Latest / Identity at the Center / #407 - Sponsor Spotlight - Rubrik

Transcript

#407 - Sponsor Spotlight - Rubrik · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey.
0:13
Jeff, how are you? Oh.
0:14
Not so bad yourself. Doing great.
0:16
I'm really excited about today's episode.
0:19
Obviously met our guest previously.
0:22
He's somebody who's not only an expert in the field, but also a
0:26
genuinely good guy. Somebody had definitely like to
0:29
have an identity beer with at some point.
0:31
Well. There's going to be
0:32
opportunities for identity beers coming up in a couple different
0:34
conferences. I like him just because they
0:36
said he listened to the show. I'm I'm extremely easy to
0:39
please. And so the fact that he was, you
0:41
know, like, yeah, have have you heard the show?
0:43
It's like, yeah, I've heard it. So I'm like, all right, good,
0:44
we're good then. But yeah, today we've got a
0:46
sponsor spotlight episode. We're going to be talking with a
0:49
rubric. So just to make it clear, right,
0:51
this is sponsored episode. They are the reason that we can
0:54
do this podcast. So their support, you know, it
0:56
means a lot to us to be able to continue to do this every week
0:59
that we do. You can find out more about them
1:02
and on the web rubric.com/I DAC. That's rubrik.com/I DAC and let
1:09
me go ahead and introduce Drew Russell.
1:11
He is the identity resilience platform owner for Rubric.
1:14
So for some reason I find that difficult to say, but welcome to
1:17
the show, Drew. Yeah, great to be here, Jim.
1:20
I will definitely take you up on the beer, Jeff.
1:22
I'll keep listening to the episodes.
1:25
We're easy to please, you know, it doesn't take much.
1:28
Hopefully we see each other conference, you know, coming up,
1:30
you know, we got a few coming up like Identiverse and, you know,
1:32
Gartner and EIC and a bunch of different opportunities.
1:36
But let's start with your background.
1:38
First thing we always ask, you know, folks who've been with us
1:41
for the first time is how they got into identity.
1:43
So is it something that you chose or did it choose you?
1:46
It definitely chose me. I can still distinctly remember
1:51
years ago at this point, we bought, we bought a DSPM company
1:54
called Laminar. So data security posture
1:57
management. And we were kind of in the early
1:58
stages of investigation of do we go down this path?
2:01
And I, I still remember seeing kind of the road map from his
2:04
name's Amit. He was the, the Co founder and
2:06
it was all about data access and governments.
2:09
So who has access to what and what are they doing?
2:11
And like, to me, that was the the mind blowing moment of like,
2:15
oh, I fully understand the value of prop.
2:17
And since then I haven't been been able to get away from
2:19
identity. It's my my day-to-day, every
2:23
every day, even weekends at this point.
2:25
So it definitely found me. So how far back was that?
2:28
How many years? Let's put the rings on the tree
2:30
like. We were talking about at the
2:31
beginning, it's day by day at this point.
2:33
So you really put me on the on the hot seat here.
2:37
I'd say maybe 3 or 4 years ago. So it's still probably
2:39
relatively new in the grand scheme of things, but it's been,
2:42
it's been a wild ride since. Well, that's good.
2:44
We're always happy to have, you know, people industry.
2:46
My favorite thing about I am is the community.
2:49
So there's a lot of, you know, really fun, smart, just good
2:52
people in this and you know, you're definitely one of those.
2:54
I'd like to find out more about rubric though, because that's
2:56
why we're here. Tell me a little bit about
2:59
rubric and then, you know, the jaded Cecil question will be OK,
3:04
lots of tools. What is it that you think makes
3:06
rubric, you know, set apart itself from others and that
3:09
might be doing similar things? Yeah, I feel like we could spend
3:12
all hour of the episode just on that one question.
3:14
So let's see how how quickly I can do it.
3:16
Rubric restart. It was a better faster backup
3:20
company. That was our claim the same day
3:22
one, what originally actually attracted me to the platform was
3:25
AP is at the time it was every every action you could take in
3:28
the UI had an underlying API. That was my my jam back in the
3:32
day. So I'm like, I'm all in on
3:33
rubric. Since then we started focusing
3:36
around this concept of cyber resilience.
3:38
If you're hit by rain somewhere, what does it actually take to
3:41
bring back your environment? And there there's a fundamental
3:43
difference between your your old school backup recovery and how
3:47
do I bring back the environment in the worst case scenario.
3:49
And a couple years ago, we released a pretty basic identity
3:55
support module as part of the platform and it just picked up
3:58
almost overnight. No marketing, no focus from a
4:01
sales perspective. And we took a step back and
4:03
said, what what's happening here?
4:04
And been living a wild ride since then.
4:06
So if to answer your question, why rubric if compromise of your
4:12
identity system, if any instant response is something top of
4:16
mind like rubric is where do you want to go down to our bread and
4:19
butter is those worst case scenarios And how do I help you
4:21
make it a non event as part of your your normal day-to-day.
4:25
Grab a coffee, hit the big red green button, bring things back
4:27
up running. That's our jam.
4:29
It's almost kind of like you're the product that nobody really
4:31
wants to have, but needs to have.
4:34
Yeah, that's very true. I I love with my customers,
4:38
never have to use me, especially for those worst case scenarios.
4:42
A lot of what we do is on the proactive side as well.
4:45
You're in real time alerting what's going on in the ecosystem
4:48
is gym compromised at the end of the day.
4:50
Like the reason why you've been by rubric, though, is that worst
4:53
case scenario, that's something that keep everybody up at night.
4:55
So I got to ask the the name rubric for the company.
4:58
Do you know how that originated? I'm sure there's a couple of
5:01
people who are OG's at the company who are going to make
5:03
fun of me. But you know, I came in, I think
5:05
it's like employee 400. So quite a few people before me.
5:07
But the story I always heard was First off, I know original name
5:11
was scale Data and we had like an employee contest to say what
5:14
is our new name? From what they told me, Rubric
5:17
is some kind of Scandinavian name that means like next
5:20
generation game changer, like that directional vibe.
5:23
So that was our kind of our mantra, like how do we change
5:26
the industry? How do we change the game?
5:27
So that's my understanding if I ever came to be from a name
5:30
perspective at least. You know, we like to put things
5:33
in buckets. That's just kind of what we do.
5:35
And we've got lots of different I am buckets, right?
5:39
IGA, Pam, we've got new ones like I, I zip, there's ISPM,
5:45
there's ITDR. You know, there's probably a
5:47
bunch of resilience I haven't thought about.
5:49
Like is, are there traditional categories that rubric fits
5:52
into? Does it stretch across maybe a
5:54
couple depending on maybe like capabilities, Like give me some,
5:57
some, some idea of kind of like if I'm trying to
6:00
compartmentalize, where does this fit?
6:03
Where does it fit? I mean, I think the beauty of
6:04
IVIP is that includes everything.
6:06
So I'll go with that as my default answer because it's so
6:09
broad. I mean ISPMITDR to me they're
6:12
like the real answer is the reason why Rubric has been so
6:16
successful is there wasn't like a clean bucket for us to fit
6:19
into. Like what I've seen is, you
6:21
know, all the lessons learned Rubric had on the data side of
6:23
the house in terms of recovering in an actual into response.
6:26
Like that was a market we created.
6:28
To me the identity industry is just getting towards that.
6:32
So things that kind of call it the core Data side rubric take
6:35
for granted. People in the identity space are
6:37
just kind of wrapping the hedge around probably from like a need
6:39
perspective. So I'd never really thought of
6:42
us as like a clean category of hey, I have this tool set, I can
6:45
replace rubric or I need to add towards it.
6:47
A lot of feels like a lot of my day-to-day is like education
6:50
around this stuff. Like what does it actually need
6:52
to recover in these worst case scenarios?
6:54
So, you know, pick your Gartner buzzword like we talked about,
6:56
IVIP, ISPMITDR, like it's all piece of the puzzle, but for me
7:01
it's all about how do I tie those together in a way that's
7:04
not fragmented and then allows me to actually recover in these
7:07
worst case scenarios. That's a great way to think
7:09
about it. So employee number 400, you guys
7:13
are a big company. How many clients do you have?
7:16
7000, something like that. We're definitely up there from a
7:19
number count perspective and it grows every day.
7:21
At this point it feels like, you know, at the end of day, I'm on
7:24
the sales side of the house and it feels like my calendar is 12
7:27
hours a day of customer meetings.
7:28
So it's a crazy time out there, massive growth across the board
7:32
and thankfully we got some pretty cool customers where I
7:34
get to have these type of conversations day in and day out
7:37
with them. Oh yeah, now that you're on
7:38
their Identity at the Center podcast, watch that number just
7:41
jump to the moon but skyrocket overnight.
7:46
No, but for your identity line of products and what is the main
7:51
use? You kind of teased it a little
7:54
bit. What are the the main use cases
7:56
you'd say you'd focus on? I mean, without exception
8:00
twofold. So think of it as post incident
8:04
Jeff, I'll pick a new time. This time Jeff's user account
8:06
has been compromised. What does that look like?
8:08
And to me there there's two possible paths as part of the
8:11
workflow. So like absolutely worst case
8:12
scenario, they go after your your ID.
8:15
PS You know, AD is always the easy example here because all of
8:17
the kind of inherent flaws with Windows.
8:19
So, you know, pick your attack of the day like Marks and
8:22
Spencer, they go after AD, they encrypt a server.
8:24
What do you do? How do I bring back my
8:26
ecosystem? So a big, big piece for us to
8:29
kind of what original play in the fame is like how do I handle
8:31
those workflows? So as we take a take a backup is
8:35
the simplest way to think about it of your your domain
8:37
controllers, I'm going to proactively stain it for the
8:39
molar. We actually integrate with
8:41
mandate. And so if anyone in the call or
8:43
podcaster say doesn't know mandate, like leading incident
8:46
response organization across the globe.
8:47
So I will look at your domain controllers for indicators to
8:50
compromise. You know, I saw Jim on the
8:52
system getting ready to deploy ransomware.
8:54
How do I detect this and find the threats?
8:56
And really the main goal there is how do I find a clean
8:58
recovery point? It's a, you know, you get into a
9:01
Groundhog Day situation where I restore my drain controllers,
9:04
spoiler your rains and we're still on it.
9:06
It gets redeployed and you're kind of stuck back at that that
9:08
day zero situation. So how do I help that?
9:10
And then more importantly, like, how do I guarantee it?
9:12
How do I give your teams confidence with that over like
9:15
the last couple years? Really what I've seen is more
9:18
importantly like people are starting to think about like
9:21
ADFR, maybe entry ID, recovery, Octa, whatever it is, it's not
9:25
just about those worst case scenarios or ransomeries.
9:27
It's like how do I kick out Jeff itself if his user account is
9:30
compromised? How do I move that persistence?
9:33
And I think ADFR is like the classic tool for that, where
9:36
everybody has it. 99% of the people I I talked with still
9:39
have ADFR. As much as Microsoft is, is
9:42
going to tell you differently. It's not going away.
9:44
But nobody ever wants to go down that process because it's such a
9:46
pain. But now with different folks out
9:49
there, we've made it easy. And to me, it's like the nuclear
9:51
option where it's a pain to find if Jeff is compromised.
9:55
And really more importantly, what did he do with those
9:56
compromised events? It's going to take forever to
9:58
find that. So kick off the ADFR, remove the
10:01
persistence, get things back to a no good state and get
10:04
operational. So it's all about that instant
10:06
response. It's just a matter of what was
10:08
done and what was the the path you're going to take as part of
10:10
those workflows. Is it fair to call that first
10:12
use case the malware use case? Is it malware?
10:16
Because it sounds to me like Rubric helps you identify and
10:20
remove the malware. Yeah, 100%.
10:22
And we have, I mean great way to describe it.
10:25
There's a proactive side of that and called a reactive side.
10:28
So the proactive side is that mandate integration, I think
10:30
it's it's 1,000,000 plus indicators compromise.
10:32
It's going to say, hey, this known tool used by the threat
10:36
group is on your domain controller.
10:37
Something bad is about to happen.
10:39
And the key piece with that is like we do it on an offline copy
10:42
of data. It's like I don't want to put
10:43
any CPU pressure on your system, but we're also kind of realistic
10:47
that we're going to miss something like if anybody ever
10:49
tells you you're going to be perfect in this space, like 1.
10:51
They're a great sales guy, but probably more important that
10:54
they're lying. We all know the instant
10:56
responses like do Google, we can find how how how customers get
11:00
hit. So big forces is what we call
11:02
threat hunting. So how do I go out and take a
11:04
known, known indicator compromise?
11:07
You know, you're bringing the maintenance, the Palo Alto, the
11:09
Googles of the world and say like this is what happened.
11:11
Here's the concrete thing that that occurred in your
11:13
environment. Look at a copy of your domain
11:15
controllers and find out. So I will scan all my historical
11:18
record of your data. So say I have like 100 days of a
11:22
backup in the environment, I'll scan all 100 days and say, hey,
11:25
day 33 is when I saw that range were introduced in your
11:28
environment. So day 34 is your known good
11:30
clean recovery point. So it's kind of two birds, one
11:33
stone, but it gives you the ability to find that that mall
11:36
where it ecosystem whether or not it's deployed or not, I
11:38
still want to identify that for you.
11:40
Yeah. I'm wondering with how you
11:41
describe that, is this safe to assume that someone needs to an
11:45
organization needs to be running rubric before the incident or
11:50
OK, you're shaking your head yes?
11:53
Yeah, 100 a 100%, you know, by its nature, like kind of our our
11:57
secret sauce in the covers and we can always dive deep into it
11:59
when it makes sense is our underlying bunker in a box.
12:02
It's kind of our our physical appliance deployed in your
12:05
ecosystem without that like all the magic kind of leaves the
12:08
system. So having that bunker in a box,
12:10
physical hardware for the on Prem role like it's a key piece
12:13
of the the equation here. Yeah, Bunker and a pie.
12:15
I like that. It kind of reminds me of like,
12:17
you know, if you're setting up for the apocalypse scenario, you
12:21
have to put the the dry food in the canned food away before the
12:26
apocalypse happens. Folks, you can't wait until the
12:29
zombies are at your door. Now I want to pick up something
12:33
else you said. So you talked about that
12:36
proactive use case. So it sounds like Rubric will
12:40
help you identify and prevent the attacker or the attack.
12:45
The easy attack pass. Is that right?
12:47
Yeah, Yeah. I'd really like we said around
12:49
like the easiest attack pass as well.
12:51
So you know Jeff to your question earlier, like you see a
12:53
lot of ISPN components of the platform and to me like the
12:56
biggest value of that, that Gartner world I call it isn't
13:00
necessarily to stop the threat on itself like a course we want
13:02
to minimize that attack surface. But also realistically, you
13:06
know, some ways going to vish into the ecosystem and just log
13:08
in and nothing you can do from ISPN for if there's going to is
13:11
going to prevent that. So for me that the value of like
13:14
this posture management conversation is how do I make
13:16
the attacks more noisy? So if Jim or Jeff had their
13:20
account compromise, like I want you to take the more difficult
13:22
path that way your upstream tools like the crowd strikes the
13:25
Microsoft the defender world are going to be like flashing red
13:28
lights. Something unusual is going on in
13:29
your environment. So get rid of that low hanging
13:31
fruit, make it more difficult for the threat actors.
13:34
So all of your your goodness that you've invested from a
13:36
security perspective says this is what's going on and gives you
13:39
the ability to start that instant response process.
13:42
It almost. Feels to me I wanted to see if
13:44
this resonates with you, but doing some kind of ISPN like
13:49
functionality. Identifying the easy routes in
13:52
is probably the most important thing you can do because even
13:56
though you see a lot of the attacks are based on social
14:00
engineering and things like that.
14:02
Now with AI, you know, I'm hearing about this idea of like
14:06
swarms of AI agents and what if someone let's lose a swarm of AI
14:12
agents to attack your organization?
14:14
They're just scanning your environment looking for the easy
14:17
routes in right? I love it.
14:19
It didn't take us long to bring up my favorite buzzword, the
14:22
day. AIII love this conversation so
14:25
much. I mean, I think you did on the
14:26
hedge and where you have the the what I've seen time and time
14:31
again, the threat isn't necessarily like, how do I get
14:33
in? It's like, what do they do
14:33
afterwards? Like if I could just deploy 100
14:36
of myself and attack your environment and find those easy
14:38
paths like a course like that would find the low hanging
14:40
fruit. So if I can plug those up, like
14:43
the better off we'll be. And and you know, if we had the
14:45
same conversation in a couple years from now when we see it
14:47
more in the wild, that's probably going to be a a pretty
14:50
good prophecy, I'll call it that.
14:52
You just called out there, Jim. Yeah, yeah, it was definitely an
14:55
important use case. The I'll call it.
14:59
The last thing I heard you talk about was kind of this risk
15:03
reward, how long does it take to get back up and running?
15:07
So it sounds like that's part of the value proposition well as
15:11
well, which is that rubric helps you get back up and running
15:15
quickly after a breach. 100% I mean, at the end of the day,
15:19
like that is our biggest value prop.
15:21
There's there's a good case study that was with a bank over
15:25
in Taiwan. I actually read it in one of the
15:28
the books that got published by the sea.
15:29
So I had to look it up. But he was talking about how it
15:32
took him six weeks to rebuild their AD post attack in this
15:37
case, like they weren't actually copper like there was no malware
15:39
deployed. It was more of what happened.
15:42
How do I rebuild my environment? But they they went through and
15:45
said like I need to scan this. I need to look for the more
15:47
because the threat group they identified with the Mannings of
15:50
the world, like they knew this was a pattern they're going to
15:52
go after. So they had to go through and
15:55
like restored since yesterday, put into an icedent recovery
15:57
environment, scan it, rinse and repeat.
16:00
Do that over the six week time period.
16:02
So to us, it's like I want to have that done proactively.
16:05
I want to have that done automatically as part of the
16:07
process to where you're not waiting six weeks.
16:10
Within two hours, I'll give you a clean copy of your IDP up and
16:14
running. Your users can start logging in
16:16
and you can be confident that there's no malware going to use
16:18
part of the system. So probably, probably even more
16:21
importantly, Jim is like, how do I make sure that even happens in
16:24
the 1st place? That goes back to the bunker in
16:26
the box conversation. Yeah, I mean, you talked about
16:29
the nuclear option. And as you're talking about
16:31
that, I'm thinking to myself, what if you didn't have
16:34
something like Rubric, right, and you had someone come in and
16:38
attack, what would you do? Restore from where you
16:42
reasonably think you're confident that you were not, you
16:46
know, pre pre breach, restore from that and then try to
16:50
restore everything since like manually like what does that
16:54
look like? Not fun is what it looks like.
16:57
I we, we often talk with our customers about this and my, my
17:02
favorite quote to this and I've heard it multiple times.
17:04
I was, do you mean before or after I get out of feeder
17:07
position? Like that's the pain point
17:08
customers want to go through. The state of Nevada actually
17:12
published a good case study around this as well.
17:14
They got hit. It was probably a couple of
17:15
months ago at this point. They had to bring in Microsoft
17:18
to help with the equation. I think it was like 400,000 plus
17:21
in Microsoft charges that they had to go through and harden the
17:25
system. Jim, to your point, put in some
17:27
some ISPN type of controls, but then also do a three and rebuild
17:30
your environment. So 400,000 is not cheap in any
17:33
any conversation. And if I remember correctly, it
17:35
took like 30 days to get everything back to a known good
17:37
state. So painful process no matter how
17:39
you look at it. And that's just the cost of the
17:41
IT fix and probably not even the full fix, right?
17:44
The everything else that goes along with it, right?
17:46
All the customer stuff you have to do, or internal business
17:49
services or reputation, like it's way cheaper just to get an
17:54
insurance policy in place than to actually try to restore.
17:57
That's the easy metric to measure, right?
17:58
It's all the other things behind it that really bubbles up, like
18:01
the pain around what these actually look like.
18:03
Reworld. I want to put my jaded Cecil hat
18:05
back on because you said, you know, get back up and running
18:10
and kind of restore. And I want to be clear.
18:12
What does that mean? So when you say yes, we're back
18:14
up and running, like what is Rubric specifically going to
18:16
help me, you know, recover from an incident?
18:20
Is it the Active Directory? Is it more than that?
18:23
Help me understand. Like where you are and aren't
18:26
helping. Just so I can be clear on that.
18:27
The thing I love the most around the, the IVIP concept is that it
18:31
really takes in like the biggest problem I see in the identity
18:33
spaces. Everything's so fragmented.
18:35
Like it could be different, different conversations with our
18:37
platform where I'll talk like the five or six different teams
18:40
and depending on the politics, It's it's a mess.
18:43
It's like the way we, we approach this is how do I have
18:45
like this unified platform that expands across your ID.
18:48
PS And in today's world, that's for us, Active Directory, Okta
18:52
and enter ID. So the way we think about this
18:54
is you don't have these three separate ID.
18:57
PS You have your identity system and I have to treat them equally
19:00
as part of your platform. So I want to give you the
19:02
ability to manage, protect and restore all three of those and
19:06
different areas we're expanding to obviously, like, how do I
19:09
bring those back as part of those worst case scenarios?
19:12
And like the simplest, simplest form is within that two hours,
19:15
how can I have my first users or system authenticating it?
19:17
So your Tier 0 users, your Tier 0 applications, you're going to
19:21
have to go through and, and build that back as part of those
19:24
workflows. But it's definitely not the end
19:26
all be all. Like that's the starting point
19:27
of the conversation. And a lot of we, what we want to
19:30
do is that post restore, like, how do I bring back all the
19:34
changes that were lost? You know, the, the example Jim
19:36
and I were talking about as part of the conversations here was
19:39
talking with the CSO to where his plan was to go back 180 days
19:43
in the path. And Jim, like very, very truly
19:45
said, what do you do then like that's 180 days of changes part
19:50
of your environment, Like that's not a fun process.
19:52
So a lot of what we have in place is how do I monitor that
19:55
real time activity? What's going on in your system
19:57
day in and day out? That way I have that that
20:00
authoritative log of what's changed, I'll bring those back
20:03
on top of the workflows. That way you're not having this
20:05
secondary disaster after you go down the security workflow.
20:08
So I want to ask some questions around sort of the, the malware
20:11
and proactive side of things, but let's stick with restore
20:15
restorative use cases for right now since we're already talking
20:17
about it. You, you mentioned earlier and
20:20
just now again, like being able to go back in time and sort of,
20:24
you know, what is the last known good backup, right, of whatever
20:27
state it was that the IDP was in.
20:29
Can you talk a little bit more about how exactly that works?
20:32
Because is it, is it my simple brain is like, OK, like how many
20:36
backups do you keep? Is 33 days good enough?
20:40
Is, you know, 6080? And then what if I have, you
20:43
know, 180 days of backup? Like how do I know which is the
20:46
right one to restore from? Yeah, I think unfortunately, the
20:50
real world answer to like how long you store from isn't a tech
20:53
decision, it's a legal decision. Like most of the time, that's
20:56
just making the call for you. Realistically, the biggest
20:59
recommendation I have is as long as you possibly can, because in
21:02
today's world, like you're never gonna know what that dual time
21:04
is. Like you're never gonna know how
21:05
long the thread actor was in your environment.
21:08
I think realistically, a lot of times we see the tacks happening
21:10
faster and faster. So you don't need five years of
21:13
history. Usually it's pretty quick from
21:15
an actual breach standpoint, but the longer you have, the better.
21:19
Part of that bunker in the box is US indexing your systems
21:22
automatically across the board. So kind of our secret sauce is I
21:25
have that index of your system and you know, the high levels I
21:28
basically stored in a database. What that allows me to do is
21:31
crawl all 100, a hundred, a hundred and 9200 days of your
21:36
ecosystem and say, this is when the clean recovery point is.
21:39
So if you tell us what to look for or as part of our practice
21:42
scaling, we're doing that day and out anyway.
21:44
Like I will help identify the clean recovery points.
21:46
But the other kind of piece, the puzzle there too, is that
21:49
doesn't necessarily tell you what the identity compromise is
21:51
like who was done as part of your workflow.
21:53
And to me, that's kind of why I like that nuclear term that Jim
21:56
used and hopefully I used to where it's way harder to find
22:01
that piece. You're really looking for a
22:02
needle in the haystack. A lot of the Cecil conversations
22:05
I have is you're going to rely on the maintenance the world to
22:08
tell you that both from I want to make sure I'm covered from
22:11
like a legal perspective. You want to bring in like the
22:13
experts, they'll help identify that.
22:14
But realistically, I don't think you're going to have a great
22:16
answer. And to me, that's why I love
22:18
kind of that, that nuclear approach where you can go back
22:20
further in the past, you may not have a good concrete answer,
22:24
maybe you have guideposts, but by going that nuclear option, it
22:26
takes care of everything kind of simultaneously as part of the
22:29
workflow. So that's the biggest trend I've
22:31
seen happen in the last couple years.
22:32
So I'm kind of learning about this, you know, at the same
22:34
time, probably a lot of people are listening.
22:36
You mentioned indexing and so, you know, part of the restoral
22:42
is making sure that the IDP is up and running, but there's also
22:46
all the changes that were supposed to happen between that.
22:50
Will Rubik help me sort of re effect those changes and kind of
22:53
exclude the bad actions? Yeah, so 100% like I think
22:57
that's the, to me that's kind of the the biggest challenge people
23:00
have. Like first of all, like most
23:02
folks are like you Jeff, but I'm not even thinking about that.
23:04
Like they haven't thought about what those down streams effect
23:06
are. And like the second I bring it
23:07
up to like, oh, like that's a really big problem.
23:10
So our approach is kind of two full, like first and foremost,
23:13
like how do I leverage the intelligence you have in the
23:15
platform today? You're going to have a crowd
23:16
strike, you're going to have a Microsoft defender.
23:18
It's almost universal across the board.
23:20
So how do I leverage the intelligence that that brings
23:22
into the system so I can go out and say, hey, crowd Strike only
23:25
found issues with John's account at this point in time and I'll
23:28
integrate that into our recovery workflow.
23:30
And I can basically say ignore Gen. or ignore Jeff as part of
23:33
those areas. But also realistically, like
23:35
we're all admins. Like we know what happened in
23:37
the system. Like an easy whitelist changes.
23:39
You know, if all of a sudden somebody's name change, like I
23:42
probably don't have to worry about that.
23:44
Like low level attribute restoration, Like I can go
23:46
through and kick that off and go through and do a little bit of a
23:49
methodical process. Like we don't have a magic 8
23:52
ball. It says no matter what, these
23:53
are going to be great. There's a way to kind of work
23:55
through your system and say like this is going to be good.
23:57
I'm confident in these workflows.
23:59
Probably simpler to be able to look at a dashboard of some
24:01
sort. Web interfaces say hey he's
24:03
these are low risk. We think these are OK versus
24:06
yeah, here's the here's, here's the bad actor and here's the
24:09
actions they took. Yeah, we we use, yeah, don't do
24:13
these. These are bad.
24:14
We use, we use your classic stop, stop light analogy
24:17
internally like red, green, yellow, like green, go for it.
24:20
Like we know these are going to be great.
24:21
Yellow, like put a little bit of thought into it.
24:23
Red that came from crowd strike that came from Defender.
24:25
Like they're putting up all kind of flags around this.
24:28
Like let's think about these before we bring it back from
24:30
your ecosystem. But in the day, the biggest
24:32
thing is how do I bring you back to a normal state as close as
24:36
possible as quickly as I can? Otherwise like you're spending
24:39
months and months, I think realistically.
24:41
So one of the things that attackers like to do is destroy
24:42
those backups. So if I've got something like
24:45
this in place, I guess how do you keep those backups secure?
24:49
And I guess what happens, you know, and this maybe goes back a
24:52
little bit to the malware question as well, is like, OK,
24:54
admin accounts getting compromised.
24:56
You know, Rubric probably has some sort of admin account in
24:58
this case as well, right? Yeah.
25:02
So how do you keep the backup secure and, you know, make sure
25:06
that not only is the is, is the data there, but, you know, you
25:11
are recovering from those good spots or that you actually have
25:14
the spots to recover from. They're not just gone.
25:16
Are they there to start from? Yeah, yeah, exactly right.
25:19
You know, going back to some of the other previous conversations
25:21
of like, why rubric, like what was our kind of claim to fame?
25:24
I think it's that bunk in the box concept.
25:26
And to me, you know, I could probably spend hours talking
25:29
about this, but it comes with two fundamental assumptions.
25:30
Like one, somebody's going to go after the environment, like hard
25:34
stop, they're going after rubric, like every time they're
25:36
going after rubric. And two, I also need to make the
25:39
assumption generically for anything rubric that somebody's
25:42
has full admin access to the platform.
25:44
Even more so, more so inaugural where we're talking about
25:47
identity compromise like a course.
25:49
I need to assume the rubric admin interface has been full
25:52
global admin. They can do whatever they want.
25:54
So we have different controls in place that says even though
25:57
situations you can recover from their system on the the side of
26:01
their going after rubric like key tenants.
26:03
No, no Windows, no virtualization Windows is
26:06
probably obvious, especially on the AD front.
26:08
If I can compromise, ADI can compromise my Windows based
26:11
server. It's like, let me remove that
26:12
from the equation. And then probably more
26:14
importantly, no virtualization. We see these attacks happen
26:18
constantly. So instead of having to go after
26:20
an attack, you know, call it the hundred VMS individually running
26:24
on your your V center, I'm going to go after V center itself.
26:28
I can't stall a crowd strike agent or defender agent around
26:31
that. So I don't know what's going on
26:33
at the operating system level. So if I blow that away, I'm
26:36
taking out everything simultaneously.
26:37
So it's the easy button as part of those workloads.
26:39
So I just want to remove myself from that equation altogether.
26:42
You can't access that bunker in the box like it is the perfect
26:45
analogy. And you can't log in, you can't
26:47
operate, you can't get the underlying operating system.
26:49
The only thing you can do is log into our web interface, and then
26:52
that's where we have different controls in place.
26:53
Everything from Jim logs in. I'll prevent him from deleting
26:57
the backups. So instead of putting that as an
26:59
actual thing you can do in the UI, you have to call in the
27:01
rubric. Give us a password, and we'll
27:03
make those changes for you. Or things even more simpler of
27:07
NTP attacks. You know, if you're attacking
27:09
rubric and you say rubric, it's not not today, it's a year from
27:13
now. Like that's going to say, oh,
27:14
like you told me on the key to back up for 30 days, like I'm
27:17
going to delete it because it's a year in the future.
27:18
So I have to take that into account and say if I see these
27:21
changes from a time perspective, like ignore it, like this isn't
27:24
normal, rely on our own source of truth and don't have that
27:27
part of the platform. So really what it comes down to,
27:29
to give everybody a buzzword, zero trust.
27:32
Don't assume, assume compromise, assume breach makes your
27:35
controls are in place around it. And knock on the wood, we've had
27:38
a lot of success around this. If I go to my instant response
27:41
team, they're dealing with this on a regular basis.
27:44
And you know, not only just about bunker in the box, I
27:46
always say it's a battle tested bunker in the box.
27:48
We know it works. So let me come back to the
27:51
malware and proactive side things You talked earlier about
27:56
changing behavior of attackers and not having the easy path and
28:01
sort of making them stick out more, which I find really
28:04
interesting. Can you talk about that a little
28:05
bit more detail and maybe like an example for somebody that is
28:08
looking at this and trying to understand?
28:10
It yeah. So that all goes back to that
28:11
ISPN buzzword of how do I find these low hanging fruits in the
28:15
ecosystem. So easy example would be like
28:19
you have an admin account that hasn't had a password change.
28:21
Like obviously that is something that's probably never going to
28:24
happen in ecosystem, but you'd be surprised.
28:26
Like I see all the major issues you think would never happen,
28:29
like put itself as part of those workflows.
28:31
So the way I always think about it is it's it's usually
28:34
something never major on the surface.
28:36
Like you're not doing like this major misconfiguration.
28:39
It's all these little changes eventually blown up on top of
28:41
themselves and then eventually it learns into like a security
28:44
posture risk that allows the the threader to do something.
28:46
So it's all about those low, low level issues that you'll never
28:51
think about that can balloon up like I say and go and solve it
28:53
as part of those workflows. So that probably leads them to
28:56
the proactive side of detecting things.
28:58
And I guess are you taking intelligence from some of the
29:02
other signals that might be in the environment like a crowd
29:04
strike like a Microsoft, like any of these other things and
29:07
combine that with what you're also collecting, Like how does
29:09
that work kind of work together to say that, hey, this is weird.
29:13
Yeah, so no matter what like Crowd Strike, Microsoft, us,
29:16
like we all have this real time activity feed and to me it's
29:19
such a powerful solution. It's all about what you do with
29:21
that information. Like, you all know, like the
29:23
benefits of keeping track of everything that happens day in,
29:26
day out. What do you do with that?
29:27
Crowd Strike and Microsoft will put different threats around it.
29:30
They can find the different compromise events.
29:32
Like, they're very, very good at it.
29:33
What we'll do is integrate those alerts into the platform.
29:36
So Crowd Strike will submit the rubric, Defender will submit the
29:38
rubric. And then the conversation
29:40
becomes like, how do I move that persistence?
29:42
So where they usually stop is they alert you, but you can't do
29:45
anything about revoking those access or or bringing it back to
29:48
a known good state. So we call it rewind.
29:51
So I will rewind it back to whatever the the previous state
29:54
was, remove that persistence and use the crowd strike and
29:57
defender intelligence. But what I'll also do with that
30:00
intelligence feed is do a belt and suspenders approach.
30:03
So we'll do and check on it and see what's happening.
30:06
How do I give a visibility into it?
30:07
But more importantly, it gives you that ability to bring things
30:10
back after the full force rebuild or the full IDP rebuild.
30:14
So it's that canonical log of all the changes.
30:16
And to me that's the most important piece.
30:18
So I can go back, you know, 180 days and bring back the
30:21
different identities, I'll call it because of that real time
30:26
activity tracking. And I found a lot of people buy
30:28
tools and then don't actually test them and use them,
30:31
especially in this kind of scenario.
30:32
So I'm curious, you know, what do you see typically when you
30:36
know tabletop exercises get run? Or is there ways that I can do
30:40
like what ifs or things like that where it's like how do I
30:42
make sure that this thing will work when I need it?
30:48
I promise you Jeff and I did not talk about this, but like to me,
30:51
I hate the table tops out in the industry 99.9% time here.
30:56
I did a table talk. I know what my response is and
30:59
you dig into it after 2 minutes you realize it's just scratching
31:02
the surface. So what I always recommend is
31:05
like very much go into what's next, what's next, what's next.
31:10
Like don't stop at like how do I rebuild a single piece of my
31:13
IDP? Think about all the different
31:15
workflows or think about if there is ransomware as part of
31:18
those, those those day to days. It's like so much that we
31:22
actually just created our own tabletop that we're getting
31:25
ready to push out into the fields I think next month.
31:28
So I think right after this podcast gets released, it'll be
31:30
out in the wild. But that's how much of a pain
31:32
point it is out there. How do I give folks a as much as
31:36
we can vendor agnostic view of wanting to be thinking about as
31:39
part of these day to days? We've talked a lot about how the
31:42
product works. I'm really impressed.
31:44
I definitely encourage everyone who is also impressed to go out
31:49
to therubric.com/IDC for more info.
31:54
But I did want to ask a little bit about where you guys are
31:58
going. And I will throw out the word AI
32:01
again because as you know, you have to do a shot every time I
32:03
say AI has one of the rules. But yeah, where are you?
32:09
Where are you taking those identity line of tools?
32:13
I love it. It's such a, my brain
32:15
immediately went to like 1000 different directions.
32:18
It's such a such an interesting time out in the space to me, as
32:23
much as we all joke about on these podcasts, like we're not
32:25
getting away from AI, like I personally use it day in, day
32:28
out. And a lot of the conversations
32:29
we had was like, what does that fit into the equation?
32:31
So we have a problem called the rubric agent cloud.
32:34
So that the quick high level here is that most of the time
32:37
organizations are going to use agent builders.
32:39
So think of something from like GCPAWS, like a way to stitch
32:43
together basically multiple LMS and have some kind of agenda Ki
32:46
approach. So where we focus there is like
32:49
the middle man, like how do I have rubric sit in in the middle
32:52
of it and give you the ability to govern, put different
32:55
policies in place, more point, have visibility into what's
32:59
actually happening from a agenda Ki perspective.
33:01
And at the end of the day, excuse me, an agentic AI is just
33:04
not human identity. So the more and more, as we get
33:07
better, bigger into this, this AI world, like NHIS, you're
33:10
going to be top of mind. We had a lot of conversations
33:13
like a year ago with CSO's, like, what do you guys focus on?
33:15
And NHIS were a big problem, but then like it just dropped off.
33:19
Like we didn't hear it again. And to me it's obvious in
33:21
hindsight, it's because they're all focused on agentic AI.
33:24
There's a new buzzer, but it's the same problem.
33:26
So a big, big focus for us is around that.
33:28
What does it look like? What's going on as an industry?
33:30
I think it's still pretty, pretty and new out there.
33:33
A lot of things are being figured out as we go, but it's a
33:36
big area of focus along with the the usual areas of expanding
33:40
into the IGA space, expanding into the different ID.
33:43
PS We support all that kind of good stuff.
33:45
Yeah, the genetic AI PS I think is it's pretty new, but that's
33:51
the at the same time it's moving so fast.
33:54
So you know a couple months in it starts to look a lot
33:59
different than the look three months prior.
34:01
I'm just wondering, I mean you guys are so big 7000 clients you
34:06
said is the what is what does rubric go to market to with
34:13
besides Identity and is AIA separate piece from identity or
34:18
how are you kind of integrating it into the company's offering?
34:22
The way I always think about this is kind of there's three
34:23
pillars of the rubric world. You have the classic rubric data
34:26
world where all your enterprise data, cloud, SAS on Prem, all
34:29
lands on the bunker in the box, which gives us a lot of
34:32
different cool things we can do with it.
34:34
But we also have the identity side as our, I don't want to say
34:38
secondary pillar because that makes it feel like it's the
34:40
second pillar, like behind data, like it's all tainted with it,
34:43
right? Identity is everywhere these
34:44
days. So pillar to identity.
34:46
And then we have AI more generically as our third pillar,
34:50
like a big, big focus force. Well, at the end of the day,
34:53
like what powers your AI system? It's data and identity.
34:56
So you have like this middle circle of how these interact
34:59
with each other. And a big kind of strategic goal
35:01
for us is what does that look like?
35:03
How do we keep driving these conversations?
35:04
So yes, go to market for me is 100% identity centric.
35:08
Like I don't get paid on anything on the data set house.
35:11
It's a way to think about it, but I still have those
35:14
conversations day in, day out. And we very much have teams that
35:16
work together goes from your high level strategic perspective
35:19
to like a go to market strategy of like, what does this do?
35:23
If I deploy rubric, what is the goodness I get across the board?
35:25
And reality is, AI is the pillar in almost every conversation
35:29
now. Welcome to Identity at the
35:30
center. We didn't show for the reason.
35:33
Yeah. What you've said here is
35:35
interesting and I'm curious what it takes to put this into place
35:38
realistically, right. So what does it look like from a
35:42
deployment standpoint? How long does it take to get
35:45
this set up? And sort of what are those types
35:47
of people that you're typically working with as part of a
35:48
deployment? Yeah, there's, there's 2 answers
35:51
here and it depends on what we're working with.
35:53
Like SAS think after entry ID 5 minute deployment process, like
35:56
we have a SAS offering basic, basic, give us an identity into
36:00
those systems. And we're also relatively
36:02
straightforward on premise, a little more complicated just
36:05
because it's, it's it's own beast in the on Prem world, you
36:08
have that physical bargainer box.
36:09
So work with your on Prem data center teams to deploy that
36:13
depending on the scale. Like we have customers where you
36:15
have dozens of those across the globe.
36:17
And it's really just the goal there is like, how do I have it
36:19
as close to your identity as possible?
36:20
So if you have, you know, some DC running in the US, in Europe,
36:24
EMEA, whatever it is, like we'll have it there as part of your
36:27
process. That's relatively easy.
36:29
It's just usually politics red tape to get through it.
36:32
To me, the harder part of the equation is, is how do I
36:34
actually operationalize it? How do I test it?
36:36
How do I go through and not break my ID?
36:39
PS You know, if I want to go through and do an insulated or
36:42
so an isolated recovery environment, that's always the
36:44
biggest challenge of what does that architecture look like?
36:47
How do I make sure things are in place and how do I prep for
36:49
those worst case scenarios? And probably just as a point,
36:52
like how do I tabletop those? Like I have this new solution in
36:55
place. How do I have a plan that says
36:57
when I'm, when I'm compromised, the one I'm breached?
37:00
Like what does those workflows look like?
37:01
So initial deployments relatively easy, right?
37:04
The original claim to fame or was our easy use, like it's dead
37:07
simple. You don't have to have a PhD and
37:10
identity to do this, that the harder part is always the people
37:13
and process behind it and make sure things are in place around
37:15
it. So we had so much.
37:17
So we have entire teams dedicated to that.
37:19
Like we know there's a challenge.
37:20
You have to have the insurance and outs.
37:22
How do I take all the lessons learned from customer A and
37:24
apply it to customer B and so on and so forth.
37:26
So big big piece of us is how do I operationalize it so it
37:29
doesn't become shelfware? I want to talk about the
37:30
architecture a little bit. Is it, is there like a rule of
37:33
thumb? Because I think what I heard you
37:34
say is, you know, the bunker in the box, is that an appliance
37:37
then that I set in my environment?
37:39
Is that a virtual appliance? A physical appliance either?
37:41
Like how does that typically work?
37:43
Yes, like any good answer, yes, best practice is 100% the
37:47
physical appliance like if I don't have that physical
37:49
appliance, I can't guarantee the recovery if I do a virtualized
37:53
appliance like that's when you get into the different threat
37:55
landscapes like you know, going after ESXI.
37:58
But we have it out there for a reason.
37:59
Like I as an example, we have a lot of hotel chains that we work
38:02
with and they have limited space at the edge in their hotel in
38:07
Thailand. Like there's not a great
38:09
interconnection. I have to be as local as
38:10
possible. But you also don't have a data
38:12
center there, but I can deploy a virtual machine.
38:14
So deploy the virtual machine when it makes sense.
38:17
Best practice, especially at like your hubs, your main data
38:20
center's physical clients, because you can always recover
38:22
as part of those workloads. You mentioned DCS and that's
38:24
where my thought process was going and you kind of said it at
38:27
the same time I was thinking it is, is there like a rule of
38:30
thumb like, you know, 1 backup box for each DC, 2 for
38:35
redundancy? Like what does this look like
38:36
from like a footprint standpoint?
38:37
Yeah. So our our default like bunker
38:39
in a box has redundancy built in.
38:42
So think of it as that Peach that that pizza box has multiple
38:45
compute instances on it. So that's kind of taking care of
38:47
automatically from that perspective.
38:49
So it's more of a a a scale conversation at that point.
38:52
And you know, the beauty of Active Directory, I think it's
38:54
relatively small in the grand steamer things like I'm not
38:56
transferring a lot of data with it.
38:58
It's very, very small from that perspective, but it's so it's
39:01
more of a less of a scale, less of a redundancy conversation
39:05
than it is about like how do I give you the best recovery time
39:07
if I can recover as close as possible to where it's store
39:10
like that's the overall best practice.
39:12
Is this something that you typically see, you know, your
39:15
customers do it themselves? Are they getting, you know,
39:17
services from you guys or maybe others to kind of deploy it?
39:20
Like how does that typically work?
39:21
Yeah, Most of the time it's through services.
39:23
Like we're very, very partner centric.
39:24
It's not necessarily a complex conversation.
39:27
It's more of I don't have the time to do this myself.
39:29
So we do a lot of PS engagements.
39:31
That's part of the workflow. They'll come in and you know,
39:34
everything from rack stack, cable to, you know, get you set
39:38
up and running, configure it, all that kind of good stuff.
39:40
But yeah, I mean, almost everybody's going to do APS,
39:41
especially at like an enterprise scale.
39:43
So let's take a, you know, an organization is hybrid, which a
39:47
lot are right, they've got some cloud stuff, still have an on
39:49
Prem footprint despite them trying to get off of it.
39:53
What give me a timeline and I don't I'm obviously not going to
39:56
hold you to this like every every deployment is going to be
39:58
this. But you mentioned, you know, the
40:00
clouds quick, right, It's API based.
40:02
But the reality is when you start talking about putting
40:05
things in data centres and physical appliance, now you
40:08
start to get legal and security and a whole bunch of other
40:11
people kind of involved. What's a good timeline, or at
40:15
least a good rule of thumb to say, OK, you know about this
40:18
time frame to get up and running in a hybrid type environment?
40:22
The way I think about this is this somebody came to me and
40:24
said we're a month into deployment and we're still doing
40:26
it. Like to me that says we did
40:27
something wrong. So anything longer than month
40:29
like it's kind of raising red flags on my side.
40:31
But a big, big piece that is all the pre work we do a part of it.
40:34
So when we onboard new customers are getting ready to onboard new
40:38
customers say like, Hey, we know we're going to buy rubric, we're
40:40
going to the legal process, we're going through procurement,
40:42
right? Like I want to start that
40:44
planning process now. It's all about that pre work as
40:46
part of the process. And that's where that team is in
40:48
place that that I mentioned earlier, like their entire job
40:51
is to figure out what is your internal politics?
40:53
What's the red tape? How do I submit it to your
40:55
architecture review board? So like we we we dot our IS
40:59
cross our T's beforehand. And then it's just a matter of
41:01
scheduling the shipment of the hardware.
41:02
Although in today's world, bring it back to AI for your gym.
41:06
Like it's hard to get hardware like compute and memory and all
41:09
that stuff. Is that A at a a premium these
41:12
days? So there's probably going to be
41:13
a little bit delayed just from that perspective like that's the
41:16
the world we're all dealing with.
41:17
But once the hardware arrives, relatively simple to rack,
41:20
stack, get things configured, and we're also the races.
41:22
You've probably seen some curve balls through and I'm curious if
41:25
you've, what are some objections that you, maybe you've heard
41:28
from like different parts of the business where if I'm thinking
41:31
about, hey, I need to get this in place, people listening to
41:33
this are like, OK, you know, I've heard this objection.
41:36
What should they be thinking of to get ahead of to make this
41:39
successful? I think the biggest objection is
41:42
just at the the pre side of there's this kind of this
41:45
intrinsic assumption that I don't have to worry about this.
41:48
For whatever reason, identity has never really been trishly
41:50
thought about in these worst case scenarios or maybe at the
41:52
executive level, it hasn't been thought, thought about.
41:55
Thankfully, I've seen that that change like especially like the
41:59
last year and two. But like a lot of times when I
42:01
talk with customers like, yeah, I tried going down this path a
42:03
couple years ago and I couldn't get by him.
42:04
So to me, that's the biggest challenge of how do I convey
42:08
upstream like I need this, that if I don't have this, there's a
42:10
downstream risk as part of it. But from an actual deployment
42:13
standpoint, relatively straightforward, like we've done
42:16
it 7000 times. We know the insurance and outs,
42:18
we know of some of those areas with it.
42:20
It's just more of making sure we get the process in place than
42:22
anything else. I'm always looking for tips and
42:25
tricks to think ahead. Last question before we start to
42:30
wrap it up. And you know this is a question
42:34
that I think is very hard to answer.
42:35
So how do you measure something for a product that you hope you
42:40
never use? Like how do you measure success
42:43
that I'm getting what I pay for? Is it just Peace of Mind?
42:45
Is it maybe cyber security insurance premiums maybe go down
42:50
a little bit? Like what should a customer be
42:52
thinking about to help justify the investment?
42:55
From a boots on the ground perspective, to me the best way
42:57
to measure the success is the Peace of Mind.
42:59
Peace. I have countless conversations
43:02
with customers like this keeps me up at night.
43:05
I want to stop worrying about this.
43:06
So I think getting to the point where they can repeat this
43:08
workflow and say I've tested the rubric solution, I've gone
43:12
through this, I've done rear roll table tops.
43:13
Like I can test this in my environment.
43:15
So if I know worst case is going to happen, I'll click the big
43:18
red green or say big green button, go grab a coffee and I'm
43:21
I'm back up running to me. That's how I measure success.
43:24
Above and beyond that, it's more about checking off boxes at the
43:27
CSP level. Like how do I report back to the
43:29
board that I am up and running, that I'm operational, that I
43:32
have the ability to recover in these worst case scenarios and
43:35
go through and document and make sure those processes are in
43:37
place. Hopefully nobody ever has to
43:40
test that, but that's that's the true test of how do I measure
43:43
success is at those worst case scenarios.
43:46
This has been an interesting conversation.
43:48
We're going to head to a little bit of a lighter note area here
43:51
in a second, but definitely encourage people go check out
43:53
rubric.com/idac. We'll have links in our show
43:56
notes as well for people to look at.
43:57
But I, you know, I, I caught the Easter egg that you planted
44:01
earlier about, you know, rewinding it back and people may
44:06
be familiar with Rubik from a commercial that Ludacris was in
44:10
for his lyrics in the song. Yeah.
44:12
By Usher, which is a fantastic song, by the way.
44:14
So, you know, kudos to that. What can you tell me that's like
44:18
inside baseball of that whole Ludacris rubric commercial?
44:23
You know, take that, rewind it back.
44:25
Which makes a whole heck of a lot of sense in this backup
44:27
world and restoring. Yeah, my, my inside baseball is
44:31
the to talk to my my chief boxing officer John Q and John
44:35
for listening next time let me into those Luda conversations
44:37
earlier. I want to be on site.
44:39
So I saw a great a couple of good pictures.
44:41
He seemed like a really friendly guy, like from everything I can
44:44
tell. And I think a lot of a lot of
44:46
what we want to do is kind of that, that fun marketing that we
44:49
do out there. That's what I'll pick on John
44:51
here again, that's kind of where what he's known for.
44:53
So hopefully you see more and more from us on that side.
44:56
It seemed like a fun photo shoot.
44:58
I guess that's the right term. But yeah, it was a fun one.
45:02
Take it back and rewind it. That's always good.
45:04
So now you've got to look for the next song to go viral with
45:06
and sort of like stay on top of it.
45:08
I know that's the tough part. Maybe, maybe some folks can ping
45:12
me on LinkedIn and say what are we going to do next from a song
45:14
perspective and I'll forward those on.
45:17
Jim, do you have a song that you think maybe like would be
45:19
applicable that maybe we can use as like a a tagline for this?
45:24
You know the song that's going in my head right now is all I do
45:27
is win, and Ludacris is part of that, right?
45:30
So why not? Drew, the other thing that you
45:33
were going to know you before we hit record here is that you're
45:35
into is watch collecting. I'm not so much a watch
45:39
collector other than technology side of things.
45:41
So, you know, I'm typically rocking whatever, whatever phone
45:45
watch I happened to be using for whatever phone I happened to
45:48
have at the time. But I can tell you I was
45:51
fascinated as a youngster growing up, my father had an
45:54
entire drawer full of various watches.
45:59
They I wouldn't call them like collectors.
46:01
They were like of the Casio variety, but people listening
46:04
might remember some of these, right, like the calculator
46:06
watch, right. That was like there there was
46:09
one that I had and that he had ended up becoming mine at some
46:13
point. Was it had like a little clip on
46:17
booster for the sound to be able to do like louder alarms and
46:22
stuff like that. So it's kind of like a
46:23
three-dimensional watch, you know, once you put this clip on
46:26
it and there's a whole bunch of stuff like that.
46:28
Is that the sort of watch collecting you're in tech nerdy
46:30
stuff or are we talking? Like the exact opposite.
46:33
Yeah, that's, yeah, that's why I love them.
46:38
The less tech the better. We deal with tech enough.
46:40
And to me, that's why they're so interesting.
46:42
And for me, the reason why I love watches and when I collect
46:45
them is that it's always tied to like a, a moment of my life.
46:48
So they always bring me back to those areas.
46:50
Like the, my favorite watch is a, an Omega Speedmaster to the,
46:54
the watch my wife gave me as a wedding present.
46:56
And to me, that's something I want to pass down to my son.
46:59
You know, when he turns 18, he's going to get that watch.
47:01
It's like, that's why I love it because it's not necessarily,
47:04
you know, going out and buying watches for the sake of it.
47:06
Like I wanted to be tied to like a momentous event and brings
47:09
back those memories as part of those workflows.
47:11
Plus the less tech I could have in my life the better.
47:14
Now my my own personal goal is to buy a cabin in the middle of
47:17
nowhere with no Internet access and just go there every weekend.
47:21
So far I haven't convinced my wife to do it, but if I do do
47:23
that, I'll have the watches behind me.
47:26
That's why I love them so much. It's an expensive hobby.
47:29
I mean, these, these watches are, you know, thousands, 10s of
47:32
thousands even, you know, hundreds and millions.
47:36
How do you, I guess, how do you keep up with that?
47:39
Carefully, carefully, I, my, my family had a trip over to
47:43
Switzerland. My wife had always dreamed of
47:45
going to see the Christmas markets and I made sure we
47:48
stopped in some of those watch stores and it was hard to walk
47:51
out of those without buying me anything.
47:52
Just to see you kind of where the watches came from, like the
47:55
higher end versions. Like love to do it, but I can't
47:58
justify it. It's, it's tough.
47:59
But I can still remember being like a kid in the candy store
48:03
when I walked in there and seeing all the cool stuff that's
48:05
going. So there's no good answer there.
48:07
Find the ones you want, make sure there's a reason behind it,
48:10
and treasure it. Is it purely the the emotional
48:15
aspect of it, you know, kind of like the era of it or do you
48:17
actually look at, you know, the craftsmanship, the quality of it
48:21
or maybe the uniqueness of it like that sort?
48:22
Of thing, a little bit of both. I think it's on the higher end
48:24
one is definitely craftsmanship, like just being able to walk
48:27
through it and look at it and read the microscope and see
48:29
what's going into the complications and all the works
48:32
that going into it. Like it's a pretty fascinating
48:34
engineering conversation and diving into the weeds with it
48:37
is, is really fascinating. Like I've got a couple of books
48:40
on it just so I can learn more around it.
48:41
And so, you know, you can go out and put a price tag on anything.
48:45
But to me, it's is it worth it? You know, am I spending this
48:47
amount of money for something that, you know, I can make
48:50
myself? Like if that's the case, I'm
48:51
probably not going to be interested, but there's some
48:53
real expertise around this and looking at all the cool stuff
48:56
that they innovate on, like that's I think where it makes it
48:58
more interesting. So I'm looking at the Omega
49:01
Speedmaster list here online and I just had to sort by price and
49:06
there's one that's lifted. It's a Speedmaster Chrono chime
49:10
that is listed for $592,000 for a watch.
49:14
It's that chime piece that made it, made it more expensive.
49:17
That's when it makes an actual noise around it.
49:19
So think about the engineering effort.
49:21
You have this little area and on intervals it'll do that that
49:24
that chime, that alarm. I did not pay 500,000 for it.
49:28
I would never pay that much unless I'm winning the lottery,
49:31
but yeah, they get pretty crazy, that's for sure.
49:35
I think some of these watches you could you could fund that
49:37
cabin in the woods. Yeah, exactly right.
49:39
I know what I'm picking. I'm picking the cabin over the
49:41
watch any day. Jim, are you a watch guy?
49:43
Not really, but it's so funny because as you're talking like
49:46
so many different memories came back.
49:48
Jeff I didn't even think about watch collecting in terms of
49:52
that era of watches. And I actually had a watch when
49:55
I was a kid that you could play Pac-Man on.
49:58
I wish I had that watch now, but that's a different kind of
50:00
collecting. It's like.
50:03
Well, it had the. It had the clock on it.
50:06
Yeah, actually I just saw that in Vegas they're have they were
50:09
building an Atari hotel and it was going to be Atari 2600
50:14
themed. I think they cancelled it, but
50:17
it also got me thinking about, I actually have an Atari 2600 with
50:21
like 50 different games and remember, like with the games,
50:25
you have to like blow on them to get the dust off the cartridge.
50:29
I just don't know if I I'd be able to hook it up to a modern
50:33
TV, you know, because like the plugs were designed for the old
50:38
TV. So I'm not sure if that would.
50:39
Work or not? Just go buy an old TV at the
50:41
same time start a new collection.
50:44
Why not? Why not start a collection of
50:46
like old black and white TV's or old junkers?
50:52
Yeah, so definitely brought back some good memories there.
50:57
But I actually, after talking the other day about these, about
51:02
watch collecting, ended up in a jewelry store.
51:05
So things needed to get a ring resized.
51:07
So they had a big case of watches.
51:10
Of course, guys like our, they kind of wrote about the watches
51:14
I have to go over and like show them every watch and get them to
51:17
try them on. So I started trying them on and
51:19
they're sharp looking. You know what I think was the
51:22
watches? Like, what I really want is an
51:25
Apple Watch, the new one. And I always kind of felt like
51:29
the Apple Watch looked cheap. It looked like a consumer
51:32
electronic that you wore on your arm, not something you'd wear
51:36
with like a suit. And like the watches at the
51:40
jewelry store look like something you'd wear with the
51:42
suit. I mean, I was looking at like a
51:47
a citizen watch. It was like 5 or 600 bucks.
51:50
I mean, this thing was really sharp, but I got it out of there
51:53
without spending any money. Then Denise looked it up online,
51:57
where you can actually get a wristband for the Apple Watch.
52:01
That is, it looks like it's silver and gold and like super
52:05
sharp. I'm like, OK, that's what I'm
52:07
getting. I'm getting the Apple Watch, the
52:10
current model, and the awesome wrist, awesome wristband that
52:15
makes it look like something to wear with the suit.
52:18
And in fact, you can change the face to look like a fancy face
52:22
because one of the things that was cool about like the Citizen
52:26
watches and all the other ones were you can see the inner
52:29
workings of the gears and stuff. I was like, oh, that's so cool.
52:35
So yeah. I still don't have a watch
52:38
though. Jim, next time I see you in
52:41
person, Jim, I'm expecting to see the Apple Watch with the
52:43
fancy band on it, so I'm going to hold you to it.
52:45
That sounds like a good plan. Fine, I mean I'm rocking an
52:48
Apple Watch, you know the ultra and they're uncomfortable for
52:52
me. You know the links, you know my
52:54
arm hair gets caught in it and it's just like no, give me a
52:57
nice comfortable sport band and I'm happy with it.
53:00
I think you see a lot of tech watches now on.
53:02
People just watch people talking and I don't think there's a.
53:05
Lot more hairy than mine. True.
53:08
And maybe that's why I don't want a, you know, a Milanese
53:11
loop band that is constantly pinching me like, Nah, I don't,
53:15
I don't have time for that. Stay comfortable, that's the
53:18
important piece. All right, well, let's keep it
53:20
comfortable here and get things wrapped up.
53:21
That was a professional Segway for podcasting.
53:25
I'm going to have links in our show notes like I mentioned
53:26
before. So we'll have link to Drew on
53:28
LinkedIn and then the rubric website rubric.com/I DACRUBRIK.
53:34
Drew, thank you so much for being with us.
53:36
I'm going to give you the final word.
53:37
Anything that you want to mention before we close things
53:39
out? Wow, no pressure.
53:41
Take a look at rubric. I'm very, very bullish on what
53:44
we're doing. We've seen a lot of market trend
53:46
around there. There's a lot of cool stuff.
53:48
We're we're out there driving for the marketplace standpoint.
53:51
And if you need any help, reach out to me directly.
53:53
I may not know the answer, but I know who does.
53:55
So we'll figure it out from there.
53:56
That's a great way to end it. So we'll leave it there.
53:58
Thanks everyone for watching or listening.
54:00
You can find us on the web, IDC podcast.com, like subscribe to
54:04
all that fun stuff. Thanks to Rubik for sponsoring
54:06
this episode. Reason why we could do this.
54:08
So yeah, that's it. And we'll talk with you all
54:12
later. You've been listening to
54:15
Identity at the Center. We hope you've enjoyed the show.
54:19
Make sure to like, rate and review, and we'll be back soon.
54:24
But in the meantime, hit the website at
54:26
identity@thecenter.com. See you next time on Identity at
54:32
the Center.