
50:19
And then ultimately getting to a point where, you know, you can
50:24
you can Implement that those ephemeral credentials only
50:28
because that's the way the cloud Works in general, right?
50:31
Out in of itself is a femoral so that kind of understanding those
50:34
Concepts and really going in with it with a wits goal of
50:38
learning and understanding first.
50:40
I think it's going to get you to the end and you know get your
50:43
program implemented much more successfully.
50:47
It's okay to get smarter and I'm glad you were here to kind of
50:49
help educate myself and hopefully others.
50:52
Jim final thoughts for this week.
50:54
Yeah I hope it didn't come off as - on the king space, I think
50:58
what Kim does is terms of the Of control in the analysis of your
51:04
accounts. Entitlements is very important
51:06
on the detector side of it. What I was trying to point out
51:09
was is not the whole picture, right?
51:11
There's the preventative side which I got into as well.
51:15
And I also wanted to point out kind of one of my life mottos
51:19
is, don't let Perfection be the enemy of better.
51:22
So, you know, I work with a lot of clients where they have a lot
51:26
of over-provisioned accounts already.
51:29
If you can start to eliminate a couple, Richard over-provisioned
51:32
accounts or get them right size. You reduce your attack surface
51:37
and that's important. And it only takes the one
51:41
account. That's over provision to cause
51:43
the problem. So, if you can eliminate a bunch
51:45
of them by doing a cleanup project, assisted by Hakeem
51:49
platform, then you're better. And, you know, I think that's
51:54
the game in cybersecurity, right?
51:57
Is there is no perfect, you're never going to be Bulletproof.
52:01
Proof your another words you're never going to be 100%
52:05
risk-free. So it's about managing the risk
52:07
and about reducing the risk. So if you can go and do a
52:11
cleanup of over-provision accounts, I highly recommend
52:14
doing that. That's pretty good.
52:16
Pretty good tips there. It's a journey.
52:18
Right security and it's never-ending you've got to get
52:21
it right? Every time people who are
52:23
looking to do bad things only have to get it right once.
52:25
So trying to put as many layers of, you know, thoughtful risk
52:30
mitigation is probably the waiter.
52:31
Watch it. But all right, let's go ahead
52:33
and leave it there for this week.
52:34
I'll have links in our show notes where you can connect with
52:36
j-jim myself, which you've got five questions, concerns, you
52:41
know looking to get more information, upper 20's,
52:42
whatever it might be. Right?
52:44
I'm sure the three of us will be happy to talk.
52:46
Well, maybe not Jimmy so much about this point you towards me,
52:48
but why look? So that we also have linked to
52:50
Bright of Bri tive.com so people can check out what those guys
52:56
are doing and thanks to you for being part of the show, we're on
52:58
the website or on the website. Our website is is identity at
53:02
the center.com so you can find out more information about us
53:04
including our snazzy. New listen page, that is joined
53:07
the year 2000 and now has all of our episodes and and show notes
53:11
and links and stuff like that. And then we're on Twitter at
53:14
idac podcast. So with that, we'll go ahead and
53:17
leave it for this week. Thanks everyone for listening,
53:20
and we'll talk with everyone in the next one.
53:25
Thanks for listening to the identity at the center podcast.
53:28
If you like what you heard, don't forget to subscribe and
53:30
visit us on the web. Identity at the center.com.