Latest / Identity at the Center / #368 - Sponsor Spotlight - P0 Security

Transcript

#368 - Sponsor Spotlight - P0 Security · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:10
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. I'm good live from South Dakota.
0:19
Jim McDonald. Yeah, you've been making a cross
0:21
country move the last couple weeks here, so hopefully things
0:24
are going well. Going well enough, we'll see you
0:27
for one of our banter episodes and I'll get into it.
0:30
Yeah, people love the banter, but that is not today.
0:32
Today is all about P0. So we've got a sponsored episode
0:36
and so we are going to invite our guests on here in a second.
0:38
But just to make it clear, right, this is a sponsored
0:40
episode. We do these from time to time.
0:42
Let's just get a little more, you know, product specific.
0:45
I would say most of our episodes are more vendor neutral and we
0:48
we generally don't have vendors on those episodes, but this
0:51
gives an opportunity to learn more.
0:52
And this is 1 I think a lot of people will want to hear about.
0:54
So let me go ahead and introduce P0 Security.
0:57
You can find them on the web at P0 dot dev slash IDAC And we've
1:01
got their CEO and founder, Sheshwat Sagal.
1:04
So welcome to the show, Sheshwat.
1:07
Thanks chef. How are you?
1:09
I'm good. It's a little bit warm here, but
1:12
I'm inside and as as we're chatting before we hit record, I
1:15
am very much an indoor cat. So I am totally fine in my, you
1:18
know, air conditioned, you know, home studio, office, things like
1:21
that. So hopefully things are going
1:22
well for you as well. Yeah, no complaints.
1:25
It's right at the start of the California, some of the best
1:27
time to, to, to be living out here.
1:30
Not that other times are any different, but my definitely my
1:34
personal favorite time of the year.
1:37
Yeah, it's tough to beat California weather.
1:39
It's it's it's generally pretty darn good.
1:41
So yeah, congratulations and thank you for making me envious.
1:44
And I'm sure a lot of people listening who are either
1:45
sweltering in the heat that has been gripping, you know, a lot
1:48
of the the US or around the world or whatever.
1:50
Maybe. But let's find out about your
1:53
identity background. So the first time we have people
1:54
on, we just like to find out where they came from, you know,
1:57
from an identity perspective. So we're going to put you on the
1:59
hot seat here and say, how did you get an identity?
2:01
Is it something that you chose or did it choose you?
2:05
Oh, great question. I'd say a bit of the latter.
2:11
So I have been in engineering and R&D and product roles for
2:16
the vast majority of my career and the the mid 2000, mid tier
2:22
2000 tens were a very interesting time to be building
2:26
products out in the Bay Area. Why do I say that?
2:29
It's, it was a time where as you all know, cloud native
2:35
development was, was going mainstream.
2:37
Everyone was, was either moving to the cloud or if they started
2:41
on to the within the cloud, if they were cloud native, they
2:44
were experimenting with cloud native technologies and
2:48
infrastructure like Kubernetes and various databases and such,
2:52
right? And I built a variety of
2:58
products across different spaces.
3:01
And the commonality in every one of those roles was that as
3:09
development, as application development, as engineering
3:12
became more and more cloud native, the, the problem of
3:17
securing who has access to the, to the privileged resources
3:22
became kept getting more and more complex until it hit, you
3:27
know, what I believe as a breaking point.
3:29
And, and, and what I mean by that is that the old tools, the,
3:34
the, the tools that are managing privileged access, which all of
3:37
us are familiar with, you know, the, the, the, the legacy tools,
3:40
which I like to believe used to manage walls and secrets, right?
3:45
They were not built for an environment where privileged
3:50
access meant access in the cloud.
3:54
And we saw this gap and we saw it becoming worse, you know, the
3:58
the problem becoming bigger and bigger and bigger.
4:01
And that's when I decided to start P0 with S my colleagues.
4:04
And Fast forward three years, here we are.
4:07
So you had kind of a personal investment here, right, of
4:09
seeing this problem first hand with some of the roles you had
4:11
before. How do you solve that?
4:14
So let's let's talk about P0 kind of upfront is tell us about
4:17
P0 and then what are some of the capabilities that you bring to
4:22
address those problems that you've just talked about?
4:24
Great question. So let me back up a little bit
4:28
and talk about the broader space that we play in and how that has
4:32
evolved over the years. And then maybe that'll be a good
4:35
segue for me to talk about the capabilities that we bring to
4:38
the table, right? If you think about the space
4:44
itself, people call it in various different names, but at
4:48
its core, it's really just managing privileged access or
4:52
privileged access management, right?
4:55
And 2025 years ago, the space was, as I mentioned, synonymous
5:01
with creating words and secrets. And the, the, the definition of
5:07
the space at the time was depended on what privileged
5:13
resources were. So for people who've been like,
5:18
like you and I, who've been in the industry for decades, right,
5:21
if we wind down the clock, wind back the clock. 20 years ago,
5:25
privileged resources meant servers in the data centre or
5:31
databases that were physically located on boxes within the data
5:35
centre, right? And access to them basically
5:39
meant create a root, a root account or a Linux administrator
5:44
account or a database admin account, create a credential to
5:49
those accounts, put them in a vault and then rotate those and
5:55
then issue issue those credentials to people on demand,
5:59
right. I call this version of Pam as
6:04
the vault LED Pam or the secrets LED Pam.
6:10
Then you know, let's call it early 2000 tens.
6:15
This was the early cloud era. And instead of servers and
6:21
databases being physically located within a data centre,
6:25
they began to be located in a WSGCP Azure, right?
6:29
And the very first use cases that people had was just lift
6:34
and shift your workloads as they are from the data centre to the
6:39
cloud, right? So then the the use cases for
6:43
Pam translated to hey, give me access to databases and and and
6:49
the virtual machines in the cloud, right?
6:50
Easy peasy, right? So in those very early days, the
6:56
legacy or the vault LED Pams attempted to solve the same
7:00
problem by checking in, checking out credentials to these
7:03
databases and virtual virtual machines.
7:06
The problem was there were too many of them, right?
7:09
As, as, as is, you know, anyone who's familiar with cloud,
7:14
native cloud development will know that infrastructure spins
7:18
up, up and down on demand. And there's a lot of
7:20
infrastructure, right? So the old strategy of securing
7:26
credentials didn't quite work as well as people would have liked
7:32
it. It left SSH keys for virtual
7:36
machines all over the place. It left database credentials all
7:38
over the place and rotating those manually became a bit of
7:43
a, you know, pain in the neck, right.
7:46
So, so the second fail evolution of Pam was what I call as a
7:50
bastion LED Pam. And, and what I mean by bastion
7:53
LED Pam Well, instead of giving and managing access to each and
7:57
every one of these servers individually, people saw that it
8:00
was much easier to just put a bastion in front of your network
8:04
or a proxy or a jump host. The the bastions come in various
8:08
different names, right? And and, and and just control
8:12
the access to your network through this one server called
8:15
the Bastion, right. So, So what I'll call this the
8:19
the pans of this era as the bastion LED time, they worked,
8:26
except they were also a giant, giant pain in the neck in, in,
8:30
in ways in, in different ways than than than than the the
8:33
older Pam solutions. The problem with spinning up
8:36
infrastructure was that, hey, as, as when I know, every time
8:40
you, you, you start deploying an infrastructure for anything
8:44
you're on the hook for to maintain it, right?
8:47
So maintenance and usability and developer experience was a major
8:52
challenge in in using the Pam solutions of this era.
8:55
And and and secondly, the other big problem was once you were in
9:04
the network, you still had access to everything.
9:06
In other words, you had standing access as a developer to a lot
9:10
of your privileged infrastructure, right?
9:15
And hence to solve these problems is, you know, we
9:20
believe we are in the third evolution of of Pam, which I'd
9:24
call as the API LED Pam, right? And that is ultimately the
9:29
problem we are solving, which is that as P0, we want to provide
9:35
a, a, a solution that can secure access to all of your sensitive
9:40
assets in the cloud from identities of all sort use,
9:45
whether it's users, whether it's service accounts, whether it's
9:48
machine identities or whether it's AI agents, right.
9:52
And what's changed in the past few years is that we, you know,
9:56
now the cloud IMAPIS are, are robust enough that we can use an
10:03
architecture that's based on using those IMAPIS to, to secure
10:08
privileged access on demand for, for any, for any identity of any
10:12
sort. And, and, and that is what we
10:15
call as the API LED Pam, right? It's, it's, it's a natural
10:18
evolution of Pam from Bastian LED Pam or sorry, word LED Pam
10:22
or secret LED Pam to Bastian LED Pam to ultimately to API LED
10:27
Pam, right. And it's, it's, it's meant for
10:30
organizations who've been using cloud, cloud native technologies
10:35
or hybrid environments. And, and, and what they have
10:39
witnessed is that there are so many identities in the cloud, so
10:42
many resources in the cloud users, you know, people call
10:47
them non non human identities or service accounts or IM roles.
10:50
And all of these can access the cloud in so many different ways
10:53
that you really need a, a, a different solution that can work
10:57
at the scale of the cloud. That is, that is the ultimate
10:59
problem we are looking to solve. So you, you talked about sort of
11:03
the history there of Pam and, you know, the, the vault era,
11:06
the bastion era, the API era. And I'm sure there'll be future
11:09
errors that we are, you know, thinking about.
11:11
How do, how do analysts think about this is when you have this
11:15
conversation with folks like that, who are looking at the
11:18
markets, like how do they, how do they see P0?
11:21
And do they, do they slot you in as a, as a privileged access
11:24
management vendor or some other spot?
11:27
Like how does that typically that that that conversation go
11:29
no? It's a it's a great question
11:32
That is, you know, like most spaces in cybersecurity, right,
11:38
there are various overlaps with various different spaces.
11:43
In particular, you know, there is a reasonable overlap between
11:47
Pam and IGA, right? We do solve some IGA related use
11:52
cases as well. And, and for the most part, when
11:56
people, when analysts look at us though, it's, it's, it's, you
12:01
know, we, they, they've recognized that most of the
12:04
capabilities that we bring to the table are, are the domain,
12:08
are within the domain of a next Gen.
12:10
Pam vendor. And that's what people tend to
12:12
recognize us as as. OK, makes sense.
12:16
You know, nobody likes to be put into a box I think, but I think
12:19
that's it probably helps people kind of understand like where
12:22
things fit sort of together in a market.
12:24
I got to ask, P0 is such a a unique name.
12:27
Where does the name P0 come from?
12:31
So the story here is that in my last, in one of the companies
12:39
that I worked at before I joined, before I started P0,
12:45
there was an acquisition of a company.
12:49
And as we were trying to merge the company's assets into the
12:55
wider code base, what we realized was that, you know,
13:01
the, the company which was acquiring the, the, the, the
13:07
acquisition had obviously had a very high bar for security and
13:12
they expected the acquiring the acquisition to be at a similar
13:16
high bar. So they had to make sure that
13:20
they pause any development of any new features for one entire
13:25
year in order to, to, to get the, the, the security story to
13:30
get right. And as we were implementing the,
13:36
the, the features and functionalities to make sure
13:38
the, the combined solution had a watertight security posture.
13:42
By far the biggest challenge that we faced as an R&D team was
13:47
answering the simple question, who has access to production?
13:50
Or rather who or what has access to production, right?
13:54
And, and how do we make sure that access is secure, that
13:57
access is least privileged. It conforms to all the best
14:00
practices. No static credentials, no long
14:03
standing keys, heavy roll is just the right sized.
14:08
And it turned out to be a ginormous problem, right?
14:11
Just operationally, how do you make sure that these best
14:15
practices get implemented? And that was the motivation for,
14:22
for calling the name of the company is P0AS.
14:26
As as I'm sure you know and as as I'm sure many of your
14:29
listeners are also aware, P0 is the highest level of severity of
14:33
any incident. So our our tagline is access is
14:38
always AP0 problem. Yeah, that, you know, I, I
14:44
wanted to go back because I think the explanation you gave
14:48
on the history of privilege management, a lot, it made so
14:53
much sense. I just never heard anybody put
14:55
it in those different eras. And it kind of leads me to the
14:59
question that I wanted to ask, which was, you know, when I
15:04
talked to practitioners about how they're solving the very
15:08
problem of, OK, now your company's moving more and more
15:13
of its IT operations out to the cloud.
15:16
How are you managing privilege? How are you managing all these
15:20
new accounts? And I know that kind of the
15:23
starting point of the preference is, well, I've got IGA, I've got
15:28
privileged access management, maybe I've Kim, can I just use
15:33
these tools? I, I get the sense that
15:36
obviously that falls short, right?
15:38
You started this company, P0 dot dev, and by the way, that's P
15:42
with the #0 dot dev and P0 dot dev slash idac if you want to
15:48
learn more. But you started this company,
15:50
you had a vision that if you're just to take kind of the
15:54
existing tools and try to approach this problem, it falls
15:57
short. My question to you is, what is
16:00
that shortcoming? The solutions that you mentioned
16:03
in particular like things like IGA, things like Kim, right?
16:08
They, they talk it at least as far as Kim and related spaces
16:16
like CSPM and CNAP etcetera are concerned, they are concerned
16:22
primarily with offering visibility to an environment,
16:26
right. In other words, it's an after
16:28
the fact at a station of sorts. Hey, these are all the things
16:32
that exist in your environment. Let us just make sure somebody's
16:35
reviewing that. And most often than more often
16:40
than not, it's, it's either the SoC team or the cloud security
16:42
team. They, they'll do a, a, a review
16:47
based on the limited context they have and they'll say, OK,
16:50
it passes all the checks or hey, it does not pass the checks,
16:54
right? This is very much a compliance
16:57
driven problem or a compliance driven use case, right?
17:03
When it comes to actually managing the privileged access,
17:06
who are the people who are using access, creating access,
17:10
destroying access on a day in, day out basis?
17:13
It's not the people who are reviewing access after the fact,
17:17
three months later, six months later, on a quarterly schedule
17:20
or, or what have you, right? The people who are using access
17:24
tend to be the developers, the dev OPS teams, the platform
17:26
engineering teams. These are people who need to
17:29
maintain production, need to make sure access to production
17:33
is secure. Then they are the ones who need
17:35
to go and make sure databases are being spun up, data data
17:39
jobs are being executed. You know, clusters are healthy,
17:43
cluster health has healthy, etcetera, etcetera, right?
17:48
They and and and and and what we, because there's a
17:54
distinction in the persona. It's not a SoC use case.
17:57
It's more of a practitioner driven use case.
18:01
The the use case becomes, hey, I don't want to merely review who
18:06
has access. I want to give people access
18:09
safely. I want to make sure that
18:11
whatever they do behind the scenes is audited.
18:14
And once their work is done, I want to destroy that access,
18:18
right. In other words, the goal of Pam
18:21
is not to ensure after the fact that, hey, somebody's reviewing
18:26
access. That's the goal.
18:28
That's a compliancy compliance related use case relevant for
18:32
IGA and Kim. But for Pam the use case is
18:38
every access to any privileged system should be a short lived B
18:44
it should not be it should be least privileged and C it should
18:49
use. It should not use static
18:51
credentials or or long lived keys or long lived tokens.
18:54
It should as much as possible be based on, on short lived
18:58
credentials and add a fourth one in there.
19:02
Any activity that is going on under the hood should be
19:05
auditable logged for any kind of compliance related audit
19:10
requirements, right? So I'd say that that is really
19:14
the job of a Pam solution to make sure I reiterate any access
19:18
to short lived least privileged does not use static credentials
19:23
and is, you know, auditable by design.
19:26
And that's that's that's how we differ from an IGA solution or a
19:30
chem solution. Yeah, I was kind of so you jump
19:36
me to mode one of the other questions that I wanted to to
19:39
ask or maybe a topic that I wanted to pose because I think
19:44
there's at least this is the the goal state that I've come down
19:52
to where you you want your privilege access management
19:55
program to be. Is that at least your privilege
19:59
access? Maybe it's not the credentials,
20:02
maybe it's more the entitlements that it's where the rubber hits
20:06
the road. You want that to be just in time
20:09
0 standing privileges because if some account gets compromised,
20:15
it won't just lead to inappropriate access or
20:20
downright dangerous access. Is that kind of where you're
20:23
going with what you're talking about earlier?
20:25
And then I mean, the reason that organizations aren't doing that
20:31
I, I don't think it's because they don't agree with that or
20:34
that they're lazy. It's just, it's hard to do.
20:36
Maybe it's hard to do because the tools that existed up until
20:40
today don't really make it easy to do.
20:43
I don't know. Absolutely.
20:45
Absolutely. So you hit the name on the head,
20:47
right? Entitlements are something you
20:50
worry about when a system is very complex, like the cloud,
20:55
right? During the vault LED pan era,
20:59
there's no such thing as entitlements, right?
21:01
Once you had root privileges to to a box, you could go in there
21:04
and do whatever it is that you wanted to right?
21:06
The entitlements were fairly easy to to control because you
21:10
they were only a handful of systems.
21:12
This started breaking down completely in the cloud native
21:16
era, especially as IMABI has became more sophisticated
21:20
because instead of the front door access via username
21:23
password, the the attack surface became entitlements.
21:29
Right? So a big portion of what we call
21:33
as the API LED Pam is as I said, the problems it looks to solve
21:39
are how do you make every every access short lived and least
21:45
privileged and auditable by design.
21:47
You know what that means? Just in time access for users.
21:50
That means 0 standing access for users as well as non human
21:54
identities, right? It's how do you implement and
21:59
operationalize these concepts that is really the heart of what
22:02
this next Gen. pad panel is all about.
22:06
So I'm wondering when you get called into, OK, let's see demo
22:13
P0, is that usually when an organization saying that we kind
22:17
of hit our limits with privileged access management or
22:21
we don't have privileged access management, or, you know, I've
22:25
seen a lot of privileged access management organizations buying
22:30
to privileged access management and it flops, right?
22:34
Or maybe they own a whole lot of licenses and are just doing
22:37
vaulting and things like that. It's because there's so much
22:41
resistance from the developer. And one thing I'm getting the
22:44
sense of is that the developers want to use this product.
22:48
It makes their job easier. So, you know, one, I wanted to
22:52
to validate that. But two, I'm more interested to
22:55
know when is it that practitioners are calling you
22:59
in? Is it because their wholesale
23:01
need to, you know, they've, they've recognized that they
23:05
need a new platform or is it that there's certain use cases
23:09
that are coming up and they're looking to, you know, add on to
23:13
what they have to kind of just address those use cases?
23:17
Yeah, no, great question. So I'd say people fall along the
23:21
spectrum of of of their of how much bought into the concept of
23:28
pan. They are right on one extreme of
23:34
the spectrum are people who are already bought in, they know
23:38
they need pan and most likely they're already using some
23:43
version or older version of a Pam product.
23:46
Let's call let's say that they are using the bastion LED Pam,
23:50
right They'll security team, in fact one of our largest
23:53
customers falls in this category.
23:55
They were using a, a, you know, a bastion LED Pam with, let's
24:03
go, let's say a 15 year old technology, right?
24:05
And, and they realized that A, the user experience of
24:10
maintaining infrastructure and deploying infrastructure is not
24:12
the best in the world. And, and B, this, this product
24:16
gives developers standing access to critical infrastructure,
24:20
which does not fly with most sophisticated customers anymore,
24:24
right? Every, every customer wants
24:25
their data sensitive data in the hands of their vendors to be
24:30
secure, right. So this this company was a
24:33
vendor to their own customers. They want to make sure that
24:36
their developers do not have standing access or standing
24:39
privileges to do to any of their customer data.
24:43
So they came in and they decided, hey, yes, we would like
24:48
a solution in which our, our developers are, their experience
24:54
is, is, is not affected. If anything, it's enhanced.
24:58
And yet they do not have standing access to, to, to any
25:02
infrastructure anymore. They can elevate their
25:06
privileges on demand in a just in time fashion.
25:09
And when their work is done, they can revoke those.
25:11
You can revoke that access, right.
25:13
So that is 1 extreme of customers who are completely
25:16
bought into the idea. They need Pam and if anything,
25:19
they might need a refresh of the, the, the, the Lexi Pam
25:23
vendors that they already have. On the other extreme, they might
25:28
be customers as you, as you, as you said, right, who where the
25:33
security team knows that they need Pam, right, But they may
25:38
not have the buy in from the developer teams just yet.
25:44
Developers are a little hesitant to give up their standing
25:46
access. They are a little hesitant to,
25:49
to make sure that these service accounts, IM roles, etcetera,
25:53
they, they conform to the best practices, right?
25:58
And for, for such customers, the idea of Pam is more of a
26:02
journey, right, which starts by giving them visibility into
26:08
every access path to their production stack, right?
26:14
So that's the step one. Step 2 is identifying which of
26:17
those access paths or access patterns are potentially risky
26:23
and, and giving them workflows to, to implement some governance
26:27
or remove those, those standing privileges.
26:30
And step three, once that is done, how do you transition them
26:33
over to a just in time access model, right.
26:35
So these three steps don't happen overnight.
26:38
It becomes more of a journey to, to educate the, the, the broader
26:43
teams that, hey, this is, there's a better way to do this.
26:46
And, and, and, and, and that's how those, those conversations
26:50
go. And, and, and most customers are
26:53
not, are somewhere on the spectrum between these two
26:56
extremes, as you can imagine, right?
26:59
And, and, and, and that's it. It.
27:01
It really comes down to understanding what specific
27:04
problem they're looking to solve and working with them to make
27:06
sure we operationalize that. Yeah, great answer.
27:10
You know, I'm kind of sitting here thinking like the identity
27:14
industry follows what's happening in IT, the tools and
27:18
identity need to solve the problems that or challenges that
27:23
the IT infrastructure applications, etcetera throw at
27:27
it. I'm also kind of thinking with
27:31
that question that it does seem to me, you know, it goes all the
27:35
way back to that timeline that you payment, you know, going
27:39
from 20 year old where it was the vault, then it was Bastion
27:43
or Jump Box, now it's API driven that really there is legacy Pam
27:50
and modern Pam. I feel like when I talk to
27:55
organizations and this has always been true, OK, so this
27:59
has been true since my very first days in IT is that
28:02
organizations have one foot in the past and 1 foot in the
28:06
future, right? One foot in the past is always
28:10
going to be there. But if you look five years down
28:13
the road, more is going to be what you call the future today,
28:17
right? And so if you're starting out
28:19
today and you say we got 1 foot in the future, if you say we
28:23
need to solve for both, bottom line is we need to follow solve
28:26
for both. That you're going to probably
28:28
need legacy Pam and modern Pam at the same time.
28:32
But if you start, if you're at the point where you have nothing
28:35
and you have to pick between the two, I'd say where are you going
28:42
to 1st off, you're not just going to snap your fingers.
28:45
Then a Pam's going to be rolled out.
28:46
So you're looking at a couple years and you have to look at
28:50
like, where are you going to be in the future?
28:52
You're going to be mostly in the future or mostly in the past.
28:55
You're going to be mostly in the past.
28:56
Maybe you do need legacy Pam as your answer.
28:59
But if where you're going is going to be in the cloud, it's
29:02
going to be using much more automation, maybe AI agents in
29:07
the future, like that's where you put your investment.
29:10
Thoughts. Yeah, no, absolutely.
29:12
So you you hit the name on the head right, given the
29:16
implementation times involved with with with with digital
29:20
transformations of most of the size that most respectable
29:25
organizations undertake right. It's the, the, the calculus in
29:33
front of most security leaders is not just what they need now.
29:37
But hey, given our organizations current investments, given our
29:41
organizations planned investments, where are we likely
29:44
to be in the next 5 years, right?
29:46
What is my stack on a look like? Is it going to be more cloud
29:49
native? Is it going to be less cloud
29:50
native? Is it completely irrelevant
29:53
based on some of the AI investments we are making?
29:56
And given that reality or given that projection five years out,
29:59
what is the best solution that fits the needs and will future
30:03
proof us so that we don't have to worry about this damn problem
30:06
for the next 10 years, right? That's, that's the, that's the,
30:10
the calculus in front of, of, of most security leaders out there.
30:14
What is the the maximum we can solve that would make this this
30:20
investment moot for the next 10 years?
30:24
Yeah, absolutely. So I wanted to ask you another
30:27
question based on something you said earlier.
30:29
We were talking about we need to, I think you're taking a
30:33
story from your past. You're talking about protecting
30:37
people, but also the non people, right?
30:39
So you're getting into this whole non human identity
30:43
question. And I guess in my mind they're
30:49
different, but I'm not, you know, and having talked to you
30:52
in the past, I kind of get the sense you don't treat them
30:57
differently or you don't think about them differently when it
31:00
comes to management of the access that they have.
31:03
And I'm wondering if you can explain that a little bit.
31:07
Great question. So I think I want to distinguish
31:10
between what's a use case and what's a company, right or or
31:15
rather what's a use case and what's a platform.
31:18
Absolutely securing service accounts, non human identities
31:22
etcetera is a very legitimate use case, right.
31:25
Absolutely. This thing is becoming more
31:27
relevant now that we are in a in a cloud native error, we are in
31:33
moving towards an agentic error. There the number of entities
31:38
that can access your sensitive infrastructure and data is is
31:44
increasing and only going to explode even more rapidly from
31:47
here on, right. But I would argue that is a use
31:56
case and not a company defining feature in and of itself because
32:04
I define the space privileged access management as hey, I need
32:10
a platform that helps secure privileged access to my
32:14
sensitive infrastructure. Period.
32:16
No way do I say that it has to only come from users, or it has
32:20
to come from machines or it has to come from agents, right?
32:24
I mean, at the end of the day, if I'm a security leader, I care
32:28
about securing access because that is my most important
32:35
perimeter, for the lack of a better word.
32:38
I hate the word perimeter. It gets used and abused so much.
32:41
But but it's true, right? It's identity and access is is
32:44
the foot is the most important line of defence, right?
32:48
But it almost sounds a little too narrow to think about access
32:55
for only certain categories of identities, right?
32:59
Particularly when it's the same product or the same framework of
33:02
thinking can solve both those problems, right?
33:06
At the end of the day, our belief is that any kind of
33:09
access, whether it's from users or from non human identities,
33:13
any kind of access should be least privileged.
33:15
It should be short lived and it should conform to the best
33:20
practices of of not using static credentials, no matter whether
33:24
it's for users, EI agents or non human identities, right?
33:29
So. Yeah, Yeah, it's absolutely.
33:32
So the business drivers that you just mentioned I'm 100% on board
33:38
with. I mean you are spot on.
33:41
My question, I guess my follow up question to that is talked
33:45
about the word in this API era. I think I know what that means.
33:50
Is that what enables you to more or less treat them the same?
33:54
Or is it just the the business philosophy?
33:58
Is the technology in the background, this API era that
34:02
you know, if you can script it to go out to an API, then you
34:08
can you can make it work? Absolutely, Absolutely.
34:10
I mean, you, you hit the, you hit the name on the head, right?
34:14
So it's not just the business drivers that I was talking
34:15
about, it's also the technical drivers.
34:19
In a nutshell, the way our product works is that we create
34:22
a graph of of every identity in the system, who's the consumer
34:30
of that identity, what credentials they're using, what
34:33
roles, permissions they have and what insensitive resources they
34:37
have access to, right. So think of it as a graph and it
34:41
does not make a huge amount of sense, in my opinion, to treat
34:45
this graph differently for users versus non human identities
34:48
versus versus agents. What not right?
34:51
So technically we have under the hood, a common engine that
34:57
treats all of these different kinds of identities as one,
35:01
right? And all of this graph is just
35:03
built by hooking together the the APIs of different systems,
35:08
such as your cloud providers, your identity providers, your
35:11
HRMS systems, right? And and and we don't really need
35:16
to to to slice and dice it further based on the the the
35:20
kind of identity when when when one common framework can is good
35:25
enough for treating both of them as first class citizens.
35:28
And so I think that's going to be a lead into my, the, the, my
35:31
next question or my last question, which was really I'm,
35:35
I'm thinking from the practitioner perspective.
35:37
So some tools you buy them because they've got great
35:41
features and functionality other tools bring to the table, like
35:46
wide visibility, like you can connect to a lot of things and
35:50
get the visibility. And I'm wondering from the P0
35:54
perspective, which of those two camps do you fall into?
35:59
So ultimately we want to be the, the tool that helps in the
36:03
operationalization of, of police privilege, right?
36:08
And visibility is a necessary first step on that journey.
36:12
So again, it goes back to what I was saying, customers fall on a
36:16
spectrum. They'll be the ones that they'll
36:18
be ones that are more advanced who will come in and say, you
36:22
know what, we don't need visibility.
36:23
Just help me implement least privilege because I already have
36:26
the basic building blocks in place, right?
36:29
For them. We are first and foremost an
36:32
operationalization of least privilege company, right?
36:36
Then there'll be others who are bought into the idea, but they
36:40
may face developer resistance to begin with.
36:42
For them, in the beginning, we'll land by providing them
36:46
visibility. But ultimately, even for them,
36:50
if we are so successful, we want to move them towards a model of
36:56
operationalizing lease privilege, right?
36:58
So to answer your question, Jim, for all customers, we are
37:03
ultimately a company that wants to operationalize lease
37:08
privilege. For some of those.
37:11
The way to do so is by giving them visibility and hand holding
37:14
them. On the journey so all this talk
37:16
of identity and you're you're preaching to the choir here,
37:18
right you're on the identity at the center podcast, right so we
37:21
kind of get it but there's a lot of people who listen to this who
37:24
maybe don't consider themselves an identity they might be an
37:26
engineering or insecurity or, you know somewhere around there.
37:29
What's something that you wish, like engineering, people would
37:33
understand about access and, and identities and, and how to
37:36
manage it? Because I hate to say it, but
37:41
people keep saying identity is the new perimeter.
37:43
It's been around forever. It's not a new perimeter.
37:45
So I feel like this is an area where we could probably do some
37:48
education for for people who maybe aren't as familiar with it
37:51
or haven't traditionally looked at identity as as part of their
37:54
their role. Yeah, no, absolutely.
37:56
I think the biggest learning for anyone who's not in a core
38:01
security function, who's not thinking about identity on a day
38:04
in, day out basis, is that expediency in technical
38:09
decisions ultimately always creates headaches further down
38:17
the line. And in many areas, this is truer
38:23
than others. And identity happens to be 1.
38:27
And what I mean by that is if you're an engineer, it's very
38:30
easy to be expedient and say that, hey, no, I need standing
38:34
access all the time because I need it for my work.
38:36
Or hey, I, I need to hard code this credential into my, into
38:40
the service that I'm building because you know what?
38:42
Yellow right? But, but, but, but those things
38:49
are never the security best practice.
38:51
They always snowball over time. They almost always compound and
38:58
and in time become a much bigger problem than if they're
39:01
addressed directly at the source.
39:04
And if you have the right tools that addressing those at the
39:07
source is actually much easier than it than it sounds right.
39:12
So, so that is that is something that I wish you know the the the
39:19
people who are in touch with identity, but from a user
39:24
perspective, but not thinking about it day in, day out.
39:26
That is something that I would wish that they would stand, stop
39:29
for a minute and appreciate. So let me challenge a little bit
39:32
because what happens if you've inherited a mess, right?
39:37
This happens a lot, right? As you know, someone comes into
39:39
a new role or you know, decisions that were made in the
39:42
past maybe aren't the best decisions, and we have to pick
39:44
up the pieces of whatever that looks like.
39:47
What's some advice if you're in that scenario where you know
39:50
what you should do, but it might be difficult either financially
39:54
or politically? Absolutely, absolutely.
39:56
Look, some amount of technical debt is is.
40:00
Is to be expected, right? People go to do things which
40:04
they have to do. Everyone is making trade-offs
40:08
based on the time, the budget they have, the resources they
40:12
have, the OK Rs they need to hit.
40:14
That's, that's that's just the world we live in, right?
40:18
But at the same time, many of these decisions need not be made
40:23
the way they are, especially for Greenfield projects or even if
40:28
for brownfield projects, right? If you have to fix something
40:31
right, just make sure you are tackling the most important big
40:36
rocks in your in the mess that you inherit, right?
40:39
And it just so happens identity is usually one of the biggest
40:42
rock, if not the biggest rock. Here, here you're, you're, like
40:45
I said, you're, you're, you're talking to the right people
40:47
about this. I guess I kind of want to wrap
40:49
up the conversation with where do you see this going?
40:52
Because you've talked about the different eras and being in the
40:54
API era. What do you see as like the next
40:56
era and like the next challenges that we need to be thinking
41:00
about? And how do you see P0 kind of
41:03
staying with it, right? Because you don't want to get
41:05
left behind, as we've seen with some of the other eras.
41:09
Yeah, look, we're, it's, this is an easy one, right?
41:11
We are in the age of AI agents, right?
41:13
Or we are very soon, depending on who you ask.
41:16
We are at the doorstep of the the age of AI agents.
41:21
And, and what this means is that very soon, once a lot of these
41:27
agents are in production, you know, 9099% of the organizations
41:32
that I've spoken to, they're still playing around with
41:34
agents. They haven't been productionized
41:36
just yet, but it's only a matter of time, right?
41:38
So I think the next evolution of Pam would be the agent LED Pam
41:43
for the lack of a better word, where the same problems.
41:46
By the way. Again, the core focus of Pam
41:49
hasn't really changed for the last 30 years.
41:51
It's still make sure every acts, I, I.
41:54
I hate to sound like a broken record but that is what it is.
41:57
Every access needs to be least privileged, every access needs
42:00
to be short lived, every access needs to be auditable and every
42:04
access needs to be not using static keys and credentials.
42:09
Right. The same 4 problems need to be
42:13
solved for agents, right? And and it will just make for a
42:19
product with slightly different form factor, slightly different
42:22
assumptions based on how agents get operationalized in practice.
42:27
But again, the Gen. 4 I'm pretty sure would be the agent LED Pam
42:36
solving. The same for, you know, 3 or 4
42:38
problems for an entirely new class of of of identities.
42:43
It sounds a little bit kind of like The Matrix where we've got
42:44
a bunch of agents talking to each other and figuring out what
42:47
they should and shouldn't be doing.
42:48
And, you know, I've kind of sent us a four in previous episodes.
42:51
It's like, all right, you agents, you figure it out and
42:53
let me know what you decide. Just kind of take care of for
42:56
me. Yeah, absolutely.
42:58
I mean, that's, that's, that's a, that's a good way of putting
43:00
it, right? I mean, it's and, and, and the
43:02
use cases, the tangible use cases are actually very easy to
43:05
think about. So like for example, right, if
43:08
you, if you're using a coding agent, you, you want to make
43:12
sure that whatever agent you're using cursor or or or broad or,
43:18
or something else, you want to make sure that a they have
43:22
access. If they're talking to GitHub,
43:23
for example, right? You want to make sure that these
43:25
agentic identities are not using personal access tokens or
43:29
they're using some, if they are authenticated via Oauth using an
43:36
MCP in the middle, you want to make sure that you know the,
43:40
the, the, the tokens that they're using are, are going
43:43
they are, they are not static. They are not long lived.
43:45
They are not hard coded into the MCP, right.
43:48
You want to make sure that their scopes to the repos that they
43:51
are are, are accessing our least privilege.
43:55
Nobody, no agent has, you know, write or delete access to just
44:01
about every repo in your in your code base, right?
44:05
So again, the the the the precise problems might sound
44:08
different, but it's all it it all.
44:10
Rhymes with what has happened in the best.
44:14
I feel like it's a speed problem more than anything in an
44:16
automation thing because the use cases are the same.
44:19
It's still even if it's not a human versus a human, it's still
44:22
onboarding, offboarding, you know, join your mover reliever.
44:24
It just so happens that they're not humans, but the speed with
44:28
which it has to take place with and the ephemeral nature of some
44:31
of these, you know, micro services or API calls or agents
44:34
that might only live for milliseconds.
44:36
You still need the traceability and the audit logs to show that,
44:39
Oh yeah, this agent did exist. It did these things and these
44:42
three milliseconds, and then it went away.
44:45
Right? All that kind of stuff.
44:46
Yeah. So this has been a really fun
44:50
conversation. I'm glad you were able to join
44:51
us. I have to say, I'm going to
44:55
assume you do more than just, you know, solving identity
44:58
challenges. What do you do like outside of,
45:01
you know, being in the nerdery, you know, with us talking MCP
45:05
and Pam and agents and all that other stuff, like what do you do
45:08
for fun to unwind? I spent time with the family
45:12
first and foremost. I have an 8 year old.
45:16
I played tennis with him. Earlier, I used to play tennis
45:18
by myself. These days, increasingly I
45:20
played tennis with him. I like to stay fit as much as I
45:27
can, by going to the gym, by swimming, by playing tennis,
45:33
whenever, whenever time allows. And I'm trying to get back into
45:38
a reading habit which I've not been so good at, especially
45:41
since I started a company. Is there a specific genre of of
45:46
reading that you like to do as a fiction?
45:47
Non fiction? Like what are you into?
45:50
Increasingly it's history, historical narratives.
45:53
OK, so now you're starting to talk about Jim's language
45:56
because he's always interested in like documentaries about
45:58
history, working out, stuff like that.
46:01
I I guess I'll let you 2 talk right recommendations for each
46:05
other. Maybe, maybe, maybe the next
46:07
time we talk, I'm I'm on the road to, to South Dakota for all
46:12
you know. I would love it.
46:14
You'd be welcome here. Well, that's been a lot of fun,
46:18
Jim. Like what would you give like
46:19
some suggestion for Shashwat to read?
46:22
I know you're big into like documentaries and stuff like
46:24
that. I don't read, so I, you know, I
46:27
have YouTube Premium because they can't stand the commercials
46:31
and it's just unbelievable with the amount of historical
46:34
documentaries. And now what I'm seeing is a new
46:37
genre is that there are content creators who take a period in
46:42
time and build a day in the life of story and they'll pick a a
46:50
fictitious figure who lived in that place at that time, like
46:54
New York City in 1882. And you just watch like, and I'm
47:01
talking like an hour long documentary.
47:04
I watch. I love those, I love those.
47:06
I can't believe like there are people out there and I know it's
47:09
when I say it's like an independent creator.
47:11
I don't know what his whole corporate structure is, but
47:15
there's one guy, because I saw several videos where he's the
47:19
fictitious character, he's the actor in all these different
47:22
videos. And I'm like, this is the
47:25
future. It's people kind of saying, hey,
47:29
this is what I want to create. I can be an artist now and put
47:32
together something because all of the materials that are
47:37
neither commercially available, there's AI to help me create
47:40
backgrounds and create videos, etcetera, etcetera, and put that
47:45
up and then other people can enjoy it.
47:48
That's what I love about technology.
47:50
We talk about like the bad parts of technology.
47:53
Yeah, they're there, but there's so much good that can come from
47:56
it. Just what do you know what Jim's
47:59
talking about with this day? And I think because I've never
48:00
heard of this, it sounds, it sounds kind of interesting, but
48:03
I'm, I don't know what to think about it.
48:05
No, it sounds, it sounds interesting.
48:08
I'm not too big into into YouTube videos.
48:11
I do not have YouTube Premium, just for the record, but it's
48:15
it's, it definitely sounds very interesting.
48:18
Well, you're, you're in the minority here.
48:20
I think Jim and I are both YouTube Premium.
48:21
I, it's on quite a bit for me and I think it's such an
48:24
interesting thing. I think, you know, if I'm going
48:26
to lay a, a, a day in the life gym, I want to like, have some
48:29
fantasy around it, like Game of Thrones, right?
48:32
Or I don't know, the Matrix, right?
48:34
Things like that. I want to like have a good
48:36
story, you know, and, and 'cause I, I mean, you're going to have
48:41
to fill me in on this at some point because I can't imagine
48:44
that there are that many interesting lives of like
48:47
normal, like people. If that makes.
48:50
Sense these are fictitious lives, the person's making them
48:53
up and then they make a video, right?
48:55
I'll, I'll send you a few of them, OK?
48:57
I mean, 'cause I'm, I'm thinking of like the most dry video ever
49:01
where it's like, oh, I woke up today and then I went and did
49:04
laundry. Then I, you know, sat at my
49:06
computer all day and did nothing.
49:08
Or, you know, I went and farmed or something like that.
49:11
I'm like, I'm sure there's a market for it, but I I'm.
49:13
Just so there's a day in the life of this guy in 1882.
49:17
He was in New York City. He was a German immigrant, and
49:22
his girlfriend came over and some pickpocket, like, dropped
49:26
something in her bag. And then she pulls it out of the
49:30
bag. The police see her, they arrest
49:33
her. Now he's like, trying to figure
49:34
out how to get her out of jail. Like, there's a whole little
49:39
drama behind it. So it's kind of a good story.
49:42
Will acted and I mean, it seems like there's a little more to it
49:46
than a one person, you know thing, but it's pretty
49:51
incredible that it's out there. It's just free content.
49:55
I'll have to check it out. I think you know every, my
49:58
position is everybody at this point is a content creator.
50:00
It's just do people want to consume that content?
50:04
That's right. We're on camera somewhere.
50:05
So all right. Well, this has been a just a
50:08
really fun conversation. Joshua, thank you so much for
50:10
being with us. Any final thoughts that you want
50:12
to get out there for the the folks who are listening and or
50:15
watching? Access is our probably 0, so if
50:19
you have any any challenges managing privileged access to
50:26
cloud, native or hybrid environments, please come talk
50:31
to us. We'll be happy to help.
50:33
I love that tackling access is our priority Zero that that's
50:37
something that resonates with a lot of IT people around the
50:39
world. So good one there.
50:41
So be sure to visit the website P0 dot dev slash IDAC.
50:45
There'll be a bunch of information that you can kind of
50:47
check out and learn more about what you guys are doing.
50:49
So thank you again for being with us.
50:52
For those listening, keep on a liking, subscribing, sharing
50:55
with friends, enemies doesn't matter.
50:57
As long as they're listening, that's all that matters.
50:58
So check us out on the web idacpodcast.com.
51:01
And with that, we'll leave it for this week.
51:03
Thanks everybody for watching and or listening and we'll talk
51:05
with you all in the next one. You've been listening to
51:10
Identity at the Center. We hope you've enjoyed the show.
51:14
Make sure to like, rate and review, and we'll be back soon.
51:19
But in the meantime, hit the website at
51:21
identity@thecenter.com. See you next time on Identity at
51:27
the Center.