Latest / Identity at the Center / #218 - Identiverse 2023: *BAC with Gal Helemski of PlainID

Transcript

#218 - Identiverse 2023: *BAC with Gal Helemski of PlainID · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:10
am this is the go-to podcast. Now your host Jim McDonald and
0:18
Jeff Stedman Welcome to the identity of the sender podcast.
0:22
I'm Jeff. And that's Jim.
0:23
Hey, Jim. Hey, Jeff, how are you?
0:25
Oh, not too bad yourself. I'm doing fantastic man, and
0:28
I've survived last night tonight.
0:30
We've got karaoke, are you ready?
0:32
Well, i'mi'm? Ready?
0:33
Because I'm just gonna be sitting there watching.
0:35
Yeah, well, I have to make sure that I don't end up as horse at
0:39
the end of today, doing a lot of recording you over here at
0:42
identify worse. And by the way, you know, we're
0:46
doing this Nostradamus week idea.
0:47
I think it's been going really well.
0:49
What do you think? Yeah, I've got some good.
0:50
Predictions. We've had some great guests.
0:52
We've got another one. Today we'll get to in a second.
0:55
It's interesting to see identify worse this year, a ice there
1:00
decentralized identity. It seems like all the future
1:02
stuff is starting to become more prevalent as topics within
1:07
things but there's a lot of new speakers to like that.
1:11
People just haven't seen before which has been pretty cool.
1:13
So I'm digging that. Yeah you know I think
1:15
everybody's like real open and networking here as well.
1:18
So all those new speakers there Like we're talking about before.
1:22
Like you, you can learn so much from these individuals who are
1:27
out there in the real world. Just like our listeners
1:30
implementing identity and access management Technologies, and
1:34
they just have so much knowledge to share.
1:37
And I think what's great about our industry is that people are
1:40
so willing to share that that knowledge.
1:42
Yes definitely. That is like one of my
1:44
highlights for sure. I think I mentioned that in our
1:46
conversation, we talked about Andre Durand yesterday.
1:49
I think I came up during that So, yeah, yeah, it's good times.
1:52
Yeah, and by the way, I didn't point this out, but he was one
1:56
of the few people who said, I chose identity.
2:00
Yeah, he absolutely did. It's a rare bird.
2:03
But yeah. Well it's just also to think
2:05
about like, you know, paying idea in the size of PID and he's
2:08
like talking about like his first day was just him as in
2:11
boxes. Empty and he had no emails that
2:14
you know I just picture that my head.
2:16
I'm like that is absolutely insane.
2:19
It's funny. You know, everyone talks about
2:21
Inbox zero, and you're crazy inbox and stuff like that and
2:23
some people thrive on that and some people like, oh my gosh, I
2:25
have way too many emails when you're gonna get done.
2:27
It's interesting that see the dichotomy between the two.
2:30
It's like people who keep a clean inbox or have nothing
2:34
versus an inbox is just jam-packed with stuff.
2:37
Yeah, so I had a client, I won't identify who it was, but he had
2:41
gotten so far behind on his email that he quote, unquote,
2:45
declared email bankruptcy. So that meant if you emailed me
2:49
and you're expecting your Response.
2:51
You will not be getting a response from that email.
2:53
So you need to email me again. It's like the big reset button.
2:57
It's a big reset. Yeah, kind of wish you could do
2:59
that for few different things. All right.
3:03
Why don't we get to our guest for today?
3:04
She's very, very gracious to gift us.
3:07
Some of her time. She is Gallaher Lansky.
3:09
She's the co-founder and chief product officer at plain' ID.
3:12
Welcome to the show. Go.
3:13
Thank you, thank you for having me here.
3:16
Yes, you're all the way coming from Tel Aviv Israel.
3:19
Yes, I were suffering. Various versions of jet.
3:22
Lag. Yours is probably little bit
3:24
worse than mine it at this point, but this is the first
3:27
time you've been on the show and we like to learn more about
3:30
about identity origin stories. I actually met you several years
3:33
ago, I think when playing Eddie was just kind of starting out
3:36
and it seems like you guys have grown quite a bit since then.
3:38
Yes, we have. So this is a conversation that's
3:41
definitely worth worth having and has been probably long
3:43
overdue before we get to that, though.
3:47
How did you get into the identity and access management
3:49
space? Is it something that you You
3:50
chose or did it Choose You? Well I think it shows me
3:55
actually I you know, I started studying physics, not even
4:01
computer science. I did combine it a bit with
4:03
computer science but once I, you know, in Israel does the
4:08
military service that we are doing right after that.
4:12
I started working for a company called mem Co not sure if are,
4:16
you know, when core but it was one of the first cyber security
4:20
companies in Well, and they invented single sign-on.
4:24
So maybe, you know, some of the other names of that product such
4:27
as proxy, mices. So control is say, and so on.
4:32
So that's how I started my. I am Journey after that, I
4:37
joined cyber log, which you probably all know, right?
4:40
So again and identity company and form, they'll that was my
4:45
primary focus security, identity and access management and now
4:50
plane Eid. So for those who aren't familiar
4:53
with plain' ID, the authorization company I believe,
4:57
tell us about it. Give us like what's the 32nd?
5:00
62nd hallway? Identifiers pitch if somebody's
5:03
like, oh, what have I done? You know, what is what is plain?
5:05
I do put in a dee doo. Yeah.
5:06
So, plain idea is, there's always action company or thighs,
5:10
ation is connecting identities to digital assets, right?
5:15
We enable organizations to manage to control Ortho ization
5:19
policies in a Assistant way a centralized way and enforce dose
5:24
of the relation policies in the different Technologies which
5:27
organizations have today whether those are applications apis,
5:31
Michael services, and data, so that the 30 seconds about of the
5:38
relations, but we are going to talk more about that, right?
5:40
Yeah. We're going to get into P back a
5:42
back, our back, all the backs, I'm sure authorizations are
5:46
really hard to do cross application cross.
5:50
Loud. I'd love to get a little more
5:52
about how you kind of approach that before we get to that.
5:55
We were kind of talking a little bit before we hit record here
5:57
around introductions and say, okay, we've got gal, she's the,
6:01
You Know, Chief product officer, but you're also do CTO work as
6:05
well. And you kind of had this
6:06
interesting spin, which I totally like get.
6:09
It makes, though it makes sense. I was originally going to
6:12
introduce you as CT o /c p 0 product officer, no privacy
6:16
C-3PO. Yes, a very, but she had this
6:19
interesting response. Why did you ask, why do we
6:23
settle on the introduction of Chief product officer and that
6:26
both? Yeah.
6:27
So I believe that Paul actually did technology and not the other
6:32
way around. Eventually we are building
6:34
products for our customers. We are not throwing technology
6:39
on them that they can't really use.
6:41
And that's why. I believe product should be the
6:45
primary focus product should be using the technology options.
6:50
Which are available to the best way it is.
6:54
It is possible and not the other way around.
6:56
You can just get in love with technology and then try to turn
7:01
it into a product. I think it should be the other
7:03
way around because sometimes you need to choose other
7:07
technologies that can better fit.
7:09
What your customers are actually asking, I love that connection
7:13
between customer requirements. Customer needs to the technology
7:17
that can address them in the best way.
7:20
So, Give a standing ovation. I would because I love the idea
7:22
of identity as a product, even if even if you are a product
7:26
company even within an organization identity, is a
7:29
product that you're serving to your constituents employees
7:33
vendors, consumers, whatever it may be.
7:35
So yeah, I don't have my son works here but standing
7:38
Applause. I like that concept, Jeff.
7:39
I mean, you're putting together product and if nobody's buying
7:42
it, that ought to be an indication that it doesn't have
7:45
a lot of value or something's wrong, right?
7:48
They, it could be value. Could be awareness, maybe you've
7:50
got Got wrong assumptions but yeah, nobody builds something
7:54
and hopes, it doesn't get used except maybe Disaster Recovery.
7:57
It's kind of a weird way but yeah.
7:58
Right. I get where you're going with
7:59
it. Yeah, so so gal, you're the
8:02
co-founder of plain' ID and you talked a lot about P back.
8:07
Can you give us an overview of what P back is?
8:11
Yes, I'm going to start with what provoked is not be work, is
8:14
not marketing, just marketing. You know, some people might
8:18
argue but I do want to emphasize It hasn't been development.
8:22
In that phase p Bach is a way to manage authorization, policies.
8:27
That's pee bucket management method.
8:30
And if you look at how this space has evolved, it started
8:34
with ACLS. We all know ACLS, right?
8:37
Access Control list. That was the very first way.
8:40
We started managing Authority tations and then it evolved into
8:44
a wall based Access Control to try and simplify how we manage
8:49
authorization that. Ended up in Roll Explosion.
8:53
We are also all familiar with that a buck attribute based
8:57
Access Control. Try to maybe.
8:59
So some of those challenges, a buckets, eventually the method
9:04
of leveraging attributes from the identity and the acetyl, the
9:09
result identities, trying to access defining, the combining
9:13
relationship between them, and then making decisions based on
9:16
that. But it did also lacks some
9:19
stuff. It was very It wasn't it didn't
9:22
include all the posters which are required and then came
9:25
p'burg and feedback is not a replacement.
9:28
I mean, it's very important to understand P.
9:30
Work is a method of management. It includes yes.
9:35
A book policies is obviously travel injure attributes, but it
9:39
also uses Roars Roars is just another attribute of the
9:43
identity. We can't throw away roles.
9:47
We can't do it because we don't know anything everything about
9:50
the idea. Entity.
9:51
So that's really P. Back one business policies life
9:56
cycle of how policy should be handled within the organization
10:00
and then enforcement different methods because so many
10:05
Technologies are out there. Can you give an example?
10:07
Because I do think that, I don't think people confuse P back with
10:12
our backs so much. I think people have that concept
10:14
down but P back in a back. And I think you pointed that out
10:19
as people think it's the same thing.
10:21
Can you give an example of P back that will kind of highlight
10:24
that difference. Yes.
10:26
So a book started as a velly technically notion.
10:30
Let's leverage attributes. To Define connections between
10:35
identities and assets. Right?
10:36
That's a box. That's very clear, but it
10:40
doesn't include the processes. Eventually we know authorities
10:44
ation. Should be governed.
10:46
Should be audited. Should be managed as a lifecycle
10:50
to all of that. That and that is what P back
10:52
brings to the table. The policy is not just a
10:56
technical tool. It's also a business
10:59
representation of the decision, the organization wants to
11:03
implement within their systems, right?
11:05
So it needs to be expressed in that way.
11:08
It needs to go through a life cycle through the, through the
11:11
processes of the organization development staging staging
11:15
production. How that looks like, right?
11:19
It needs to have some Kind of review process simulation.
11:23
Maybe those are all elements of the policy system that the
11:29
organization I think. So, shout out to Paul volution
11:33
friend of the show, one of your employees.
11:35
They're playing an ID and he actually made the introduction
11:40
to get you here today. But he had given me a demo and
11:45
kind of one of my big takeaways was that you know the P back
11:49
system could Pull data attributes that were maybe
11:53
traditionally, identity data or they're not like in your ldap
11:59
right there. You can pull this data and start
12:02
to build an Uber profile of a person.
12:06
Now, apply the policy to it and now you've got something that's,
12:10
you know, a force multiplier if you will exactly it.
12:14
Sits on top of all those attributes that are being pulled
12:17
about both the identity, by the way, and the acetate To
12:21
destroying to access. So leveraging, both sides in
12:25
order to make the decision. Yeah.
12:27
Where does p back fit from a strategy perspective?
12:30
Because I see a lot of organizations struggle with
12:33
rolls just in general, like, oh, we want to be a man are back,
12:37
you know, shop, for lack of a better word.
12:40
And they get some percentage of the way down the journey.
12:44
And then they stopped making progress if I'm going into a
12:49
green field situation where We really haven't started anything
12:51
yet. I've always been more of a fan
12:53
of the attribute base side of things, because I feel like it's
12:57
a little easier to start up setup because he was okay.
13:01
Well, what are some key attributes?
13:03
Are you an employee or you not an employee, okay?
13:05
Well, if you're an employee, you get this.
13:08
And now, we've got some sort of Access Control like that and
13:10
maybe you start to combine a few different attributes and for a
13:13
long time, I'm glad Jen, Jim asked the question because I
13:16
thought a back could be back where the same thing it was just
13:19
pee back was the marketing term and Is I don't know a back
13:21
wasn't sexy enough, I don't know.
13:24
But as I've said, you know, learn more over the years.
13:26
It's like, okay I get it if I'm going into an organization and I
13:30
have not yet taken the journey towards any sort of consistent
13:34
access control method. Any of the backs could I start
13:38
with policy based Access Control P back or are there
13:41
prerequisites to be able to be successful for a policy
13:45
standpoint versus attribute or role-based perspective?
13:49
Yes. Oh, I think you should dealt
13:51
with policy based access control.
13:52
I think it is a core component of any modernized.
13:56
I am infrastructure but you know, you need to understand.
14:01
You can't do without holes and they'll explain.
14:04
Okay? You give an excuse, you gave an
14:06
example where you're leveraging HR data to make decisions, but
14:12
it's not enough, right? We can't make all the decisions
14:15
just to on what HR knows. And we all will also understand
14:18
that HR Doesn't get it. Always right.
14:23
No come on I don't hate has always pristine and never needs
14:27
to be cleaned. You know.
14:28
I was also thinking of a scenario like let's say you
14:31
wanted to have an authorization based on, you know, you can only
14:35
access this if you have more than a hundred thousand dollars
14:39
of assets under management, right?
14:41
Well that's not data that you would want, you wouldn't want
14:44
the person's account balance, in your, I am system, where you'd
14:47
want the ability to apply that rule, they get the Access
14:51
because yes or no. Hmm, right?
14:53
Yes, exactly, exactly. And that's, that's another key
14:56
component, which needs to be to be not.
14:59
Well, known, right? Pivec is not just about those
15:03
Dynamic, fine-grained decisions. Eventually authorizations are
15:07
not implemented, just one way there.
15:11
So many ways of authorizations are implemented today and even
15:15
if we want for standard to be out there, it would take some
15:19
time if at all All we need to be able to manage authorizations
15:24
for application Level security. We need to do the same for apis
15:28
for microservices for data and we can't say one fits, all
15:35
right, doesn't work that way. That's the advantage of P back.
15:38
They enable you to manage the decisions in a consistent way.
15:43
Regardless, if it is for data Access Control, API Access
15:48
Control, Michael service, Access Control.
15:50
All. And that's important.
15:52
That is a key component P. Back does not enforce technology
15:57
P. Back is a method of management
16:00
with many options of enforcement.
16:04
All right, I'm going to post a little bit into a rabbit hole
16:06
but all that on, I promise I'll stop.
16:09
But I would imagine a scenario where it let's take that
16:12
example. I had where, you know, people
16:14
can only access a certain portal if they have a hundred thousand
16:18
dollars under management, So assumably that would be some
16:22
kind of like web service call to some system that would say you
16:26
know Jim has the assets or he doesn't have the assets.
16:29
Ideally that's in real time but you can see the potential hang
16:34
up if that's in real time. So you have to probably stage
16:39
that data which is always like why virtual directories existed
16:43
in the first place, right? So I would imagine that's one of
16:45
the real challenges when it comes to authorization is like
16:48
okay, how often do I have refresh this my data that I'm
16:53
going to base this policy decision on.
16:56
Yeah, absolutely. And you know what, that's how we
16:59
used to do authorizations. But now I believe you would find
17:03
our more advanced ways. There are actually four patterns
17:06
to authorities ations and and that's also, I don't know if
17:09
it's a well, known fact. But in the old standards, there
17:14
was just permit to deny. So you could ask that question.
17:18
Can I approve this transaction? Chen which is more or less than
17:22
1 million dollars and get a. Yes, no.
17:25
But that's really inefficient and you need to go leafless your
17:28
data over and over again. Right today.
17:31
There are more patterns for, like, I mentioned patterns for
17:34
authorizations in addition to permitting.
17:36
I we also have entitlement resolution, which is an
17:41
open-ended question, right? What are the least of
17:44
capabilities? A user can do within this
17:47
session. People might even consider that
17:50
as Log in time or so ization, to support a, the authorities,
17:55
ation spell, a login session. There's also a resource
17:59
resolution or asset resolution, which is the same way.
18:02
Same question, into the wealth Pearl, a specific asset.
18:06
What al-essawi idea user resolution is called what are
18:10
the list of users per asset under the most interesting one?
18:14
Which is, I think the answer to the example you gave it's called
18:18
policy resolution and this is This decision is that handles
18:22
data because you do not have to ask a pill meeting I per
18:26
transaction, you don't need to do that.
18:28
You need to put your controls in that case on the data 11 and
18:32
therefore the data which user can see is only the data, the
18:37
policy enables him to see not by transaction by by filtering the
18:43
data, the user can actually access implementing those within
18:48
your overall architecture provides It's you the best
18:52
authorization solution and obviously Security in place.
18:55
So that gives a good background. I think of P back and what it is
19:00
today, right? We talked about going to talk
19:03
about how things are going to be in the future and one of the
19:06
things that I'd like to know would be, do you see p back over
19:11
taking our back in the future and let me just before you start
19:16
answering that? I feel like, I don't know if
19:19
Jeff really agrees with this because we kind of got into it
19:23
on, on this topic before, but I think that the popularity of our
19:27
back is what it is, because people understand it.
19:32
I've got this role and I put people in the role and then they
19:38
get this access. I get that or if it's a dynamic
19:42
role. It's, you know, I take the data
19:44
and my plug-in, I understand that.
19:46
All right. And it's audible a my orders,
19:50
like it. Now, I think Pete back
19:53
challenge. I think it's much stronger.
19:54
I think it has much more capabilities.
19:57
I don't think people understand, right.
19:59
We're here on the identity, the center podcast, and I'm learning
20:02
a lot. Just listening to you, I'm
20:04
learning a lot. So how's the data?
20:06
How does this information get out there and no bring it back
20:10
to the simple question? Do you see p back?
20:13
Overtaking are back in the future.
20:16
So no, I don't and also I want to emphasize.
20:19
This is not a wall between 5:00 and a buckle Arabic.
20:23
They are all needed in order to support the advanced
20:28
authorization requirements organization have today.
20:31
Let's let me go back to the example you provided.
20:33
Yes, you are assigning a role to a user and that simple to
20:38
understand. But now let's ask the question.
20:41
What does that wall entitle the user to do?
20:46
Who makes that decision. You are a doctor.
20:48
Okay. What can you do?
20:50
Can you see your patient records?
20:53
Can you approve of some kind of subscription that is
20:57
authorization? And that's the difference.
20:59
And that's what needs to be understood by the broader
21:03
audience. You still need words because you
21:06
need to, you need to give some title or some.
21:09
I don't know information, which is personally personally
21:14
assigned to a user. But the decision, which is
21:19
attached to that or the logic, which is attached to that all
21:23
that is authorization. It takes the role and explains
21:27
the whole to the application resources to the data to
21:30
whatever. P back is still a concept of
21:35
like centralization that right. I mean it's not you're not
21:38
talking about at the app because to me it's like if you have a
21:41
great orchestration of what you should have access to, In these
21:46
applications. But then when you get the
21:48
application, they have three rolls 33, you know, very simple
21:52
levels of what you can do within the application.
21:54
Mom getting to at least privilege models pretty
21:58
difficult or impossible. Right?
22:00
Well, if you just rely on laws, then, yes, but let's talk about
22:04
least privilege. What is least privilege?
22:06
What what what is that? What does that mean?
22:09
It means that you can access whatever resources at a specific
22:15
point of To begin with. You do not have access obviously
22:19
but you'll get your gate egg getting access when you need it
22:23
to the specific function or resource whatever right now what
22:29
is identity first what is identity?
22:32
Well what is zero trust and they all saying basically the same
22:36
thing when access is made Let's understand who the user is.
22:42
Let's make the decision if this access can be granted.
22:45
David and to what level they are all eventually talking about the
22:51
same concept, the same Notions access should be much more
22:56
advanced. It should be dynamic.
22:58
It should be smart. However, marketing terms, you
23:01
have, you want to put on top of that, make the decision for user
23:06
in the context of the access at the time of access.
23:11
Obviously, we'll possible or as close to access as possible.
23:15
Right? We make it sound so easy but
23:17
it's hard, right? I mean, if we think about it in
23:20
the real world of authorizations are a mess for a lot of
23:24
companies. Yes, it is.
23:25
Even if you just look at active directory, naming conventions,
23:28
don't make any sense incomplete memberships are off.
23:31
You've got nested groups. Now you start taking that
23:34
problem and adding in every other application and trying to
23:38
come up with. Well, what is the policy for
23:40
someone across 20, 30, 40, 50 different Maybe this the end
23:47
system doesn't support that granular.
23:50
Yeah I'm an authorization standpoint most probably
23:52
doesn't. You are absolutely right but you
23:55
know what? That's the chicken and egg heel.
23:56
Right. It's always like that with
23:58
technology. Think about s is so SS.
24:01
So today the authentication if you're saying authentication
24:04
today, everyone in the space would it automatically think
24:08
about IDP and open I did connect or sam'l depending where you
24:12
are. That's given that even In a
24:15
commodity today, but going back 10, 15 years, that was not the
24:20
case. I still remember, trying to
24:23
convince application owners where I where I walked to
24:27
connect to active directory or later on to connect to whatever
24:31
IDP I had in place, now, we don't want to speak with your
24:35
authentication system. We have built-in authentication
24:38
system. If your system goes down, my
24:40
application, not available. Exactly.
24:43
People get mad at me. They don't yell at you.
24:45
You, they yell at me and I can't control the experience to the
24:47
level that they think that they want to.
24:49
That's where I mean, that's a common organizational struggle,
24:53
where to me it's like too much decision-making has been
24:57
delegated out to, you know, the business unit or the application
25:01
teams where it's like, you're going to if you can't get by in
25:05
around a simple concept, like authentication than your current
25:09
position where you can't really push anything.
25:11
Well, the cows point, though. Single sign-on was in the same
25:15
boat. Exactly 18, 20 years ago, and it
25:17
took time as it always does, right?
25:19
We talk about cycles and yeah, some organizations are agile and
25:23
can be and some, aren't it. Takes time to to build in that
25:26
functionality authorizations. I don't know if I've seen as
25:31
much of a shift towards. Yeah, we do need to build in
25:34
more granular permissions. Sometimes you see it.
25:37
Sometimes it's hidden behind extra licensing or subscription
25:40
costs that SAS products like to charge extra era for a team
25:44
license, right? Or something like that, versus
25:46
an individual seat or something like that.
25:49
How do we get applications to get on board with you know
25:54
having more flexibility from an authorization standpoint to be
25:56
able to enable stuff like this? Yeah.
25:58
So like I said, it's a chicken and egg you need to start
26:01
somewhere. Where would you start with the
26:03
newer Technologies with the new developments, right?
26:06
Be considered an organization which cut which currently takes
26:10
big monolithic applications and Converse.
26:13
Them to Michael Services, which is a common theme, right?
26:16
A lot of organizations are going through that transition.
26:19
How do you provide authorizations for
26:21
microservices? Would you go develop that by the
26:24
by yourself? If in the past developers they
26:28
said I want to own that code. I don't want you to tell me what
26:32
to do. Once you move to my core
26:35
Services, that's not the case each micro service owner wants
26:40
to be responsible on the business logic of his His small
26:44
micro service authorization should be a service like
26:48
authentication provided to all those say microservices.
26:53
So this is like a very good opportunity to start thinking,
26:56
don't worry dowshen, don't try to take care of all your legacy
26:59
application that for sure would not walk, but look at new
27:04
development, new initiative, which you are onboarding.
27:07
So that would be one second. I see more vandals like cots.
27:13
SAS applications supporting built-in policies and that's
27:17
another opportunity there, right?
27:19
So the market is evolving still slowly but it is evolving.
27:23
I think we are seeing a very similar path to what happened
27:27
with the SSO with you know single sign-on.
27:33
Yes it's more complex but also more interesting.
27:37
What's a fundamental shift in the way we do things?
27:39
Yeah. Just like MFA was as fundamental
27:41
shift to Authentication. It's very difficult to change
27:44
How We Do authorizations in a short time period.
27:48
If you're building an application, your point.
27:49
Yes, you can do that. You know, if you're on a rack F
27:52
Mainframe which we've been saying, you know, is going to
27:54
die for, I don't know 30 years and now all of a sudden it's hot
27:58
again, you can't find people who know how to do it.
28:01
There's these great cycles and sometimes sometimes the answer
28:05
is no, we're just not going to do that because the cost is too
28:08
great to invest to re-architect an application when it is time
28:13
to replace the application. Let's take this as something
28:16
that we want to consider is part of the, you know, the purchase
28:18
decision, which is why I love having identity.
28:20
Have a seat at the table for new applications coming in having
28:24
some sort of Standards don't go buy a product that doesn't
28:26
integrate with Open Standards to do.
28:29
Authentication, don't go buy a product that doesn't set us up
28:32
for future, success from an authorization standpoint.
28:34
Either maybe doesn't have as much cash.
28:37
A right now. From a, you know, a purchasing
28:40
decision standpoint, but it should be something that I A
28:42
teams out there who are listening and who have influence
28:46
over steering committees or architecture review boards, or
28:49
whatever, you know, political thing exists, within an
28:52
organization to say yes we're going to get that app.
28:55
These are the things that they should be aware of when they're
28:58
making a decision. No one goes out and says I'm
29:01
going to buy this thing and I and I never will be able to
29:03
connect it to mind active directory.
29:05
Oh my gosh. Why not exactly.
29:08
And you know what? You touched, another very
29:10
important Point. Absolutely agree with you.
29:12
New identity, people, they need to be part of that discussion.
29:16
Today, there's a bit of Disconnect, right application
29:19
owners. They're doing what they want up.
29:21
SEC data stack is not connected to the identity identity space.
29:26
And that leaves a very big gap there because also ization.
29:29
Eventually, if you think about that also has a Sheen takes all
29:32
the efforts, which organizations have placed into identity and
29:36
access management well-defined identities, well-managed
29:39
identities. Well, authenticated identities.
29:43
And brings all that effort into the application, space into the
29:48
data space, but they need to stick together on the same Cable
29:52
in order for that to happen. Can I ask a side question here?
29:56
Because it's it came up this morning as part of the opening,
29:58
Keener, the keynote for this for this morning, about the role of
30:03
potentially having something, a chief identity officer, and
30:06
having a sea of the table at, you know, basically the c-suite.
30:09
So right there with cpos and ctOS.
30:13
And all the see people, where do you stand on that?
30:17
Because I thought was interesting discussion this
30:18
morning. The panel with Andy, hindle and
30:21
Glaser and Claire something. I'm gonna personally know
30:26
someone else. There was a couple other folks I
30:28
figured out names. I really apologize.
30:29
I should have been more prepared to ask this question, but just
30:31
occurred to me as I'm thinking about it here.
30:34
Do you think now is a good time to have a chief identity officer
30:41
sitting at the board level or reporting to a Like those other
30:43
roles might be, or do you have a different perspective on it?
30:48
So, I haven't thought about that too much, but I do believe it
30:54
should roll under security. Because why would you do that?
30:58
Why would you do authentication? Why would you do authorization?
31:03
And the reason is Security in many cases.
31:07
And eventually, all of those Technologies are a means to an
31:12
end. And the end is the business
31:14
objective of the organization not having multi-factor
31:18
authentication or well-defined authorization that really
31:21
doesn't matter to anyone. They want, they their
31:24
organization to preform, according to its business
31:28
objective and to do that, they need support of security and I
31:33
am. So that's the way I can't lie,
31:37
see that but still new to the concept.
31:42
So I'm going to try Later. Turn this into a question, but
31:46
during Andres keynote, he talked about.
31:48
Okay. Well, really where what's
31:51
important is like, I kind of feel like our industry has done
31:55
a pretty good job on the authentication side when you can
31:58
see what's happening with it. It's like I was getting better
32:01
and better in terms of validating that the person or
32:06
potentially the non human being is who they say they are they
32:10
can authenticate the problem now that we need To solve is on the
32:16
authorization side and I my mind where I was going with this was
32:20
like the over-provisioned account problem, right?
32:25
Which kind of a pulling back to the statement.
32:29
It's not our back burst P back and I agree with that because I
32:32
feel like P back is In this context, kind of like the
32:39
scalpel. Where's our back is kind of like
32:41
the sledgehammer or the axe, right?
32:43
It's like you have two hundred applications, you're probably
32:47
not going to do p back for all 200 application but for your big
32:50
ones it's like that's where we use the scalpel.
32:53
We got a really this is this my idea anyway, so I think that
33:00
over-provisioned account problem because you have all these
33:03
accounts sitting dormant They've got all this access if this
33:08
accounts get hijacked somehow. Now they've got tons of access
33:13
that they didn't really need to have in the first place and I
33:17
think our back puts you in position that that's what's
33:20
going to happen. I think P back is kind of like
33:23
on more like on-the-fly decision so it's not like
33:26
over-provisioned account sitting there with that access.
33:29
Do you see things that way? Is that is that the right way to
33:32
think about it? Yeah, yeah and I think it's
33:35
Evolution not a revolution and that's it.
33:38
That's part of what. What you have mentioned.
33:42
P'burg does not replace any of the other stuff which is the lp
33:46
back makes them better. So yes, we have over-provisioned
33:50
accounts, the reason being that's how application operate
33:54
today applications, the majority of them, do not know how to
33:59
operate without that account. Being still, and we do see your
34:05
applications having that ability, which is great in my
34:08
opinion. But that's again an evolution,
34:10
which P book supports Arabic, cannot support that, pubic can
34:15
support that, but that's the combination of both that enables
34:19
enable that to actually happen. I like to think of myself as
34:23
pragmatic, right? And this is where I think a back
34:25
has a role because you may get into a situation where with your
34:30
IDP you're integrating many applications since these are
34:34
just to pass them, the attributes that they want.
34:37
It's not so Security numbers is not Bank.
34:40
Count balances and find you guys want to take the attributes and
34:45
determine what parts of your application.
34:48
Pragmatically speaking, I'm just going to pass a so to me that's
34:51
where a back or if you don't have a pee back tool that might
34:57
end up being your answer. I feel like if you're going to
35:00
go down the P background as more of you know as somebody
35:04
delivering this authorization service to the organization you
35:07
have to have more of a partnership with the Application
35:11
teams to make sure that you're applying these policies
35:15
correctly, putting people into the right roles.
35:18
Correct. I mean, of course, you have to
35:19
put them in the right roles, but it made me think of where we
35:23
were with the authorization, maybe a decade ago, which was
35:26
exact mole, right? The exact Mo standard and I
35:29
always felt like the exact the most standard was, I didn't see
35:34
very many organizations implementing it because back to
35:38
your original point, it was hard enough to get.
35:40
In teams many times to give up authorization, right?
35:44
And maybe I'm just thinking a point in time where I had to
35:47
physically deal with trying to get a bunch of applications with
35:51
different application owners and their own agendas to get onto a
35:54
common authentication platform, that was really hard, but then
35:59
to get them to give up authorization where you're
36:03
making the decision whether or not the end user can see a
36:06
screen within their application. It's like, no way not happening.
36:10
You're not qualified to make that decision.
36:13
And to me, that's where exact mode put you now to me, there
36:17
was a, I use case for that. If you had a situation where,
36:22
you know, you are a Security First organization, and you
36:26
absolutely had to have a paper trail in Central location of
36:29
what people could access, and did access that put you in a
36:34
good position to do that. But it feels like nobody talks
36:37
about exactly anymore which is a good thing.
36:42
No I'm just okay so I think Sakamoto meant well and it's a
36:47
good deal it was a good involvement of the market to
36:51
start speaking about authorizations.
36:55
I also believe that is part of the reason, people are afraid
36:59
for my salvation, just because of that Camille and the
37:03
complexity it brought in In but Zach.
37:07
Amell is not the only method for authorization management.
37:13
Certainly not for authorization enforcement.
37:16
There are many new developments today and we can see them all
37:19
over the place like, Opa, which is an open standard Amazon Sada.
37:27
We have, we have other development as well there.
37:33
And I think that those are all good.
37:35
Indications because it means there is the need what we
37:39
started with maybe Zachary was not good.
37:42
Enough was too complex for us and looking for news new options
37:48
and and that's good. That's the evolution.
37:50
The market is currently going through.
37:52
We need to I would say shake out that is a Camille bad notion.
38:01
May be sent to some areas are currently still.
38:03
Okay to still good. I I formed my personal
38:08
perspective, do not see organizations now.
38:12
Adopting zakah meal for four. New implementations, doesn't
38:16
seem like a lot of the concepts from exact mole still exist.
38:21
Like policy decision Point policy enforcement Point policy
38:26
Administration Point. Like to me those were like oh
38:28
yeah that helped me understand authorization.
38:32
Yes, I think those concepts are still They still apply it right?
38:37
Yes is absolutely and that that is certainly a very important
38:41
contributor physical standard to put in place those main elements
38:46
of an authorization solution but let's not get too much in love
38:51
with that because we are seeing that the solution eventually can
38:55
be more distributed. For example, we cannot force all
38:58
Technologies to outreach to the PDP the policy decision Point.
39:03
That's not how it works today. Day.
39:06
So we need to kind of understand those all separate components
39:11
that can reside in the technology itself, not just in
39:15
the authorization solution and that's how we need to think
39:18
about it. Maybe I got the Nuance that
39:20
you're talking about their the distribution which I think is
39:24
kind of like okay if you're talking about a pea back system,
39:31
you have the IDP that somewhere in the chain of Person to the
39:36
applications and authenticated User, it's doing some call to
39:40
that P. Back system to get, give me the
39:43
authorizations. I'm going to stick these in the
39:47
information I'm sending to the application.
39:50
Yes, for example. Yeah, that would be one one
39:53
example, and it's a good example.
39:55
It's not against how authorization should be treated
39:59
because again, the, he's a technology that needs to consume
40:03
the authorizations. We can't Force the technology.
40:07
How to walk? We can't force the application
40:09
to call out each. And every time it needs a
40:12
decision that failed. It didn't prove itself.
40:16
So we need to be more flexible. We buy, we, I'm saying the
40:19
authorization solution. There's always action, solution
40:21
should be flexible to accommodate the different
40:25
technology requirements application.
40:29
That needs everything in advanced and application that
40:32
needs more elaborated. Decision, that is fine.
40:35
A And surely the objective is to be able to see the decisions to
40:40
manage them. In a centralized way to be able
40:42
to govern an audit, all those authorization policies, that's
40:47
what we want to achieve. Not at the underlying
40:50
technology, which controls enforcement.
40:53
There's so much to unpack here. Well, we can do some more vodka.
40:56
Yeah, each and every suffix, your death is going to come
40:59
back, but I know we've got different engagements that we
41:02
all need to get to probably Colonel but so will probably
41:04
rise. Start to wrap things up but To
41:05
close us out with a lightning round something where I'm going
41:09
to say something and you give me your gut reaction or prediction
41:14
or whatever you'd like to go off of it.
41:16
So it's kind of a dealer's Choice.
41:18
That's we're in Vegas, are back and P back, what comes to mind
41:22
also, we sections, that was kind of a softball just to get things
41:27
warmed up. Zero trust wide concept need to
41:32
be better understood in the market.
41:35
Artificial intelligence. Oh cool.
41:38
Interesting future and one I'm just got throw in blockchain.
41:44
Yeah, absolutely. I absolutely believe a big
41:47
believer. Yes, I am.
41:49
What do you think? Is the killer app?
41:51
The killer use case for blockchain other than
41:54
cryptocurrency. Okay, so not allowed to talk
41:57
about crypto and this to the can, if you want but just just
42:02
well, they'll many there are many and they think
42:04
decentralized identity comes into mind because that's the
42:09
space. I mean, I think it would be very
42:12
interesting to see how that would evolve having each person
42:16
own its own identity and the data, which is associated with
42:21
his identity and having the ability to share that, not as
42:26
you know, just one package but in a more smart way and
42:31
certainly I want to go back to artificial intelligence for a
42:35
minute because relative to authorization, I think is a big
42:39
opportunity for AI, which is again, with these Provisioned
42:44
accounts to be able to Crunch the data of you have this
42:49
access, but you're using this access.
42:52
So therefore, all this other access, you don't really need,
42:56
we could take it away. One of the things have been kind
42:59
of turning on is, well, if you don't write those rules very
43:03
carefully. So let's say you use this access
43:06
in six months, you don't need it.
43:08
Well what about like route annual review?
43:11
Just like you, do the annual reviews of people?
43:13
People annually. What if that got taken away in
43:18
August because you hadn't used it in a year, man on a good
43:21
thing, right? It happens all the time, you
43:23
your aunt's cycles and it's true.
43:26
It happens. Anyway, right, how do we get
43:28
smarter about that maybe more? Maybe there's a way to say, hey
43:31
we're you know, because of the time of year and attribute or
43:35
policy comes up and says, for people who don't normally carry
43:39
this access throughout the year, but we know it's a busy time
43:41
this season. Maybe you were ramping up
43:43
Password reset support because we still are killing the
43:46
password. 20 years later, you know things like that where you
43:48
have more of a dynamic or a femoral access policy where it
43:53
only exists when you need it. And because you have the data to
43:57
be able to determine predetermine when you're going
44:00
to need it, we know there was going to be a spike in something
44:04
or we know that we're going to kick off a certification.
44:07
All the people who don't care the access kick, you kick it on
44:10
for the pilot for the axis owners or whatever it may be.
44:13
I think there's I think there's ways to go with that nose.
44:15
Let's see. Now we're getting into AI at the
44:17
center again. Yeah, we've been told our
44:20
podcast is becoming a at the center.
44:22
It's that could be a compliment. I mean, it's we can't ignore it.
44:26
I mean, it's you, it's everywhere here at identity
44:29
versus people are not well. We've gotta figure out how to
44:32
how we're going to work with. It's not going to go away.
44:34
I think we at some point in the last two years, the name
44:39
identity at the center, kind of finally hit like, oh my gosh,
44:42
genius. Like you guys saw this coming?
44:44
Yes. Well, here's why I say, we just
44:47
call it identity. The center people say, identity
44:50
is the new perimeter and then we're at the identity as
44:54
everywhere conference. So it's just identity, identity
44:59
identity. All right, let's end on a
45:01
lighter note. What's been your favorite
45:04
identify verse experience so far this week?
45:08
Okay. So the many, the many Event
45:14
Zealand and, you know, discussion panels and so on.
45:18
I was primarily in meeting. So I'm just being locked in a
45:22
meeting room to speak with customers.
45:23
That's what they do. So I would say my favorite
45:26
experience was the pizza place. I really like pizza.
45:30
Okay. Which pizza place one here.
45:32
That's where I saw you. Yo, yes, exactly.
45:34
That's what we met on that first day.
45:36
Yeah. What did you what did you end up
45:38
ordering to eat? Well, what's on your pizza
45:42
basic? You know, Oh the napoletana.
45:45
Like they call Italy love something like that.
45:48
Just plain tradition of picture. I like the margarita.
45:52
Yeah, my beliefs and yeah, yeah, exactly.
45:55
I actually went to this place to get pizza and I wound up getting
45:58
chicken parm and I don't regret that decision.
46:01
One bit, it was fantastic. I had Margarita Pizza on Monday
46:05
when I fill in, so hey, of course, we're good.
46:07
Yeah, Jim. What's been your favorite
46:10
experience? So last night we went out of on
46:13
on this party bus with my friends from accents, thank you
46:16
to them. They had that Jason, Statham
46:20
impersonator his, by the way. His real first name is Jason,
46:24
Jason Stanley's is real name. Very cool guy.
46:27
And what I realized was when you get a bunch of it, people
46:31
together, right? We're kind of like a tame crowd.
46:35
So having somebody like him kind of like get everybody dancing
46:39
and doing their thing was really cool.
46:41
So party bus kind Sounds a little intimidating, which is, I
46:45
think why I probably didn't have a bigger crowd than they had,
46:49
but I mean, we basically took a bus and they had some like, an
46:52
open bar on the bus. We took this bus to that,
46:57
welcome to Las Vegas sign, which is a very everybody knows it.
47:02
And then we went to the Fremont Street Experience, they had an
47:05
outdoor concert. I mean, so if you need a
47:08
recommendation, it take. Next time I come to Las Vegas is
47:12
either. Spend some extra non-business
47:15
time or come here on vacation Fremont Street.
47:18
Looks like that's my speed man. Like you know they've got the
47:23
1199 steak and lobster dinner. They've got open concerts and
47:29
its technical Wizardry. Like you think Times Square or
47:35
the strip here is like neon. Go there.
47:39
You feel like it's full day time because they have an overhead
47:42
TV. Just bigger than one I've ever
47:45
seen before and just like, great, fantastic experience.
47:49
So, yeah, last night sounds like about you, Jeff, you know, it's
47:55
a lot of little little moments walking through the hall seeing
47:58
people that I haven't seen before being able to thank guess
48:01
that we've had on the show that we haven't been able to meet in
48:03
person over the years. I'm not, I don't know what it
48:07
is, but I guess I'm not as approachable as you because I
48:09
know you have always had people coming up saying, Hey, listen to
48:11
the show and for that, which is very cool.
48:13
We always appreciate all our listeners, I had one last night,
48:16
which was great. I was walking back to my hotel
48:18
room and I think his name was John John.
48:22
Hopefully, with John, from transmits times like, hey, Jeff,
48:25
I listen to podcasts like, oh, very cool.
48:26
Thank you very much. So you're definitely the more
48:29
social butterfly but little interactions like that.
48:31
I think are very cool and being able to kind of talk with looks
48:34
like that. Yeah, yeah.
48:35
Like well half of it is like me grabbing people that I've known
48:41
over the years I saw Ryan Rossi in the vendor Hall.
48:45
And, you know, we go back a long time and back from his board
48:50
Rock days and he left word Rock and now he's back and forward
48:53
Rock. So yeah, it's great seeing him
48:55
and he's supposed to come out and do karaoke tonight.
48:58
So we'll see. We'll see what you're supposed
48:59
to sing something tonight. You still haven't told me what
49:01
your songs going to be Jesus. And told me what
49:04
misunderstanding. Okay, well I won't be singing.
49:06
So hopefully people come out and join me on the bench watching.
49:09
There you go. Hey I think you guys will have
49:11
just as much money on if not. More definitely.
49:14
All right, let's go ahead and wrap it up for this one.
49:16
Gal thank you so much for being part of this conversation for
49:19
folks who are interested will have links in the show notes.
49:22
But you can check out plain' ID.com to learn more about what
49:27
you guys are doing a speech was very cool.
49:29
We'll also have a link to gals profile on LinkedIn, so you can
49:31
connect with her and tell her why she's right or wrong when it
49:35
comes to, I guess anything. But probably something identity.
49:38
Right? Is what I'm guessing we're on
49:41
the web. Idac.
49:42
Podcast.com On Twitter at idac podcast, Mastodon at I still
49:47
have mastered. So I still post we have one or
49:50
two people who sort of engage on that side and like a post, we
49:54
definitely help appreciate that. Our friend, Chris is one of
49:57
those. So I basically do it for Chris,
50:00
do it, because it's hard. Yeah, Chris Powers but yeah,
50:04
we're on Macon. At idac podcasts at infosec got
50:07
exchanged. Obviously, you can always
50:08
connect with Jim and I we got a lot of interesting things coming
50:11
up. I think I want to get into a
50:12
little more. I run this Chief identity
50:14
officer role and Jim and I are going to kind of fall some ideas
50:18
and take it back again. We've got Ian Ian's coming up
50:21
next here, except so yeah, so that would be a good one to
50:24
springboard off of maybe. Yeah.
50:26
And that's pretty much it. So subscribe like all the cool
50:29
fun things that you know people like you to do when you listen
50:32
to podcasts and we'll talk with everyone in the next one.
50:36
Thank you. You've been listening to
50:39
Identity at the center. We hope you've enjoyed the show.
50:43
Make sure to like rate and review and we'll be back soon,
50:47
but in the meantime, hit the website at identity at the
50:51
center.com and find us on Twitter at ivac podcast.
50:57
See you next time on identity at the center,