Latest / Identity at the Center / #72- Talking about PAM with Paul Lanzi

Transcript

#72- Talking about PAM with Paul Lanzi · Identity at the Center

0:16
This is the identity at the center podcast.
0:19
This is a show that talks about identity and access management
0:22
and making sure you know who has access to what?
0:25
Let's get started. Welcome to the identity of the
0:33
center podcast I'm Jeff and that's Jim.
0:35
Hey Jim hey Jeff, how's it going?
0:37
I'm good yourself. Good.
0:39
I gotta observation my observation for the week.
0:42
So ugly driving with my son, my younger son last night and I
0:47
said you know I was giving him the rundown of where we had to
0:50
be and when we need to leave the gym by quarter after quarter,
0:56
quarter after what's that, you know, like 7:15.
1:00
When I grow up, I'm just going to say 715.
1:03
I'm not going to say quarter after why not?
1:06
He's like well why do you have to make it so confusing?
1:09
I thought, okay, that's Through The Eyes of babes, right?
1:13
I mean it gives you that fresh perspective, you don't think of
1:16
very often, I empathize with him because I'm the same way I am
1:20
not 10:15, to type of person originally, I was always very
1:24
specific because, you know, I'm the nerd in middle school, high
1:28
school with the digital watch. And, you know, what time is?
1:30
It is 723, right? It's not.
1:34
It's about half till, you know, I don't deal in vagaries of
1:37
time, I like to know when things are Are taking place.
1:40
So so I can empathize and I certainly understand.
1:45
Yeah, well he you know he followed up with.
1:47
Why do you why do you even do that?
1:49
Why do you say I was like, I don't know, that's what
1:53
everybody does so he you know he made me think about it.
1:58
I've been thinking about it several times today.
2:00
I'm sure we could have a very philosophically discussion and
2:04
time and the you know, human constructs that it is and all
2:09
that good stuff. Stuff.
2:10
But we should probably talk about identity about identity
2:13
and access management, which is easy for me to say.
2:15
Yeah, we don't do that. I think people are going to
2:18
going to turn this off pretty soon so we should get to that.
2:21
Well, let's talk about privileged access management and
2:24
to help us with that conversation.
2:25
We've got a guest. His name is Paul lanzi.
2:28
He's the co-founder and CEO, a tree medians.
2:31
He's also a member of the identity, technical working
2:34
group 48 Arc, chair of ideas, say Beyond best practices,
2:38
technical working group. The board advisor to the
2:41
cybersecurity non-profit member of the order of the arrow, and a
2:46
whole bunch more. I'm sure that if behind the
2:48
scenes, welcome to the show. Paul, thank you so much Jeff.
2:50
And by the way, that introduction makes me sound far
2:52
more important than I actually am.
2:53
So thank you for that. Well, I don't know how you find
2:56
all the time to do all that, you know, in addition to what I
2:59
assume is your day job working over at median and you know,
3:02
operating you know that that is an organization, a lot of
3:05
coffee, is it? Turns out and sleep is optional.
3:08
So those two things makes it work.
3:09
So there was a lot of things we mentioned there but typically,
3:12
when we're going to have a conversation like to start kind
3:15
of at the beginning and, you know, you've been in the IM
3:18
space for a while, maybe you can kind of give us a synopsis of,
3:22
how did you get into identity and access management?
3:24
Is it something that shows you or did you choose it?
3:28
Yeah, well, it really starts back in 1994 and I'm actually
3:31
going to date myself pretty severely here.
3:33
But back in 1994, I helped helped co-found.
3:36
The first Aaron service, provider, and the rural County
3:39
where I grew up, Humboldt County and the farther Northern reaches
3:41
of California and one of my first jobs was the guy who had
3:46
to go create and update and delete accounts.
3:49
So my very first job was in managing the identities of our
3:52
customers. So my technology career started
3:55
off with account management fast forward about give or take 20
4:00
years. I was at Genentech and I was
4:02
working as an IT project manager there and one day my my manager
4:06
called me into her office and said, hey, I think we got this
4:09
new Checked. I think he'd be perfect fit for
4:11
it. It's a great thing.
4:12
Tell me about this project. Well, it turns out that
4:16
Genentech ex-ceo is also the member of Google's board of
4:21
directors and when Google launched, what is now called,
4:24
Google Suite, or Google apps for domain, or it's had various
4:27
names over the years, but basically the concept of having
4:30
Gmail and decal. But for Enterprises the our CEO
4:34
at Genentech decided that we were going to be one of the
4:36
first companies to adopt it. And so the specific project I
4:39
got assigned was trying to figure out how to hook up wave
4:42
set. If you guys remember wave set
4:43
from the way back days, how to hook up wave set to Google's at
4:47
that time. Very nascent API is for account
4:49
creation, deletion update. And we had a very limited time
4:53
very to get that done. And it's to my knowledge.
4:56
The first time that at that time was actually called son.
4:58
One Source, I son, identity manager, but trying to get son,
5:02
identity manager, hooked up to Google suite and all the
5:06
challenges that presented and that was really what really
5:08
launched me into the idea. World.
5:10
So that's quite the history. Especially when you start
5:12
talking about wave set. You know, I think of the, you
5:15
know, Obi-Wan that's a name. I haven't heard in a long time.
5:18
Well, they worry that I just figured a bunch of PTSD in a
5:21
bunch of your listeners. So I apologize right off the bat
5:24
for any mental trauma. I just caused by mentioning that
5:28
word, it was too late. Now I guess it's easier to ask
5:31
for forgiveness than permission right before you get into it.
5:34
So what about some of these other organizations that you
5:36
work with like idsa and eight? Tariq, which is the advanced
5:41
technology academic research center and things like see, snps
5:45
itís, pretty nonprofit. How did you get involved with
5:47
organizations like that and maybe you could tell what about,
5:51
you know, some of that? Yeah, well just last week you
5:53
had sought on for my ds8. I think you got Julie on before
5:56
that. So I will refer listeners back
5:58
to those episodes because Juliana solder far far better
6:02
trained on the history of. I they say that I am but I can
6:05
talk a little bit about the cybersecurity non-profit.
6:07
That's an area. I have a lot of passion around.
6:09
The cybersecurity non-profit only has two missions.
6:11
The first one is to increase the diversity of the cyber security
6:15
practitioner community. And then the second mission is
6:17
to sort of increase the level of information security.
6:20
Knowledge among the populace in general, right?
6:24
And demonstrably, nonprofits, amazing.
6:26
They've got over 7,000 members globally and they've got
6:29
chapters in cities that stretch from San Francisco to Chicago to
6:33
parts of Africa and parts of Asia.
6:35
Now, as well and being aboard a visor to that organization has
6:38
been just a fantastic Fantastic way to look at this problem from
6:42
a different area, a different sector because the members of
6:45
see SNP by and large are, those were just getting started in
6:48
their cybersecurity careers and you know, us the three of us
6:51
have been around. This been around the block a
6:53
while. It's often easy to forget how
6:55
hard it is to break into cyber security.
6:58
We talk all the time about this, massive shortage we have in
7:01
cyber security practitioners, but at the same time like I hear
7:03
stories every day about how difficult it is to break into
7:06
this as a entry level. Insurance.
7:10
So csmp is trying to help bridge that Gap and find ways to make
7:14
that easier for new practitioners and Community,
7:16
especially those who are a diverse background.
7:19
So Paul, I'm very interested in your background with room,
7:22
medium. My understanding is that you
7:25
guys are focused on privileged access management and Jeff and
7:30
I, you know, we work with our clients and developing their I
7:35
am strategy. We typically start that with
7:39
With an assessment process kind of a maturity assessment and one
7:44
of the areas that we look at is privileged access management.
7:47
And so you know kind of taking the look at the privileged
7:53
access management capability and organization and assigning a
7:58
value say somewhere between like one in five in terms of kind of
8:03
current state maturity and then targets 8 maturity.
8:06
And so what I'm wondering is kind of do you have you
8:08
formulated Maturity model similar to that or could you
8:12
maybe talk through some of the capabilities that least in your
8:14
mind that are kind of at that Baseline level of maturity of
8:19
privileged access management and then how an organization we kind
8:23
of move up the scale in terms of increasing their maturity?
8:27
Yeah, for sure. Well, I want to start off by
8:29
endorsing your son, or your kid's perspective of we don't
8:32
need to do it the way we've always done it, right?
8:33
And so that's one of the reasons why I helped start remediation
8:36
was when we looked at privileged access management for Basically
8:40
the 20 years of privileged access management existed as a
8:42
concept, it always sort of revolves around this idea of
8:45
past revolting, right? And over the years, password
8:48
vaults have evolved to be better, faster cheaper, but at
8:51
the end of the day, it's all about taking some credential and
8:54
sticking it in a password Vault and then making users go fetch
8:56
it when they wanted to do something privileged.
8:59
And so that's sort of the way that it's sort of one of Point
9:01
always been done and when we started Romanian, it was really
9:04
with this idea that there should be a better way of doing this.
9:07
And that we should have strapped out the Concepts of
9:10
authentication from the concept of authorization or access
9:14
rights after V sort of merge. Those two things together that
9:17
if you can, authenticate then you should have all these access
9:19
rights in. Generally, speaking that sort of
9:21
access rights to a lot of things, right?
9:23
And in the remediate perspective really authentication, should
9:27
happen. However, then occasion happens,
9:28
biometric, cards, whatever. And the authorization is really
9:32
the thing where we can apply the controls, the principle of least
9:35
privilege. So, getting into the concept of
9:37
a maturity model, it's really about Sort of call it three,
9:41
three major stages, that we've seen organizations sort of go
9:44
through, as they try to climb the Pam maturity curve and
9:48
often, you know, they're pushing the project manager off the
9:50
curve, by the end of this, right?
9:51
So as a former project manager myself, I have a lot of empathy
9:54
for project managers that have been assigned a privileged
9:56
access management projects, but at the sort of the base level
10:00
sort of the basic starting point for organizations, as relates to
10:03
privileged access they often have no idea what's going on,
10:06
right? They just know that a lot of
10:07
people have a lot of brothers access And there's not a lot of
10:10
insight be onto that, right? They just know it's a thing.
10:13
They don't want to mention in front of the Auditors and if the
10:15
honors bring it up, they just sort of like do a lot of hand,
10:18
waving things to get past it as fast as possible.
10:20
And unfortunately there's a lot of organization still stuck
10:23
there because historically privileged access management has
10:25
been a really difficult thing to go solve.
10:27
Right? It took a year to 18 months
10:29
project it caused a lot of user pain and suffering a broken.
10:32
A lot of processes and it wasn't really something that
10:34
organizations wanted to Embark upon.
10:37
So even if they knew that they had Add that they're sort of at
10:40
this stage, right? The sort of we don't really know
10:42
what's going on stage or public access management.
10:44
Those projects tend to get the pan projects tend to get
10:47
deprioritized in that Force ranked list of ceaseless
10:50
projects because it was such a hard mountain to climb.
10:53
But if you started to climb that mountain, really the next step
10:55
in the maturity curve is run visibility and just getting some
10:59
basic idea of which accounts have privileged access.
11:02
We're right. And that is a surprisingly,
11:06
constantly shifting picture. You know, when we talk to
11:09
organizations, And they sort of assume, okay.
11:10
Well, you know, these active directories, we groups we know
11:13
that confer some privileged access.
11:15
We know that these are the members of those groups, or the
11:17
nested members or whatever. And we know that the roughly,
11:20
those groups confer this amount of privileged access.
11:23
But then if you're able to deploy some tool to actually go
11:25
about, be able to go out and numerate, all this stuff, it is
11:29
shocking. Not only how underestimated the
11:32
amount of coverage access is, but also how much it changes day
11:35
to day, right? Like this often a big surprise.
11:38
So in our commercial Deployments we some see something like an
11:41
average of 450 accounts having privileged access to the average
11:45
machine on the network, right? The average laptop desktop
11:47
virtual machine, you know, hybrid Cloud, whatever it is,
11:50
something like 450 accounts on average having persistent
11:54
pillage access on the system's. There's often a shocking number
11:56
to the organization's. When were able to show them this
11:58
data because that's often an order of magnitude greater than
12:01
what they thought it was right without having this visibility.
12:03
So the second stage is of this maturity curve or whatever is
12:06
really just getting visibility and hopefully continuous.
12:09
The into the shifting state of privileged access.
12:13
I think then really the third stage is control and that's
12:15
where your neck, okay? I see how bad the problem is.
12:18
I see how much the house is on fire.
12:21
The control stage is really about giving you a hose and
12:24
getting you to be able to cool off the fire.
12:27
Pull back the unnecessary amount of privileged access and really
12:30
get as close to the principle of least privilege as possible and
12:33
in the specific way that remediate does this.
12:35
We talk about it in the concept of zero standing privilege and
12:38
we didn't come up with that, that's it.
12:39
Gardner term, you can look on our website read more about what
12:42
that means. But the concept that you get as
12:44
close to zero standing privilege as possible is really the
12:47
endpoint of the maturity curve as it relates to control and
12:51
like that model. One thing that I am wondering
12:55
is, you know, in theory but also in practice.
12:59
What are you seeing in terms of applying these principles based
13:04
on risk? Is it the focus is placed on
13:08
just doing this for High-risk applications or is there a
13:12
maturity level? That's appropriate for high risk
13:15
and maybe not required to be as mature on medium and low risk.
13:21
Or let's just say lesser risk resources.
13:24
Yeah, there's there's two. There's two ways I want to take
13:28
this answer so I'm going to pick one to jump off of first but
13:31
this is a great question Jim. So I think the first thing is
13:33
just being able to tie together the Pam data and the risk
13:38
assessment data that's actually We a really hard problem that
13:40
goes unsolved in a lot of organizations.
13:42
I think that one of the, the sort of unspoken secrets in the
13:45
IT world is that cmdb is were never really a solved problem.
13:49
Like we never really figured out how to do that, right?
13:51
So the kind of risk assessments are talking about the tracking.
13:54
Oh, these are high-risk applications.
13:56
These are medium risk applications.
13:57
These are low-risk applications. You know, those sort of
14:00
Assessments exist in theory in a lot of organizations.
14:03
But in practice are often outdated or broken or in, this
14:06
is what I'm this is sort of my core Point here is there?
14:09
A nun integrated with anything else, right?
14:12
So you may have an Excel sheet somewhere that lists all the
14:14
applications and how risky they are, how important it is that
14:18
you protect them. But that data doesn't ever leave
14:21
that Excel spreadsheet and so it then doesn't benefit the Pam
14:25
application or the antivirus application or the EDR solution
14:29
that could really benefit from. Knowing oh this is a high-risk
14:31
system or this is a medium risk for this is a low-risk.
14:34
So I think the first hurdle to get over is just getting the
14:37
data about what is high risk, medium risk and low risk.
14:39
Risk, sort of Federated across multiple infosec complications
14:44
and then, to the second part of this answer is really okay.
14:47
Like, once, you know that once the Pam application has been
14:50
taught that this said, about this set of n points or
14:52
whatever, is is a high risk. Like what's the level, what's
14:55
the desired level of maturity? Now, ideally you want to have
14:58
visibility across everything, even your low risk or no risk
15:01
applications, you really should have visibility across all those
15:04
things but the level of controlled how tightly you
15:06
tighten, those screws can definitely buried by the risk
15:08
level. The All did I hear you mention
15:10
that on average there was something like 450 accounts with
15:15
access to a given resource. Is that I got that right?
15:18
You did yeah it was a it's a shocker.
15:20
Every time we show this data in these Enterprises during our
15:23
proof of Concepts. It's like I said, it's always an
15:25
order of magnitude greater than what they they estimated ahead
15:28
of time. Is that it, you know, I would
15:30
assume well, maybe I shouldn't assume.
15:31
This is what we got here is, is that direct access?
15:35
Is that a combination of direct? Plus nested groups, nested
15:38
accounts things. Like that.
15:40
Do you see any, you know, I guess frequent offenders, you
15:46
know, on that list you see more, you know, it's sequel databases
15:49
at typically have the problem versus, you know, active
15:52
directory, or maybe it's even something in the cloud, right?
15:55
Maybe it's AWS, or Azure, or Google Cloud platform that has
16:01
different types of risks. Can you talk a little about
16:03
where you see those risk coming in?
16:05
Just from the sheer volume. And if there are any crime
16:08
offenders or prime, And it's that for a prioritization
16:11
standpoint a risk standpoint, you typically see.
16:13
Yeah, we know that usually AWS is a mess, right?
16:17
There's issues are or maybe it's sequel or, you know, I'm praying
16:20
a d or whatever it may be. Yeah, it's in.
16:22
There is 3. Mm, three items on my FBI, Most
16:25
Wanted list or my Pam, most wanted list.
16:26
I guess the, the first one is local accounts, and this is the
16:30
thing that people forget about because everyone's obsessed with
16:32
her directories like, you know, whatever they're using, as our
16:34
director, it's like all this is gives me visibility and all the
16:37
identities, right? Well that's actually not true.
16:39
Because every computer has at least one local identity on it.
16:43
And those often get forgotten about, but the hackers don't
16:45
forget about them. Like they love penetrating,
16:47
those, especially if there's a GPO or other policy that setting
16:51
the same password for all those local accounts on all those
16:54
endpoints and that is a sin of our past that continues to this
16:57
day, even in large organizations.
16:59
And so, those local accounts that the directory focused
17:02
people, forget about that, sort of number one, on my Pam, most
17:05
wanted list, I think, number two on my Pam, most wanted list is
17:09
That's deeply nested, active directory groups, and it's it,
17:13
it's never been a good practice. But it's a thing that just came
17:16
out of necessity in a lot of cases, but it's often not clear
17:20
to the IT Help Desk person or the identity group or whatever,
17:25
whoever's got the ticket says, hey, let's add Jeff's account to
17:28
group XYZ. It's not clear to them that by
17:31
adding Jeff's account to group XYZ, what level of privileged
17:34
access that ends up conferring because group XYZ probably
17:37
doesn't have a naming convention that makes any sense.
17:39
With outdated or was a reorg, four years ago and this group
17:42
member got renamed. And so the knowledge sort of
17:46
corporate knowledge about what amount of college access, that
17:50
nested group actually confers because the Lost very easily and
17:54
without some sort of monitoring tool to be able to tell you what
17:56
that is, it's very difficult to discover this on your own.
18:01
Yeah, and I think number three on my Pam most wanted list is
18:03
what you described. Aw.
18:04
Is this sort of the emerging victim, the land I would say is
18:08
aw I am in the similar control planes for the other eye as
18:12
providers. They are amazing, bits of
18:15
Technology, right? Like this is the kind of thing
18:18
that when all of us were, you know, five ten years ago as
18:21
creating role definitions and attribute-based controls and all
18:25
that kind of stuff. Like this is what we wanted.
18:26
Like, we wanted to this level of fine granular control within the
18:29
Enterprise and now we actually have it right?
18:31
Like he'd only do us gives us, you know, literally thousands of
18:34
possible entitlements. If we can assign to any any
18:37
computer in a user in a Virtual identity, whatever the problem
18:42
is that without the right tools, the temptation to just give the
18:47
computer or the network or the user.
18:49
All the access is super tempting because it went from a problem
18:52
of all I'll sign them a lot of access or no access to now it's
18:55
like well this is super overwhelming these thousands of
18:58
entitlements and so the default definition is just to give them
19:01
a lot more entitlements that they need.
19:03
So I actually think we've unfortunately moved further away
19:05
from the principle of these privileged, thanks to the
19:08
granularity of these Panels even though it's exactly what we
19:11
asked for. So soap, I feel like you've got
19:13
a Blog article there and your your Pam.
19:16
Most wanted list. I probably should write one.
19:18
Yeah, you really should. And, you know, I thought it was
19:22
interesting how you give the shout out to project manager?
19:27
Because I feel like a lot of organizations you know,
19:31
prioritize privileged access management how they will but
19:34
it's not prioritize high enough. It's the project manager who has
19:39
to To try to run a Grassroots effort to get people to
19:43
willingly participate, rather than being able to drop the
19:46
hammer from on high. I think that's a big part of it.
19:49
Right. We've worked with organizations
19:51
where, you know, almost from a from a risk and security
19:55
standpoint privileged access Management's almost always jumps
19:59
out as like the top priority. But maybe it's, you know, the
20:03
first time that the organizations really thought
20:05
about it others. They know that that's a glaring
20:08
Gap, especially Like large organizations who have
20:11
outsourced data center Services. A lot of times they realize that
20:15
they don't have their arms around who's accessing their
20:18
most critical resources, and they've got to.
20:20
And obviously, if an organization is dealt with any
20:23
kind of a breach that, you know, came as a result of an Insider
20:29
with with privileged access, obviously things rise to the
20:32
top. But one thing I want to do is
20:35
use this to kind of transition topics, use, one of the things I
20:39
Really feel like is driving the realization of the importance of
20:45
privileged access is the Advent or the age of the cloud, you
20:52
know, AWS devops. You know all these new forces
20:59
that are entering the Enterprise had been here for a while for
21:03
many organizations or really picking up a head of steam and
21:06
others. But realizing that These are new
21:10
technologies. They need to be dealt with in a
21:11
new way and they present new privileged access challenges and
21:16
organizations are realizing that they need to get their arms
21:20
around. That they may be needed
21:21
technology. So I wanted to throw that topic
21:25
at you broadly. You know what are some of the
21:27
things that you're seeing with the age of AWS age of devops to
21:32
how it affects privileged access?
21:34
I think I've seen some good behaviors.
21:36
I've seen some bad behaviors, right?
21:38
So I think last week when you had a slot on, he talked about
21:41
having a strong identity, you know, up store whole cyber
21:44
security game and that's as true 10 years ago as it is today and
21:49
especially in the cloud world where if you can have, if you
21:53
can maintain a really tight control over the identities that
21:55
get put into your Cloud platform control plane, then that's a
21:59
great place to start because often that gets out of control
22:02
pretty quick, right? Especially when you've got
22:03
devops Engineers that need access right now in other
22:07
things, especially things like Shadow.
22:09
I You've got organizations outside of the core, it function
22:11
that are needing access to specific parts of the control
22:14
plane, but the default is to give them more access than they
22:17
actually need. So I think there's a lot of
22:18
different possible crimes. You can commit, when it comes to
22:23
managing identity within your eye as control planes, but
22:26
getting a really tight control over who even has the ability to
22:28
log into them is really a great first step.
22:31
I think the next thing, the next layer down in the difficulty and
22:35
crimes committed in the age of devops and Cloud.
22:39
Is this default thinking that? It's too hard to manage the
22:44
individual entitlements on an ongoing basis?
22:46
And thus I'll just assign all of them are all signed large groups
22:49
of them and not think about it again in that sort of setting us
22:53
up for problems down the road but it's also setting us up for
22:57
problems in the immediate term because if any of those accounts
22:59
can Compromise, take an attackers know how to use
23:02
compromised. Aw was.
23:03
I am control plane access to be able to add an additional
23:07
entitlements. Users to move laterally within
23:11
the the hybrid Cloud. So I think there's some real
23:14
challenges there. I think the other thing that
23:16
we're setting ourselves up to repeat is all the sins of deeply
23:18
nested active directory groups. So just because active directory
23:22
groups were on my pan, Most Wanted look deeply nested,
23:24
active directory, groups, run my Pam, most wanted list.
23:26
I think we're seeing some bad behavior started to emerge even
23:29
in the eye as control planes where without necessarily.
23:33
Exactly nesting them, you're creating sort of lots of
23:37
different entitlement groups that Tie back to maybe one
23:40
person or one account and then it becomes difficult to manage,
23:43
it will become difficult to manage those in a few years.
23:45
And so, I think that, unfortunately, we're setting
23:48
ourselves up to repeat some of the same problems that we live
23:50
through, in the days of from active directory.
23:53
I know we've been talking a lot about how, what a mess AWS and
23:56
other kind of Club. We're getting wwiser, just use
23:58
an example, right? But AWS Azure and the I am
24:01
controls there and I kind of liken it to sometimes.
24:04
You don't know where the string leads, it's just start to pull
24:06
the permissions and figure out what's going on there.
24:09
And I think a lot of times, a lot of these Cloud
24:12
infrastructures were not really designed with, you know, proper.
24:16
I am governance to start with that.
24:19
Usually a tactical thing, some group went off and said, hey,
24:22
you know what, we need to stand up, you know, whatever platform
24:24
for whatever reason, and it wasn't really part of the scope
24:27
of a security program, or it was brought in after the fact and
24:30
clean up. Never took place or anything
24:32
like that. I'm curious that based on, you
24:35
know, what you've seen in your travels, you know, it does that
24:39
At tactical thinking resonate with what you've seen or do you
24:43
see other reasons why? You know it's been such a
24:46
challenge to take whatever one said that they wanted right with
24:50
these granular permissions and really didn't do a good job,
24:53
maybe of setting it up initially because it wasn't a strategic
24:58
approach to managing the entitlements in those areas
25:01
versus again, just taking more of tactical or you know,
25:03
project-based approach. Well, I'll do you one further.
25:06
Let's, let's first, let's presume that.
25:08
The organization had the Foresight to do a really strong
25:11
strategic stand up of their, I am control panel for AWS or
25:14
whatever the equivalent was for, whatever.
25:16
I as they're using, let's say that they spent six months
25:19
planning it out, and they had a perfectly aligned.
25:21
They created the all the right roles and they signed All the
25:23
Right entitlements to the right roles, the right rules, the
25:25
right users Etc, and then there's a reorg or then there's
25:29
a corporate MMA or then, you know, they sell off a division
25:32
or then they decide to switch. I as providers like, there's so
25:35
many line of business events that can just totally upped
25:39
these carefully laid plans that I don't need teams make, I have
25:43
so much empathy, right? Because I've lived through this
25:45
myself working in the Biotech Industry for more than a decade.
25:48
You know, Biotech Industry loves nothing more than Ma, and this
25:52
happened to us so many times when psycho, we've got the
25:54
perfect thing. And then, oh no, it's disrupted
25:56
by my life, right by the corporate events or the business
26:00
events are happening. So I think there's a lot of
26:02
different things that can disrupt that I think that if I
26:04
want to jump into solution instead of just, you know,
26:07
admiring the problem, I think the solution Has to really be
26:10
agile and how you think about these things, right?
26:12
And just expect that there's going to be some disruption down
26:14
the road. And so as I say this as an IT
26:17
project, managers loves nothing more than the triple constraint
26:20
finishing projects Etc. But sort of plan that your
26:23
project is going to take longer than you, thought it was going
26:25
to and you'll probably end up repeating that project at some
26:29
point in the future. Right?
26:30
And so make sure you leave behind the assets and the
26:32
information in the decision-making and all the
26:34
other things that you use during this project to make it easier
26:38
to execute the next. Time to do the next cleanup or
26:40
the next part of the m&a activity or whatever it is to go
26:44
back. And revisit in this case, the I
26:47
am control plan but it could be some other part of that any
26:49
ecosystem as well. I think it's great advice, you
26:51
know, hindsight's always 20/20, right?
26:53
You're looking back and should have should have would have,
26:55
could have write all the things that could have impacted that.
26:57
But if you leave those artifacts behind, you can kind of justify
27:01
at least the thinking of the time and the great thing about,
27:04
you know, the mind is that it can change, right?
27:06
You don't have to be stuck in the same decision for It is okay
27:10
to get smarter right as your Viewpoint in the world and the
27:14
capabilities, you know, around it.
27:16
Of also I think that's a really great point.
27:19
I, uh, you know, I think also from, you know, the strategy of
27:23
managing I am as a whole there is sometimes competing
27:29
priorities when it comes to who's responsible for what maybe
27:34
infosec is responsible for kind of, I am at, you know, at a top
27:38
level but they made. Legate privileged access
27:41
management to the server team, right?
27:43
Or the it infrastructure team or whatever, it's called with any
27:45
organization because they're the ones closest to, you know, those
27:50
resources, those sorts of things from your Viewpoint, who do you
27:54
think should own Pam? Is it what?
27:57
I kind of described, is it a hybrid model in and understand,
28:02
right? We know that no one, no one size
28:04
fits. All right.
28:04
It's going to be different every organization.
28:06
But is there something that's jumped out at you as maybe
28:09
something? That people listening to take
28:10
into consideration when we're thinking about, where does Pam
28:14
fit within my organization? Yeah.
28:16
And to be honest, I have a bit of a contrarian view on this
28:18
one. So if you're living for
28:19
listening, this buckle up, right?
28:20
Because we're about to go on a wild ride and that contrarian
28:24
views, actually, it doesn't matter.
28:25
It actually doesn't matter who owns the responsibility for
28:28
public access. It could be daichi operations
28:29
team. It could be the identity team.
28:31
It could be the info 16 info SEC, team broadly.
28:34
What actually matters is how you measure the success of the Pam
28:38
function. And for me, if I was, you know,
28:41
C. So for a day and I had a
28:43
dashboard at operational dashboard, and I was looking at
28:46
the road that said, privileged access management, it would be
28:48
two measures one would be how much standing privileges are in
28:51
the environment. How many persistent privileged
28:53
accounts, how many accounts with persistent Village access are
28:56
there and the second one would be, how often are just in time,
28:59
entitlements used. Then those were the two measures
29:01
that matter the most to me if I was visiting that shoes in the
29:04
shoes of the sea. So whoever ultimately has
29:06
responsibility for the information security or The
29:09
organization and then as far as which organization actually
29:12
runs, the the tooling for that and provides that data and you
29:16
know, trains users and goes after scofflaws it that sort of
29:21
matters a lot less to me. Honestly, I feel the same way,
29:24
you know, as long as somebody owns it, I feel like that's kind
29:26
of the answer that I look for. I think you and I have had a
29:28
conversation about this in the past on different episodes and
29:31
just in our normal day jobs is, you know who owns identity
29:34
access management at the end, it doesn't matter as long as
29:37
someone owns it. And you know, there is Of like,
29:40
you know, if you think about from a racy perspective, right?
29:42
Who is the, a, who is accountable for it?
29:44
And I kind of feel like, it's like Highlander there, can only
29:47
be one, right? That's one.
29:49
Someone has to be able to make the decision, break the Log Jam,
29:52
take ownership, you know, Falls to them and, you know, whatever
29:55
it looks like and as an organization.
29:57
But as long as someone owns it, I don't, you know, I don't think
30:00
it really matters you talked a little bit about, you know,
30:03
being see. So for a day and measuring Pam,
30:07
and you mentioned some things that were kind of based on You
30:09
know, indicators of risk, may be associated with number of
30:13
accounts approvals entitlements. Those are the things.
30:16
What are some other methods and and you know, maybe I'm throwing
30:18
on, is by here. But how else would you measure
30:20
success for privileged access management beyond that?
30:23
If I'm if I'm a practitioner and I'm, you know, thinking about
30:26
putting in a Pam tool, you know, what are ways that I can kind of
30:31
justify, not only the tool itself, but the reduction of
30:33
risk the organization that people can think about.
30:37
Yeah spoken. Like a guy who says the time is
30:39
7 23, right? So you and I are cut from the
30:41
same cloth, my friend numbers, don't lie unless you want them
30:44
to. We are.
30:46
We're both data-driven decision makers, I suspect and I think
30:49
that, you know, a good Pam effort, whether it's a project
30:53
or an ongoing function is run the same way it's driven off of
30:56
data. So the two data measures, I just
30:58
mentioned would be for me if I had to pick two k pi as those
31:01
would be that right? How much persistent privilege
31:03
accesses are in the environment that number should be going
31:05
down? That number should be trending
31:06
downward and how often are just in time.
31:09
Privileged access. Entitlements.
31:10
Utilized in that number should be out or flatter trending
31:13
upward based on the organization's situation.
31:15
I think beyond that you can certainly get into other
31:18
measures like how frequently are n points assessed for how much
31:22
Public Access they have? And then in an organization that
31:25
has I would say a distributed it function it could call it Shadow
31:28
it or call it you know Department a lie to.
31:30
You can call it whatever how well integrated are those
31:33
sources of privileged access integrated back into whatever,
31:36
the core Pam function is with us, run by it or Someone else.
31:41
How how cohesive a picture across all the different
31:44
Departments of the privileged access management is available
31:47
within the organization would be another critical measure.
31:50
I think another one is how the Pam project or solution or
31:55
service is evolving over time? I think this is one of the
31:58
things that really gets us really bites us.
32:01
Is that we don't think about the evolution of the Pam technology.
32:04
And so, when organization started to do hybrid cloud
32:07
rollouts, like the Pam, Solutions at the time just
32:10
didn't keep up with that. I did just weren't ready and so
32:13
they fell behind right? And so that's one of the reasons
32:16
why I think a lot of these ideas deployments in large companies,
32:19
still have a lot of unmanaged Public Access because the
32:23
tooling wasn't available when the organization started it, and
32:26
they never went back to update the tooling or apply it to these
32:29
new sources. So thinking about what is, what
32:31
is my Pam service look like a year from now, two years from
32:34
now? Five years from now is another
32:36
key measure and it can't necessarily put that into Data
32:38
but it's a critical. Thing to be thinking about and
32:40
planning for ahead of time. I'm glad that Jeff joined in and
32:44
agreed because I'm going to take the contrarian View and I don't
32:48
want to be arguing with you, Paul.
32:50
I'd rather argue with you and Jeff now, but the point that I
32:53
was going to make is that I do think where Pam sits does
32:59
matter. And I say that from the
33:01
perspective that when I've seen Pam project, struggle or fail,
33:06
it's because of resistance from the end user, The users of that
33:11
system, you can come up with reasons.
33:12
It takes me longer to do my job. What if, what, if what, if, what
33:17
if the Pam servers down and, you know, all these reasons why I
33:21
might not be able to save the world?
33:24
Even though I have my Cape, you're putting this piece of
33:26
technology in front of me. That's a piece of junk.
33:29
So, how do you flip that script? How do you get those folks to be
33:33
on board with it? Why don't you put them in charge
33:35
of it? They run it.
33:37
And then you say, well, you know, Oh, is that kind of not
33:43
fulfilling our duty? Well, I think what you need on
33:46
top of handing, over the Pam system, to the users of the Pam
33:50
system. In other words, the system
33:51
administrators is you need a checks and balances.
33:54
So you need to have some kind of oversight and administrative
33:58
capabilities, whatever that balances, so that you have a
34:01
checks and balance, but that those users of the system are
34:05
not quote, unquote disenfranchised or you know that
34:09
They feel like their ability to perform their job function is
34:15
being jeopardized. So that's, that's my two cents
34:19
on it. Is that I want to see those end
34:22
users on that system. Well, I think we're actually in
34:24
violent agreement on this point. In the measures, I mentioned are
34:28
ways of measuring. Whether the onions are our end
34:30
users are actually using the system.
34:31
Right? Because I think, one of the
34:33
other things, one of the other skeletons in the closet of
34:36
society folks, is that these Pam Solutions were often rolled out.
34:39
This password Vault Solutions Rock and rolled out and then
34:41
bypassed, right? So some really smart sysadmin
34:44
would just go up and go and set check out the account right, or
34:47
whatever. And then create themselves some
34:49
local accounts on the endpoints, and they would just use those
34:52
local accounts, not have to worry about the password Vault,
34:54
any longer. So I think that the measures I
34:56
mentioned are ways to detect if and users are bypassing the Pam
35:00
tool. So that adjustments can be made
35:03
in the way that it works or the training that's provided or the
35:05
value is provided to the end user so that they actually
35:08
adhere to the Pam. Practices of the organization.
35:11
I think. The other thing to say is that
35:12
you're absolutely right, these Pam, projects are historically,
35:15
have been very hard and they just didn't get done.
35:18
If they didn't have the right level of executive support,
35:20
which I think, is the point you're trying to make is like,
35:22
if you don't have the backing of whoever matters in the
35:25
organization, whether it's the CIO or the sea.
35:27
So or headed the line of business or whatever it is, it's
35:30
CTO, whatever it is. If you didn't have their backing
35:34
then these Pam projects would just fail, right?
35:36
Because it would get partially deployed and there would be a
35:38
bunch of resistance from new users and then the project would
35:41
just sort of shut down, right? They would just never really get
35:43
done on average. We see that password mold.
35:46
Technology is only ever get to 30% deployment 30% of the
35:49
planned deployment because of exactly the reasons you
35:51
mentioned. And so, I think the solution is
35:53
really twofold, one is the increased level of executive
35:56
support, but I think the second thing is we need to provide a
35:58
better solution, password Vault suck and here.
36:02
I'm standing on my soapbox is a founder of a company that
36:04
directly competes with basketballs.
36:05
So, you know, grains of grains of salt for everyone.
36:08
But Getting away from this idea that you have to in introduce
36:13
additional friction in order to better manage privileged access.
36:16
I think that idea is outdated and there are better approaches
36:19
to doing this and that we can achieve both better user
36:23
experience and increase secured around privileged access at the
36:26
same time. Absolutely great points.
36:30
So, Paul were coming up on time but I just have to imagine that
36:35
in your role you've come across some interesting.
36:39
Ting use cases. So, would you mind maybe taking
36:42
us out with one or two of those kind of were stories that maybe
36:46
you've gone through and hopefully, some of them come to
36:49
a bright and happy ending. Yeah.
36:52
Well, there's a longer version of this story on our website.
36:54
If anyone wants to hear the longer version of this but
36:57
Romanians, first commercial customer was Lockheed Martin and
37:00
there's, they continue to be a public reference customer for
37:03
us. Very happy, customer of ours, in
37:05
their use case, was really around Regulatory Compliance and
37:08
it was a random Special kind of Regulatory Compliance something
37:11
that they call instrumented compliance.
37:14
So Lockheed Martin had been in compliance with all the rules
37:16
that they needed to be in around the federal government for
37:19
forever, but they really didn't have the instrumentation to live
37:23
instrumentation to show themselves to prove to
37:25
themselves that they were continuously in compliance,
37:28
right? And that's what our technology
37:30
was used for. Was to bring about this
37:32
instrument to compliance around the specific Regulatory
37:34
Compliance rules around the DeForest or defense Federal
37:37
acquisition rules. And so that's An interesting one
37:40
is to think not just about through the lens of Regulatory
37:42
Compliance, but continuously enforced and continuously
37:44
insured compliance with regulations and there's a bunch
37:47
of them out there that have to do with college access, right?
37:49
So that was one, interesting one, another one.
37:51
Interesting one is zero trust. You guys talked about it on your
37:53
show last week. Actually, zero trust came up,
37:55
but I'm sure it's come up with as many times in the past and
37:57
hopefully we'll come up many times in the future and thinking
38:00
about how does privileged access fit into zero trust because I
38:03
think zero trust is often seen through the lens of device and
38:06
network security and less often through the Identity security,
38:10
in fact, sometimes I see dirt rust denoted is zero.
38:13
Trust network. Access writers?
38:15
Each DNA. And so how do you introduce
38:17
identity Concepts into that and I firmly believe that privileged
38:22
access is the correct bridge between the identity world and
38:25
the device and network-centric security world of zero trust
38:28
today. I think the privileged access
38:29
makes that bridge work really well.
38:31
So much of Concepts around zero trust, another really
38:34
interesting use case for us. And the last one I'll leave in
38:37
this actually does end in a very bright story.
38:39
Which Which is incident response and privileged access
38:41
management, and incident response have never been
38:44
considered to be even in the same side of the planet.
38:47
Much less adjacent Technologies are adjacent approaches.
38:50
And again, there's a talked about this on the risky business
38:53
podcast, this past week, with country of gray, in longer form
38:56
of anyone's interested. But the idea that you can
38:58
actually roll out a Pam solution during an incident response,
39:02
there's some malware that's spreading across the
39:04
organization. You're watching compromise
39:06
privileged accounts being used to spread the malware, you know?
39:09
Starkly. We've only ever been able to
39:10
bring ETR XTR Technologies to bear in those situations.
39:14
We now have about a half dozen cases where remediate has
39:17
deployed pen technology over the course of a weekend to help slow
39:20
down or stop those malware spreads as well.
39:22
So, instant response yet. Another interesting use case,
39:25
it's come up more recently for us as pretty.
39:27
Those are some pretty cool examples.
39:29
Yeah, I guess you could call me a fan of Lockheed Martin just
39:33
from the aircraft perspective and some of the things they put
39:35
out there like the SR-71 Blackbird the F16, the F-22,
39:38
they have to T5. I'm a big nerd.
39:40
So what can I say that's going to be a fascinating kind of
39:43
client to work with when it comes to kind of thing.
39:44
So and you have been very gracious with your time.
39:47
We really do appreciate it. Before we wrap things up for
39:50
this week. Are there any other Pearls of
39:53
Wisdom that you want to lay Upon Us Paul before we close things
39:57
out? You know, I think just think
39:59
expansively about what's possible the end of the world.
40:02
I think that just like, Jim's kid we should break with the old
40:07
habits, right? There's a lot of emerging.
40:09
Technology. I think identity is seen an
40:11
amazing amount of investment in Innovation from the VC world and
40:14
from from others. And I think it's time for all of
40:18
us to think more holistically about what's possible and
40:20
identity and sort of break with saying it's 7:15 and say that
40:25
it's 7:23 instead I like that it's okay to get smarter right?
40:28
I mean it's okay to grow and think about things in new ways,
40:33
Jim anything you want to bring up before we close it out.
40:36
Back in my day we said 11:15. And we liked it so much.
40:45
I do my best for sure, send me, LinkedIn
41:06
connections and me Twitter. On the Tweet things.
41:11
And then if there's folks out there that are brand new to
41:13
cybersecurity, definitely encourage them to join the
41:15
cybersecurity nonprofit cost zero dollars and you get a lot
41:19
of value for that zero dollars. It's tough and I'll have links
41:21
to all that stuff in our show notes for people to check out in
41:25
their podcast app of choice or a tide any at the center.com.
41:29
Another place you can find that information Paul greatly,
41:32
appreciate it, Jim greatly appreciate it.
41:35
We're going to go ahead and close it out for this week.
41:37
Thanks everybody for listening and we'll talk with you all in
41:40
the next one. You've been listening to the
41:45
identity at the center podcast, if you like what you heard,
41:49
don't forget to subscribe and visit us on the web at identity
41:52
at the center.com.