Latest / Identity at the Center / #365 - Exploring the Future of Machine Identity with Felix Gaehtgens

Transcript

#365 - Exploring the Future of Machine Identity with Felix Gaehtgens · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:10
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Not so bad yourself. Doing great, man.
0:17
It feels like it's been forever that we've been able to sit down
0:21
and actually do a podcast like this.
0:23
I just got done watching our string of podcasts that we've
0:26
recorded at EIC and that night, Danena Verse, I'll tell you what
0:30
they both feel like they were like a year ago.
0:33
In that time, I've moved, I'm getting settled, or I should say
0:37
I'm moving. I feel like moving just takes
0:40
forever because you actually when do you call it done?
0:44
I don't think you ever do because I'm still finding boxes
0:46
from three years ago when I moved from Chicago to North
0:49
Carolina that like, I don't know if I'll ever actually open that,
0:52
but I, I don't know if I want to get rid of it.
0:54
Yeah, yeah. I mean, you know, I found some
0:56
boxes as those moving pictures from high school and stuff like
1:00
that. It's like you're not throwing
1:01
those away. You might never.
1:03
You only look at the one you move.
1:05
But you can't, you can't actually put those in the trash
1:09
can, can you? Why?
1:10
Don't you just auction it off to everyone?
1:13
Don't look inside, just auction it off OK?
1:19
That's that's also an option. I guess while we got you here,
1:21
Felix, let me go ahead and introduce you.
1:22
So we've got Felix Gaitgenz, he's the former Gartner
1:25
analysts. I feel like we're the kind of
1:26
like the first stop for people who were at Gartner kind of
1:29
moving on and we're we're happy to have you on here.
1:32
Consider that a badge of honor, I guess.
1:35
Yeah. So before we're we're going to
1:37
talk about machine identity, there's a couple things Jim and
1:39
I want to cover here. We've got some conferences
1:41
coming up. Jim, you've been moving and
1:43
you're right, it's been like a couple of months since we've
1:45
actually sat down and sort of like our ** of home studios.
1:48
You're not back fully to your home studio, but I have to
1:52
imagine that we're probably, what, a couple weeks away from
1:55
kind of having you back at full strength?
1:57
Yeah, I mean, as you want people who watch the show on YouTube,
2:01
which by the way, we put every episode out there on YouTube,
2:03
you'll see my background evolve over time.
2:06
You know, I've got the old school fan behind me, the old
2:09
school Vertical Blinds. I'm going to move to a different
2:12
room and it'll be much more like Jeff's background.
2:15
And I don't think I'll, Jeff, I don't think I'll ever achieve
2:17
your background. I probably won't ever have a
2:20
crisp, clear camera like you have.
2:23
But you know, I can strive to such things.
2:26
Hey, you know, squad goals, let's call it that for the
2:29
podcast. We'll see.
2:31
There's always green screens. There's so many different
2:33
options. I've actually been thinking
2:34
about kind of toying with my background a little bit if had
2:37
the same 1. So if you're on YouTube, you can
2:38
kind of see it's been the same for a while.
2:39
I'll change up the lights, maybe the video playing behind me,
2:42
kind of stuff like that. Maybe I'll start to throw like
2:45
AI generated videos behind me. I created one of like a dog
2:48
doing, you know, DJ ING. I mean, I'll put that on a loop
2:51
and have that behind me. And maybe that'll be kind of
2:52
like an Easter egg for, you know, people who kind of watch
2:55
this on on YouTube, but. I think this is called
2:57
refactoring. Refactoring.
3:00
Yes, it's OK to get smarter, right?
3:03
We can always improve or try new things.
3:05
And you know, if people don't like it, I can always change it.
3:07
Or if I like it, screw you, I'm going to keep it and do what I
3:10
like to do. It's my.
3:11
It's my. Green screens are really not new
3:14
for us because we used to do live streams and the idea was
3:17
let's put green screen behind and we'll try to have fancy
3:20
backgrounds and that was cool, but it was a lot of effort.
3:24
You need good lighting, you need a good green screen, and you
3:26
need a really good solid lighting to pull off a good
3:29
green screen effect. And, you know, we've all seen
3:31
like the bad ones where you have like that shimmer, you know,
3:35
kind of old Star Wars look of a Force ghost, you know, in front
3:39
of a camera, that kind of thing. But yeah, we'll, we'll continue
3:42
to work on it. Let's jump into some of the
3:44
conferences we've got coming up because I've been doing a couple
3:47
different things and I've got some more things coming up here.
3:49
We've got the Cyber Risk Summit, So that's put on by the CRA
3:52
folks and people who put on identifiers.
3:54
So I just did one to rally a couple weeks ago and that was
3:57
kind of cool. I moderated a panel or an
3:59
incident response and sort of threat mitigations and things
4:02
like that. So it was kind of cool.
4:04
I'm going to be doing the same thing in Chicago and in
4:06
Philadelphia in September. So we'll have on our homepage
4:10
for idacpodcast.com. If you just Scroll down, you'll
4:12
see I've got some free passes. So anybody who's listening, you
4:16
know, they can register for that and hopefully I'll see people in
4:19
Chicago and Philadelphia for that.
4:21
So that's cool. We've also got the Ideniverse in
4:25
DC that's taking place in November.
4:27
I think it is. I'll be there.
4:29
I don't think, Jim, I'm not sure if you're going to be there yet
4:31
or not, but right now. We'll figure it out, we'll
4:34
figure it out. I mean, I really do love being
4:36
out there interacting with practitioners, you know, our
4:40
people who are just like us. And so I'm going to try to make
4:44
it out there. But it's been tough to travel
4:47
with the move going on. But by November, I think things
4:50
will be settled down. But you've been doing Yum's work
4:53
getting out there and representing the podcast chef,
4:55
so it's been fantastic. Yeah, it's cool.
4:57
And, and I dig it when people come up and, you know, most
5:00
people notice you because you're usually dressed in a very
5:03
conspicuous way, some sort of jacket or cowboy attire or
5:07
whatever it may be. And so people, I think, you
5:09
know, naturally gravitate to like, who the heck is this guy?
5:12
Why don't you be so different, right?
5:15
So Ideniverse. And then, yeah, we're going to
5:17
be at Gartner again this year. So we've got kind of a cool
5:20
session that we've been planning with our friend Rebecca over at
5:23
Gartner. So we have a new game show that
5:26
we're going to be working on. So it will probably debut
5:29
Gartner. We might do it at a dinner verse
5:31
to kind of, you know, work through that as well.
5:33
But right now it's called majority rules and it has a lot
5:37
of audience participation. So people will play along with
5:40
us. And so we're still working out
5:42
kind of details exactly how we want to pull it off.
5:44
But a new game show brought to you by IJ at the center.
5:47
So that's kind of. Yeah.
5:49
Well, I think the game shows are been a big hit, especially it's
5:53
one of those things where you want to see it in person.
5:56
So I think we probably will debut it at Gartner, make it
5:59
special for Gartner. But I think that one thing I
6:03
wanted to throw out there about Gartner is that it's at the
6:08
Gaylord in Grapevine, which is right near Dallas.
6:13
It's a fantastic venue for families.
6:16
So especially around in December is right around Christmas time.
6:19
So you get to see all the decorations that they do and
6:22
they kind of started up that way.
6:23
So if you're thinking about going and thinking about
6:25
bringing your family, I think it would be a great thing for young
6:29
kids. Yeah, it's kind of a resort
6:31
style place. And for those wondering, yeah,
6:34
we'll have a discount code that's actually going to go live
6:36
in October. So right now there's still early
6:37
bird. You get registered with that or
6:39
we'll have a discount code in October for people to use and
6:42
you'll find that on our on our website as well.
6:44
So, OK, so we've kind of covered all that stuff.
6:48
Let's talk machine identity and, and Felix, I kind of introduced
6:52
before and I'm always curious how people get into the world of
6:56
identity and access management or digital identity or identity
6:59
security or whatever it is the heck we're calling the space
7:01
that we're all in. So tell us something about your
7:03
background. How did you get into identity?
7:08
Well, I got into computers when I was 8 and into Unix when I was
7:11
17. Got my first e-mail account
7:13
through something called GUCPI don't know if you guys even know
7:16
what that that is. She was a little younger.
7:18
But I I then work as a software developer, sys admin, network
7:22
engineer, database admin, you know, all this kind of stuff.
7:25
And I have a pretty deep technical background.
7:27
The 90s, I was connected to the Internet that was like, so they
7:31
also you could see your packets go around the world almost real
7:34
time. And so I was on projects to
7:36
build and operate ISPs. We had service providers,
7:38
eventually got into bigger projects and got the chance to
7:41
work with telcos. And that's when I first heard
7:44
about the term provisioning. And then later on I slid into
7:48
LDAP and just as the term identity manager was making its
7:52
way, I was the space with a virtual directory vendor called
7:55
Simlabs. There were four commercial
7:57
products then and only one of them, Radiant Logic is still
7:59
around. All others got acquired.
8:01
But anyway, when I first heard provisioning used for, well,
8:05
enterprise provisioning, I, I thought it was a joke.
8:07
Yeah, compared to the pretty elaborate and crazily difficult
8:11
provisioning process that were used at telcos.
8:14
But I, you know, joined and stayed in the IM field for more
8:18
than two decades, doing all kinds of things and eventually
8:21
working as an analyst for Copencola.
8:22
And then after short hiatus at Gartner for 12 years.
8:26
And now I'm currently on a career break doing a lot of
8:28
thinking and writing on machine IM.
8:31
Yeah, you've done a lot of LinkedIn posts recently around
8:33
that and I definitely want to get into, you know, that's kind
8:36
of the purpose for today's conversation is all right.
8:38
So Felix, you've been flooding the zone, so to speak, with like
8:40
machine identity. Why is it top of mind for you
8:43
right now? Is it just something that you
8:44
think needs to be addressed? Is there something more to it
8:47
and infatuation? I go back the same way with you.
8:49
I've been in computers since I can never remember the, the IBM
8:53
was APC junior and was my first computer and when we first
8:57
brought it home and the dual, you know, disk drives and
8:59
cartridges and stuff like that. So I'm a.
9:01
Oh, we were almost the same age then, I guess.
9:06
Well, look, I understand the bigger story.
9:08
Let's we really have to zoom out a little bit.
9:10
So here's what keeps me up at night.
9:12
Every critical business process today runs on machine to machine
9:16
interactions. So you have apps talking to
9:18
services, services calling APIs, and now you've got AI agents in
9:23
the mix as well. So the majority of your business
9:26
is literally machines talking to machines, right?
9:30
I've gotten pretty good at managing human identities,
9:32
usernames, passwords, multi factor authenticate and all that
9:35
good stuff. But ask any IM team how they're
9:38
handling machine identities and just watch them score once
9:41
they're doing a terrible job. And you know, I, I understand
9:45
why, you know, let's emphasize a little bit here.
9:47
I, I can count the exceptions though, on one or maybe 2 hands.
9:52
Uber is one of the few companies getting it right and even
9:55
they're still grinding away at it.
9:57
And, and so I think the real problem that we need to solve is
10:00
securing these machine and machine interactions.
10:03
That's the game, that's what matters.
10:05
They could try to solve this with NHI approaches means more
10:10
API keys, more service accounts, more static credentials.
10:13
But that's just doubling down on the problem.
10:15
You're creating more technical debt, not less.
10:18
And so I I think the breakthrough inside is really
10:21
that modern machine to machine interaction, these interactions
10:25
don't need these legacy identity constructs at all.
10:28
We have better ways. The question isn't how do we
10:31
manage NHI spinners, how do we build secure machine
10:34
interactions without that? And I think that's the
10:36
conversation that have you seen that should be having right now?
10:40
So I think this is super timely and I guess there's I don't at
10:44
the risk of getting too confused, we have machine
10:47
identity, we have NHI, we've heard workload identity.
10:51
These are all just aren't these all just service accounts?
10:54
Like why, why do we have so many different names for this?
10:56
And I guess why does why does machine identity, you know, when
11:00
in your mind compared to maybe something like NHI or workload
11:03
identity or maybe it's something else?
11:05
Sure. Look, I'll, I'll be blunt about
11:07
NHI. There's a lot of hype.
11:09
NHI is a hot buzzword and buzzwords have this tendency to
11:13
Mac back, make background buzzing noise, which sounds like
11:16
this is this is, and yes, I'm spelling that exactly how it
11:19
sounds. So when you dig into what people
11:22
are actually talking about, it's those legacy artifacts.
11:25
Every organization is drowning in API keys, service accounts,
11:29
static passwords, personal access tokens, right?
11:32
Goes on and on. I call this what it is.
11:34
It's technical debt. Sure, you need to find and
11:36
manage what you've got today. But here's the bottom line.
11:39
The goal isn't better NHI management.
11:41
That goal is actually, or should be, to stop creating these
11:44
things all together. Use modern machine identity
11:47
practices that don't just manage the problem, try to eliminate it
11:50
as much as you can. So you know, while everyone's
11:53
chasing the NHI buzzword, smart organizations are asking
11:56
themselves, how do we build systems that don't need these
12:00
legacy identity constructs in the 1st place?
12:02
That's where the real conversation should be.
12:06
So Felix Merrill, what is the what's different about machine
12:12
identities and human identities? What about them, about managing
12:16
them is different? OK, well, OK, when when when
12:21
people ask about human versus machine activity, I always start
12:24
with the reality check, right, Because non human isn't really
12:28
just work with devices. She have a pet, you know, that
12:31
has microchip probably in their ear.
12:34
That's already management too. There's there's legal
12:36
identities. That's a legal entities that
12:38
also have identities. So the scope is is really much
12:42
bigger than than people saying now we talk about humans versus
12:46
machines. Let's first we briefly talk
12:48
about the similarities. Machines actually use some of
12:51
the same technology that we use for humans in terms of IM
12:55
especially Oauth for authentication and
12:57
authorization. But now here's where it gets
13:00
really interesting, because the differences between your
13:04
handling humans and machines are really game changing.
13:07
First of all, machines don't necessarily need accounts.
13:11
Now let that sink in for a few seconds, right?
13:15
Think about it. When a container spins up, we
13:18
create a new identity with it. The container terminates, the
13:23
identity vanishes. Poof, no orphan accounts
13:26
cluttering your directory. And you know, second, forget
13:29
multi factor authentication for machines because they can't use
13:32
MFA, right? So how do you secure them?
13:34
Simple, don't store credentials at all.
13:37
Generate ephemeral one time credentials on the flight when
13:42
the machine starts up. And, and here is where it gets
13:45
messy. You know, most organizations are
13:47
doing this completely wrong. I think they're treating
13:49
machines like humans. They create accounts, assign an
13:52
owner, store credentials in a vault, do quarterly
13:56
attestations, and eventually decommission these accounts.
13:58
That's backwards. The right way, in my opinion, is
14:02
embed identity in the workload life cycle itself.
14:05
Workload starts, identity appears, workload stops, poof,
14:09
identity disappears. Automatic clean right stop
14:13
assigning individual owners to workload identity.
14:15
So why would you do that? Assigning assign ownerships to
14:19
to applications? That that makes much more sense
14:22
if you assign ownership to applications instead and make
14:25
those owners groups, not individuals.
14:27
Even if it's a person making a group of one that's not just
14:31
clear, I think it's the only way it scales.
14:35
So it was the the distinction made between MHI and machine.
14:41
It all felt like they're synonyms, right?
14:43
They, that's what I felt like. And it feels like within this
14:49
whole space, there's so many different types of accounts that
14:54
are machine accounts. You have everything from devices
14:57
to workloads. I know you, you mentioned like,
15:00
OK, let's handle business entity and things like that separately.
15:04
But it kind of feels like within the space are things like
15:08
service accounts and things like potentially API keys and things
15:13
like that. Do you have a taxonomy in your
15:16
mind in terms of what the buckets of different types of
15:23
non human accounts are? I'm thinking about it from a
15:25
practitioner perspective because practitioners are trying to wrap
15:29
their brains around just like what do I need to care about?
15:31
Is it the IoT devices on the manufacturing floor?
15:34
Is it the thermostats? Or do I only need to worry about
15:39
service accounts and things that are workflow related?
15:43
Maybe device related, but answer that question if you would.
15:47
Sure. Yeah.
15:49
So I would always start in, in the taxonomy, I would say we
15:56
have machines and machines can be devices that you can touch
16:00
and workloads that are a piece of code.
16:02
And you know if you ask any computer science graduates,
16:05
they'll tell you that piece of code is a machine as well,
16:07
right. So this probably all lives under
16:10
machines. Now what you mentioned are
16:14
legacy constructs, API keys. I like terrible, like friends
16:19
don't let friends use API keys. I'm, I'm serious about this.
16:22
An API key is like a piece of cash.
16:24
You drop that, you drop that coin.
16:26
Anyone can pick it up and just use it to buy something else,
16:29
right? Service accounts are terrible
16:31
too, because you create an account for something.
16:33
Now you've got this piece of toxic sludge that you have to
16:37
manage, right? So the the much better way of
16:40
doing these things is when you really focus on what does it
16:43
take to enable secure machine to machine communications.
16:50
It's not like do I use an API key or do I use a service
16:52
account? It's like, well, let's try not
16:54
to use these static constructs that come with all of these
16:58
problems with it, but let's try to use modern dynamic identity
17:01
constructs that shift the whole responsibility from managing
17:07
static accounts and keys to managing policies, having the
17:14
identity live with the workload. Like you don't have to create
17:18
the account for the workload. The workload starts, Dang, it
17:21
gets its identity dynamically, right?
17:23
That's a much cleaner way to do it.
17:25
I definitely see, you know, the kind of the modern IT doing some
17:29
of these ephemeral workloads and things like that.
17:32
But we Jeff does this was kind of my favorite saying we have 1
17:36
foot to pass one in the future. So most of us practitioners are
17:40
dealing with things that are not ephemeral service accounts and
17:46
things like that that have those same problems.
17:49
And in fact they very well may be the riskiest, riskiest non
17:55
human accounts that we have kind of how do we deal with that from
18:01
that that same framework that you're talking about?
18:04
OK, I see it the $1,000,000 question right?
18:07
How do we clean up this, this legacy?
18:09
I'm already drowning in service account.
18:11
What now, right. I, I get it, you've got legacy
18:13
mess everywhere, but I do have a three-step game plan for you.
18:18
So the the first thing is you need to stop the bleeding.
18:21
Don't create any more of these things.
18:24
This is really important because the technology to do this right
18:28
already exists in your environment.
18:30
You just need to learn the modern patterns.
18:32
I'm constantly posting about this stuff on Linu because
18:34
people need to see there are better ways.
18:37
And the second thing is, yes, absolutely you need to manage
18:40
the mess that you already have. And sure, there are plenty of
18:43
vendors selling workload identity management solutions,
18:45
although they hype it up as NHI solutions.
18:48
But here's what they won't tell you.
18:49
These are band aids, tactical fixes, right?
18:52
They they helped you invent, re and rotate your existing junk,
18:55
but they don't get you off the junk, right?
18:57
And this is exactly why the whole NHI narrative bugs me.
19:00
Venice are literally selling you better ways to manage bad
19:03
practices and calling it strategic.
19:05
It's not strategic. This is 1 big tactical piece of
19:09
duct tape right now. Third, when you can migrate some
19:13
of that legacy stuff to modern dynamic ephemeral identity,
19:17
sometimes it's easy, sometimes it's impossible, right?
19:21
So don't aim for perfection, but aim for no new technical that
19:24
he'll always have some legacy stuff there.
19:27
And you know, the, the workload identity manager, management
19:30
vendors, the NH Ivers will always have some value there.
19:34
But you know, don't try to create any more of it.
19:37
And so the real win isn't cleaning up everything that you
19:40
have. The real win, I think, is making
19:42
sure you stop digging the hole deeper.
19:44
His legacy will always be with us, but it doesn't have to
19:46
define our future. I actually love that answer.
19:50
I mean that is the kind of stage advice that people should be
19:55
looking at. You mentioned you post about
19:57
this all the time, so give me a chance to kind of plug that.
19:59
Where do you post about this? I'm getting better at this kind
20:05
of going from being a Gartner analyst to just kind of writing
20:09
myself. It's a it's totally different
20:11
way of of of writing. I do post on LinkedIn.
20:16
I'm wondering whether I should post my articles on Medium as
20:21
well or maybe created on website.
20:24
My struggle right now is I can go pretty deep on this.
20:27
I can go pretty deep in the region.
20:28
Sometimes you have to do this because otherwise people think,
20:31
you know, you're just kind of spreading some kind of gospel.
20:33
You're not really ready to back it up with with hard fats.
20:37
But then again, when you dive too deep, you're also kind of
20:40
losing people. So I can try and kind of find my
20:42
way in between. And I think how I do it right
20:46
now is I do publish some higher level things.
20:49
I also publish some things that are much more in the weeds, like
20:52
the stuff yesterday that I published on Kubernetes.
20:54
That's a little bit more in the weeds.
20:56
And I do have some some friends who help me peer review this
20:59
stuff. You know who you are if you're
21:01
listening to this. Thanks a lot.
21:02
It's it's, it's helped. It made them so much better.
21:05
And yeah, if if you'd like a maybe to offer me some some help
21:10
by by previewing some some things that I have in the in the
21:13
works, be happy to do that too. OK, Felix, so it sounds like
21:17
people can go out, follow you on LinkedIn, follow your journey,
21:21
you see your blood posts. I wanted to switch topics a
21:24
little bit because again, kind of what you're talking about is
21:28
like, how do you make this so that you don't lose people?
21:32
Same thing from my perspective or from me and Jeff is like we
21:35
fight for the practitioner. We want to make sure that
21:38
there's a framework to build from no matter where you are in
21:41
your journey of understanding identity.
21:44
And so at a real basic level, we started with the question of
21:47
what's the difference between managing machines and people?
21:51
And now I want to think about it from the perspective of what,
21:56
what are the buckets of managing identity?
21:59
Is it life cycle and authentication?
22:02
What are the in your mind? What are the things that a
22:04
practitioner needs to think about when he's talking?
22:08
He or she is thinking about managing those buckets.
22:13
OK, gotcha. So I think I would love to talk
22:17
to, I'd love to talk about what I call the the Swiss Army knife
22:21
for managing machine identities. And again, the real objective is
22:28
to secure machine to machine interactions.
22:31
That's what we're trying to do, whether it's cleaning up after
22:35
legacy constructs or doing it properly.
22:37
This is really the main objective.
22:39
Now, if you make this just about NHI, you're accepting the use of
22:42
a legacy static identity model that's full of problems and
22:45
you're slapping on band aids, the band aids to make some of
22:48
those problems less painful, but not really solving the issue.
22:51
So if you want to secure machine to machine interactions, here's
22:54
how you should go about it, right?
22:55
First of all, you should understand where your
22:57
stakeholders are and you, we're Imers, we know this stuff.
23:00
We should know this stuff, right?
23:01
This is critical and we know this from other areas.
23:03
If you don't involve them, then you're effectively just trying
23:06
to clean up after your kids, right?
23:08
And once you know the stakeholders, bring them
23:10
together in a working group and collect the requirements.
23:13
What are they doing? Writing applications, scripts,
23:17
AI agents, other types of automations and I'll get to the
23:20
Swiss Army knife, right? You find what your Swiss Army
23:22
knife for modern machine IM will look like.
23:25
By the way, modern machine IM, that's not really an official
23:27
concert. I, I say machine IM because for
23:29
me it makes sense. We talk about customer IM, you
23:32
might talk about workload IM. So I think machine IM is just
23:36
like a perfect continuation, especially because you look at
23:39
CIM and machine IM customer IM machine IM, they use a lot of
23:44
the same standards like Oauth is like heavily involved in both,
23:48
right? But anyway, didn't want to
23:50
distract too much so you're going to need different
23:53
technology and luckily you'd likely already possessed quite a
23:57
few of them. You don't necessarily have to
23:59
buy that much. So the Swiss army knife will for
24:01
sure also contain workload identity management tools or the
24:06
so-called NHI vendors, right? Or there may be some discovery
24:09
tools that you may already have for your Pam products.
24:13
You also need some ways to to bootstrap identities for
24:16
workloads. In other words, you know, give
24:18
the workload the credential from nothing and if instantiated out
24:22
of nothing when the when the workload starts up.
24:24
And I think spiffy SPIFFE, the Secure production Identity
24:31
Framework for everyone is very well positioned to fill that
24:35
gap. Plus you need a working Oauth
24:38
stack, ideally one and only one, but possibly different from the
24:44
IDP that you use for human users because you have some ID PS that
24:48
are much better positions to work, much better position to
24:51
work with, with API use cases, right?
24:55
You're going to need API gateways.
24:57
You probably already have them, right?
24:59
You need authorization frameworks, either a policy
25:02
agent or Opsen or Cedar, any of that.
25:07
So good news is that much of this is already there.
25:13
You can eat PKI as well. Solid PKI infrastructure is
25:18
required to to bridge trust between different organizations.
25:22
And you might think about getting a separate certificate
25:26
life cycle manager because, yeah, enterprise certificate
25:29
life cycle managers are a little expensive to use them for
25:33
ephemeral certificates that just live a few minutes, right?
25:37
And also, there are a ton of other things in there.
25:40
Don't forget service missions for that virtual network layer
25:43
with tight authorization controls and observability.
25:49
You need to think about that as well.
25:50
So make sure that every log message that you have has
25:53
identifiers that you can trace from start to finish, right?
25:57
Yeah. One thing I've seen in the real
25:58
world is organizations kind of investing in the key management
26:04
infrastructure for network access control, being able to
26:08
use certificates on devices, mobile devices, laptops, things
26:13
like that to drive network access control.
26:18
Putting your analyst hat on, I mean.
26:21
Oh dear. I just imagine this is an
26:25
analyst call, right? Is our, you know, you talked
26:29
about a lot of things that are emerging standards and a lot of
26:33
times the way you're seeing in this MHI space is a lot of
26:37
vendors coming to the fold to solve these problems.
26:40
And when I talk to practitioners, they want to get
26:43
more out of the investments they've made already.
26:45
They're willing to go out and acquire a technology if that's
26:50
the right move, but they need a framework for thinking about how
26:53
far can I get with my existing investment maybe in a platform.
26:58
I'm not going to name names, but we all know what the platforms
27:00
are versus where do I go out and acquire a fit for purpose
27:05
product that maybe has promise of doing more down the road.
27:09
But IT shifting under our feeds, you see new problems, you've
27:15
seen new vendors, you see new standards.
27:18
How far can I get with my existing platforms?
27:21
You need to expand your horizon a little bit because it's not
27:24
just the classical IM tools that are of interest over here, but
27:30
it's also the tools that are used by other parts of the IT
27:34
organization. I mean, but if you're in the IM
27:36
team, do you actually manage the public key infrastructure?
27:40
If you're organizing, Maybe you don't, but but someone will for
27:43
sure they, they've got those tools out there to do that.
27:47
If you, do you manage the AWS or, or or Azure assets or Google
27:55
Cloud assets? Probably not, but you will
27:57
probably find people that have some secrets managers and use
28:02
some secrets managers within those platforms, right?
28:05
You probably have some parts of your organization that are
28:08
deploying applications in Kubernetes.
28:10
And so they, they might be running Kubernetes secrets,
28:13
right? Maybe some of them are using
28:16
service missions as well. They might have Istio or linker
28:18
D or, or maybe console or something like that.
28:22
They're DevOps people that are using maybe GitHub seekers,
28:26
which aren't really great. I don't really like that too
28:30
much because it's again, they're the old NHI problems, static
28:33
credentials. But you know, the, the question
28:36
is always at the end of the day, right?
28:42
Most organizations, they have mature process, mature process
28:47
for for many of those of those buckets.
28:50
But when you ask the IM team about helping you to, to manage
28:57
this better, securing your workload, to workload into
28:59
actions better, you know what you get, you're going to get
29:02
crickets, right? Imagine that someone calling the
29:06
IM team saying, you know what, I've, I've got this script.
29:08
I need to talk to the database every night and clean up some
29:11
things. I don't really have a secure way
29:13
to store any frames. What should I do?
29:14
What kind of answer are they going to get?
29:16
You see, that's where the IM team is not really involved.
29:21
And I think that's why we need to to solve this in a, in a much
29:25
better way, in, in a more holistic way, if that makes
29:28
sense. Yeah, you bring up, you bring up
29:30
a really good point. And so I've let's start with the
29:34
question I'm going, I'm leading toward with this leading
29:37
question is who should own this, right.
29:42
I see this space called identity security evolving.
29:46
And when I talk to vendors that have identity security products,
29:51
I think to myself, that's not, I am sure there's identity baked
29:56
into the solution, but there's already a team that does that.
30:00
And then I wonder to myself, I wonder to myself, so does IM
30:06
need to evolve? Does the IM team need to evolve
30:11
to take that part of things? Yes.
30:15
OK, I'm going to I'm going to stop there if you looks like you
30:17
have an answer, but I do have a follow up question to this.
30:20
OK, go. Ahead.
30:20
Oh yeah, yeah, yeah. All right, so who's responsible
30:25
for machine identity? Now here's the brutal truth.
30:27
It's everyone's job, right? Which means it's kind of no
30:30
one's job. This is kind of what it ends up
30:33
to. But look at the stakeholder.
30:35
You have security teams, sys admins, developers, application
30:39
teams, DevOps infrastructure folks.
30:42
And yeah, theoretically the IM team should be leading this.
30:46
They're used to hurting cats, getting multiple groups of line
30:49
on identity initiatives already. But but here's what's really
30:52
happening. The IM teams are missing in
30:54
action from these conversations, right?
30:57
I've been talking to Cesar's for two years about machine ID, and
31:00
guess who's not in the room? The IM folks.
31:04
Well, that should terrify us. You wanna know why?
31:08
Pictures. As I mentioned, you're in
31:09
infrastructure engineer. You've got this, this piece of
31:13
code that you're writing that that needs access to some kind
31:15
of API. You need secure programmatic
31:17
credentials, and you really have a secure way to store them.
31:20
So you call the IM team and ask how do you get this?
31:23
But how do I do this right? What do you get?
31:25
Crickets. Good luck getting an answer.
31:27
And that's the gap right there. Traditional IM teams, they, they
31:30
know human identity inside out. But ask them about ephemeral
31:33
workload credentials or dynamic machine authentication.
31:37
You get blank scares. Service account?
31:40
No, that's not the right answer. So here's what needs to happen.
31:44
You need to form this machine IM working group and get all the
31:50
stakeholders talking together, get all the stakeholders in one
31:53
room. I think I am is a pretty good
31:56
situation to lead that because they do have the coordination
31:59
scope. But you know, if they won't step
32:01
up, someone else needs to grab that wheel then.
32:04
Because right now we've got critical infrastructure being
32:07
secured by whoever happens to be close to the keyboard.
32:09
That's not a strategy, that's a disaster waiting to have.
32:13
Yeah, I think that's what I've seen working with clients over
32:17
the years. Is that the organization, let's
32:20
call it the developers, I don't want to pick on anyone group,
32:23
but the organization has moved in, moved forward with cloud
32:27
infrastructure like Amazon AWS. And like all of a sudden you've
32:32
got this whole big. And I'm probably dating myself a
32:37
little bit, but this is what I've seen over the past five
32:40
years, maybe five years back, where you start to see, I am
32:43
starting to realize that there's all this cloud infrastructure
32:47
that their tools aren't managing and needs the identities.
32:50
And there's all this automation they're rolling, you know,
32:54
ephemeral infrastructure and workloads out.
32:59
And the identity team doesn't have a role in it at all.
33:03
Now, I never recommend being the department that slows down the
33:07
progress, right? This is something that the
33:10
business is doing because of good reason, but you have to
33:13
have control over it. You have to have a set of
33:17
controls over it, right. It can't be the Wild West in
33:19
terms of, you know, because developers, I, I've worked with
33:23
developers a lot over the years and you know, they want to make
33:27
sure things work and then get the security right.
33:30
They don't want to try to start with the right security and then
33:34
have security stop them along the way.
33:36
And then sometimes what happens is the priorities shift to
33:40
something else and the security never gets cleaned.
33:43
Like the app gets rolled or the infrastructure or something gets
33:48
rolled out and then something else takes priority.
33:51
Security never gets cleaned up. And that's where you have the
33:54
big openings where, OK, the identity team is to be tracking
33:59
on that has to be aware, has to make sure that for at the bare
34:04
minimum that policies are being applied and being adhered to.
34:08
But it's the next level of if you don't provide some
34:11
automation or some management of all this, you know, it's too
34:15
much to do it manually. It has to.
34:18
There has to be an automation. Inside to it as well.
34:20
Right. Yeah, it's going to it's going
34:22
to flame out for for sure. Now you you mentioned a few
34:27
great points. Let me see if I can still
34:28
remember all of them. But I think one of them that
34:30
that you mentioned it, the way that I understood it is that IM
34:33
teams aren't really that often talking to developers or aren't
34:39
really quite familiar, even comfortable with the kind of
34:42
constructs that developers use. And that's a problem because if
34:46
you're an IM team that is disconnected from your
34:48
stakeholders and then you've got a problem.
34:51
And if you think, hey, you know, I'm an IM, this is more of a
34:55
business discipline. Well, you know, machine and
34:57
machine interactions, Dr. every critical business.
34:59
So if this is not a business problem, then what is, right?
35:02
So I think this is the big disconnect.
35:05
And of course, you know, look at many IM teams, say many of them
35:09
don't really have a lot of development experience, but
35:13
there might be someone who, who does, you know, maybe some
35:16
someone like me or maybe somebody from the development
35:19
team who understands something about ideas.
35:21
That's why it's so important to, to get this working group
35:24
together so that you can really look at the individual use
35:27
cases, you can find the best practical solutions.
35:29
Because when you're saying, you know, how do they actually
35:31
secure these? It's not really that difficult.
35:34
The technology's already out there, the frameworks are there,
35:36
the libraries are out there. But if you're not going to tell
35:38
them how to weird, right, they're just gonna look on the
35:40
net and take one example and whatever works for them, heck,
35:44
they're gonna use an API. It's not their problem, right?
35:46
But if you tell them you're maybe programming in Node and
35:51
we've got our IDP here, so use for example, passport dot JS and
35:57
then you do this type of interaction.
35:59
Don't use client IDs and client secrets, but maybe use something
36:03
like Spiffy, which by the way, get for free and your Kubernetes
36:06
and all of that kind of thing. Or we use MTLS, which is also
36:10
usually enabled out-of-the-box. This way you really make the
36:14
whole thing dynamic and you don't have to clean up after the
36:17
kids anymore because you don't have these static credentials.
36:19
This is really important, I think for IM teams to figure
36:22
out, you know, we're being, we're being sidelined.
36:25
We're, we're maybe just doing our IGA and our, our SSO, but
36:30
there's like this whole world out here that does identity and
36:34
we're not involved. It's pretty scary actually.
36:36
And I'm trying to rally people into understanding this a little
36:39
bit better and getting involved because I think it's critical.
36:42
I think you've covered this strategy for a lot of this.
36:45
You talked about the frameworks. You talked about kind of that
36:52
strategically speaking, that leap from you have your foot in
36:56
the past, you have to kind of deal with that to some extent.
36:59
I talked about this situation, which is very common, which is
37:03
that the development side of the organization is running at full
37:08
speed and identity in many cases as kind of the discovery like,
37:12
Oh my gosh, there's all this stuff and now we have to manage
37:15
it. Do you have in your mind kind of
37:18
a tactical approach of like how what you would say to a
37:23
practitioner? Like if, if you are discovering
37:26
this now you've got this big machine account problem if you
37:31
want to be the leader? Because I think one of the
37:34
things you said is it's nobody's problem is everybody's problem,
37:36
but somebody has to like step up and be the leader.
37:39
That's usually Jeff and I talk about it as like the IAM program
37:43
manager. If you're the IAM program
37:45
manager, what do you do today? What are the steps that you
37:49
follow to try to get this under control?
37:52
So the first thing that you should do if, if you're actually
37:55
tasked to do that, because in the conversation said I've had
37:58
in the last few years, I am was nowhere at the table.
38:01
Like sometimes it was just the CSO talking directly to someone
38:04
and say, you know, go clean this up.
38:06
And what they then did was they kind of looked at NHI and they
38:09
cleaned up that mess. And while they cleaned up that
38:11
mess, they produced more and more and more of a mess.
38:13
It was kind of like this, this viscous circle like, but if, if
38:17
you really want to solve it, then let's try to think about
38:20
solving it together. Because it's not the IM team's
38:23
responsibility to clean up after after everyone, right?
38:26
It's perhaps the IM team's responsibility to, to be the
38:29
visionary there and to provide good guidance on this.
38:32
So get the stakeholders involved, right?
38:35
Find all the use cases, define the right integration patterns
38:39
for securing the machine interactions.
38:42
And then first thing is try not to, right?
38:46
It could be either be the first, it could be 1A or 1B.
38:49
But you kind of got to do 2 things at the same time, right?
38:52
I would say try not to create any more of this junk, right?
38:55
Use better patterns and you design your Swiss Army knife so
38:59
that you can do it. The second thing is honor what
39:03
you have and try to clean it up. And that's where these workload
39:05
identity management tools or NHI tools come in as well to kind of
39:09
help you clean up the mess that you've already have.
39:11
But you want to reduce that. You don't want to continue doing
39:13
the same kind of thing again. And then the the the third thing
39:17
is the sorry, the second thing is really to provide that
39:21
guidance. It's not enough to just put in
39:23
policies like, oh, well, you shouldn't store credential clear
39:26
text. Well, yeah, if you do that, then
39:28
people are just going to default to maybe Kubernetes secret.
39:31
They won't store it in their code, but you know, they're
39:34
going to store it somewhere else where it's not adequately
39:37
protected. So you really have to give them
39:39
that, that guidance that cookbook like do this, do that.
39:42
And I'm, I'm trying to write a little bit about that on my on
39:45
my articles. There's also 10 tons of ton of
39:48
documentation out there already to do it to do it right.
39:52
And I'll, I'll send you some some links afterwards if we want
39:55
to post them with that, with that thing.
39:58
The third thing is to. Make sure that you can move
40:05
from, you know, the old legacy practices to more modern
40:08
practice, which means reduce your legacy, right and build up
40:12
your your modern stack and shift some stuff over from from here
40:15
to to there. That is over time.
40:17
And there's obviously some legacy that you're never going
40:20
to get rid of. So this is kind of good news for
40:22
the NHI runners. You're always going to need
40:24
them. It's just you're not going to
40:25
need them as much as they think you're going to need them,
40:27
right? And then the last thing is to
40:31
provide observability because with all of these interactions,
40:34
you got to know when, where, why, from where, you know all of
40:39
these kinds of things. And you need to do this by
40:42
ensuring that you can correlate all of your log message from the
40:46
instantiation of an identity to some kind of transaction that
40:52
was done. Even though the token was
40:55
already exchanged multiple times.
40:57
You had several actors in the middle, especially for for a
40:59
genetic AI that that is really important.
41:02
So these kinds of steps are there.
41:03
The IM team, I think is a very important contributor, could
41:06
even take a leading position, but it's not the one that is
41:09
going to do all of these things. But you're the influencer here
41:12
as the IM team. If you don't rally your other
41:15
troops together and solve this with them, you have someone else
41:18
going to take the wheel and do it for you.
41:19
And you're just going to be at best informed because they're
41:22
going to see you like, you know, the the legacy team, They're
41:25
they're the ones that do IGA. They understand nothing about,
41:28
you know, modern identity concert.
41:30
Let let them do their thing. You don't want to end up in that
41:32
position either, because that's kind of what's starting to
41:34
happen. So I want to go back to
41:37
something I think I heard you just say is that NHI vendors and
41:41
we might not need them or something along those lines.
41:44
I was like, whoa, whoa, hold on a second because I feel like NHI
41:47
has such a, a hot market buzz right now and there's a ton of
41:50
vendors that are positing themselves as NHI thing.
41:54
So help me understand kind of that viewpoint that you just
41:56
expressed there around you might, we might not need.
41:58
First of all, did I hear that correctly?
41:59
And then two, get into that report in detail.
42:02
NHI is, is this huge buzzword, but the ones that are driving
42:08
this are what I would call workload identity management
42:11
vendor and they they have perpetual Rd. shows.
42:13
They invest millions in, in hyping up this market and they
42:18
do something that's very, very useful.
42:21
They help you identify all of your legacy static identity
42:26
constructs because otherwise you don't know where they are.
42:28
If you don't know where they are, how can you actually secure
42:31
them? And then they, they help you
42:33
manage that technology debt, which is something that's really
42:37
important. I think it's, it's tactical,
42:41
right? Because strategically you
42:43
shouldn't be creating any more technology debt, but you will
42:45
always have some of this, right? I think it's unrealistic to
42:49
assume that you're going to get rid of everything.
42:51
That's like saying you're going to get rid of your Active
42:53
Directory. Yeah, Domain service.
42:56
Eventually, maybe we might, we might still be working when that
42:59
happens, or maybe not, right. So I think you're always going
43:02
to to need them because if something just kind of creeps in
43:07
your identity system that was not adequately done, something
43:10
that's not some kind of dynamic identity construct, then you
43:15
need to find it. And for those things that are
43:18
static legacy constructs, you need to manage them by managing
43:22
their life cycle, by finding owners, by doing attestation,
43:26
all of this, all of this tedious stuff that you don't have to do
43:30
with dynamic service identities, but you'll for that legacy
43:34
stuff, you will still need them. I'm just saying you'll probably
43:38
always need them, just like you'll always need your active
43:41
directories. They're not the strategic
43:43
solution. They're one component in a
43:46
bigger puzzle. And I think over time, if you do
43:48
things right, they're going to be less important than than the
43:51
other stuff. Does that make?
43:54
Does that make sense? Totally makes sense.
43:57
So Felix, we've been doing this podcast for six years.
44:03
We definitely just celebrated 6 years.
44:05
I think this is going to be episode 365.
44:10
I think that's an important number.
44:12
It's there's 365 days in the year.
44:15
And do you have an hour and episode for every day of the
44:18
year if you should choose? So you can celebrate New Year's
44:21
with me. Do you want me to tell you a
44:22
little bit how the future is going to look like now that
44:24
we're entering in you? I would love that, especially if
44:28
you can give me some stock tips. If you know where things are
44:31
going, maybe you can just tell us all where Bitcoin is going.
44:35
But here's what I'm going to say.
44:37
It's like I mentioned earlier, Jeff and I make it our mission.
44:40
We kind of fight for the, the practitioner.
44:45
We, we do this podcast for the practitioner.
44:48
And we also, I think the growth of the podcast is, really is
44:52
like more and more people follow it because you get educated and
44:56
we focus on the education. We also try to make it
44:59
entertaining. To make this episode
45:02
entertaining, I'm going to throw something at you which I think
45:05
is kind of funny about non human identities, not necessarily
45:09
machine identities. I don't think people would argue
45:12
that this is a machine identity topic, but non human for sure,
45:16
which is animals. So there's this controversy
45:19
happening about whether or not animals have identities, which
45:24
to me is kind of like a tongue in cheek argument to say I think
45:28
most people probably come from the standpoint of like, no, they
45:31
don't have identities. My personal opinion is it
45:34
depends on the context. But you're our guest, you're our
45:38
expert here in non human identities.
45:42
What say you? And my just to interject my
45:46
opinion is that anything can have an identity.
45:49
It doesn't matter if it's human or non human or what's called
45:52
life form or non life form based identity.
45:55
Everything that is distinct from each other has an identity.
46:00
So think about it. You got 2 cats from the same
46:02
literary. They look identical, but you can
46:04
tell them apart, right? That's because each of them has
46:07
their own unique identity, and you can use identifiers and
46:10
attributes to describe what makes them different, right?
46:12
Maybe this one has a slightly bushier tail than the other one,
46:15
right? Rather than the same thing with
46:17
machines launched 2 containers from identical images, you get 2
46:20
exact copies. It's the same service, but
46:22
they're still different. Different IP addresses,
46:24
different container IDs. So you can describe what makes
46:26
them unique. You have to find their
46:28
identities. That's I think where people get
46:30
confused. An account is not the same as an
46:33
identity, and an account is just a registry and a registry entity
46:36
on the system for a particular identity, right?
46:40
So yeah, your cats don't share a food bowl label.
46:44
Why should your container share static credential?
46:46
This is kind of the same thing. Yeah.
46:49
And now the opinion I've kind of, I feel like I've formed is
46:53
that pets, for example, would have identities, right.
46:57
If Jeff's dogs, he has three dogs.
47:00
I believe they each have specific identities.
47:04
Sorry, sorry you. Have two.
47:05
All right, I'm sorry I got that wrong.
47:08
The two dogs go to the veterinarian to them their
47:12
individual identities. If you have a stockyard, they're
47:17
more or less quote UN quote inventory.
47:19
I hate thinking about it that way, but I think it's how's that
47:23
different than having, you know, some inventory in a warehouse?
47:28
You don't think that Amazon considers identities for every
47:32
piece of inventory that they have, do you?
47:35
Even if they have some kind of RFID chip in them.
47:39
All right, Jeff, you got a look on your face.
47:41
You go ahead. Well, I mean, not to be too, I
47:46
guess Orwellian around it. I think we're all inventory of
47:49
some degree. So, you know, let's go back to
47:52
the pet thing real quick. So I, I do, I have two dogs.
47:55
They are chipped. So there is an identity
47:57
associated with them. There is also GPS collars,
48:01
fitness trackers, right? You know, these are my kids
48:03
basically. So there are sub accounts for
48:07
the identities of those things that are wearing around their
48:10
neck or they're, you know, embedded in their shoulders or
48:12
whatever it may be. So I don't think it's any
48:14
different than you know, me who has my own identity and I have
48:17
multiple forms of identity. I have both credentials like
48:21
from the government. I have a phone which has an
48:23
identity of its own but is also associated with me.
48:27
I have a ring, a watch, a tablet.
48:30
If I'm, you know, cattle in a stockyard.
48:32
Yes, You know, unfortunately that's probably like inventory
48:36
in that context. But I would bet that there's in
48:39
addition to just, you know, the chip that might be associated
48:43
with, you know, that particular cow, for example.
48:45
There are probably other devices that are being used that are
48:48
maybe associated with some of those other life forms.
48:50
So I don't know, I just I get into this kind of exploding
48:54
universe of anything can have an identity, but not everything
48:59
needs an account. Absolutely.
49:02
I, I really think that, you know, static accounts are so
49:05
passe they're, they're like such a thing of the past.
49:07
We really shouldn't be using. That that's so 2024.
49:11
No, it's so 2015, maybe even, I mean, really, I, I have my home
49:17
lab and I, I, I don't use service accounts at all unless I
49:21
absolutely have to, right? And even then I try to get rid
49:24
of them. It's actually possible.
49:26
But still, I think there's this big confusion between what's an
49:30
identity and what is an identifier and, and, and what is
49:33
an account identities. I'd like to see an identity more
49:37
as something philosophical. So your, your cats have
49:40
identities. If you have two also identical,
49:44
identical twins, they, they still have their own identities.
49:47
Now identifiers are what we use to describe something that has
49:52
an identity, right? And we can use one identifier or
49:55
a multiple identifiers to describe that identity.
49:58
So in the case of, you know, your, your smartphone, you, you
50:02
have an IMEI, which is the number.
50:05
It's kind of like the identity of the device.
50:08
And then you also have, I forgot what this other number is.
50:11
So if you're a SIM card, right, your subscriber number, I think
50:13
it's called the IMSI, right? So you already have two
50:16
identifiers and the combination of that says this is Jeff's
50:18
phone and it's Jeff's phone number as well.
50:20
It's just phone containing just phone number, right?
50:23
And then we can create, if you need an account, usually you
50:26
would as at a telco, you probably wouldn't need an
50:28
account for that. You create an account that
50:32
specifies these identifiers and then uses them in order to
50:36
provide services to to Jeff. So I think it's important that
50:39
we really understand the difference between identifier
50:41
and identity and account and a credential.
50:44
Now with NHI, it's a sloppy term.
50:46
They just throw everything together.
50:48
So you never know. Are they talking about
50:49
credentials, accounts, identifiers?
50:52
It's not really quite clear. It's kind of like this anything
50:54
goes kind of thing. Well, I think the other thing
50:57
too, another is we also have to agree on definitions.
51:00
I think of some of these things because I think we're, you know,
51:02
guilty as an industry, a lot of conflating definitions between
51:06
two different things. And you know, we go back and
51:08
forth and a lot of it based on context and things like that.
51:12
So I think, you know, I've been listening and I'm I'm, I'm right
51:15
there with you, Felix. I think there's so much more to
51:18
have a conversation around this. I know we're running a little
51:20
bit short on time here, but real quickly, like where do you see
51:24
the machine identity going? Like, what's your prediction
51:27
here for the next couple years, 3, five years, maybe even longer
51:30
if you've thought that far ahead?
51:32
OK, so where is all of this going?
51:40
So first of all, I'm I'm seeing massive sees O attention right
51:42
now. Finally, right?
51:44
They're realizing machine identity is their biggest blind
51:46
spot. But again, here's the problem.
51:48
Most organizations are making rookie mistakes right out of the
51:51
gate. They're going all in on the NHI
51:52
vendor story rather than building solid machine IO
51:55
foundation. This is kind of like you got
51:58
perpetual heartburn so you're popping into acids all day
52:01
instead of changing your diet. This is not the right approach
52:03
to, to to fix it, but but here's the catalyst that's actually
52:07
changing everything right now. So Genting AI, you know, these
52:10
things are forcing organizations to confront machine identity
52:14
because agents are work loads from day one, right?
52:17
You can't sling around static credentials when you've got AI
52:19
agents spinning up and and down dynamically.
52:22
I guess you could it's your very own risk, right.
52:25
So the, the big shift I'm seeing we're, we're moving from how do
52:28
we manage more credentials or more NHIS to how do we manage
52:33
trust and authorization policies.
52:35
And that's the only approach that that really scales and mark
52:38
of us, it's fascinating. So the, the workload identity
52:41
vendors are making tons of noise and they of course do do useful
52:44
things, but they're just one piece of a much bigger puzzle.
52:47
The the real game changer is technology like Oauth, which we
52:50
all have, which we all use, right, MTLS, which we probably
52:54
use, we'd probably also have and spiffy, which you can get.
52:58
It's not a problem. Probably you might even have it
53:01
might not use it. That lets you bootstrap trust
53:04
for workloads like with without all of that credential baggage,
53:07
right? And and you know, don't don't
53:08
sleep on service meshes either, like Istio linker D and console.
53:13
They're already solving workload to workload authentication,
53:15
coarse grain authorization at the network layer.
53:17
Now secrets management also isn't disappearing, but it's
53:20
also becoming less critical. But what I'm excited about our
53:23
policy engines, tools that let you define which workloads can
53:26
talk to what and exactly what they can do.
53:29
Traditional RBAC won't cut it at machine scale.
53:31
So I think you know those those attributes based access control
53:36
vendors where you can call the Asterix back, which it's like
53:39
all this buzzword thing go happening there as well.
53:41
I think they're going to have a renaissance with this as well
53:44
and the Holy Grail. Like if you were to do a start
53:47
up right now, I would be really impressed if you, if you create
53:51
a tool that actually helps you migrate from the legacy static
53:55
constructs to more modern dynamic, IM right, ephemeral
54:00
identities just in time axis, just enough privilege there.
54:03
There's some vendors who are doing part of this like like
54:06
Aimbid and Axis. Now they're they're starting to
54:08
tackle this migration challenge, but it's a fairly proprietary
54:11
approach. So the vendors that evolve from,
54:13
you know, better credential management to dynamic workload
54:17
trust, those are the ones who are going to really own the
54:19
space, I think. So I think that's a great call
54:23
to action because we have a lot of vendors listen.
54:26
To this episode both. You know, establish I don't
54:29
have. Anything to sell to you at this
54:30
point once you know if whoever wants to take this you.
54:33
Know they may be in spell if they may be out there.
54:35
There are a lot of vendors. I think this is getting to where
54:37
the puck is going to be is always kind of the the right way
54:40
to do it. I want to start to wrap things
54:42
up here and I want to stay with the, you know, we got really
54:45
deep, right, submerged in machine identity.
54:47
And so that's my terrible segue to talk about scuba diving
54:50
because I think you mentioned in a previous call that we had, we
54:53
were kind of prepping for this, was that you've done some scuba
54:55
diving. And so I'm curious, like how
54:57
long have you been scuba diving? I've never done it myself.
55:00
I don't know if Jim has either, but what is, you know, what
55:04
should I know maybe as a first time attempt at scuba diving?
55:07
And what's been your most memorable dive?
55:09
Well, don't hold your breath. That's the important part.
55:13
And when you go down there, clear your, clear your nose or
55:17
clear the pressure on your, in your sinuses.
55:20
It's actually a very safe thing to do if you respect the
55:25
environment and you keep your, your limits.
55:28
Now, the, the one thing that the analogy that I like to do is I,
55:32
I, I've been diving in since the 90s.
55:35
I don't even know which year it was.
55:36
It's like in 1996, I can show you my certification cards.
55:40
You laughed because I'm like a 20 year old guy with, you know,
55:44
ponytail and all of that. You know, what is this?
55:46
And so I've probably I must have, I must have been diving at
55:50
least more than 1000 times. What I, what I noticed though,
55:55
when I did all my recreational diving and then when I moved to
55:59
where I'm living right now in Spain on the, on the beautiful
56:01
island of Tenerife, is it, it actually gets pretty deep there
56:05
pretty quickly. So I mean, the, the, the water
56:07
line kind of goes down like this.
56:09
And it's, it's very interesting down there.
56:11
But you know, pretty, pretty deep.
56:13
Like you have some reefs that started, I'm sorry, I'm metric
56:17
40 meters, 45 meters. That's beyond the reach of
56:21
recreational diving. So if you want to dive these
56:23
steps, you have to learn how to do it securely and properly.
56:27
And I think there's this great analogy to how we should do
56:32
dynamic service identities or even dev OPS where we run much
56:37
faster. And we need to have all of
56:40
those, all of those protocols and all of those procedures that
56:44
allow us to do that is, for example, in recreational diving,
56:47
you leave usually 1/4 of your time, you know, as a reserve.
56:50
And you know, when you're kind of reaching that, you kind of
56:53
come back up. If you're doing technical diving
56:56
that's you have AC ring, like you can't pop up just like that.
57:00
You have to potentially decompress.
57:03
You get all of the nitrogen out of your out of your system.
57:06
So you need to plan for that. You have totally different ways
57:10
of calculating how much air you need, how many tanks you're
57:13
going to take. You plan for yourself and for
57:15
your buddy. What if your buddy loses a tank?
57:17
What if you have everything doubled?
57:20
So there's some in the last year I've really studied machine IM
57:26
and I came kind of came from the same back of the, I thought I
57:28
knew all of this. Oh yeah, we use service
57:31
accounts. We got a rotate credential.
57:33
We do that through Pam. Then we've got secrets managers.
57:35
I had to unlearn all of that stuff and to actually see how
57:39
it's done properly. And I think that is something
57:43
that most IM folks will either need to go through or need to
57:48
work with with these these folks that that understand this to
57:51
really amplify and relearn how I am is actually done through an
57:55
organization. A lot of people are doing I am
57:58
not just the IM team, right? Yeah, that's true.
58:00
It's there's a lot of shadow I am taking place in organizations
58:03
for sure. Yeah, yeah.
58:05
And the stuff where the IM team is just not interested or they
58:07
don't care, that's why they don't get involved.
58:09
So this is a really huge area and an important area.
58:13
Jim, have I don't think you've been scuba diving, have you?
58:16
I've been scuba diving but non human identities has given me a
58:21
case of the bands. There you go.
58:24
That was my my joke for the day there.
58:27
You go, we better recompress you.
58:29
It was so funny, I forgot to laugh.
58:32
No, I, I haven't, but I have gone snorkeling.
58:35
It's somewhat close. And you know, I, I think it's
58:41
fantastic. I mean, you know, the first time
58:43
I did it, I'm like, Oh my gosh, I've been going my whole life
58:46
and I've never done this. So my, you know what you really
58:50
want to do? There's a great coral reef off
58:55
the coast of Cancun. I went circling there.
59:00
Ultimately I want to go to Australia.
59:02
So we have listeners in Australia.
59:05
Zef and I would love to come visit your continent, your
59:09
country and go to a conference and bring the identity at the
59:13
Centre podcast. Just saying, reach out to us.
59:15
And those are the series offer. I would love to bring the
59:18
podcast to Australia someday. But circling around the reef,
59:23
you see you get a good view. It's like watching it on TV but
59:27
in real life. It's amazing.
59:31
Can you? Swear.
59:32
Yeah, but yeah. I don't know, I'm, I'm, I'm not
59:35
a water person, so I can swim and I've done that stuff.
59:39
I'm just not AI always say I'm not a, you know, freshwater
59:43
seawater kind of person. I'm more of a pool or something
59:46
a little more controlled, you know, call me a baby.
59:49
That's fine. I'm an indoor cat.
59:51
I do think it's interesting though, because it's all it's
59:53
probably the closest thing to go into space that we have without
59:56
going to space because it's very similar, right.
59:58
It's a different gravity level. Obviously oxygen is, is a big
1:00:02
part of that. A large percentage of the of the
1:00:05
of the world has not been even mapped right effectively or like
1:00:09
explored like all the deep sea stuff.
1:00:12
So it's super interesting and super cool.
1:00:13
I don't know if I have the guts. I would actually go to space
1:00:16
before I would go, you know, under undersea.
1:00:19
Well, the. Train for being an astronaut by
1:00:23
scuba diving because you kind of have to get your get your fuel
1:00:27
for for the for the dimensions. I would scuba dive in that giant
1:00:31
NASA pool. That's probably the way I would
1:00:32
look at it all. Right.
1:00:34
So what can I say? I don't know.
1:00:35
OK, let's go ahead and wrap it up there for this week.
1:00:37
Felix, I feel like we only scratched the surface of machine
1:00:41
identity and there's so much more.
1:00:42
You've got a lot of really good work that you've been putting
1:00:44
out there, especially on LinkedIn and stuff like that.
1:00:46
So we'll have your LinkedIn profile in our show notes for
1:00:48
people to check out. You know, hopefully people will
1:00:51
read comments, engaged with those discussions you've kind of
1:00:54
started around there. But I really appreciate taking
1:00:56
the time with us and happy that we were able to get you on here,
1:00:58
You know, on the podcast, I know we've got some other folks at
1:01:00
Gartner who kind of listened. So the door is always open.
1:01:03
You know, people are always welcome to kind of come in and
1:01:05
share their thoughts and I appreciate you spending time
1:01:07
with us. So we'll leave it there for this
1:01:09
week. You can find us on the web, IDAC
1:01:11
podcast.com, like subscribe, do all that cool stuff that helps
1:01:15
us grow the channel and get great guests like Felix.
1:01:17
So thanks everybody for watching and or listening and we'll talk
1:01:20
with you all in the next one. Thanks for having me.
1:01:26
You've been listening to Identity at the Center.
1:01:29
We hope you've enjoyed the show. Make sure to like, rate and
1:01:33
review, and we'll be back soon. But in the meantime, hit the
1:01:37
website at identity@thecenter.com.
1:01:41
See you next time on Identity at the Center.