Latest / Identity at the Center / #112 - CIAM with Stephen Cox

Transcript

#112 - CIAM with Stephen Cox · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:29
center podcast. I'm Jeff.
0:30
And that's Jim. Hey Jim.
0:32
Hey, Jeff, how are you? Oh, not so bad yourself.
0:36
Good good. You know.
0:37
The this is our second podcast recording of the day we have to
0:41
do that around the holidays and things like that.
0:44
But you know, during the last recording session, I had FedEx
0:49
show up right in the middle of the call, as, as expected,
0:53
right? They gave a delivery when In do
0:55
they showed up at the very last moment within those delivery
0:59
window and then it was something I had to be signed for.
1:02
There's only a couple of t-shirts and a pair of jeans
1:04
that I was having delivered, but I had to sign for it anyway.
1:09
That's a little bit of the behind, the behind, the big
1:12
curtain. Yeah, it was like it when we're
1:14
sitting here, having a conversation with a guest and
1:15
then I see Jim get up walk away. It's like forecast, mostly think
1:20
I was like, oh they're not paying attention or like what's
1:22
going on around here. But yeah, I mean, This is real
1:25
life. This is the way things work.
1:26
Of course, if you're getting a delivery, that is exactly when
1:29
they're going to show up. As soon as we hit the record
1:31
button, you know, that's when you're going to hear the, the
1:33
doorbell or the dog bark or, you know, the fire engine or the
1:37
police car drive by. That's just, that's just the way
1:39
it works in the world, we live in.
1:40
So, so, it's all good. Well, the one, though, you saw
1:43
always happen, was the landscapers would show up.
1:46
It was like, I think we were recording the podcast and, you
1:50
know, the first 50 episodes or whatever it was on Thursday
1:53
afternoon because I Ooh the my crew showed up on Thursday
1:57
afternoon at like 4:00 and like you know the leaf blower would
2:01
go on just as we hit record as same thing here my you know, I
2:06
guess, Thursday's landscape me day Across the Nation.
2:09
So so we moved to mostly Wendy, Wednesday's a try and counter
2:12
for that. But that ends up being my like
2:15
my I don't know my homeowner's association that's when their
2:19
Landscaping does it on Wednesdays.
2:21
So whatever. I don't think people tuned in to
2:23
the identity of the center. Cast to learn about Landscaping,
2:26
Trends across the United States. Other than hey, we're real
2:29
people, we have stuff going on. And sometimes, you know, things
2:33
pop up while we're recording that, you know, you don't hear
2:36
necessarily behind the scenes, but like I said, sometimes, I'll
2:40
watch Jim get up, walk away, and then come back and they'll carry
2:44
on the conversation just like nothing ever happened.
2:46
So, so I think with that said, why don't we get into our
2:49
conversation for today? Because I am staring at a screen
2:52
here of our guests and I'm very Excited to have Steven Cox on
2:56
the show, he's a co-founder and chief technology officer at
3:00
strobe a city, so welcome to the show Steven.
3:02
Thanks a lot Jeff. I'm happy to be here.
3:04
Thanks for having me. Thanks so much for being here.
3:07
And, you know, I think one of the things that we like to get
3:09
into, and we're going to actually have a conversation
3:11
that kind of structures off a couple different things.
3:14
Probably mostly around customer identity and access management
3:17
and some things to think about that.
3:18
But as it's your first time the show we as an industry addition
3:21
around here is we like to understand kind of the origin
3:23
story for people. And how they actually got into
3:26
the identity space or maybe even when they realized they were in
3:29
identity and maybe they didn't know before just kind of had
3:31
that daunting. So, maybe I can kind of take us,
3:34
you know, briefly through kind of your past and and how you
3:37
ended up on the show, I guess. Yeah.
3:39
You know. So one of your one of your
3:41
previous pods you you ask the quite that question.
3:45
A really interesting way you asked like, you know, did you
3:48
did you find Identity or did identity find you right?
3:52
And I would say that identity definitely found and me you know
3:56
I kind of like to make the joke that I'm you know I'm not an
3:58
identity guy but I play one on TV you know I've been in the
4:02
security space for a very long time about 15 years.
4:05
My first foray into into security was doing DNS
4:09
monitoring of the common. Net infrastructure verisign that
4:14
was not too long after I was out of college.
4:17
I worked for after that a network monitoring company name.
4:21
Net witness. That was that was later
4:24
acquired. Hard, I worked after that for
4:27
for an incident response company name mandiant, you're probably
4:30
familiar with before the before the fire acquisition a little
4:34
bit after that was where I met my, my fellow co-founder of
4:38
strobe, acity, Keith g, Keith later, recruited me to an
4:44
identity company that you're a lot.
4:46
Of your listeners are probably familiar with me and secureauth,
4:50
and I really liked what secure off was doing around threat
4:53
detection at the the identity layer.
4:56
So I spent a number of years at secureauth, you know, helping
4:59
them build their product out and and, and then Keith.
5:04
And I went off and started stir Bassett e, late in 2019 and and
5:09
the with the prime focus on customer identity.
5:12
So serve a city is relatively new.
5:14
And, you know, I think people who are listening have kind of
5:16
come to realize we don't really do commercials on this show,
5:19
right? We don't talk about ourselves
5:20
and certainly try not to make an infomercial people, but I think
5:23
it's in this Yes, I want to make a slight exception, other than
5:27
to kind of bring the audience up to speak as they may not have
5:29
heard of strip acity. It's only been around, like you
5:31
said since, you know 2019, you guys are still growing.
5:34
And as a relative new player in the same space I guess you know
5:38
what's the 30-second pitch? Why does the world need yet
5:41
another see IM product or vendor in the space?
5:44
Yeah I appreciate I appreciate the sentiment there for sure.
5:48
You know. Definitely start-up problems is
5:50
getting. You're getting your name out
5:52
there getting the getting the share of voice and and You know
5:55
stir Bassett e is is the first see, I am vendor.
5:59
That was Cloud born and and designed from the get-go to
6:02
solve the the, you know, the gamut of customer identity
6:06
problems were we're built for scale were built to solve some
6:10
of the, some of the modern data privacy challenges that that,
6:15
you know, that that brands are facing today.
6:17
And and, you know, were we're, you know, we're building digital
6:22
transformation for the cloud. Really.
6:24
So I think you partially answered this question, but I
6:27
was going to say look it's not hard to find a Blog titled
6:32
customer. I am is different from
6:33
Enterprise. I am, in fact, I wrote 11 us
6:36
with. I denture P but I want you to
6:39
explain to the listeners that I am practitioners of the world.
6:45
What that really means. Y is customer, I am different
6:49
from Enterprise, I am. Yeah, we've also blogged on this
6:53
topic. It's an it.
6:54
Definitely an important one to understand, you know, at a high
6:57
level and you know, at a real at a real high level, you know,
7:00
you're you're basically looking at a different base of users in
7:05
see, I am versus, you know, Enterprise I am.
7:08
You know, Enterprise, I am traditional.
7:11
I am, has kind of been focused on the workforce, right
7:14
customer. I did, I am is focused on
7:17
consumers, of course, in in, you know, in Workforce, I am your
7:22
provisioned by an HR or an IT person.
7:24
Right. You typically have less say over
7:27
the means in which you, you access things, you know, and
7:31
work for Siam and customer. I am your often self
7:34
provisioning or registering yourself, right?
7:37
You have a lot more say, on the ways that you access things,
7:39
because you can simply walk away and find another brand to do
7:43
business with, right? You have you have that choice.
7:46
So, so here, you know, user experience becomes really
7:49
important. And flexibility becomes really
7:52
important. You have this, you may have a A
7:54
widely ranging, you know, demographic, you know, spread
7:58
and your user base and see, I am some of them may be less
8:01
sophisticated. Some of them may not have
8:03
up-to-date technology. So how do you, how do you do,
8:06
multi factor in cases, where you have, you know, a less technical
8:10
user base. Some of them might have issues
8:13
enrolling in multi-factor, we're not want to all together.
8:16
So and then you course, you've got a, you've got to think about
8:18
scale, you know, Enterprise, I am focused on like, you know,
8:22
sort of thousands to to maybe hundreds.
8:24
Thousands of users and see, I am can easily get into the tens and
8:28
tens of millions of users and up?
8:31
Yeah, that's right. And I think, you know, really
8:33
where I was keying, my thinking was really where you started,
8:38
you know, there's such variety, we're talking about customer, I
8:41
am, who are your customers? Are they consumers?
8:44
Are you doing an e-commerce site?
8:46
Are they your members are? They beat has be to be to be
8:52
partners are you know the other business Aces and there's such a
8:56
different different ways. You could go about managing
9:01
those user accounts. Getting people access, you know,
9:04
whether or not, they are able to maintain that excess over time.
9:07
Or you know, when they leave the customer organization, your
9:11
off-boarding them compare that to Enterprise.
9:14
I am so you know, Jeff it's so there are doubt, we'd all really
9:18
talking about what we do but for those who listen to us every
9:21
week, you realize that we do Consulting On, I am and develop
9:26
strategies. But, you know, a lot of times
9:28
we're working with organizations, or what we call
9:30
Enterprise I am, is figuring out how to manage who gets access to
9:35
what from a Workforce perspective.
9:38
Now, we're really not Reinventing the wheel every
9:41
time. It's not like well, you know,
9:43
most organizations they're getting a feed from an
9:45
authoritative Source like a human resources system but maybe
9:49
you guys should do it differently.
9:50
That that sound that's not the way we look at it, right?
9:53
It's like You know, you'd have to really be completely
9:58
different than everyone else in order to, to really shake some
10:02
of those kind of fundamental Roots.
10:04
But when it comes to customer, I am I find that you know, that
10:08
that's not necessarily the case, you have to kind of go into it
10:10
open-minded. Like how do you do it today?
10:13
What are you trying to achieve? And and it's a, it's a big, it's
10:16
much more different picture and I think that in some ways makes
10:21
it easier or makes it Provides a justification for why there
10:28
would be so many, see IM up, or opportunities for CA and
10:33
products to be introduced in the market.
10:35
But at the same time difficult, because since the problem is not
10:40
one clear solution to kind of develop a CA and product that
10:44
solves all these problems and so it creates opportunities but at
10:49
the same time makes it a very difficult problem to solve, you
10:53
know, kind of In Ewing on with that you know we talked about
10:57
the blog, you guys have a Blog will get the link out there in
11:03
the show notes blog. I saw another blog that you guys
11:06
wrote called trade-offs of using open-source.
11:09
See I am and that's I found that interesting because you know
11:15
again the CIA in problem is something that has so many
11:19
different solutions, I've run into a lot of clients that do
11:22
there were using open-source. See I am Were seriously
11:26
considering that and I wanted to get your perspective on what
11:30
those trade-offs are. Yeah.
11:32
Absolutely, you know, just just a small distinction, you know,
11:36
when I when we talk to, you know, open source.
11:38
See I am, you know, on that blog, we're not necessarily
11:41
speaking about like using open-source libraries in your
11:44
software. You know, we all know that's
11:45
pretty much the standard way that the people build software
11:50
these days but we're really talking about here is like using
11:53
a fully baked, you know, No see IM open source offering and then
11:57
Landing it sort of directly within your product or your your
12:01
infrastructure, right? And again I'm a joker.
12:06
So you know the the analogy I like to use is that open source
12:10
CMS see IM is kind of like a free puppy, you know you know,
12:13
puppies are cute and awesome and and and and you, you know, you
12:18
there they're awesome. You know, it's great to have.
12:20
But, you know, when you get, when you take on a puppy, you're
12:23
taking on much more than Then just, you know, the the
12:27
immediate relation of having a puppy, you have to feed the
12:30
puppy, have to walk the puppy have to take, you know, it's a
12:34
multi-year obligation right to care to care for care for that
12:38
puppy. And that's kind of, the sort of
12:41
mouth mentality. I speak to, when I, when I, when
12:43
I talk about taking on an open source, see, I am offering you,
12:47
you do get a free product, right free product, quote, unquote,
12:52
but you're taking on the, on all the obligation of Of all the
12:56
Care and Feeding around it, right operationalizing?
12:58
It hiring people to maintain it hosting it somewhere, monitoring
13:03
it patching, it addressing security vulnerabilities, right?
13:06
And that can, that can quickly get daunting a lot of the
13:10
open-source offerings that you see, you know, in this space,
13:15
you know, have premium support packages.
13:17
So then it's really not even even free anymore, right?
13:19
If you go that route and and you know, none of these things are
13:23
bad there. Many organizations that are
13:26
perfectly fine with that type of arrangement, and they have the
13:28
resources to do that. And, you know, you have you
13:32
ultimately have more fine-grain control over it because you
13:36
actually, you know, own the code and, or working from the code
13:40
with a CI M platform. You may have a little bit less
13:42
fine, fine, grained control, and maybe that's okay too.
13:46
But you should just really kind of think of those.
13:48
Think of those trade-offs, it's not it's not quite as you know,
13:52
clear apparent, as you might think, you know, From from the
13:55
beginning, right? It's not really the open source
13:58
model that I hear you have it. An issue with a really talking
14:03
about in terms of trade offs. What you're really talking about
14:06
is the kind of responsibilities that you're taking on yourself.
14:10
Exactly. Your your organization is taking
14:12
on, right? Exactly.
14:13
It's kind of back to my point about was see, I am and kind of
14:17
user management being so different.
14:19
I mean, when you look at CA and products but they seem to all do
14:24
well. Is authentication, right?
14:28
Authentication for web applications has gotten you know
14:32
baked into standards. There's not many solutions out
14:37
there that are saying hey you know, forget about the
14:39
standards, we got something proprietary.
14:41
That is a heck of a lot better, right?
14:44
So then it becomes a matter of, you know, hey, we implement the
14:47
standards, we have, you know, robust hosting offers cloud.
14:55
His successor excetera. I guess what I'm saying is, I
14:59
think that, you know, there's not a ton of differentiation
15:02
there where the differentiation for my money becomes is around
15:08
what capabilities, do you provide in terms of doing user
15:11
management, terms of user registration and terms of, you
15:16
know, credential management when you get into the bead abuse
15:21
scenarios, it can get extremely complex but I find that A lot of
15:27
my clients, you know, they're looking for a product that can
15:30
solve most of their problem. They don't want to go and
15:33
develop their own user management platform.
15:36
They want to do that. They can just go and do that.
15:38
They don't need the product, but they want a product, right?
15:42
And they, you know, even more they want to cloud service,
15:44
right? And they're even willing to make
15:46
some trade-offs to get there, but I wanted to kind of throw
15:50
that out there. Is that kind of what your
15:52
thoughts are as well. Do you really feel like, you
15:56
know, user management is Is kind of what is one of the main areas
16:00
that differentiates eam products?
16:03
I think so. Yeah.
16:04
I mean, you know, the, the question kind of comes down to
16:07
like, well, what what amount of user management is enough,
16:10
right? Like it and it really comes down
16:13
to, in the, to me, to my eye, and my opinion in the CIA I'm
16:17
space. It really comes down to user
16:19
experience, right? Being able to craft, you know,
16:22
it's not just crafting user experiences for the end users
16:24
for the, for the end. Customers but also for the, for
16:27
the For the brands themselves that are using the see, I am
16:30
product, right? They they may have different
16:34
user. Personas that you need to cater
16:35
to, right? You have the brand admins, you
16:37
have the I am specialist, you have the marketing teams that
16:41
the support folks. You know, there's there's a
16:43
there's a variety of different user personas within an
16:46
organization that may need access to be able to do certain
16:49
things within a see IM platform. You know, so, you know,
16:54
role-based access control is kind of, kind of one ways.
16:56
One way to address. Dress this, right?
16:58
You kind of allow people to do different things within your
17:01
Administration, console, kind of based on their their role, or
17:05
their user Persona that you that you can figure, right?
17:07
So you kind of make it, kind of make it easy to get to get to
17:10
where they want to go and do what they want to do within
17:13
within your product. So I do think it's important for
17:16
sure. Now so now that I kind of made
17:19
the case that you know user management should be the top
17:23
priority and I'm not even saying that I think that's one of the
17:25
main differentiators. when we talk about customer, I am versus
17:30
Enterprise, I am I think one of the main differentiators can or
17:34
differences between the two can be scale, and when I say that,
17:38
I'm talking about, you know, Enterprise scale is, you know,
17:42
typically up to 100,000 users, where an internet scale or or
17:49
where the customer I am, fits in and can be millions billions of
17:53
users but like even if we just take Millions that's all
17:57
Exponentially more than than even large Enterprises.
18:01
And when you start talking about companies with or organizations
18:06
with high seasonality, those the volumes can just become
18:12
ginormous. Now, one of the things I looked
18:15
at in researching shrive, acity architecture, if you will, is
18:21
you guys look to address that using kubernetes, you're the
18:26
architect. It you were probably the person
18:29
behind that decision so maybe even like we like to start the
18:34
most basic level maybe we could do for the audience to kind of
18:36
explain what kubernetes does and then why you selected it to help
18:42
with their scale or how it helps you with scale?
18:45
Yeah. Yeah.
18:45
See. Yeah.
18:46
You mentioned you mentioned that scale is, you know, a
18:48
differentiator and between see. I am Andy, I am.
18:52
I definitely agree. I mean you can get to, you can
18:56
get to sort of match. Massive levels of scale and see,
18:59
I am I really, I really like your your point about
19:03
seasonality, write, the example, I love to give is the is the tax
19:09
company, right? That's got extremely bursty
19:11
traffic at certain times of the year.
19:14
You know, when everyone is like, oh my gosh, I'm late on my tax
19:16
return. I have to do it right now and
19:18
they're rushing to get those. You know, those were tax returns
19:21
in right before the deadline. So, you know, so you have to
19:25
handle, you know? Detra burst of traffic, right?
19:29
And in a way that doesn't doesn't kill your your wallet.
19:33
I'm I'm sure a lot of your users have posted stuff in the cloud.
19:36
So they kind of know what I'm talking about, but one of the
19:39
one of the core tenets of kubernetes is a concept called
19:42
auto-scaling, right? So you look at metrics that are
19:47
being, you know, emitted by your services and you can add
19:51
additional instances of your services, if you know, the
19:54
metrics reach certain point, they call that sort of
19:57
Horizontal or vertical auto-scaling, and you're able to
20:01
also scale that traffic back down.
20:05
And in a situation where you know, the burst traffic kind of
20:10
you know, subsides, right? So it makes kubernetes like
20:14
really well designed for for for this type of product because you
20:17
can handle the seasonality, you know, the crazy bursty traffic
20:23
and you can also scale it down and and not kill yourself in
20:26
terms of You know, in terms of your hosting bills that make
20:30
sense. Yeah, that makes sense even.
20:32
So maybe you could talk to us a little bit more about how that
20:36
scaling works. I mean just, you know, we're not
20:38
looking to get a PhD in how this works but just, you know, a
20:42
little bit more in terms of our eight.
20:44
So is it that there's some kind of monitor watching over your
20:49
instances looking for processor utilization, then spinning up
20:53
additional server instances. That's exactly right.
20:57
Yeah, yeah, you you you you have, you know, you have a
21:01
certain set of services you're monitoring their their, their
21:05
activity, right? You're minding what the CPU is,
21:08
what the memory is, you know, various different metrics.
21:10
I mean, you can actually in some cases design, your own metrics
21:13
if you want. And when you reach a certain
21:16
threshold, you can effectively kick off a job that spins up a
21:21
new instance of that service, right?
21:23
So and you can sort of Define all kinds of you know,
21:26
parameters around. That right.
21:27
Maybe you want to double the amount of services or maybe you
21:30
just want to add one additional service, right?
21:32
So you you have a lot of control over being able to do that.
21:37
And then the flip side of that is, you know, when it falls
21:40
below the threshold for some period of time, you drop one of
21:42
those Services, you know, off and so you do have some, there
21:47
are some design constraints around that, right?
21:49
You have to make sure that your, your services can be run in
21:52
parallel, right? That there's not any sort of
21:54
State shared between them, they have to kind of run and Be able
21:57
to run in parallel, pretty easily, right?
21:59
So that one instance of the service can handle a
22:02
transaction, on its own, that makes sense.
22:05
And yeah, and that's kind of the idea of scaling, with in
22:09
something like kubernetes. Yeah, so glad I asked, you know,
22:12
I guess did you look at Docker as potential or maybe a Docker
22:15
swarm versus kubernetes? I guess, what was kidding?
22:19
Can you help me? Understand, you know why maybe
22:21
you went with kubernetes over Docker specifically?
22:24
Yeah, we did. We did look at darker swarm.
22:26
I actually Have some, some personal experience with dr.
22:29
Foreman, you know, it previous companies that I've that I've
22:33
worked with, I think it was really mainly that we had
22:37
amongst the early Engineers that we had some some real direct
22:42
knowledge of kubernetes. So it just kind of made sense
22:45
for us to go in that path. Just because of you know what,
22:48
you know, startup bootstrap get stuff running as you know, type
22:52
of mentality. Yeah.
22:53
So it was more of like a prism or like a team experience thing
22:56
then Than anything else. Gotcha, I'm answering helps with
22:59
a raffle perspective. I would say if, you know, the
23:01
closer to using, I'm always curious about the security to,
23:04
you know, I guess when we talk about the scale of some of the,
23:08
you know, install bases in the fennec ation basis that you're
23:11
probably dealing with and getting into millions and spikes
23:14
and things like that. I immediately think of things
23:15
like DDOS, and other types of attacks, that that can Trend
23:20
that way. But also other things like
23:22
passwords praying, you know, man-in-the-middle social
23:25
engineering fishing like all the stuff.
23:27
The Comes along with this. Yeah.
23:29
How do you approach security from a CI, M environment
23:33
perspective and what are some things that people should be
23:36
thinking about as they look at 6 a.m. for their organizations of
23:39
some of the threats and and how you've looked to address some of
23:42
that? Yeah.
23:43
You know I you know, I know it's a it's a bit of a buzz word but
23:46
you know I do also like to talk to this in terms of you know,
23:51
defense the defense in-depth concept, you know, there's
23:54
really no one one way to solve. So, all these types of different
23:59
attacks. You know, you know you mentioned
24:01
password, spraying just defending against password
24:03
spraying is, you know, a combination of things like doing
24:06
bot detection and breached password detection, right?
24:10
You know, are these are these transactions coming from from
24:14
known, but infrastructure, you have the ability to sort of rate
24:18
limit, you know, based on various patterns of traffic or
24:22
you can you, you know, are you pivoting on the data?
24:27
Like, you know, things like looking at multiple IPS coming
24:30
after one set of credentials or a single IP hitting multiple
24:33
sets of credentials, right? You're kind of looking at these
24:36
traffic patterns and trying to make make decisions off of
24:40
whether you allow those, you know, those trick, those
24:42
transactions that go through or not and you know where you are,
24:46
you protecting your users from sort of the the stolen or weak
24:50
password situation, right? You know, setting up password
24:55
policies to something meaningful.
24:57
You are using passwords doing reach, password protection when
25:01
a user sets or reset their password.
25:04
You know, if you in a few you kind of want to really get sexy,
25:06
you can think about things like password list flows, you know so
25:09
there's actually no password at all like you're taking it out of
25:11
the problem entirely and when we're talking about like
25:16
man-in-the-middle type of tax I assume we're you know we're
25:20
specific specifically talking about man in the middle attacks,
25:22
you know, against authentication and that and that has some
25:26
interesting Solutions. To it's, it's really around
25:29
making sure you're taking advantage of, you know, a lot of
25:32
the lasers later. Latest browser, security
25:35
enhancements a specific way to defend against this.
25:38
You know, in authentication is to use an out-of-band MFA
25:42
method. So, you know, when an action has
25:45
to be carried out on an external device to complete the
25:49
transaction, you know, something as simple as like, push to
25:51
accept his kind of a real base idea there.
25:54
And the, the concept there is that You know, the, the, the to
26:01
multi Factor methods are not going through the same channel,
26:03
at that point right there. You can't fish, you can't fish a
26:08
one-time passcode that's on a, it's on a list on a separate
26:12
channel, right? From from where you're from,
26:14
where you're sitting. So you're pushing the, you're
26:16
pushing the the security context of this in two separate
26:21
channels, which is, which is just an inherently good thing to
26:23
do when you're trying to trying to design secure systems and
26:26
century Mention the password was because they see a lot of kind
26:29
of interest in that especially in the Enterprise space and we
26:32
see password list to some degree.
26:33
In the consumer side of things. I immediately think of something
26:36
like slack. Where, of course you can use a
26:38
password to log in, but they also have the magic link process
26:41
which is kind of a veiled password that sort of approach,
26:45
you know, maybe not the smoothest transaction, but it
26:47
works. And then I think of some of the
26:49
other things that you mentioned to around the, the multiple
26:53
channels that can be happening for MFA or second Factor types
26:56
of authentication, I think of them Apple.
26:59
So, I, you know, I've got an iPhone, a watch, an iPad, a Mac,
27:05
I'm up. And, you know, I have all this.
27:06
I have Windows too. So, don't don't hate me for
27:08
everything. But when I get a multi-factor
27:11
prompt for Apple, it dings me on every device.
27:15
Even the one I'm using which never really made sense to me.
27:18
It's like, oh, okay. I, you know, you're sending me a
27:20
second Factor request, but you're setting it to the same
27:23
device that I'm already using. That seems a little bit.
27:27
Like that was not well thought out from that kind of deployment
27:30
standpoint and just curious, you know, if that's if that's
27:33
something you've seen as well. And I guess just also if you can
27:36
touch on the passenger side of things, because I'm wondering
27:39
how see I am products are looking to address that specific
27:43
use case for consumers and getting away from the password,
27:46
which, you know, everyone hates and everyone's been telling us
27:48
as has been dying now for 10 years, it's the longest death
27:53
I've ever seen. Yeah, yeah, so you know, the
27:56
impact Password. Listen, see I am is is
28:00
interesting. You know, we've it's interesting
28:03
to see that you mentioned, you mentioned, your Apple in your
28:06
Apple devices. It's interesting that the
28:08
consumers, the consumer device, companies have really kind of,
28:12
kind of led the way here in terms of using Biometrics as a,
28:18
as a potential second Factor, right?
28:19
So they're actually making it there.
28:21
I always like to say, they kind of their kind of making it easy
28:23
for us as I am. As I am designers Architects to
28:27
To leverage a biometric as as a second Factor, right?
28:31
So you can get into a password list situation where, you know,
28:35
you do, you do a an out-of-town, you know, an out-of-band sort of
28:40
push to accept type of transaction.
28:42
And the biometric is the the devices.
28:44
The first fact is the, is the first Factor.
28:46
The biometric is the second Factor, right?
28:49
And, and that's, that's actually pretty cool, right?
28:51
And consumer because it's easy, right?
28:54
It's I mean, it's it, you may have some challenges with
28:57
Rolling it but like it's user-friendly, you know, it's
28:59
like, oh cool. Like I just logged into, you
29:01
know, the service I'm trying to get to just buy open picking my
29:04
phone up authenticating putting my thumb on the on the reader or
29:08
my finger on the back of the phone and I'm in, right?
29:10
I don't have to like though type my password in or try to
29:13
remember it or try to pull it from my password manager.
29:16
It's like, oh I'm just in you know.
29:17
So that's that's actually really beneficial in the in the, in the
29:22
consumer space the enrollment side like I say is a little
29:25
harder but it's The user experiences is great there and
29:30
it's interesting. Yeah I mean even you mentioned
29:32
like oh yeah the the code goes to all of my devices even the
29:36
one, I'm even the one on I'm sitting on that.
29:40
That's not ideal of course, right?
29:42
But it is, it is still somewhat of a separate Channel because
29:45
it's not in the same browser session, right?
29:49
It's out, it's an, it's in a separate browser session.
29:51
So you could argue that it is slightly more secure but but
29:55
probably not probably not. Ideal.
29:57
Yeah, you mentioned there Stephen about the consumer
30:01
Brands, kind of driving a lot of this.
30:02
I think they're driving it from the standpoint that they're
30:05
putting readers into their devices.
30:08
They're putting, you know, the touch ID or the facial
30:14
recognition. But to me, it's the the Fido
30:17
alliance with the fighter to standard web authentic, that's
30:20
really making this interoperable and not proprietary.
30:25
And so to me, that's such a key that You know, we continue to
30:29
kind of support that recognize that, at least I was trying to
30:34
give a nod to it here on the, on the podcast.
30:37
Yeah, but I yeah, yeah. I also wanted to just mention.
30:41
We had a guest Roger Grimes, who was on the podcast?
30:45
A couple episodes back. He wrote a book called hacking
30:49
MFA and he kind of dissected the man in the middle attack built
30:56
on the evil jinx. Framework, you get an
30:59
opportunity to recommend highly going out and looking at that,
31:01
because it really shows you how someone can take an out-of-band
31:06
MFA. And if they set up a
31:08
man-in-the-middle attack, really, you know, take advantage
31:11
of that. And this is a framework, that's
31:13
still out there on the internet today and it's really, you know,
31:17
kind of driven from from fishing campaigns to get people to log
31:22
into a fake website. Yeah, but you know that fake
31:26
websites relay In those credentials and really just
31:29
trying to steal and access token, right?
31:32
Yeah. So all that I kind of led to the
31:37
next question that I had for you in terms of kind of looking at
31:40
your architecture and I see you guys are standards.
31:44
Based in terms of the authentication, oid see support
31:49
Samuel support. I got the sense and in talking
31:53
to you I think you validate this is that you favor.
31:57
IDC which is I think the trend I'm seeing almost everywhere you
32:01
favor oid. See over Samuel, I'm wondering
32:04
why that it is to avoid kind of the overhead of dealing with
32:09
browser redirection or is it something else?
32:12
So interesting, I I'd actually argued that that redirection is,
32:16
is the preferred way to do this. There's, there's a, there's a
32:20
lot of reasons for that, you know, it a, if you think that a
32:23
think of it, as a really sort of Base philosophical level, You're
32:27
not, you know, when you, when you redirect your not
32:30
necessarily sending data between two security domains, right?
32:33
You're redirecting. The browser, the office Kirk is
32:36
carried out and then you're redirecting back to the to the
32:40
original location that you were at universes embedding
32:44
embedding, you know, sort of log in you.
32:48
I within a within a portal your you have to collect the
32:53
information like username and password and pass it, you know,
32:56
over to whatever your Authentication solution is so
32:59
there's, you know, quite simply more attack surface there than
33:03
you have in in the, in the redirection.
33:07
You know, in the redirection method, another reason is that,
33:11
you know, we would favor redirection is that, you know,
33:15
ux or customer Journey changes can be easily made with
33:18
configuration rather than requiring code changes within
33:22
your, in your web app, right? You, if you change, if you
33:26
change flow, Within a web app yet you probably are changing
33:29
code within your web app. If you change flow within a
33:32
solution that you can redirect to you, you may be able to do it
33:36
and with configuration only, right?
33:37
So it's a very quick change versus something that you have
33:40
to involve your engineering teams with and then you know, we
33:46
favor oid see, you know it's it's just more modern, right?
33:50
It's based on rest apis uses Json, you know as the payloads
33:54
typically it's more lightweight, you know, Sam olens.
33:57
Is is old. Its twin almost I guess almost
34:00
20 years old. Now it's XML.
34:02
It's very heavy. You know, ATC takes things like
34:06
data privacy. Very seriously.
34:08
You know like consent handling is built into the is built into
34:12
the protocol so we we do kind of have to progress Jing Li support
34:17
sam'l for, for legacy reasons and will for a long time.
34:20
But I wouldn't advise anyone, you know, in this day and age to
34:24
build a net, new app on Top of sam'l know.
34:28
That's, that's kind of my personal to sense their.
34:31
I think we've been saying that sandals is like the passwords
34:34
then dying not quite as long as the password.
34:36
But yeah, I think it's gonna be around for a while.
34:40
Unfortunately. I think I'm trying to memorize.
34:42
It was Ian Glaser from Salesforce, I think that that
34:45
kind of talk about that we had him on the show while back and
34:49
that was back in. We record with him in December
34:51
of last year 2020. I think the show went live
34:54
January 2021 and as far as I checked, Samuel his As has not
34:58
died any further, is it son? Passwords haven't died yet
35:02
either, but I hope the password eyes before Samuel.
35:05
Yeah. No, Sam was going to be around
35:06
for a long time. I'm afraid to say, well, you
35:09
know, problem is, if people aren't if people keep using it,
35:11
it's going to stick around. Right.
35:12
So what point do you start to re-architect on these old apps
35:15
is it on the apps or end of life?
35:16
Is it when something new shinier comes along to replace it?
35:19
You know, what is it? It's just I think it's just the
35:21
nature of of applications and how they're built.
35:25
I want to Pivot the Because I want to make sure I leave some
35:28
time to talk about something that I personally like to watch
35:33
and enjoy. And, and it relates a little bit
35:36
to customer. I am in a way that I'd like to
35:40
understand who is your favorite twitch streamer and why is it
35:44
you? Oh, well yeah, why is it me?
35:48
I mean, I I follow a lot of, I follow a lot of OverWatch
35:53
OverWatch streamers, and it's kind of a kind of my favorite PC
35:56
game. I follow the OverWatch league
35:59
and and there's there's quite a few like, you know, professional
36:02
players that scream often on Twitch.
36:04
So there's a, I follow a bunch of them.
36:06
That's, that's really my, my probably the most of the time
36:11
that I spend on Twitches doing that.
36:13
Yeah, I definitely I've done a little bit of streaming here
36:17
inerrant, which myself, definitely not anything that I
36:20
do if any sort of regularity and it's usually the same two games,
36:23
it's either World of Warcraft or week of Legends.
36:26
So, we to games like a Is that we will play despite the
36:29
toxicity. I think of sometimes of either
36:32
of those folks but Jim I think wasn't your son looking at being
36:36
a streamer at some point. Yeah.
36:37
Both my boys, give it a shot for a little bit and they had some
36:41
followers and people made donations to them which seemed
36:45
to really weird to me as like, you know, almost like lesson
36:49
guide only giving you money while he was the last time you
36:54
got a donation for this chef and we don't ask for him.
36:57
It's fine. Yeah, all right asking for the
36:59
now but I just I thought it was weird.
37:03
I don't know. I don't look, there's just in
37:05
some things. They don't get and that's one of
37:08
them get off at Jim's Lawn. I think is what he's trying to
37:10
say and I kind of think you're right.
37:14
I do watch. I like the idea of twitch and
37:17
and what it brings. I think it adds a social aspect
37:20
to gaming, that used to be there with couch Co-op.
37:23
That doesn't necessarily exist anymore.
37:25
You still have multiplayer. Online games.
37:27
And obviously, you know, I have a long history of World of
37:30
Warcraft. I used to be at a rating gold.
37:32
So I have, you know, I was definitely nerd out on that for
37:35
a long time, definitely much more casual now.
37:36
But when I see services like that, I also look at I was like,
37:41
oh, that looks like an interesting game rather than me
37:43
go in and spending 60 $70 on the game.
37:45
I'm gonna go watch someone play it and see if it makes sense,
37:47
right. It's almost like it's almost
37:49
like a demo without any fee for it.
37:51
And sometimes these streamers are can be relatively
37:55
interesting and actually hold a conversation and it's it's not
37:57
just, you know, I think probably maybe what some people might be
38:00
expecting. If they're not familiar with it
38:01
is just like you're watching someone else.
38:03
Play a game. Why is that interesting I guess?
38:05
Stephen tutor back to you is like, okay, so I'm watching
38:08
someone play a game. Why is that interesting?
38:10
Stephen so when I decide when I discussed this with the, you
38:15
know, with the get off my lawn crew.
38:18
I I kind of I kind of say well do you do you watch sports on
38:24
TV? Do you watch football on TV or
38:25
what? Why are you Catching the
38:27
football player on TV rather than playing football yourself,
38:30
right? It's a similar analogy.
38:32
I mean, that's that, that's the that's what that's what Gamers
38:37
want to do. Is they want they want to watch
38:38
other Gamers of play, you know. And it's it's there's a lot of
38:42
different reasons you mentioned is a good, a good, a good
38:45
reason. Definitely is like, oh, I'm
38:46
interested in buying this game. I want to go check it out, see
38:49
what people are doing with it. See if it kind of fits what I
38:51
like to do. Another reason is people use it
38:56
to get better. Right?
38:57
So like, I watch OverWatch streamers because I learn all
39:00
the horrible mistakes that I make when I play, right?
39:03
And I see what the professionals are doing when they, when they
39:06
play. And I go, I can't, I can, I can
39:07
incorporate that into my game, right?
39:09
You know, this is sorts kind of a, it's kind of a learning
39:12
experience as well, right? So, yeah, I think another thing
39:16
that I saw, so this wasn't twitch.
39:19
It was YouTube. I believe my kids kind of made
39:24
their entry into video games with Minecraft and People who do
39:27
Minecraft videos first off its, I don't know.
39:30
It's under the price, not a very high fast-paced game.
39:34
So the folks who would stream their videos were like
39:38
entertaining, right there are they're trying to make like a
39:41
fun story and they made it sound like they're having so much fun
39:44
playing the game. And I think that was really what
39:49
drew the kids into it in the first place.
39:52
Yeah, yeah and there's a personal connection thing to you
39:54
there, too. Because I mean, you can, you can
39:56
you can talk To The Gamers and on Twitch.
39:59
And, and if you if you really like a, you know, a streamer, if
40:02
you really like a professional gamer and like, they might
40:04
actually reply to you right like them.
40:05
And actually I call you out. And that's I mean, that's pretty
40:08
cool. Especially for I think
40:10
especially for younger folks. They're like wow, you know, the
40:12
my favorite streamer does actually talk to me, you know.
40:14
That's, that's pretty cool. Yeah.
40:17
We get that all the time with the podcast, you know, I'm sure,
40:19
yeah, autograph sessions, all that kind of stuff.
40:22
So, you know, we get it totally. Alright.
40:25
So, you know, at the end, Day. Here's, I'm going to type back
40:29
to Identity and, which is, especially when you mentioned,
40:33
you know, getting better and watch how the pros do it.
40:35
And OverWatch, for example, it's all about owning noobs, right,
40:39
making sure that you're a step ahead of the game, whether it's
40:42
on, OverWatch, or people who try to break your see, I'm system.
40:47
Whatever it is. You want to make sure that you
40:49
own the noobs. Would that be fair?
40:50
Stephen, I would say, I would say the analogy is if I want to
40:53
own the noobs, I want to I want to own the the script kiddies
40:56
that There that are trying to attack your, your your portal,
41:00
right? Yeah, those are the noobs and in
41:02
my in my view. Yeah I kind of we had this
41:07
conversation that's with that same guests.
41:10
Roger talking about hacking MFA. It was like even if you had the
41:14
worst MFA that's going to block a bunch of their script kiddies
41:19
because you know, it takes kind of next level versus just going
41:23
to the dark web downloading a password file.
41:27
And trying all the passwords, exactly what Kleenex is still
41:30
better than no Kleenex. I guess Stephen.
41:35
You've been very generous with your time.
41:36
But before we go, I'd like to just kind of give it an
41:39
opportunity for each of you can to kind of I guess we've any
41:43
Pearls of Wisdom advice for folks who are looking at Sea.
41:47
I am as part of their their strategy that they're looking to
41:50
address. What are some things that you
41:52
hope people took away from this conversation?
41:54
Steven. I think I think he I think you
41:56
started the conversation and exactly the right way.
41:59
It's kind of fun. It's kind of understanding the
42:03
nature of the difference between traditional I am and customer
42:08
identity and making sure that you're you're kind of thinking
42:11
through that decision process of what you're going to do when you
42:16
go to undertake your first, you know, see, I Am project and
42:21
understanding that decision process, understanding the
42:23
trade-offs, understanding those differences that, You know, that
42:27
we that we talked through and and making sure that you're
42:30
making the right, you know, purchase decision or build
42:33
decision or by decision, right? I think that's really the, the
42:37
words of wisdom, I would want to leave with Jim.
42:39
How about yourself, my parole was some kind of ties back to
42:42
the episode. We did with Martin Cooper and
42:44
grow. You know, the analyst firms, put
42:48
out analysis of a space, like, see, I am and include the major
42:55
vendors and some vendors don't. Even make it into that field.
42:59
Doesn't mean if they're not in that in that analysts report
43:03
that they don't have Merit and just because they are on that
43:07
answer for. Maybe they're the the furthest
43:09
up to the right doesn't mean they're right for you.
43:12
And I think, you know, Justin having done the amount of
43:16
research that I've done. It was tribe acity.
43:19
It's it. There's a lot there that
43:21
interests me and I think that, you know, I just wanted to the
43:27
opportunity to say don't kind of rate vendors off just because
43:31
they don't fit into the analyst report where you expect them to,
43:35
you know, the at the I think what it's worth doing is like,
43:42
including some vendors who wouldn't normally expect to win
43:48
three of them into your RFP, or your POC process because the
43:52
other thing that happens is our vendors who you know, middle of
43:57
the pack or less and three years later that the far upper, right?
44:01
There's others who are the four upper, right?
44:04
Who get Acquired and then they just drop off the page then you
44:08
know, three to five years. So keep those things in mind
44:12
that's kind of my role was Demers.
44:16
What I'm sitting here thinking about, I think we've mentioned
44:18
this before, you know, and I'll supports are great, they should
44:20
be a data point to take as part of the decision but they should
44:23
not be the decision and unfortunately I still see a lot
44:26
of companies out there. That you know they only look at
44:28
Gartner and if it's not on Gartner we don't care.
44:30
They're missing out on a lot of stuff and they're probably you
44:33
know paying a lot of money for things, they don't need all you
44:35
know sets of things. So my recommendation would be
44:37
you know if this if you're looking to solve a particular
44:40
solution or specific area should say is talk with people who have
44:44
already solved, it talk with people in the space.
44:46
Get out there and talk with other people.
44:48
In the I am World groups like ID Pro, which have fantastic select
44:52
Channel where you can ask questions like this, you know,
44:55
ask questions out there because Cuz, you know, the you don't
44:58
want to be, you have, you know, you want to have more data
45:01
points to have a better decision.
45:03
And what's right for your organization versus just taking
45:07
the word of Gartner, or cumin or coal or forest or any other, you
45:12
know, and these kind of analyst firms.
45:13
So, all right, so I think that's enough soap box.
45:16
At least it was for me on that topic.
45:19
Well go ahead and call it for this week in the show notes will
45:22
have a link for folks who want to connect with Stephen on
45:25
LinkedIn. People could also Learn more
45:27
about serve acity at St. R IV, AC ity.com.
45:33
Stir a city like said, show notes.
45:36
Link will be in the show notes and we'll also have a couple
45:38
links to some of the blog articles that we mentioned.
45:41
As part of the conversation here around differences between
45:43
Enterprise. I am customer, I am trade-offs
45:47
for versus open source, things like that.
45:50
So be a wealth of knowledge that people can check out there.
45:53
All right, so I think we'll call it Stephen.
45:55
Thank you so much for your time. Jim, thank you so much for your
45:58
time and we'll talk with everyone in the next one.
46:04
Thanks for listening to the identity at the center podcast.
46:07
If you like what you heard, don't forget to subscribe and
46:09
visit us on the web and identity at the center.com.