Latest / Identity at the Center / #196 - CIAM Authentication with Mickey Boodaei

Transcript

#196 - CIAM Authentication with Mickey Boodaei · Identity at the Center

0:09
You're listening to the identity of the center podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast, I'm Jeff. And that's Jim.
0:28
Hey, Jim hey, Jeff, how are you? Oh, not so bad yourself.
0:32
I'm good. I was wondering, who is it too?
0:33
Late to say, Happy New Year, you know, I was like a call
0:37
yesterday and I feel like, you know, all last week it was happy
0:40
New Year and this this was words of Williams, I think it was
0:44
Brian. And I was talking to is like
0:46
well you know I kind of said happy New Years that way, are we
0:48
still doing that in the second year of the of the new year?
0:50
He's like well last week was a short week because most people
0:53
had Monday off. So Going to wow it.
0:55
As far as Monday. Now, what I don't know is I'm
0:57
going to do it today Tuesday or if we were just kind of we've
1:00
moved on. Yes it's the new year.
1:02
Let's just keep it as it is. Yeah.
1:05
It's like about this, right? We're recording it advance.
1:07
So we say happy new year. Now it really is dated by the
1:12
time this goes live and then by the time somebody maybe listens
1:15
to it, it's like you know, could be summer.
1:18
I mean that's that's how people listen, as I think this will go
1:21
out, probably like January 23rd episode 196.
1:25
Theoretically, unless something changes in scenes, but, yeah,
1:30
it's tough to be timely on some of the stuff.
1:32
So, we're getting close to 200, and I'm gonna do we ever have a
1:35
conversation about Christmas gifts?
1:37
I think we did. I think we touched on it, right?
1:39
But one thing I didn't didn't mention this.
1:42
Yeah, that's right. Your Sweetwater talked about my
1:44
stickers, but I never talked about my chair and the reason I
1:49
thought of it about it this morning is that, you know, I've
1:52
been getting by for about a here with a squeaky chair and I
1:56
bought a Herman Miller chair. And I talked about it on the
1:58
show before because most like, embarrassed, I spent 1600
2:03
dollars u.s. on the chair and this was before inflation.
2:07
So it is an expensive chair. So that's like 40 Grand chair
2:10
now. Yeah.
2:10
Right. Exactly, exactly.
2:12
I could treat it in for a BMW or something, but you know, the
2:17
issue with the chairs, like it was squeaking and I tried to hit
2:21
it. Yeah.
2:21
You know, I tried hitting it with the WD-40.
2:25
It didn't solve the problem and what happened was I contacted
2:30
Herman Miller was under warranty.
2:32
So get this, you know, rather than saying well what you need
2:36
to do is XYZ, they used FedEx to send a box to my house, I put
2:43
the chair Inside. The Box FedEx, came picked up
2:46
the box with the chair in it. Brought it back to Herman
2:49
Miller, they replaced the part that was squeaking.
2:52
Another going to ship it back to me.
2:54
Now, the good and bad. I mean, like, it's like wow.
2:57
Like they spared. No, expense to fix my darn chair
3:01
but, you know, I'm also without a chair for like two weeks while
3:05
this is all happening, and it just kind of seems like an odd
3:08
way to go about fixing the problem.
3:12
Yeah, I guess, I guess Advanced replacement, maybe that's
3:16
something that I've done to pass for like laptops or stuff.
3:18
Like that would have kind of physical issues that can't be
3:21
solved for software, like yeah, okay, send the chair and then
3:24
take your chair and put it in the same box and then send that
3:28
back would seem to me to make the most sense laptops are kind
3:31
of small chairs for big. Yeah.
3:34
Oh yeah. I know, I I treated myself to a
3:36
chair as well. Yeah.
3:38
Yeah. So anyway, I'm excited about the
3:41
new year kicking off. Really looking forward to the
3:44
conference's. I mean, we talk about this every
3:45
week, but let me get the word out and get people thinking
3:48
about like setting their conference schedule or agenda
3:51
for the year. I think, you know anyone who
3:55
follows us on LinkedIn realizes by now you and I are are
3:59
co-hosting a session along with Henry K you know head Becky from
4:06
Gartner that's Going to be during the Gartner conference
4:10
Gardner. I am Summit in Grapevine Texas
4:14
March 20th through 22nd. I'm not even sure exactly what
4:17
day our session is within that that range but certainly don't
4:22
happen within that range and we are super excited about that.
4:26
Yeah we'll have 30 minutes somewhere in there to bring the
4:29
identity of the sender show to the Gartner stage which is a
4:32
very cool. I think it's a point where I
4:35
start start to crowdsource some questions here from our audience
4:37
and What we want to do about you know, we're gonna have an
4:40
opportunity to really Grill Enrique and Becky so we can get
4:43
tough and we can have a good conversation about it and you
4:46
know maybe and the goal is to have really something different
4:49
than your normal sort of Gartner presentation or session,
4:53
whatever may be especially if it's sort of like off to the
4:55
side and it's not really like a keynote.
4:57
So I'm hopeful that we'll have a very good time and it'll be a
4:59
little bit different flavor and kind of be.
5:01
And if it's the right word, but like, the like the anti session,
5:04
if that makes sense, a are the normal programming.
5:07
You may not learn anything, but I hope will be entertained like
5:09
the unconference. I was popular for a while or so
5:12
like you show up. You have no idea what you're
5:14
going to talk about. I don't think we'll do that
5:17
though. No I will have will have a good
5:19
time at this. We got Gartner coming up, we've
5:21
got the European identity conference.
5:22
We talked to Martin cougar, a couple weeks ago, we've got
5:26
identifiers coming up. So yeah, I think Now's the Time
5:29
to get those budget requests in, try to point out that calendar
5:33
or, and you know, see what you can do to attend stuff like
5:36
that. So it seems like it's very
5:37
heavily. Front-loaded this year, for some
5:40
reason, and our essays coming up as well, in April, I think it
5:43
is, or maybe it's May. So I'm going to try and I think
5:45
is April actually, so I'm going to try and hit that as I kind of
5:48
usually do. But yeah, put it, I put the bug
5:51
and I put a bug in Daniels here. Daniel is our partner within our
5:56
SM, who Jeff and I both report to and, you know, I take the
6:02
lead on, kind of like trying to help put together the strategy
6:06
for external marketing. So, That includes like
6:09
conferences so I'm like let's let's all good RSA obviously
6:13
it's not like an endless budget for going to conferences but
6:16
it's a fantastic opportunity to network and know what's going on
6:20
within the industry. So I mean it's dollars well
6:24
invested but you know, gets expensive after a while
6:27
especially with all the the travel and entertainment that
6:30
goes along with it. Yeah.
6:33
So we don't do normally commercials for ourselves.
6:35
But yeah, if you need, identity Consulting, come talk to Jim and
6:37
I That helps us get to conferences which means we can
6:40
bring the identity of Center podcast to those conferences,
6:42
typically, and do some sort of, you know, I'm on location
6:45
recording. So Shameless plug there.
6:49
Anything else coming up that we want to get to, or should we get
6:51
to our guests? Why don't we get to our guest?
6:54
I don't want to like, you know, eat up all of our time with our
6:56
banter. Yeah are Mindless banter.
7:01
Let's talk with Mickey but I he's the CEO and co-founder of
7:04
transmit security. Welcome to the show Mickey.
7:07
Thank you, Jeff. Thank you, Jim.
7:08
It's great being here. Actually like listening to your
7:12
opening statement. So first of all, like I'm
7:16
sitting on probably the most uncomfortable chair that was
7:19
ever built, but it's part of the office design and the designer
7:26
is my wife. So you know, I'm stuck with this
7:29
chair but I kind of like learned to to like it.
7:35
You know, the other thing that you've mentioned is Gardner
7:38
conference, which is obviously a great conference.
7:41
And this is probably, you know, a good opportunity for us to
7:45
introduce David Maddie who was previously, Gartner identity and
7:51
access management analyst, who is just joined transmitted and
7:56
he's starting in about a week. So I think by the time that this
7:59
is going to air, it will be, you know, part of our team.
8:04
And, lastly, you mentioned our say, which is very funny.
8:06
But like I I the first RSA I attended.
8:10
The first conference was in 1993, I believe, which was
8:15
probably one of the first RSA conference has ever.
8:20
It was so tiny back then and you know, I think the last one I
8:25
actually, you know, I attended was about like, you know, just
8:29
just before covid and it was so huge.
8:33
Like, you know, this one, and I keep kind of like looking at the
8:38
RSA conference has I kind of like it's interesting to see how
8:43
the entire industry of cybersecurity as evolved since
8:47
like you know the early 90s to, you know, these days, it's
8:51
pretty amazing. What keeps growing and growing.
8:54
You mentioned are saving so small and now it's a huge thing.
8:57
I think it's something like 20 or 30,000 people sort of all
8:59
descend into downtown San Francisco.
9:02
And yeah, I was there at the same one right before.
9:05
Sort of the pandemic sort of hit it was like right at the very,
9:08
very beginning and I remember getting that notifications,
9:10
okay? Someone was at the conference
9:12
and there was, you know, an infection.
9:15
So that was sort of like, I think the, the closing
9:18
Ceremonies for the conference circuit and that kind of
9:21
reopened maybe, like, around this time.
9:23
Last year when I was at RSA, you last year, as well.
9:26
And it felt like it was, there was excitement.
9:29
I think, I think people were kind of, like, okay, we've been
9:32
cooped up for a couple of years. Now, let's kind of get out there
9:34
and, you know, No. Yeah manually.
9:37
Yeah yeah it's pretty amazing. Like and everything's getting
9:41
back to normal like even China is getting back to normal you
9:44
know. Like that's that's a big event.
9:48
Yeah. So I want to touch on something.
9:49
You mentioned, you mentioned about your uncomfortable chair
9:52
and that's sort of like the office design and I got to ask
9:55
questions. So if your wife design the
9:57
office and the chair is uncomfortable.
9:59
Is that so that it's like forces you to like, stand up, move
10:03
around KT, KT office all day. No come home or was, is that
10:07
like a subtle nod? Like, hey, you can't work 24
10:09
hours a day. Let's do other things too.
10:12
Look, it's, it's probably the cheapest share that you could
10:17
imagine, but it goes well, with the decor of the office, like
10:23
the entire design. So it's all about how it looks
10:26
rather than, you know how it feels.
10:30
But yeah, you know, like, I'm mom mostly when I'm in the
10:34
office. So I'm you know, moving around
10:36
between meetings. So you know this is probably
10:40
going to be the longest that I I'm sitting on this chair today.
10:45
So you know. Well let's keep on Pace here so
10:48
your back thinks this later or doesn't blame us later.
10:50
Anyway, this is the first time you've been on the show with us
10:53
and one things I like to do when we talked with new guest is we
10:55
kind of find a little bit about their identity background and
10:57
how they got sort of into the infosec space and identity at
11:00
large. Can you take us through sort of
11:02
your journey from the beginning? Did you get into identity?
11:06
And I don't think we need the whole Wikipedia entry, but maybe
11:08
something that kind of explains, you know, here's the context
11:10
that you're coming from. Because obviously, you've
11:12
started up a couple companies. Now this point and now you're a
11:14
transmit security. I'm just curious if if something
11:17
is identity something that you chose or did it choose you?
11:20
All right so you know this story goes back to when I was 18 years
11:25
old. I'm 50 now so as you probably
11:29
know in Israel we have like mandatory military service and
11:34
you started that when you're 18. So I joined the military.
11:38
When I was 18 in this part of like the process, I was screened
11:43
for its cyber security unit in the, in the military, I then
11:50
went to learn computer engineering and the first thing
11:53
that I was assigned to when you know my first day in in the unit
12:00
was this like huge book and this book was right.
12:05
Kits. For those of you, no doubt, it's
12:07
like the axis control system for mainframes.
12:12
So like, you know, for I remember that for a month, I was
12:16
like, you know, reading the book, trying to figure out
12:19
what's going on there. So this is mostly identity
12:23
access management and then my first project in the military
12:27
was implementing Rock. If like kind of like Concepts on
12:34
Unix Systems. Right it was like you know
12:37
before Lee Newton was like Unix systems.
12:41
So since then I move between like different disciplines of
12:45
cybersecurity in the military, firewalls intrusion detection,
12:50
systems data security and then write it that like the last two
12:55
years was around application, security, web security.
13:01
So when I got out of the military, the first thing I did
13:04
was Starting, you know, company around application security and
13:09
it's kind of like started my low whether intrapreneur but yes,
13:15
identity was the first thing I ever touched in my career and
13:21
it's a rough entrance rack f. I remember that back in the
13:25
early 2000s, I guess would have been for me administrating rack
13:29
F access for for that. Not my most favorite thing to do
13:32
in the world. Nah not at all.
13:35
Like yeah. Took me a while to get back to
13:37
Identity. Yeah.
13:40
So those for those not familiar transmit security, I guess help
13:45
for the folks are listening out there.
13:46
What's the 32nd or 60? Second elevator pitch for what
13:49
transmit security does, right? So Travis is security provides
13:55
end-to-end customer identity Services, mainly for large
13:59
Enterprises, so our customers are alike, you know, City Bank
14:03
HSBC, JP Morgan Roger is a lot of these large down Giants and
14:11
the services include user management or ization advanced
14:15
advanced certification Reese trust and fraud identity
14:19
document verification identity orchestrations of pretty much.
14:22
Anything around customer identity and what's unique about
14:28
us is that we're experts in cybersecurity.
14:31
So our platform is built ground up for Enterprises want to keep
14:36
secure yet, move very very fast in terms of their identity
14:41
Journey. So we're going to get probably
14:43
to talk a little bit more about the the see, I am aspect here,
14:46
especially on the risk as read an article where you were
14:50
mentioned in it. And it mentioned I think there
14:53
was a quote and maybe can kind of help me understand the
14:55
context of this was you mentioned being kind of thought
14:57
of as they're at least the goal was to be the Google or meta of
15:01
personal security in the digital world can you?
15:05
Me what you meant by that or maybe there was context that was
15:07
missing from the conversation. Well yeah, thanks for for this
15:10
question, Jeff. It's it's a good opportunity to
15:13
clarify but up, I'm not comparing ourselves to Google or
15:18
meta but what I'm like saying is that I'm inspired by the way
15:23
they build their brand. So for example with Google,
15:27
right it's like googly is a term rights like you know you're not
15:32
searching the web so So you know the way.
15:36
Yeah, I do you think about being Google is Google search and
15:39
search is Google. So for me to kind of like set
15:43
goals for transmit security around identity, what I really
15:48
want to happen eventually is that large Enterprises when they
15:53
think about their customer identity, they think about
15:57
transmit security. So that's kind of like the way I
16:01
present it to, you know, everyone wants to listen to the
16:04
video. Well, you picked a good name and
16:06
transmit because you think about it was like, okay well we're
16:09
transmitting our identity where transmit security so I'm not
16:12
going to your marketing for you definitely.
16:13
Don't want that. But anyway you're based in
16:19
Israel and you know, been very gracious with your time with us
16:23
and I'm curious because we talked with a lot of folks in
16:25
the infosec space and it seems like Israel such a hotbed for
16:29
different cybersecurity startups and things like that.
16:33
I guess why, is that what? You know, what is The the
16:35
culture there or whatever other you know, winds kind of that
16:40
help with that, right? So I think it's a combination of
16:46
probably two main main things. The first one would be the, the
16:52
military, as I said, like no, we have a mandatory military
16:56
service, which means that everyone at the age of 18 goes
16:59
to the military and then in the military, the different units
17:04
just decide. Where are you go?
17:07
So you know, some of them become Pilots, you know, they they they
17:12
want to but also the military needs to to decide that, you
17:17
know, this is, you know, a good seat for them.
17:21
But then like, you know, cyber security units within the
17:24
technical units are, you know, typically the most prestigious
17:30
units in the military and they get to pick their talent first
17:36
So if you think about it, the entire talent that we have in
17:39
Israel, the cybersecurity military, I get to choose the
17:46
ones that they want, so everyone goes there like know, the best
17:50
talents and then in the military you really get an opportunity to
17:55
work on projects that you would never get a chance to work on in
18:02
your civilian lives by the things that we do in the
18:05
military. We are liking almost on
18:07
comparable to, you know, what private companies are doing.
18:12
So, you get like a lot of experience very, very fast.
18:15
Definitely for someone who is a junior developer or Junior
18:19
researcher, they will never get the chance to do that in any
18:24
other part of the world. So you know military service
18:28
could be anywhere between like you know three years 26-year.
18:32
This is this is like where most people most Years and up.
18:38
So after like, you know, four five, six years in the military
18:41
with a lot of experience, you know, this guy's just go out and
18:46
start their civilian career. And typically, what they want to
18:51
do is to keep on doing the things that they're good at,
18:55
which is our security. So, you see a lot of
19:00
cybersecurity startups in Israel, you see a lot of big
19:04
companies that Out, you know are in cybersecurity.
19:08
So you know I think it's kind of like culture right now in Israel
19:13
where you see most of the technical Talent going into
19:18
cyber. So Mickey we I mean,
19:20
transmitters been around for quite a while.
19:23
I mean, the buzz, I think lately that I've heard is really, you
19:28
know, Pastor Liz for customer identity and access management
19:32
or we that's, you know, probably if somebody asked me what
19:35
Schmidt does that's where my mind would go right away.
19:38
But early on, it was a focus on orchestration orchestration, can
19:43
mean different things to different people.
19:45
They, for example, we had Jerry Gable and the show in November
19:49
talking about what they're doing over shraddha and they're doing
19:53
orchestration. It's quite different.
19:55
I've encourage anybody who's listening who's interested to
19:58
understand the difference to go back and listen to that episode.
20:02
But you know, I think the orchestration that transmitted
20:06
was focused on early on and probably, you know, still makes
20:10
up a big part of the stack is what we call security,
20:14
orchestration and automated response or soar, as kind of a
20:19
product area. Is that, what am I getting that
20:22
right? Or is it something else?
20:24
It's not exactly that about like you not to really understand
20:28
what identity orchestration is. It's better to understand like,
20:34
you know, kind of like the history and where we come from.
20:37
So it's around 2007, my co-founder Rakesh in Ankara
20:43
myself. We, we started a company called
20:45
trusteer now, trusteer was eventually got acquired by IBM
20:50
and it's not part of IBM security, but what we did there,
20:53
There is like we identified very early on that on the next big
20:57
thing in terms of attacks against organizations and
21:02
specifically financial institutions is going to be
21:06
malware and financial malware. Now, this was even before
21:10
sentential malware was even invented and that was probably a
21:15
year here and asking for the first one like Zeus was
21:18
invented. So we started a company, we
21:21
started building like, you know, the defense's around it.
21:24
And you know, then when the axle, you know, let's say the
21:34
the actual attacks against Banks started to happen, you know,
21:39
like organizations were looking for Solutions.
21:43
And this is where we basically came in with the ability to
21:47
identify fraudsters and, you know that that are Leveraging
21:55
malware against Banks consumers and be able to alert to the
22:03
bank. That for example, a certain
22:06
consumer who is now trying to Bank online is infected with a
22:13
financial malware that could eventually still credentials or,
22:18
you know, make transactions and things like that.
22:21
So the signal was very strong and You know, was we were very
22:25
successful with that but as we kind of like wanted to build
22:29
that into mitigation controls, okay?
22:32
Like you know, you get a signal, you understand that there is
22:35
something bad happening how do you stop it right?
22:39
The way to stop it is true, perhaps stronger authentication
22:43
or restricted access. So these are kind of like you
22:47
know, what you want to to do as actions because when you look at
22:53
Consumer identity, right? It's different than Workforce
22:57
identity because you still need to like allow your consumers to
23:02
to log in and do stuff so you can just keep blocking People
23:06
based on, you know, all these signals.
23:08
And we're talking about Millions sometimes of tens of millions of
23:12
users per organization or per application.
23:16
So to automate all that we had to kind of like blend our
23:21
signals with Authentication. Shen's and authorization actions
23:26
and we wanted to to do that. But you know based on the
23:32
architectures that our customers add back then it was really
23:37
really hard to do. Like how do you blend their?
23:40
I am stack into the signals that we're giving them and change the
23:45
authentication on the Fly based on these signals.
23:50
So it could be like, okay, when the user comes to trans day,
23:53
Doctor do something during the session.
23:57
You need to challenge them just because your seat you're picking
24:01
up different signals or when the user is opening an account.
24:05
During the process, you want to change the experience and
24:10
introduce more friction because you're picking up these signals
24:14
and it was impossible to do. So it was like, okay, we need to
24:19
do a lot of coding in the application and deserve very
24:22
difficult. Nations to touch.
24:25
And these are very sensitive places to touch and like you
24:29
know you need to buy cast the entire.
24:32
I am architecture to do that. So you know, for years I think
24:37
like three or four years that we we actually try to implement
24:41
this concept. It was impossible for us to do
24:44
it. So eventually, what we decided
24:47
to do is we want to start a new company.
24:51
Where we can glue together, all sorts of signals about risk with
24:58
authentication with authorization in a very easy way
25:03
for the application. So think about it is kind of
25:06
like an abstraction layer that sits between the application and
25:11
the iin stack, and most organizations that have a lot of
25:15
Solutions in our I am. So we sit in between and we Can
25:21
take the signals and then operate the different actions
25:27
like, okay, you need to do this type of authentication or we
25:30
need to restrict your access to specific parts of the of the
25:35
application. So this is our, the concept was
25:38
born and when we started to present the concept to customers
25:43
and to to analysts, you know, I think David was like, you know,
25:49
the gal that I mentioned. Earlier they came up with the
25:54
kind of like, the category of identity orchestration, okay.
25:58
So this is like, you know, you're orchestrating the entire
26:02
I am stack and this is how it all started.
26:07
Yeah, that's really interesting. You mentioned a couple key
26:09
terms, I want to pick on but overall the impression that I'm
26:13
getting is really, you know, this is all comes back to risk
26:18
and gauging the risk of the Authentication.
26:21
Fashion Event and let's be frank, different organizations,
26:25
different Industries, have a different tolerance for risk.
26:29
You mentioned, you know, if you're in the customer identity,
26:32
you don't want to just keep sending people away because they
26:37
represent some level of risk. You know, as a Workforce people
26:41
are going to keep trying until they get in, right for whatever
26:44
reason, will call the help desk but if it's somebody wants to
26:47
buy a sweater or sign up for a cell phone service, Or transact
26:53
with their Bank. Those are three different levels
26:55
of risk and they probably want to turn people away based on
26:58
different levels or make sure I'm getting that right?
27:02
And then talk to me a little bit about how these signals that you
27:06
talk about, what are some of the examples of signals and how does
27:09
that play into determining that risk?
27:13
Yeah. So first of all you're, you
27:16
know, absolutely right that different verticals have
27:21
different tolerance to to risk and you know, account Takeover
27:25
in general. So traditionally the financial
27:30
sector was much more sensitive or is much more sensitive to
27:35
Therese and this is why you see like all the controls and much
27:40
better or stronger authentication process.
27:43
As with financial institutions, then you see, for example, with
27:46
retail. But even, you know, we three
27:50
till what we're seeing recently is that there are two main
27:53
reasons why in there trying to look at that more seriously.
27:58
The first one is customer experience so think about like
28:03
you know, your account, you know, getting and or you know,
28:09
your credentials are stolen, someone gets in Your account
28:14
with a certain retailer, you start getting like, you know,
28:17
these emails about like is EQ, is it?
28:20
Not you? Do you want to stop it?
28:23
We had a breach, we had something so it's like it.
28:27
There is damage to the brand and this is something that they want
28:31
to to avoid and the frequency and the kind of like, you know,
28:38
the amount of attacks that they're seeing today in retail
28:42
is Not comparable to what they used to see, probably five, six,
28:47
seven years ago. So as this increases their
28:51
starting to look at this more seriously to, you know, improve
28:55
their other brand and like, you know, their entire operational,
29:00
you know, cost. But you know, in terms of the
29:05
attacks themselves, it's a lot about, you know, account
29:10
takeover so account. Typically you would see, you
29:15
know, someone like they're kind of like typical ways of doing
29:20
account takeover. So we're reading a lot of bad
29:23
data breaches, right? It's like almost on a daily
29:26
basis that were saying even the, you know, the biggest brands
29:31
being rich and like, you know, customer data is going out and,
29:36
you know, is probably available in the dark web and what current
29:42
cyber those are doing is just like, you know, downloading this
29:45
data and, you know, starting to do things like credential
29:50
stuffing, which is for those of you don't know.
29:53
It's like, you know, you're taking a database of usernames
29:57
like typically email addresses and their passwords from a
30:02
specific website and then you go and try the same credentials
30:07
with other websites. And the assumption is that
30:11
customers are Using their credentials across multiple
30:15
websites, which is typically correct assumption.
30:19
And so they go and just try these across multiple
30:23
applications with huge databases of customers and they're able
30:29
to, you know, get into your into your account even though you did
30:35
nothing wrong. Other than using the same
30:37
password across multiple applications.
30:40
So this is one attack Vector for Example, the other would be
30:46
another one which is very interesting would be social
30:49
engineering and this is something that we're seeing more
30:52
and more which is like, you know, someone colds you
30:57
pretending to be your, you know, someone from the bank or someone
31:01
from law enforcement agencies or you know, even your Telco
31:06
provider and they tell you a story that you believe
31:10
eventually that you need to do. And this something could be, you
31:16
know, as bad as like you need to move money from your account to
31:20
this account because, you know, this is a backup account and
31:26
something happened and for security reason you need to do
31:29
that, it really, it really depends on the creativity of
31:34
the, you know, if the attacker of cyber criminals and there are
31:38
quite successful in that. So, obviously the more practice
31:41
they get the better, They become in telling these stories and
31:44
finding the right victims for it.
31:47
So this would be like, you know, a couple of the attacks that
31:50
we're seeing today. Also you know, you're seeing
31:54
things that are more geared toward bypassing two-factor
32:00
authentication. So it you know this is funny
32:03
like you know, when two Factor authentication is kind of like
32:08
you know, recent in terms of the adoption rate of two Factor
32:12
Authentication Station. Even though it's been with us
32:14
for many many years only, you know, probably in the last five
32:19
years or so. We're starting to see
32:21
organizations really adapting two-factor authentication and
32:26
typically with an OTP typically over you know SMS or email or
32:33
not specific application to do that.
32:36
And you know as soon as you know fraudsters realized that you
32:42
know, this is this This is what organizations are doing.
32:45
They immediately came up with men in the middle attacks like,
32:49
you know, stuff like they invented it, right?
32:51
Like this attack vectors. I can tell you that, you know,
32:54
we've been experimenting with them like 20 years ago.
32:58
So, everything was known but like, you know, sometimes like
33:02
the motion is, it's like, always like, you know, for me, it's
33:06
like you're watching something in slow motion, right?
33:09
It's like when you're watching something in slow motion, you
33:12
know what's To come next because you get like a lot of time to
33:15
think. So with, you know, for example,
33:18
with two-factor authentication was pretty obvious that as soon
33:22
as everyone is, you know, starts to adopt it, you know,
33:26
fraudsters will be able to bypass it very easily.
33:29
So we're seeing a lot kind of like men in the middle phishing
33:32
websites where like you know the phishing website asks you for
33:37
the the OTP code and then the fraudster goes and completes
33:41
that and let slightly more. Advanced attack would be a seem
33:45
swap which is becoming easier to do now, with a seam and the fact
33:51
that you don't need like a physical seem to, to pretend to
33:55
be, you know, to take over a different phone number.
33:59
So the the actual mobile operators are being a part or
34:04
being you know a step in the attack itself.
34:09
So we're seeing a lot of that typically yeah you hear a lot
34:12
about Out the evolving threat landscape and I think evolving
34:17
may or may not be the right word, but evolving to me is like
34:20
it's not Revolution, right? There's not a whole different
34:25
set of you know, from year to year how these threats are
34:31
Manifesting, it's interesting. Every time you look at one of
34:34
these reports of, hey, let's recap the year.
34:37
The data breaches that have occurred.
34:39
It's fishing as social engineering.
34:41
It's like the most common denominator, and it's kind of
34:47
sad that it always kind of seems to boil back to those those
34:50
Basics. But it's interesting because I
34:53
was thinking as you're talking, there's, you know, if we just
34:56
want to Super simplify it, there's really kind of two.
35:00
Types of actors. There's the single actor that
35:05
you talked about. That's how to be the harder one
35:07
to stop, right? Because now neither, they're
35:10
hitting it from a normal browser.
35:13
They've got a regular IP address might be out, you know, that
35:16
they probably have some Shadow of Doubt behind them but they're
35:22
probably harder to detect. The other type.
35:25
The other bucket is the campaign.
35:29
It's we just Downloaded 50,000 accounts from the dark web and
35:35
now we're going to try to hammer every website and you can do.
35:40
So they've really have a shadow behind them, right?
35:43
Maybe it's the same IP address, maybe it's a thousand login
35:48
attempts per minute. Talk to me a little bit about
35:53
those kind of scenarios because I think that that's what the
35:56
signaling is all about, right? It's identifying or detecting.
36:00
That That hey, this is a malicious actor or you know, a
36:05
campaign that's going on, right? So you know it with campaigns.
36:10
If it all comes to automation, when you want to do something
36:16
like a thousand times ten thousand times sometimes
36:18
millions of times against a specific application or across
36:22
applications websites you need good Automation and you know the
36:28
signals that you want to pee During the, you know, the
36:33
detection phase are all around automation.
36:37
So you mentioned, you know, frequency you mentioned, you
36:42
know, the ability to understand that, you know, perhaps they're
36:45
coming from the same IP address. I would say that like, you know,
36:49
they're much smarter today then, you know, then then just at.
36:53
So like you know, these kind of like basic signals or not enough
36:58
to take these campaigns. What you actually need to
37:02
understand is how automation tools work.
37:07
So you need to like, you know, map, the different automation
37:11
tools that are available to cybercriminals.
37:15
You need to research them, you need to figure out.
37:20
How do you identify the specific behavior of each?
37:24
One of these tools and build kind of like, not the right, you
37:29
know, the right, Detection capabilities for these.
37:33
So it involves, you know, if you think about it, it involves two
37:37
parts. The first part is more around
37:40
threat intelligence. How do you keep up with the
37:43
sybers criminal community and everything they do because
37:48
almost none of them is lacking on making their own tools or
37:52
building their own optic Technologies, the whole reused
37:56
by from each other, and use kind of like, you know, the same
38:02
Tools and, you know, so this would be the first.
38:05
The second is like, okay, we need to analyze all that and
38:10
build the right ability to build the ability to detect these
38:15
signals as the tools are being used against, you know, a
38:19
specific application, specific website.
38:23
So, these are kind of like another two parts there.
38:25
So this is around, automation when goes to single, Attackers
38:32
it is much harder to do than just detecting automation but
38:38
again it involves a lot of understanding of how these cyber
38:44
criminals out is fraudsters operate.
38:47
How they think? What are they going to look for?
38:50
And which tools are going to use and eventually the tactics that
38:55
they're using are very similar across.
38:58
Cyber criminals and Crosse, Regional.
39:00
Ins around the world. So you know once you once you
39:04
understand that and you know how to build the kind of like the
39:08
ride detection mechanisms around it what what are the things that
39:12
you need to profile water than the things that would trigger an
39:15
anomaly? How do you connect different
39:18
anomalies together and understand that there are part
39:21
of an actual attack as opposed to just you know, false false
39:26
positives then then you get a chance to You know, detect and
39:32
stop the the real attacks. Yeah, just observation that this
39:37
is everything you just mentioned.
39:40
I'm sure all of our lists are thinking the same thing, which
39:43
is that, you know, this would for an individual company to
39:48
kind of build these capabilities is threat intelligence.
39:51
It's just something that doesn't make sense to try to build your
39:56
own, I think, you know, my early days of it, that was the
40:00
question. Question like build versus by
40:02
today. It seems like you can bypass
40:04
that and go right to which one do we buy?
40:07
Because everything, you just laid out unless you are not even
40:10
a tech company, to me. If you're a tech company, you
40:13
still need to buy, unless you want to become an authentication
40:16
company. If you're an authentication
40:18
company, that made me spill versus by.
40:19
But, you know, to me this model of relying on, especially when
40:25
you're talking about the threat intelligence, the intelligence
40:29
is built. Across hundreds, or thousands of
40:33
customers into, and seeing these signals repeat themselves, and
40:37
building into the, you know, the Borg of understanding of what a
40:42
what an attack looks like. Because it's like you said, it's
40:45
not the basics. It's not.
40:46
Oh, you're just, you know, we're getting 1,000 hits from one IP
40:50
address, obviously, that's how I simplified it but it's that the
40:54
attackers already know that that's getting us knocked out.
40:57
So how do we get around that? You know, they're they're trying
41:00
to To stay one step ahead, the authentication companies like
41:06
transmit. Try to stay one step ahead.
41:07
So it's a constant battle if you're not in that business.
41:12
Why would you want to be in that business?
41:14
Yeah, exactly. And up look, it's a very big
41:18
operation like an offer transmit.
41:20
We have around 200 to close to 250 people, you know, talents
41:27
that specialize in, you know, this type of attack.
41:30
Actors. And this is what they do all day
41:33
long. So you look at a typical
41:35
organization, even a very large organization.
41:38
They, you know, they may have people who know how to do some
41:41
of this stuff, but you know, it doesn't scale to like, you know,
41:45
hundreds of people, which is what they actually need to
41:48
provide in a very good protection.
41:50
So eventually you would see, even, you know, even even
41:55
Enterprises with a very good talent, they would go and you
42:01
know, by Technologies from companies like transmit that
42:06
specializing in fraud identity because this is something that
42:11
is very hard to to build yourself.
42:14
I like for example, other parts of, you know, identity such as
42:19
like know building a user store, you know, you can build your
42:22
users or yourself or you can, you know, you can buy it.
42:25
It's really a question of what's, what is easier for you?
42:28
What is cheaper? What is faster?
42:30
In each one of the each customer has their own kind of like
42:36
priorities around it. But when it comes to risk fraud,
42:39
actual security Technologies, you know, it's very, very hard
42:43
to build it yourself and the other part that we're seeing
42:47
that is also kind of like similar to it is when it comes
42:51
to account opening in highly regulated markets such as the
42:59
financial Market, It. So you get a lot of light, you
43:02
know, document scanning and things like that, which are
43:06
really, you know, to prevent fraud account opening fraud
43:10
where someone is pretending to be like, you know, Jim were Jeff
43:14
and trying to open an account on your behalf.
43:17
Like this is a typical attack, right?
43:18
Like, Eye-Fi convince the bank that, you know, I'm Jim.
43:23
And they open an account for Jim and then like, you know, I do
43:28
some basic stuff in the account and then, Take like a 60k loan
43:33
and I disappear. The bank is going to go after
43:36
Jim is not going to go out after after me, right?
43:40
It's like so I'll even yeah it is.
43:42
So in the u.s. we, you know, the big regulation is anti-money
43:46
laundering am L. The idea is like, okay, I'm
43:48
making cash through some illegal business, and I'm laundering it
43:53
by trying to make it legal dollars at this point and put it
43:56
into a bank account. So, you know, obviously, if you
43:59
take Dollars and run away. You make fifty thousand dollars.
44:02
But if you're taking millions of dollars of cash from no legal
44:05
operation and, you know, now making it legal by putting it,
44:10
into the system, paying taxes on it, things like that.
44:14
Yeah, so definitely account opening is a major attack.
44:18
Yeah. And as a major attack like, you
44:22
know, that Victory, you need to like nav, very, very good skills
44:27
in like your ability to actually detect.
44:30
And, you know, detecting these attacks, involve a lot of
44:33
understanding or not. These fraudsters operate, how
44:37
they try to bypass the different controls that the bank's put in
44:41
place? So, you know, this level of
44:43
expertise is is very, very hard to obtain.
44:48
When we talk about build versus by always go back to, you know,
44:51
a company. Like let's just pick something,
44:52
fictional hopefully Larry's Tire Shop, Right?
44:55
Do you want to be in the business of creating risk fraud?
45:00
Technologies, or do you want to focus on selling or, you know,
45:04
installing tires, right? Think that's, that's the
45:06
question. Take a lot of organizations they
45:09
end up struggling with sometimes is like, okay, well, they
45:11
started down this slippery slope of identity because you're
45:13
totally right. You stolen my thunder was
45:15
thinking. Okay.
45:16
Well there are probably certain components of identity that are
45:19
I won't say easy. But relatively easy to do on
45:22
your own, you can stand up your own open ldap and create an
45:24
identity store. Maybe we could do some light
45:27
provisioning through Powershell and things like that, if you're,
45:29
you know, an active directory. You're a sure, something like
45:31
that. But I think the further you go
45:33
to the right when it comes to maturity, things like,
45:37
intelligence risk, fraud signals there is no way that you would
45:43
ever be able to compete against someone who does this day in day
45:47
out. If you try to do it yourself,
45:48
even the largest companies in the world would struggle with
45:51
us. Imagine, I mean you're you're
45:52
you know, transmits working with a bunch of Banks.
45:55
Banks typically have a lot of cyber security budget and
45:58
resources because you know, they need to keep money secure and
46:02
safe and do the anti-money laundering.
46:05
Do the know your customer, right?
46:07
All that stuff to make sure that things have the appropriate risk
46:09
and protections around them. So, you know, I think about this
46:13
from like, okay, well we're going to go off and do it.
46:15
Ourselves really is that really the business you want to be in
46:19
because I think you're being a little bit more.
46:21
You can chew. Nah, definitely something.
46:23
Not something that, you know, a lot of these, a lot of, you
46:27
know, the the organizations that we're seeing at least or Trying
46:30
to do themselves. You know, some of them are not
46:33
trying to do this at all which is, which is okay.
46:36
It depends really on the level of risk and the attacks that
46:40
you're actually seeing, you know, from my 30-something years
46:45
in in in the space. I know that which is really
46:49
funny like, you know, you know, that these attacks are going to
46:53
come but then like, you know, organizations really prefer to I
47:00
first see the loss for CDI. You know, the problem first see
47:06
themselves bleeding before they actually, you know, by solution
47:12
and I remember and this goes back like, you know,
47:14
20-something years ago when I was the co-founder of a global
47:18
web application security company.
47:21
And, you know, we kind of like, you know, where the first to
47:26
introduce the web application firewall concept.
47:29
And one of the The first prospects we add was a bank and,
47:34
you know, they knew like, you know, most of our customers back
47:37
then knew nothing about, you know, application security web
47:41
application security. And what we did back then is to
47:46
do like penetration testing, application, Level penetration
47:49
testing to show them that a problem exists.
47:52
So they would buy, you know, our solution.
47:55
So I remember this like, you know, One Bank in the US, you
47:59
know, it's it wasn't a all Bank was pretty like no big bang and
48:04
we went there and we'd like a penetration testing against the
48:08
online banking application and I think it was like within like
48:11
one hour we're able to get to the entire database.
48:15
Love their customers and like, you know, do transactions on
48:19
behalf of customers and they're kind of like conclusion was.
48:25
Okay. So we got like a couple of bucks
48:28
in the application will fix that.
48:30
Thank you. We don't need any other control.
48:34
So you know, eventually obviously all the bank's today
48:38
have a web application firewall. And this is kind of like you
48:42
know, part of the standard but just demonstrate that until they
48:46
actually start bleeding and that's true for you know I guess
48:50
everyone you don't go and just buy Solutions.
48:55
I think there's two types of people in the world.
48:56
There's the ones that they get a cut and they go by a by a
48:59
bandage and then There's others who have just, you know a couple
49:02
bandages laying around the house in case they get cut.
49:05
All right I know we've been really pretty generous with your
49:09
time. I want to ask a question about
49:10
password list because I feel like this is a question that
49:13
comes up every year. You know, is this the year that
49:15
the password eyes that's been I think something has been
49:18
happening for the last 10 years now.
49:20
And, you know, Jim you I think you kind of coin is one of our
49:22
previous episode this year is like, is this the decade that
49:25
passwords died because I feel like there is you know it's a
49:29
freight train. We're talking about really
49:31
changing the direction of one of the core principles, or one of
49:36
the core things that drives sort of security.
49:38
It's the password is this, is this the year password eyes?
49:43
Is this the decorated? Password dies is the century.
49:46
That's weird. Eyes, I guess, where do you feel
49:48
like we are in that journey to eventually at some point get rid
49:53
of the password. So I think, you know, we need
49:56
to, you know, split the question into two different.
50:00
Current domains. The first one is Workforce and a
50:03
second one is consumers. When it comes to Workforce.
50:07
I think like, you know, even though many of the projects that
50:12
we've seen last year for password less were in Workforce
50:17
or for the workforce, I think that it's going to take a while
50:22
until we see the password die, you know, in these environments
50:27
and the reason is Legacy systems.
50:30
Well, we got a lot of Legacy systems in these environments
50:33
that should do when it comes to large Enterprises.
50:36
And you know, you go to large Enterprise, and, and amount of
50:41
systems they have that are like, no, probably 15, 20 years old,
50:49
you know, it's like, you know, it's huge huge and you know,
50:53
these systems do not support any password less capabilities and
50:58
they will not support any Casper.
51:00
Let's Capabilities, like I still have like, you know,
51:03
organizations with as400 and obviously main friends.
51:07
And so it's going to take a while.
51:10
You'll see, you'll see a mix of systems where you can go, you
51:14
know, passing that's definitely all these SAS applications.
51:17
Everything that is in the cloud relatively easy to go password
51:21
this. But, you know, a lot of the on
51:23
Prime stuff. Just, you know, it's not going
51:26
to go away that that fast on the Consumer side actually on Mom,
51:34
you know, much more positive that we can get rid of passwords
51:39
relatively faster. And the reason is the, you know,
51:44
first the Readiness of the the protocols the support that we're
51:49
getting as an industry from Apple.
51:53
Google and Microsoft with task keys and you know the
51:56
technologies that they're building into the operating
52:00
system Eames and the browsers and the fact that most of the
52:05
endpoint devices, whether these are mobile devices that desktops
52:10
are now coming with support for device Biometrics, whether its
52:16
face recognition fingerprint scanning like this support, all
52:20
that. So you know, and they support
52:23
all that for the past few years. So I'm you know, I'm much more
52:28
bullish about that. I I think that organizations
52:31
that want to go password Less on now to do this in 2023 and we'll
52:41
start seeing like, you know what, eventually it will be
52:44
like, you know, you don't want to stay behind, right?
52:48
It's like you don't want your customers to stand with
52:51
passwords when all the other organizations are offering
52:54
Castle these Technologies. So for example like you know,
52:58
City Bank, which is A customer of ours or not in a very big
53:04
project to deploy password list technology to like, you know,
53:10
200 and users across the across the globe and we're seeing quite
53:15
a few large institutions, doing odds doing the same.
53:19
So I think that Mike, you know, second half of the year, we'll
53:24
see many more projects around Castle.
53:26
Des, I think that a lot of the organization's It to plan for
53:31
Paso. Robles last year continued to
53:34
plan for password less this year, second half of the Year.
53:37
Beginning of next year are going to be will see a very big move
53:42
toward Castle desk on the consumer side.
53:45
Okay, so you heard it here first, the password eyes, /
53:47
Mickey would I let no later than 2020 for.
53:51
So we're going to hold you to that.
53:55
I can tell that we're getting short on time because your
53:57
background is getting slowly and slowly darker as the sun, Sets
54:01
over Israel Sky there, which is very cool.
54:04
I want to end on a lighter note, we were kind of talking before
54:08
we hit record about. I think our love of travel and
54:12
restaurants and food sort of around the world and things like
54:15
that is. It's one of the things I think
54:16
all three of us look forward to after a long day especially
54:19
after travel and I want to ask each of you give me us like a
54:25
small town restaurant or meal or some other.
54:30
Sort of, you know, similar sort of activity like that, that you
54:35
just really enjoyed or conversely.
54:38
If you have a really memorable, one that you just did not enjoy,
54:41
because I think that's one of the things that really
54:43
fascinates me specifically about travel is being able to visit
54:46
all these different places. And, you know, I remember my
54:49
first trip to New York City and it was like, you mean, there's
54:52
like this Deli, like every other block and there's like this
54:55
amazing food in there and it was like nothing high-end but which
54:57
is good stuff. That's not my example, but I'll
55:01
start with you Mickey. Like, do you have an example
55:03
like a surreal? Get small town restaurant,
55:05
something, maybe something local to you or something.
55:07
You've encountered in your travels.
55:09
Wow, you mentioned travel. And, you know, I've been
55:12
traveling a lot for the past like, and I don't know, like,
55:15
20, something years and you know, many of my troops were to,
55:21
to do not Estates. And it's pretty, it's pretty
55:24
long flight from Tel Aviv to sell these to New York is about,
55:28
you know, between 10 and 12 hours.
55:31
So typically you get, you know, you get or either late at night
55:36
or very early in the morning and I remember liking a couple of
55:41
times. So first of all like you know
55:43
for for perhaps a day kid every time I got into the state's, I
55:49
was like you know the first thing I was doing I did was to
55:52
go and get a burger because like you know, back then the burgers
55:56
were so much better than the one that we had in the Israel, you
56:01
know, now we're alike. I think like, you know, we're
56:04
very good at it as well. But, you know, I remember this
56:08
like, you know, one time that I landed in Newark and I stayed at
56:16
your hotel at one of the hotels in the in the airport it was
56:21
like a pretty shitty hotel rights.
56:23
Like you know, something that you know I would not do right
56:28
now but back then You know, I was on a very tight budget and I
56:33
said, that'll tell and I went to like the until bar and I ordered
56:38
a burger and it was I don't know why it was the best burger I had
56:44
in my entire life. Really.
56:46
And then I am still a story that, you know, this one is from
56:50
the Bay Area and you know, very similar like shitty hotel.
56:56
And I remember like, you know being like you know it was you
56:58
just tell that probably You know, probably like a got a room
57:03
there for. I don't know like, 60 bucks and
57:05
night and, you know, went to, you know, went to the bar in the
57:10
evening and I ordered soup. And this was like, you know, the
57:16
best soup, add my entire life. And I don't know why.
57:21
But, you know, these are two things that I remember for like,
57:25
in a war than 20 years now. Jim, hi yourself.
57:28
We got some memorable meals. Yeah, I mean it.
57:30
It's it's along the same lines as Mickey, right?
57:33
Like When you start are still talking about a meal that you
57:38
had years ago or Mickey's case decades ago, it deserves
57:45
mention. So there's a restaurant in the
57:47
Caesars like this is not like hey, this is a quarter place and
57:51
you can spend 20 bucks and get a good meal know, this is hundred
57:55
dollar plus steaks, but the stakes are so good.
57:59
So Old Homestead in Caesars Palace.
58:02
So if you're going to Will Gardner you, so always Hold
58:04
their conferences there. So I've been to Caesars a bunch
58:07
of times. Anyway, this you were there with
58:09
me Jeff. I sure wise in that, yeah, that
58:11
Wagyu steak was just ma perfect. Yeah.
58:15
And like it's like 120 bucks for a steak and they come out and
58:19
it's a plate with a piece of meat on it.
58:22
Nothing else, right? It's taking up late at stake in
58:24
a plate and but boy was it worth every penny?
58:28
Yeah. That was that was a darn good
58:30
meal and I think it was. Yeah I think it's it's not just
58:33
the food. It's usually the Ambiance is
58:35
everything kind of goes around it.
58:36
That sort of forms, that memory. And I've got a few.
58:39
I'm thinking of another meal. It seems like there's a theme
58:42
like Jim and I had that great steak.
58:44
We went to a restaurant called, fang in San Francisco.
58:47
It's a Chinese place next to Moscow.
58:50
Nice enter. And I don't know what it was,
58:53
but that was just a darn good food, man.
58:56
I mean, they come out with the fried rice.
58:58
They do the whole like swirling scrambled egg, right there at
59:01
the, at the table. I mean, the whole place.
59:04
Stunk. Oh yeah, it was like, oh, we
59:07
couldn't like see or breathe but the food was really, really
59:09
good. Yeah, that what it was was that
59:13
scrambled egg mixture that they put down has some kind of pepper
59:16
sauce in it and when it heats up, it's like tear gas.
59:20
Yep. I've used to better link to
59:22
holds the whole restaurant starts coughing, anytime someone
59:25
rotors fried rice because it's like tear gas throughout the
59:28
place. So yeah, really strange, but
59:31
excellent food. Yeah.
59:32
And everybody orders it because it's okay.
59:34
One of the one of the I guess the other Specialties, you know,
59:38
the other one I was thinking about was this is not I my I
59:40
guess this is travel but not like exotic.
59:43
I actually had to go into Charlotte North Carolina and not
59:46
too long ago, to work on some stuff and I found this tiny
59:51
little barbecue place and like this strip mall, it's called The
59:53
Q Shack. It's like on the Southeast side,
59:56
kind of like past Matthews area for people who are familiar with
59:59
it, and this is just the place that just doesn't look anything
1:00:02
like special, but I tell you, it might be.
1:00:04
The best barbecue I've ever had. I mean it was fantastic and I'm
1:00:10
planning on going in there. Thursday, have to go back to
1:00:13
Charlotte this week so it's just one of those little things that
1:00:16
kind of popped up and I was like, oh yeah, we'll just try
1:00:18
it, you know, kind of there with my wife and we walked out like
1:00:21
super impressed and it was just, you know, it just a regular day
1:00:24
is like, okay, that was really good stuff.
1:00:27
So did you put her did you put a review on Yelp or anything?
1:00:31
I did, you know, five stars and so, Is like, this is this is
1:00:35
darn good stuff, man. I've another story which is kind
1:00:38
of like another the opposite, which I think was like, also,
1:00:42
like, not probably 15 years ago Scottsdale Arizona, I was during
1:00:46
a conference and then like no one of my cells guys told me
1:00:52
like live, there is, you know, really, really good.
1:00:56
Mexican restaurant. It's just like an old 30 minutes
1:01:00
drive for me or let's go. You have to go and we went to
1:01:03
this place. Lace and this was like, you
1:01:06
know, hardcore Mexican restaurant like you know only
1:01:10
Mexicans there and you know, they're like okay we can serve
1:01:15
you these poor very, very hot. What do you prefer?
1:01:19
I was like you know, The least hot that you can make that's
1:01:24
good for me and I couldn't take more than two steps, right?
1:01:28
It's like it was, it was so hot. Like, you know, I was starting
1:01:34
to sweat from places that I didn't even exist and, you know,
1:01:38
people were looking at me and I was like, okay, what do I do
1:01:43
now? You know, I can still imagine
1:01:47
that like even 15 years later, it's like was Horrible.
1:01:52
Yeah. You know if here it's hot
1:01:53
interior seats. Wet.
1:01:56
I Rise. We are.
1:01:57
I mean II could go out a couple different things but I had a
1:01:59
chicken sandwich. We went out for burgers in
1:02:01
Chennai about 10 years ago with a team as working with out there
1:02:05
and you know, I wasn't thinking at the time and their burger
1:02:10
means chicken sandwich is like, okay, that's fine, right?
1:02:13
No. Big deal.
1:02:13
And this might be, it might have been liquid lava, that was I
1:02:17
took like one bite and I was trying to be respectful and
1:02:20
polite so way that Mike I'm really sorry, but if I eat this,
1:02:23
I will die. Well, the funny thing is we were
1:02:27
in Nashville recently, and now everything is like, Nashville
1:02:32
chicken. And you get National chicken
1:02:34
anywhere in the United States. Yeah.
1:02:35
The higher the day I was in the freezer section at the grocery
1:02:38
store and it was Nashville style shrimp.
1:02:41
I was like I think you made that up anyway.
1:02:44
You love Hattie B's which is like the national chicken spot.
1:02:49
I like it. Yeah, it's good.
1:02:50
Yeah. But you You get you don't get
1:02:52
him National. Yeah you know chickens good.
1:02:57
I don't like super spicy. There's a difference between
1:03:00
spicy good and spicy just for the experience like I want
1:03:04
flavor it's is almost like that show that hot ones on YouTube
1:03:08
which has gotten over you know famous over the last several
1:03:11
years like there is a difference between yeah that's a little bit
1:03:14
of spice. It amplifies and helps the
1:03:16
flavor versus this is a trial that I must pass to become a
1:03:20
warrior. Of spice or whatever it may be,
1:03:23
right? Like, I'm not a fan.
1:03:25
Like, I'm not interested becoming a warrior spice.
1:03:27
I want delicious flavorful food and I feel like there's a lot of
1:03:30
places when they do the hot chicken is they just throw spice
1:03:33
at it just to make it hot and there's no flavor to it.
1:03:35
It's just hot for hot sake rather than trying to actually
1:03:38
have a flavor, which bugs me. Yeah.
1:03:42
That's myself box. I'm going to see you.
1:03:45
All right. It is now dark outside of
1:03:47
Mickey's window so we're going to let him go make it really
1:03:50
appreciate the time that you spent with us here.
1:03:52
Today we're going to have a whole bunch of links in the show
1:03:54
notes, you know, to connect with Mickey on LinkedIn.
1:03:57
If you've got questions concerns, or if you want to,
1:03:59
maybe share a good or bad meal that you've had, we'll have a
1:04:03
link to transmit security as well.
1:04:06
We'll go ahead and wrap things up for this week.
1:04:08
You find us on the web idac. Test.com.
1:04:11
We're on Twitter at idea. See podcasts.
1:04:14
We're on Mastodon at. Idac podcast at infosec that
1:04:18
exchange mastodons. Got to get way easier to take
1:04:22
off Jim and I are on LinkedIn and don't forget to subscribe
1:04:26
and and you know like the episodes and stuff like that
1:04:29
that way, you know, when new ones are coming out.
1:04:31
So Mickey, thank you so much for your time and we'll talk with
1:04:34
you all in the next one. Thank you.
1:04:36
Just thank you, Jim. I'm going to get some dinner
1:04:40
right now. So I got really angry right on.
1:04:44
Take care of. Thanks for listening to the
1:04:50
identity at the center podcast. If you like what you heard,
1:04:53
don't forget to subscribe and visit us on the web and identity
1:04:56
at the center.com.