Latest / Identity at the Center / #350 - Sponsor Spotlight - SlashID

Transcript

#350 - Sponsor Spotlight - SlashID · Identity at the Center

0:00
We understand that like real time capabilities are extremely
0:02
important to prevent reaches, stop reaches and remediate them.
0:08
So we have two core capabilities there that I think are different
0:13
from the others. One, we use LLMS to improve the
0:18
visibility and posture capabilities that you have
0:23
compared to your standard IGA and Palm tools today.
0:26
But then 2, we are able to do real time detection and response
0:31
to identity based threats. And this makes it so that you
0:36
you're able to catch anything that your identity like
0:41
governance program might might have missed or anywhere anybody
0:44
that gets fished, stolen credentials, stolen tokens and
0:48
so on. The ability to do it real time
0:51
is something that we think is is lacking in industry.
1:00
This is identity at the center if it has anything to do with
1:06
IAM. This is the go to podcast now
1:12
your hosts Jim McDonald and Jeff Stedman.
1:20
Welcome to the Identity at the Center podcast.
1:22
I'm Jeff, and that's Jim. Hey, Jim.
1:23
Hey, Jeff, how are you? Oh, not so bad yourself.
1:26
Good. I'm excited for today's episode.
1:29
I think the the focus for me is innovation.
1:32
I talked to a lot of folks who are listeners of the show.
1:35
They want to know what are the new innovations that are
1:38
happening? What are the new products that
1:40
are bringing innovation into the world of I am.
1:44
So we're going to get into this today.
1:46
Yeah, for sure. Today's a sponsored episode.
1:48
So making that very clear up front, these are episodes where
1:51
we dive a little bit deeper into the technologies and the the
1:54
players in the space. And there are a lot of them.
1:56
So I'm glad that we're able to get some of these folks on and
1:58
kind of explain, OK, where are they coming from, their
2:00
viewpoints and things like that. So just make it crystal clear,
2:03
right? This is sponsored episode today.
2:05
We're sponsored by slash ID. They're an identity platform to
2:08
protect human and non human identities.
2:10
You can find out more about them at slashid.com/IDAC.
2:16
And we've got Vincenzo Yoso today.
2:18
He's the CEO at slash ID Welcome Vincenzo.
2:20
And hopefully I didn't butcher your last name.
2:22
You didn't. I'm very impressed.
2:25
All right. Well, we're starting off on a
2:26
great note. One of the things we also like
2:28
to do before we start to get into any sort of conversations,
2:30
really find out about the backgrounds of the people that
2:32
we talked to that are in the identity space.
2:33
It's a wide and varied space. You've got an interesting 1, so
2:36
let's start there. How did you get into the digital
2:38
identity space? Is this something that you chose
2:40
or did it choose you? It definitely choose me.
2:46
So I have. I have a bit of a, a strange
2:49
background compared to a lot of like your guests in that I, I
2:53
started my career in sort of like the offensive security side
2:56
of things and then over time got a closer and closer to identity.
3:02
So my original background is in security research.
3:05
I used to work on vulnerabilities and exploits for
3:10
endpoints. Fast forward, I spent a number
3:13
of years at Crowd Strike and one of the products that I was
3:18
involved with at crowd Strike was the identity protection
3:21
product. And that's how I started to be
3:25
involved in, in the identity space.
3:27
But it's always, it's always has been more from my security
3:30
standpoint rather than a traditional identity background.
3:35
And so you take that attack mindset, no better way to start
3:37
with, like, how do we defend against attackers?
3:39
And you also do some work, I think, with Black Hat, right?
3:41
As I was just kind of stalking you on LinkedIn a little bit.
3:43
Tell me about your Black Hat involvement.
3:45
Yeah. So I mean, when I, when I
3:47
started back in the days on the security kind of like researcher
3:52
track, I used to do a lot of like presentations on attacks
3:56
and then like exploitation techniques.
3:58
And that's how I got involved with Blackett at the beginning.
4:01
And then I have stayed involved throughout the years to give
4:05
back to the community and make sure that like we still have
4:07
like vibrant talks and and interesting tracks at the
4:11
conference. So I've been put to Black Hat in
4:13
the past. It's been a couple years.
4:15
I always kind of enjoyed it and I've seen some interesting
4:18
things there. Maybe if we have time towards
4:19
the end, I'll ask you like what are some things maybe that
4:22
you've seen that might be kind of interesting there.
4:24
But let's talk about slash ID. So what is slash Idi guess?
4:28
Tell us a little bit about the the organization that you're
4:30
building there and the technology that you're bringing
4:32
to the digital identity market. Yeah.
4:34
So as I mentioned, we, we come to the space from from our
4:38
security background and what we thought was missing when when we
4:43
started a company were were really two things.
4:46
One, everyone we spoke with had problems with IGA processes in
4:51
the in the sense that they weren't particularly effective.
4:54
You had a lot of failed implementations and so on.
4:56
But more importantly, we had started to see most reaches a
5:01
crowd strike being identity related where at least either
5:05
the initial vector or at some point throughout the kill chain
5:09
you add an identity component. And none of the existing
5:12
products were focused on identity security rather than
5:17
compliance and management. So tell me about the name,
5:21
because slash ID is kind of unique and like there's there's
5:23
usually a story behind something.
5:25
How did you come up with slash ID?
5:27
Yeah. So what we wanted to convey with
5:30
the with the name similar to, I don't know if you, if you've
5:34
ever read the story of Stripe, but their first name was slash
5:38
payment. And the idea there was to bring
5:40
kind of like payments to developers and engineers.
5:43
And what we wanted to do from day one is to build a platform
5:48
that was friendly to security engineers and practitioners, not
5:51
just sort of like that click OPS kind of kind of like kind of
5:56
product. So I have to say, right, there's
5:59
a ton of products in this space of digital identity, too many
6:02
almost to keep up with. And so there's a lot of
6:04
competition. You know, I'm curious from your
6:06
perspective, what is it that you think sets slash ID apart from
6:09
your contemporaries? You know, I guess the the blunt
6:11
version is what makes you special.
6:15
Yeah. So I think it's it's really two
6:16
things. 1 is a lot of the other companies in the space focus on
6:21
a static view of the identity, whereas coming from a security
6:25
background, we understand it like real time capabilities are
6:28
extremely important to prevent breaches, stop breaches and
6:33
remediate them. So we have two core capabilities
6:37
there that I think are different from the others.
6:39
One, we use LMS to improve the visibility and posture
6:47
capabilities that you have compared to your standard IGA
6:50
and pump tools today. But then two, we are able to do
6:55
real time detection and response to identity based threats.
6:59
And this makes it so that you you're able to catch anything
7:03
that your identity like governance program might might
7:07
have missed or anywhere anybody that gets fished, stolen
7:12
credentials, stolen tokens and so on.
7:15
The ability to do it real time is something that we think is is
7:19
lacking in industry. So Vincenzo, the question I was
7:23
going to ask you was because most of the time when I talk to
7:27
entrepreneurs in this space, there's something that they
7:30
recognize in the industry that's kind of overlooked or that they
7:35
feel they could bring a fresh solution to fix a problem.
7:39
The question I was going to ask you is what drew you in?
7:42
But I think you answered that when you talked to to Jeff
7:44
about, you know, the the IGA situation, not really solving
7:49
the problem. I think you talked about the the
7:52
breaches being mostly identity related.
7:54
So I want to pick on those two areas.
7:57
And I've heard it said that, you know, the IGA solutions are
8:02
better for driving compliance than solving real security
8:08
issues. So the first is that's something
8:10
you agree with and and why it? Why is that the case in your
8:14
opinion? Yeah, 100%.
8:16
I mean, when you look at the history of IGA and I think you
8:19
had guests on on on the podcast that were sort of like the, the
8:24
real, the, the creators of of IGA as a space.
8:28
It was primarily been driven by compliance needs in the wake of
8:33
Enron and similar like fraudulent activities for public
8:38
companies. So the approach you take when
8:41
when you use governance is a very prescriptive, policy based
8:46
approach that doesn't, doesn't really work when you deal with
8:50
attacks, stereo dynamic in nature.
8:52
And what attackers really try to do is to look for gaps in your
8:58
posture. And it's something that a
9:01
governance platform is not actually able to react to in a
9:05
timely manner. Yeah.
9:06
And so, I mean, I kind of feel like it's this isn't a black and
9:11
white situation, right. I think most of the compliance
9:14
regulations try to drive better security through compliance
9:21
through kind of these governance processes.
9:24
So they at least incrementally make security better, going in
9:28
and checking to make sure people have only the access that they
9:32
should have. But it seems like most of the
9:35
processes from a governance perspective are detective and
9:39
they could be, you know, not performed until some periodic
9:45
basis, right? Maybe it's once a year.
9:47
So checking a list of accounts to make sure that they have the
9:49
right entitlements once a year is good, but not great.
9:56
Exactly. I, I think you're far on Jim,
9:58
like when you, when you, when you look at the problem is an
10:01
attacker breaks into an environment at any point in
10:05
time, right. They they don't wait for the
10:08
compliance audit to come due. And what you see in complex
10:13
organizations is that these entitlements change by the day.
10:17
And so taking a snapshot once a year or one supporter is nowhere
10:21
near enough to be able to detect and attack in real time on top
10:26
of it. And I'm sure you've seen this as
10:30
well. A lot of IGA has become so
10:33
complex. There's often, there's often
10:35
just a check box exercise where some manager just says, yes,
10:39
this, this person on my team should have access to the
10:41
system, but they don't have the ability to really know how our
10:46
buck works in that system, what entitlements really mean and and
10:49
so on. So you have this double whammy
10:51
where snapshot based solutions are not moving fast enough
10:56
compared to attackers. And on the flip side, the
10:59
complexity of these systems is such that even when you do take
11:03
a snapshot to make sure that you're compliant, often the the,
11:06
the, the degree of access control that you can really do
11:10
is a lot less than what you need for proper security because it's
11:14
too complicated to understand the authorization model of each
11:18
individual application that you're dealing with.
11:20
Yeah. I mean, as you're talking, I'm
11:22
sitting here thinking of one of the biggest faux pas within kind
11:26
of the idea of governance, which is rubber stamping.
11:31
I mean, I think what happens in organizations is there's two
11:35
major problems. 1 is the entitlement system is so complex
11:41
that people don't really understand that Vincenzo has XYZ
11:46
access. Is that appropriate?
11:48
Well, if you put that in front of the wrong person or somebody
11:52
who doesn't know what XYZ access really means, they say, well,
11:55
Vincenzo is a good guy, he wouldn't do anything wrong.
11:59
And so they just say keep it or they're afraid that they take it
12:03
off. The company's going to stop
12:05
being able to pay invoices or something, something crazy,
12:08
right? So there's the not having enough
12:13
information around entitlement. So the other thing that I find
12:17
you don't hear talk about much is that a lot of the decision
12:22
making is consolidated in very few hands.
12:25
So one person might be reviewing access for too many people, too
12:32
many applications and it becomes IAM overload for them.
12:38
So they're being asked to do all these reviews and they're often
12:43
the most busy people in the organization to begin with.
12:46
So now rubber stamping becomes out of control, especially if
12:50
you compound it with the first problem.
12:53
So I guess my question to you is like, how does slash ID solve
12:58
this problem? Do you actually solve it?
13:00
Or do you say like the approach is wrong and we do something
13:03
different? Yeah.
13:05
So I mean 2-2 of of the so like most loved features of our
13:12
platform are actually exactly tackling the first problem that
13:16
you're talking about Jim. And it's it's a very different
13:18
way to approach it, we think. So 1 is we like it.
13:23
This sounds very simple and and stupid in many ways, but like
13:28
people find a lot of value out of it.
13:30
We can automatically generate descriptions for roles,
13:34
identities, credentials and groups in your environment so
13:37
that you're able to see both us as a identity professional, as a
13:41
security professional, as well as a business user.
13:44
Hey, what can this identity actually do?
13:47
What does it does? Does this identity have access
13:50
to in in the environment? And the second thing is to your
13:54
point about the complexity of the entitlement systems, often,
13:57
especially when you look at like cloud environments, it's almost
13:59
impossible to create a use privilege list privilege policy
14:04
right from the start. So one of the things that we
14:06
help companies do is observe the behavior of their identity over
14:11
time, see which entitlements he actually uses, and then
14:14
automatically generate a list privilege policy that minimizes
14:19
the amount of access that an entity has without disrupting
14:23
disrupting it. Which we think is is
14:25
fundamentally better approach than trying to be prescriptive
14:28
and trying to create roles or groups upfront, especially in
14:34
environments that have very complex authorization systems.
14:38
That's a great, great overview. So the other thing that you
14:43
pointed out was one of the, you know, as one of the things that
14:46
really drew you into the industry was the whole data
14:50
breach aside. So truly security trying to
14:53
solve a security problem that, you know, all organizations at
14:58
least need to be thinking about. But you made a statement that
15:02
most of them are identity related.
15:04
I think I know what that means being the Co host of the
15:08
identity to center podcast but I want to know what you mean.
15:12
Yeah. So when when you look at the
15:16
various industry reports on data breaches throughout the years,
15:21
Verizon publishes a very popular 1.
15:24
AWS also publishes a very popular one yearly.
15:29
Almost all of them across the board mention identity as one of
15:33
the primary vector for either the initial compromise or
15:37
lateral movement. I'll give you some some stats
15:39
which which I find extremely interesting. 66% of the bridges
15:43
that Amazon sees in AWS are due to stalling AWS credentials.
15:52
About 33% of all the bridges that Verizon tracks have a
15:59
credential related issue as the entry point and cross strike
16:03
tracks in their global reports lateral movement attempts.
16:07
Most of them are actually an anti related where somebody's
16:10
using cover roasting or similar techniques to escalate
16:14
privileges within an environment.
16:16
And so it really feels like from from our standpoint that most of
16:23
the identity programs out there are not doing enough on the
16:27
security side and that's why we're seeing such a spike in
16:30
identity related breaches. Yeah.
16:35
You know, I read a recent report which pointed out that I
16:41
identity related breaches have dropped over the past five
16:46
years. And I feel like I, you know,
16:49
they're not as persistently in the news.
16:52
But the guidance in that report and guidance that kind of rings
16:55
true to me is that even though the the number of them may be
16:59
falling, they're the impact, the risk is still there, right?
17:04
The impact outweighs maybe the likelihood, and maybe the
17:10
likelihood is dropping because of people doing better identity
17:14
management. I, I think the, what, what I
17:19
will say is if, if you look at like the, the, the latest
17:23
Verizon report that just came out, I think like today or, or,
17:26
or last night, what you'll see is there is a spike in
17:32
vulnerabilities as the primary attack vector as opposed to
17:37
credential breaches. But credential breaches are
17:41
still so far the number one cause for, for, for, for, for
17:46
breaches. I think what what what's
17:48
happening over time is we're moving as an industry away from
17:53
long lived access tokens to better ways to authenticate
17:58
services and machines and so on. But we're still far away from
18:04
like identity being sort of like a secure part of the IT stack.
18:11
Yeah. I mean, look, the problem is not
18:13
going away. By the way.
18:14
The the report that I was referencing is the RSMUS Middle
18:18
Market Business Index special report.
18:21
And kind of the, what I thought was the punchline is even though
18:26
the data is positive, there was a spike in in breaches in 2024,
18:34
but that the methods being used in these attacks are becoming
18:37
more sophisticated. Some attacks may go undetected.
18:43
And that highlights the importance of continuously
18:45
strengthening security controls. It's that undetected piece,
18:49
right? That's the that's the real hook
18:52
that you know, people get in the door and then they sit there and
18:57
then they conduct their attack later after they realize you
19:01
don't even know that I'm in. Yeah, no.
19:03
And honestly, Jim, you're, you're really into something on
19:08
this because when you look at the average what what people in
19:13
the security industry called the well time is the amount of time
19:16
that an attacker stays in an environment before being thrown
19:20
out for a normal breach that is 10 days.
19:24
This is across the board from like Google reports, cross right
19:27
reports and so on. When you look at identity based
19:29
bridges, most of them take over a month to be discovered.
19:34
And the reason for it is that we just don't have the same degree
19:37
of detection capabilities that we have compared to endpoint
19:41
security or cloud security. So I think a big part of what
19:46
we're seeing, Jim, is that these breaches are harder to detect
19:51
and potentially a lot more dangerous.
19:53
I'll give just one, one I think here example.
19:57
Microsoft was under review from CSA because of an identity
20:03
related breach where the State Department was compromised.
20:06
What I think was interesting there was that the way that
20:10
breach was discovered was through a detection rule for
20:15
e-mail security that the State Department had internally.
20:17
It wasn't. It wasn't until then that
20:20
Microsoft realized that they had lost a key, like a private key
20:25
that the attacker was using to sign requests to expiratory
20:30
data. So that really speaks to the
20:34
complexity of these breaches and the lack of detection
20:37
capabilities that we currently have.
20:40
Yeah, it's pretty amazing. That's a great story that you
20:42
shared. You know, I kind of wonder about
20:44
that scenario because you hear about it all the time that
20:47
breaches aren't detected for 170 days, something like that, that
20:52
kind of dwell time. And I always kind of wondered
20:55
what drives that from the adversary's perspective.
21:00
They want to get in, obviously, but why does it take so long for
21:04
them to be detected? Because I'm assuming the
21:07
detection really is winds up occurring where they detonate
21:12
whatever the full blown attack is.
21:14
So is it like in the meantime they're doing research or they
21:19
get in so many doors that they can't conduct the attack on all
21:22
them? They say, all right, we're,
21:25
we've got a backlog of work here in our in our hacker, you know,
21:30
project plan. And so four months from now,
21:32
we're going to go get that cup to have in your experience.
21:36
Why? Why are those well time so long?
21:39
So, so you have different classes of of attackers.
21:43
You have some attackers that are financially motivated and then
21:46
you have attackers that are more politically motivated or have
21:50
espionage in mind. For the second class of the
21:53
attackers, maintaining access to the system is by far one of the
21:58
key statement in their mission. Like they need to stay in that
22:02
system once they've compromised. So what they do is everything in
22:06
their power to stay stealth and under the radar and not trigger
22:10
any detection. Whereas for financially
22:12
motivated attackers, they are more interested in sort of like
22:15
the equivalent of a smash and grab where like they install
22:18
ransomware and similar. And for them, what they try to
22:23
do is find a way to that, to get to kind of like your most
22:28
sensitive data and then either exportrate that data or use
22:35
ransomware to, to, to force you to, to pay up or similar.
22:39
And so in those cases, they care a bit less about detection.
22:43
And, and so the detection time, the detection time frame is, is
22:47
a lot shorter before espionage and positive motivated
22:51
attackers. It is part of their MO to stay
22:54
as stealth as possible, even though that might mean that
22:58
it'll take them longer to accentuate data and what not.
23:01
OK, I'm that makes sense. So, So what does slash ID do
23:06
given all those different scenarios?
23:08
What, what are the things that you're detecting that if I'm an
23:14
I am practitioner, I'm going to miss today.
23:16
What, what is it? What's that special trigger or
23:20
multiple triggers that slash ID is doing for me?
23:23
That's going to say, OK, now I see why I spend the money and
23:26
invest in that. Yes.
23:28
So we do three things on the detection side.
23:31
One is we can monitor our privilege identity.
23:34
So you can map, you can mark an identity as privileged and any
23:38
change done to that identity with respect to creation of
23:42
credentials, changes in the policies that they have access
23:46
to, entitlements access and so on, we monitor and alert you on
23:50
that. So you are always aware of
23:53
whether one of your crown rules is being is being used without
23:57
sort of like a proper reason in place.
24:00
The second thing is we alert you to any behavioral pattern that
24:07
we see in an identity that hasn't been seen before.
24:10
So it follows this item. We see a service account that is
24:13
trying to connect to a machine that has never used in the past
24:16
90 days or 180 days. You get a detection that that
24:21
you can action on either we'll get to the remediation in a
24:24
second, but either manually or automatically through our
24:27
remediations. And 3rd, we're we're able to
24:31
help you detect life cycle issues.
24:35
For instance, we're able to detect identities that haven't
24:38
been off border properly, orphan credentials, roles and groups
24:44
that haven't been used in a long time, and this helps minimizing
24:50
the amount of pivot points that an attacker can have when
24:54
they're trying to move laterally in your environment.
24:57
Yeah, that, that's fantastic. So that's how I detect it.
25:01
And how do I go about remeding it?
25:03
And I guess there's two concerts they have.
25:06
So if somebody, if I'm detecting OK, somebody's gotten in,
25:10
somebody's on the network they've had, they have some
25:13
accounts. How do I trace back?
25:16
Is this combination tools? Is there a role that slash ID
25:20
plays in this or trace back what maybe they've done over time?
25:25
Because I guess there's 2 scenarios. 1 is I bring slash ID
25:29
to and I look at my current environment.
25:32
But then there's the going forward of how do I make sure
25:36
that I detect the breaches quickly so there's not someone
25:39
sitting on my network for a year.
25:41
But if I bring in slash ID and I have been breach, but maybe that
25:47
breach hasn't resulted in the big data exfiltration or
25:51
ransomware insertion or something like that.
25:54
Maybe the, the, the hackers in the process of trying to
26:00
escalate privileges, things like that.
26:02
How would I know what they've done?
26:03
Have they created accounts and things like that?
26:06
And then what do you think is the the process for cleaning up
26:09
after that? Yeah.
26:11
So what we do is we record by looking at log data.
26:16
We record the actions of every identity so that the moment a
26:20
detection triggers, you're able to look.
26:22
Back. In time and see everything that
26:25
that led to that to, to, to the potential breach and attack.
26:30
So it's easy both for the identity team and the SoC team
26:33
to understand what exactly happened in your environment
26:37
that led to that specific problem.
26:39
When it comes to remediation, we provide three ways to go about
26:44
remediation. 1 is remediation playbooks.
26:48
These are instructions that your IAM analyst or SoC analyst can
26:53
manually follow to remediate a specific finding, whether this
26:58
is a posture issue or an active threat.
27:01
The second option is fully automated, so you can use our AP
27:05
is to automatically remediate on a detection where it triggers.
27:10
The advantage of doing that is you stop the attacker on their
27:14
track immediately. Like we invalidate tokens,
27:17
access tokens, so they can't move anywhere, you remove all
27:20
the privilege, all the entitlements from a role, so
27:22
they can't use the role to do anything in your system and so
27:25
on. But some companies are are
27:28
concerned about doing full remediation.
27:31
So we provide 1/3 path, which is the ability to remediate in
27:37
conjunction with a sort tool or or or manually through our UI,
27:42
where you can go in, do your investigation, and then decide
27:46
whether to suspend an entity, rotate a secret, quarantine a
27:51
role, and so on through our UI or through the sort tool that
27:56
you normally use. Is there a way to also automate
27:59
that, so if somebody comes in and detects something to, hey,
28:03
take, you know, predictive action to say, temporarily
28:10
suspend this account until further research is done?
28:14
Yeah. So.
28:16
So what what you can do is, is when a detection triggers, you
28:19
can have actions like suspend a user or a role or or a
28:24
credential. And then once the investigation
28:27
is done, you can decide whether to restore that identity or keep
28:31
it, keep it blocked or delete it.
28:34
So one more question, So you mentioned logs.
28:37
So is this something that works in concert if I have a SIM
28:41
solution on my network or does it have to replace my SIM
28:46
solution? So does could it work with
28:48
Splunk or no? Just throwing that out there,
28:51
Splunk. Or do I have to now send my logs
28:55
TO/ID? So we work with your existing
28:59
SIM and we can send our detections and alerts to your
29:02
SIM so that your SoC team doesn't have to use a different
29:06
UI that they're not used to. And we, we, in general, we, we
29:11
try to make sure that whatever tooling you already have, this
29:14
is true both on the IGA side and the SoC side, We're able to
29:18
integrate with them so that you're not changing the UI flows
29:21
that you're used to. And so we can dump all of our
29:27
findings into your SIM and then the SoC team can use the same to
29:33
investigate similarly because we expose everything through AP is
29:37
you don't if you don't want to. You don't actually have to use
29:40
our UI at all. You can have your Terraform
29:45
infrastructure as code. Use our AP is to pull
29:48
information or remediate specific actions.
29:52
I mean, to me this is like ITDR the vision realize, right?
29:56
It's all about having visibility to your environment and
30:00
detecting the threats, but working with your existing
30:03
infrastructure but adding the identity intelligence on top of
30:08
that is kind of that's kind of the approach that you had in
30:11
mind. Yes, yes.
30:14
What what we really tried to do is augment your existing
30:17
tooling. We're not trying to displace
30:20
your IGA program. We're trying to make it better
30:23
with that intelligence layer there often often is missing.
30:28
So if I have all this information right, I guess I can
30:32
think about if this is from a measurement standpoint.
30:35
All right, I just invested in slash ID.
30:37
What do your typical customers say is like, OK, this is how we
30:40
measure the success of the of the platform because it's almost
30:43
kind of like you hope you don't have to use it, right.
30:47
But you end up hopefully with, you know, data that can kind of
30:51
come through and say, OK, we're detecting these things.
30:53
And what do I do from like a response perspective?
30:55
What if you found is sort of like the the key justification
30:59
that your customers have said, OK, yeah, this is This is why we
31:02
bought it. Yeah.
31:03
So we find 3 things that customer mentioned to US.
31:07
One is reduce time in IGA tasks. This is both in terms of like
31:15
roll out or IGA programs as well as just the time it takes to do
31:21
access reviews and access request thanks to the
31:23
intelligence layer that we provide.
31:25
The second is the reduced timing investigation.
31:29
When there is a potential breach finding who actually created an
31:34
identity, was that an identity stale?
31:36
Is this a false positive or a false negative that saves a
31:40
hundreds of hours for both IAM teams and sub teams?
31:44
And then lastly, the the, the, the ability to use our
31:52
remediations to avoid all the manual effort that analysts have
31:56
to do today. Where consider you need to go to
31:59
the platform team and ask them to write some terraform to fix
32:02
identities or your IMIM team has to go in and manually fix stuff.
32:08
Whereas you can use as as a sort of like an obstruction layer to
32:12
do all the remediation. Ultimately I think that what
32:16
this boils down to is 1 it's much easier for you to be
32:20
compliant and prove to your auditors that you are compliant.
32:24
And then two, you have the Peace of Mind that you don't have to
32:29
to spend time building like custom detections in your in
32:33
your sock team to detect that entity based attacks.
32:36
That rule set is already built into the product with some sort
32:39
of standard capabilities, but I imagine is is if me as a
32:42
customer I can add additional policies or rule sets to detect
32:46
against too, right? Yeah.
32:47
And as I mentioned, you can monitor highly privileged
32:51
identities that are really important to you and might not
32:55
have sort of like might not have been picked up by our
33:00
out-of-the-box detections. How would I go about setting
33:03
that up? Is it as simple as coming up
33:05
with like a naming rule or maybe a group membership?
33:07
Or do I go in and flag individual accounts?
33:10
I'm just trying to think of ways like, all right, in the real
33:12
world, right? You know, I've got an Active
33:14
Directory account and then I have like an Active Directory
33:16
account dot Adm, right? And companies tend to follow
33:20
patterns. Can I do some sort of like
33:22
pattern matching or group membership analysis to say OK
33:25
anytime an account like this shows up, I don't have to
33:28
remember to put it into this bucket, it will just
33:32
automatically go into that bucket?
33:33
Yes, So you can, you can do group relationship analysis to
33:37
automatically tag certain certain identities.
33:41
You can also use our AP is as part of sort of your life cycle
33:47
processes to mark specific identities as a privileged.
33:51
And then lastly, we do analysis on our side based on the type of
33:58
permissions and the type of access that the an entity has to
34:02
say Pai information and so on to mark certain identities as high
34:07
risk so that you have that full coverage.
34:10
OK, so I'm sold. I'm going to get it and I want
34:13
to deploy it. What does it look like to set
34:15
this up? I guess how long does it take
34:18
for me to, you know, get, you know, it's, it's probably an
34:21
ongoing thing, right? Identities are forever and
34:22
there's always something new coming in.
34:23
But what's a reasonable expectation say, OK, I've got
34:26
this thing set up and now I've got some actionable data to do
34:30
things with. Is it days, weeks, months?
34:33
And the curveball in there is how long do you think is
34:36
appropriate to detect what I would call, you know, abnormal
34:40
behaviour? Is it based on the account the
34:42
person, right? There's, there's always that
34:44
kind of tuning period, right? So, OK, well, what is normal for
34:46
Jeff? Well, Jeff's never normal.
34:47
So he doesn't fit into a bucket right?
34:50
Yeah. So I think one of those things
34:53
that we do uniquely is we're able to ingest historical data
35:00
that you already have in your environment.
35:01
So a lot of companies have data in their SIM in S3 and so on.
35:07
We can ingest that data the moment you connect to us.
35:10
And so you can get behavioral information out-of-the-box
35:14
immediately, within 24 hours from when you connect to the
35:19
environment. The setup itself takes less than
35:22
15 minutes. You give us credentials for your
35:24
environment and we provision it automatically if it's a cloud
35:29
based solution. If it's on Prem, you deploy our
35:32
collector which is a docker image and the collector starts
35:36
to stream data to us. OK.
35:41
So is this something that you can maybe walk us through and
35:43
kind of show this how this works?
35:46
Yeah, absolutely. I think forgiven that this is a
35:51
podcast, I'll try to keep this as brief as possible and not
35:55
particularly in in try not to bore people.
35:58
But basically once you connect to the to the environment, this
36:04
is the typical, typical view you would have for an identity.
36:10
As you can see here, this is a AWS role.
36:12
It's it's an NHI. We tell you automatically you
36:15
created the role, but I mentioned earlier that we use
36:19
LLMS to improve kind of like the the readability of this data and
36:24
the visibility. So you can see here that our LLM
36:27
can automatically generate a description for this role to
36:30
tell you exactly what the role does and can do in your
36:33
environment. So for our.
36:35
People who are listening, I guess I'm looking at like this
36:37
dashboard, right? And it's it's essentially
36:40
pulling in AWS information and then and then you're doing
36:44
things against that, right? You mentioned the LLM and coming
36:47
up with, you know, probably more human friendly descriptions of
36:50
what things happening on, you know, going into this interface.
36:53
And then so OK, I have a bunch of triggers and configures that
36:56
I can do right? Yep, Yeah, exactly.
36:58
And I mean if you if you take sort of like this, this role
37:02
here, like the role doesn't tell us that much.
37:04
It's called AWS service role for Amazon, even bridge API
37:07
destinations. That's not like super helpful.
37:11
Having a human readable description of what this thing
37:15
can actually do is already quite helpful.
37:18
As I mentioned, you can suspend this role, delete this role.
37:20
You can do a bunch of actions on the role and we discussed a bit
37:25
about like the the ability to help IGA processes when it comes
37:31
to reducing excessive permissions.
37:34
You can see here that we can look back in the log data and
37:39
see which permissions haven't been used by this role in some
37:45
period of time where it's configurable.
37:47
And then you can ask our LLM to generate a appropriate policy
37:52
that we actually verify in the environment to make sure that
37:57
we're not accidentally sort of like removing privileges.
38:00
So here you see a full blown AWS policy that is tailored to this
38:06
role and achieves least privilege based on the past
38:10
seven days of data. So that's one you there's like
38:13
functionality from like a Kim system or CIE cloud
38:17
infrastructure entitlement management.
38:20
So the the the core difference here is that most of the Kim
38:24
systems try to tell you what entitlements haven't been used,
38:29
but they don't help you with remediation.
38:32
Can you do the same thing from other cloud platforms like
38:35
Google Cloud as well as Microsoft Azure?
38:39
Yes, that's the other powerful, that's the other big
38:42
differentiator. We can do it across all the
38:45
providers that we support. It's not just AWS specific.
38:50
And so you have the same least privilege capabilities across
38:54
all the environments. So you click this button that
38:58
said get recommendation and then that's where the LLM is chunking
39:02
through the data and saying OK, well what should we do about
39:04
that? I guess explain me more what
39:06
that get recommendation button did on the screen.
39:08
Yeah. What that does is it looks at
39:10
the historical data, it looks at the existing entitlements for
39:14
that identity. It removes all the entitlements
39:18
that have not been used in the the period of time you selected,
39:22
which can be one day, seven days up to like 90 days.
39:28
And what we then do is verify that policy before showing that
39:34
to you because obviously, as you know, LLMS can hallucinate.
39:37
And so we want to make sure that the policy is actually well
39:41
formed and is not accidentally breaking anything in your.
39:44
Environment and then basically what you see is like this
39:47
essentially like a script, right?
39:48
Like here's what we're going to do and then I take that
39:51
information, then I can either run it individually or can I
39:54
click another button that says, OK, do that.
39:57
How would you automate that part of it?
39:59
So what you can do is to use use our APIs to automatically deploy
40:04
this across across your environments.
40:07
I mean, one thing that occurs to me is that this gets you a good
40:13
way toward your lease privilege policy.
40:18
Didn't get you all the way there, but lease privilege is so
40:20
hard to achieve that if you can at least start to clean up
40:25
unused roles, roles that you're not even using, that shouldn't
40:29
exist in the environment, and this takes you a step closer to
40:33
that. Yeah.
40:35
And the way we think about it from a, from a security
40:38
standpoint is what we're doing here is really reducing the
40:41
options for our attacker to move laterally in your environment.
40:44
They might still breach an identity, but then they won't
40:46
have the same degree of entitlements that they would
40:49
have otherwise. And so we get to as close as
40:54
possible to less privilege, while while at the same time
41:01
sort of like being easy, easy to use.
41:03
It's not as as big of a lift as something like IGA.
41:08
One thought I had about this is, yeah, the the lateral movements,
41:14
absolutely. What I would love to see, so you
41:17
have my Christmas wish list, would be take this functionality
41:20
and bring it to the on Prem environment.
41:22
If we could do this for the on Prem environment that would be a
41:26
dream come true. Yeah.
41:28
So the the good news is that we can already do it for AD.
41:32
So we support. We support AD as well.
41:37
There you go. That's huge.
41:39
That's very cool. So I know it's a little bit of a
41:41
visual demo. So for people who wanted to
41:43
follow along, we'll have it up on our YouTube channel.
41:45
Come and check that out. But definitely appreciate you
41:47
taking the time with us. Vincenzo, I want to ask you a
41:49
question before you wrap things up.
41:50
We, we try to end things on a lighter note and I don't know
41:52
how light this will get, but I'm sure you've seen some strange,
41:56
unique, scary, baffling things maybe over your your time with
42:00
maybe things like Blackhat and so forth.
42:02
What is the most memorable thing that you've maybe seen as as
42:05
part of, you know, that environment or maybe you know
42:08
that that culture of of attackers and defenders?
42:12
Yeah, so the, the there are a lot of like interesting stories
42:15
that I'm not sure I can talk about, but but I'll, I'll say
42:18
one that is dear to my heart because because it was part of
42:22
it. So at the beginning of my
42:24
career, I start to participate in this competition called .1
42:29
where you need to demonstrate a live exploits against either a
42:32
mobile phone or browser. And the way this works is you
42:35
fly to Vancouver, you have this like 2 days competition live
42:41
where like you run your exploit against the device and hopefully
42:44
it works and, and, and you win. What happened to us one year was
42:49
the vulnerability got patched literally the night before of
42:53
the competition. And so we had to stay up like 48
42:57
hours straight to find another vulnerability, rewrite the
43:01
exploit and try to try to win. It was, it was a very, it was a
43:08
very fun experience for us. But I think he also speaks to
43:14
sort of like the, the, the, the complexity of like this world
43:19
and how hard it is to like keep up with attackers.
43:25
Yeah, it's always that cat and mouse game, right?
43:27
But I, I don't, I good on them for patching it and then good on
43:31
you, I guess fighting and something else that you could
43:35
get in through, you know, in a relatively short order.
43:37
So I guess that just highlights, right, the speed for the
43:40
detection is such an important part of this is, OK, well, how
43:41
quickly can we detect something, right?
43:43
That dual time is so important and it becomes more important as
43:47
we become more automated and more, you know, let's say bot
43:51
and AI driven where these things are happening, you know, very,
43:54
very quickly, millisecond speed. And so it can be very difficult
43:57
to kind of detect all that was. Is that a fair assessment?
44:00
Yes, I like on on on that front. One thing that I think flew
44:05
under the radar a bit too much, but recently the Microsoft
44:10
Research team used an LLM to find vulnerabilities in bunch of
44:15
book loaders. The scary thought is we might be
44:21
getting to a point where finding vulnerabilities is actually very
44:25
quick, very fast. And so attackers will have two
44:29
levers that they can use. On the one hand, it's much
44:31
easier to fish people because I get fishing these days is is
44:36
almost impossible to to to tell apart.
44:39
And then on the other hand, the factor that you use to
44:42
compromise is now much easier to to deploy because it's easier to
44:47
find vulnerabilities. So I think LMS on the offensive
44:51
side are somewhat scary just for the the increasing pace and
44:56
making it hard to detect. Yeah.
44:59
I mean, gone are the poorly written emails and text
45:02
messages, Yeah, with second language.
45:04
And now it's, yeah, like I said, very, very difficult to detect.
45:06
And it's going to happen at some point.
45:08
So you know what, the AIS fight each other and then just let me
45:11
know who wins sort of at the end.
45:14
Definitely appreciate you taking time with us.
45:16
Vincenzo, is there anything that you'd like to get out for people
45:18
that we haven't covered yet that the people should know about
45:21
Slash ID? No, I think, I think we we
45:25
covered everything. I will say maybe one last thing,
45:28
which is Jim mentioned that achieving these privileges is
45:33
very hard. One of our maybe contrarian
45:35
beliefs is that achieving these privileges is impossible, which
45:37
is the reason why you need detection and response
45:40
capabilities because you'll never be at a place where
45:43
everything is perfect. Everything is properly segmented
45:45
from under 19 standpoint. And so you need to have the
45:47
ability to detect and response and respond to attacks.
45:51
I, I can, I can, I can definitely agree with that.
45:53
I think, you know, perfection is very difficult to achieve.
45:56
So you need something to detect the stuff.
45:58
So I'm on board with that one for sure.
46:00
So we'll point people to the website slashid.com/IDAC.
46:05
We'll have that in our show notes as well as your LinkedIn
46:08
profile if people want to reach out, have questions, you know,
46:10
maybe share a, a Black Hat war story or two, whatever that
46:13
might look like. So definitely, again, appreciate
46:15
you taking time with us and thanks everybody for watching
46:18
and or listening. So you can find us on the web,
46:20
IDC, podcast.com and yeah, we'll talk with everyone and the next
46:24
one. Thank you both.
46:28
You've been listening to Identity at the Center.
46:31
We hope you've enjoyed the show. Make sure to like, rate and
46:35
review, and we'll be back soon. But in the meantime, hit the
46:39
website at identity@thecenter.com.
46:43
See you next time on Identity at the Center.