This is identity at the center. If it has anything to do with I
AM, this is the go to podcast now your host Jim McDonald and
Jeff Steadman. Welcome to the Identity at the
Center podcast. I'm Jeff and that's Jim.
Hey, Jim. Hey, Jeff.
How are you? Oh, not so bad.
Yourself. Good.
I'm getting used to seeing you in your Home Office.
Obviously we're on an audio only podcast, but we have cameras on
so I can see you're at home. You've been home for like 2
weeks in a row. This is really weird.
Only one week. So yeah, I'm home this week.
I was out last week, but I think I was able to record from home.
So and then I hit the road for the next.
I believe it's at least eight weeks in a row that I'll be
gone. So I'm making trips kind of
lower place, more in Chicago, Cincinnati.
Back to Milwaukee and then Chicago, then Milwaukee, then
where am I going after that? Then DC and then Austin, TX and
then San Diego and then who knows past that.
That's everything that I have going for next weeks.
Yeah. So what do you do?
Do you have any like tips and trips tips and tricks for the
non road warrior people like me? Well, like, what do you mean
tips or tricks? Like, I, you know, our guest.
I'm not going to announce who our guest is, but he has this
camera on as well. And I see he's got some
backpacks in the background, right?
And I'm thinking, like, I know when I'm hitting the road like
2-3 weeks in a row, I like to basically keep my backpack
packed for three weeks, right? I don't know.
Do you have anything like that? I mean, I'm coming home in
between all those trips and I like to travel light.
I'm a big fan of one bag travel if I can do it, so I try to.
I have a quest to find the perfect one bag solution.
I am somewhere around the 30 or 40th attempt of different bags
in my collection. At this point, I think it's a
big benefit if you can travel and fit everything you need
underneath the seat in front of you.
You don't have to fight for overhead space for luggage.
You don't have to worry about checking bags.
I haven't checked a bag in a decade.
I don't know, and that was for an international trip, so I'm
not. I'm not a fan of that pack
light, you know, pack what you need.
Yeah, especially if you're doing domestic US travel, you know, if
you forget something, you can always find something local to
replace it if you need it. Trying to think what else, find
multipurpose items, so try to standardize like power plugs,
cables, things like that. So you don't need to bring like
8 different power adapters. With you get a nice USBC
charger, multiport with enough wattage to juice up all your
stuff. You know, get cables that can
serve multiple purposes, stuff like that.
And definitely if you're traveling a lot.
Invest in yourself. Meaning get like an airline car,
airline club card or something like that to separate you know
yourself from the from the masses when you're in at an
airport. Yeah, I haven't been traveling
all that much really since the pandemic, but prior to that I
was traveling a lot. I think my tip would be practice
the cone of silence, which is like, you can create this
invisible bubble around yourself in your own mind anyway.
And it's like, you can kind of like, pretend you're not there,
well, you know, pretend you're not in that airplane seat,
because sometimes it's like hot or cold.
Maybe there's a baby right behind you crying, or there's
other people just being rude or whatever.
Don't don't fall into the trap of, you know, be rude yourself.
Just pretend you're not there. That you know that's a good
point get and this reminds me get the best noise cancelling
earbuds or headphones whatever that you can muster they may
they are a huge game changer. So I travel with a couple pairs.
I got my Ear Pods Pro and then I have the Bose quiet comfort to
earbud things. I don't like the overheads
because they take so much room so I'm not a fan of the in ear
type of stuff. So if that works for people
that's another one. So I carry both of those with me
and. Yeah, It was very helpful for my
last flight from New York City that had a child screaming in
the seat behind me. And I was, for the most part,
blissfully unaware. Yeah, I know when you, when you
have enough years of travel under your belt, you start
hearing people travel horror stories and you're like, yeah,
you travel it off. That's going to happen.
And we're on the runway for five hours.
Yeah, that stuff happens. It delays all that stuff, stuff
you can control, stuff that you can't.
You know, I've kind of gotten just used to.
It's like, whatever. I mean, it happens.
If and now that I'm connecting, I used to, you know, fly out of
Chicago because that's where you used to live.
So everything was a direct flight.
Now, living in North Carolina, out of the Asheville area,
everything is a connection for the most part.
Asheville, I go to Atlanta and then I go somewhere else.
So there's been a couple of nights where I've been, you
know, had to spend a night in Atlanta because flights are
delayed or whatever. It's a first world problem.
You know, I made it. We're okay.
We're fine, yeah. I get Nagri.
Doesn't change the outcome any. No, doesn't do anything for me.
Yeah, so it's. I guess So you're asking about
travel? I got a lot of things going on.
We're actually recording this a couple weeks in advance, so kind
of the 4th wall down. It's September 7th.
As we're sitting here recording this, I have all these trips
lined up starting next week. And we're going to kind of talk
through some of that because I think some of these trips are
related to speaking engagements or conferences or things that
you and I are both doing. Guess the first thing coming up
is really it's a tie. It's for you and me.
I'm going to be at Identity Week, America, October 3rd and
4th in Washington, DC I'm hosting a panel discussion on
pass keys. We're recording this in the
middle of the day. As soon as this is over, I'm
hopping onto a call with my panel participants.
To figure out what the heck we're going to talk about.
So that is real time information of what we're doing.
I'm going to be out there and we've got a discount code for
folks who want to take advantage of that.
For Identity Week America, it's ID AC30I DA C30 that gets you
30% off your conference pass. It works for both Identity Week
America and Identity Week Asia. So if you're looking at any of
those conferences here in the next few weeks, definitely come
out. Say hello, I will be there, but
feel free to use the code that shows support for for us.
And then while I'm in DC, you're going to be in San Francisco.
I'll be in San Fran at Octane 2023 is October 3rd through the
5th. We have a discount code for that
one as well, 30% off using OK TNID C30.
I'll get you 30% off. You can register@octa.com/octane
and we're also doing some fun stuff over there.
One is I'm going to have my fancy Dancy iPhone and I'm going
to take some videos and hopefully do some interviews
with folks that I see around the conference.
I'll have some of the new updated IDAC stickers.
They're more easily peeled off and you're.
Very proud of those, by the way. I mean, it's a.
It's a game changer. How often can you upgrade a
sticker, right? You know, like what do you have
to do to upgrade something that's been around for 100?
Years now with 100% more sticker.
Yeah, it's much more sticky. And then we're doing a cohosted
event with our friends from Accents We're it's Wednesday
night. We'll put the link in the show
notes for how to register for that bad boy.
Or you can look at my LinkedIn profile.
I've posted a video on it which kind of shows the last time we
did an event or actually attended their event, didn't
cohost that one at as identifiers, but we will for
this one at Octane and our guest today may be in attendance there
in Octane as well. Yeah, we'll see.
And then after that we've got Authenticate conference that is
October 16th to 18th. That's in Carlsbad, CA.
That's the San Diego trip that I mentioned.
So I'm heading out there for that.
Jim, you and I are going to be on the main stage.
We're going to do a live show in front of the live studio
audience of people in the in the venue, as well as streamed live
to the Internet. That'll be interesting.
We've got to figure out what the heck we're doing with that one
too. So we got to get out on our
horse about that. But we've got a code for that
one as well. I D AC15 podcasts that get you
15% off. So we've got discount codes, the
galore for Identity Week, America Octane, Authenticate,
very appreciative of all those guys sponsoring with us and
helping us get the word out for stuff that we're going to be
doing at their stuff and hopefully they get the benefit
of your great attendance being there.
So I'll have links in our show notes too, where people can get
all this information and make it easy for people to sign up and
register. Also, if you're a fan of the
podcast at the Authenticate Conference, we're going to
record like 5 different episodes or four In addition to that main
stage one and we're going to have a multitude of guests.
We're also going to have live studio audience opportunities
where people can come attend, ask questions of the guests.
We have to keep them in about an hour long because we're going to
be on the schedule just like any other session, but should be a
lot of fun. So if you're into the show and
you want to take part, being there at Authenticate is a great
way to do it. And by the way, they're also
having one night, which one of their entertainment nights is
they're going to have out on the patio.
It looks like a really nice hotel or nice resort.
They're going to have food trucks.
So that's how we'll be fed that night is via food trucks.
I'm really looking forward to that.
I think Mexican food in San Diego is the best Mexican food
you can get in the US Those are fighting wars.
I know that we're going to get some hate mail over that, but
I'm, I'm putting, I'm laying down.
Do you agree? No, but that's only because I
haven't had it in the San Diego area from a food truck.
I'll be honest, I didn't really discover food trucks until about
a year ago. Was never like a thing in the
Chicago suburbs. So it's like, okay, whatever
you're talking about too cold there.
Well. Yeah.
And I guess it's just it's, you know, it's urban, I mean you
know it's it's suburb and so it's just spread out everywhere.
It's not like you're in the city and stuff like that.
Or at least I wasn't very much now, hadn't lived in Nashville
for a little over a year. There is a huge food truck scene
because there are constantly going between all the different
breweries and different things. So I'm I'm all in on the food
trucks. A good food truck.
Chef's kiss for sure. Am I willing to go and say that
San Diego area has the best Mexican food out of a food
truck? I don't know.
I'll take the challenge. I'll throw away the food truck
qualifier. I'm just saying it has the best
Mexican food. But what about, like, Chili's?
We'll leave it at that, folks. Episode over.
Yeah. Why don't we get to our main
topic We're going to talk about just in time access and just in
time. We've got John Morton.
He's the field CTO, Cloud Solutions, engineering leader at
Brightive. Welcome to the show.
Or I should say, welcome back to the show, John.
Always happy to be here, gentlemen, and the Chili's
comment that that those are fighting words.
Hey, shout out to my chili heads.
I work for Chili's for like 4 or five years.
Made great friends, lifelong friends.
It was a great time and I'm. I'm a fan of the queso.
What can I say? I travel, I go to a Chili's, I
eat the queso. It's simple.
I'm a simple man with simple. Yeah, with simple needs.
The last time you were with us, John, was episode 115.
And we talked about the cloud being different.
That was way back in October 2021, now we're in September of
2023. What have you been doing for the
last two years? That is a great question and
surprisingly I've been diving into exactly that, Not just
cloud usage but actually like digital transformation and I've
been working a lot with customers.
Getting to know them and understanding what are they
doing there that's so radically different that traditional tools
just don't fit. So a lot of conferences, lot of,
you know, customer engagements, you all mentioned some
conferences. We all may be used to an
identity, but we're talking things like Google Next, a WS
Reinvent, Cube, Con, a Kubernetes specific conference,
DevOps days, these sort of conferences I've been attending
and really just learning from customers or what are they
doing. And how are they doing it?
That's it. That doesn't sound very much.
Well, the objective there, the pitch I always give is what I've
been working on for our company at Bright of is I bridge the gap
between sales, engineering and product being an evangelist for
customers. So when I gather all that data
and information of what they're trying to do, how do we build
our product and make it better and actually tangibly build it
so and then go sell it. So that's the the summary there.
So for people who aren't familiar with Bright of what is
it that you guys are looking to solve for?
Yeah. So the best way I summarize it
is that we do cloud access management.
I know that sounds very simple and it's very easy way to put
it, but that is functionally what we do.
We help folks manage access to the cloud.
And our claim to fame is, as you all pointed out, is just in
time, meaning you get the access you need when you need it.
It's the appropriate access and it's what you want.
Not to be confused exactly with authentication, more focused on
that authorized authorization piece, but that's the summary.
Yeah, that that's a good summary.
I think what I always get hung up with on just in time access
is because I think you just said what it is.
But how does it really work? Like walk me through a scenario
where somebody is like receiving just in time access to go do
something they need. Yeah.
And so, yeah, back to that point of what are these engineers, I
like to call them builders, platform engineering folks,
system engineering folks, site reliability engineers in, you
know, operations trying to do what they're trying to do for
the most part is maybe deploy a certain piece of software
literally right now, whether that's a human method or an
automated method. What they've learned over time
is you don't have to have static credentials that have static
permissions like a domain admin to add someone to a security
group. You can actually do it pulling
the levers of API. I can put Jim McDonald in
security Group A for 5 minutes, he does his job and I take him
out. That's the simplest way to break
down some of that complexity that makes a lot of sense.
I think that you know, one of the biggest shortcomings we have
is over provisioned accounts, accounts laying around that you
know even if you feel like you've got all the safeguards
and controls around those accounts, it's an unnecessary
risk to have an account out there that has all these
permissions that's not being used.
But it brings me back to I think that the terminology that I was
hearing a lot a few years ago is 0 standing privileges.
And my question is, is just in time access is 0 standing
privileges? Are they exactly the same thing?
They, they go hand in hand, they go hand in hand.
So what's always tough for customers, I've been doing this
now for three years specifically is everybody says they do JIT
and and JIT can literally mean, hey, Jeff logs on right now,
creates an account for me right now and he puts me in the group
right now. That qualifies as just in time,
right? That is radically different than
0 standing privileges where you know you may have an existing
user account and you get the access you need.
Being put into a group for example, and taken out the 0
standing privileges there is your account has zero standing
privileges. So architecture is my favorite
term for that. Makes it a little confusing
about the two and it's the operations team who really can
break it down for even better, if that makes sense.
It seems like the council we're talking about are the of the
privilege of variety makes you think of privilege access
management or Pam. I'm wondering, is what we're
talking about like Pam 2.0? Because we've done episodes
where he said Pam is dead. I wouldn't say Pam is dead,
because that hurts a lot of people's feelings.
What it is, is access is being looked at in a new way, right?
Why does it have to be privileged access when you can
manage access this way? A better way to look at it is, I
always say from the resource up, it should be the resource that
dictates the level of privilege. And you know that's a new way to
kind of look at things. If you were biased like I was
for a long time and I am where what I mean is like a developer
may say, I need access to an EC2 instance.
That's a resource. It's a bucket where you store
data, ECT. They don't care how you get
there. All they care about is getting
the access they need when they need it.
So they're looking more at the resource itself versus some sort
of account that gets down into it, right.
So John, I'm gonna ask you, I'm gonna ask the question very
open-ended about what business problem that solves, but then I
do want to get into specifics depending on your answer.
So what business problems does just in time access solve?
Oh, now that is my absolute favorite, Jeff and Jim, this is
where I over the past few years working with operations and
builders. I've been so relieved working
with them because there are a lot of shops of yes versus
working with traditional identity and security that are
shops of no. What does that mean?
Operations teams, platform engineering, system engineering.
They get paid to do things like, you know, we're recording now.
They get paid to keep the platform up, right.
They get paid to make sure when we access it, it's there.
The KP I's for the business are driven by functional operations
of organizations. The last thing they want is to
be slowed down and doing their jobs.
A lot of the KP I's revolve around and they report up to the
CTO. So what we do?
Is we help remove a lot of the complexity of access so they can
do their job. Simply put, they are begging
please remove the complexity so I can do my job.
Because when you think about things like least privilege,
privileged access management, request workflows, that is
complexity. The business value of what we're
doing is we're streamlining that process by giving these builders
a self-service opportunity that has security guardrails.
So it's win, win. The builders get what they want.
They do things fast and there's security involved because we
have guardrails with Jet and we we really enable them to build
fast. That's a great answer.
You know, I I don't, I can't think of the organization I've
worked with in the past decade or said that doesn't have cloud
infrastructure, cloud applications.
And I think we're talking a lot about how to do these things,
how to manage these privileges for the cloud.
But what about on Prem? A lot of these organizations
still have servers and data centers, and it might call it
like a hybrid cloud, but the reality of it is is it's still
on Prem infrastructure. You are absolutely correct.
So one thing I like to remind people of too, just to take one
step back, is when I talk about the cloud, I really hate.
It was a joke that came out maybe four or five years ago
where somebody said the cloud is just someone else virtualizing
your data center. That is not the cloud at all.
The cloud to me when I talk about AWS or GCP is actually a
new operating system. It's not somewhere where you
virtualize servers. It's a brand new operating
system that has its own functions.
So what they did there is they built capabilities like
ephemeral access that made it easy.
So the hardest thing we deal with that bright is your exact
point. You can do all these fancy fun
things in the cloud. Why can't you do it on premise?
Well, there's certain limitations.
There's traditional networking, traditional directory
structures, file structures. You have these beautiful
firewalls that keep us out, so we're slowly bridging that gap
back to on premise where my use case still applies on premise.
Imagine if you can put someone in a security group for 5
minutes and take them out. That's the simplest way to think
about it. Now you when you add on the
layers to it, you have to have some sort of agent that runs in
the environment that can do this job that you would have done
manually. That's where it gets a little
fun, but we are seeing these capabilities expanded with
certain tools like Kubernetes, with certain capabilities like
robotic automated processes, things like Jenkins, things like
Terraform. So the cloud world is slowly
being begged to go back to the on premise world.
We're just nobody's 100% there yet.
Yeah, yeah. There's just so many such a
variety of use cases and legacy systems and things like that,
so, so. It sounds like on Prem is a more
difficult 1 to tackle in terms of the types of systems.
Are we talking about apps? Are we talking about middleware
infrastructure or is it all the above platforms as well?
Yeah. Now that's that's still I always
talk to you is another thing I like to talk about is a cloud
journey, right, a cloud journey. You just nailed it very
eloquently, Jim. So a lot of folks, they will
start with, let me just virtualize some of these
hardware servers into the cloud, Very basic stuff, right?
So at its core lift and shift, we're managing the platform.
But anybody who goes on a digital transformation knows
that's the tip of the iceberg. You want to use these new
operating systems like I mentioned and you know, get that
going. So what we'll see is it's a
really diverse set of what they're going for.
Now a little bit bias here, but there are certain organizations
that are on the bleeding edge of pushing operations faster.
Retail for example, they get paid when you go download stuff
off their app and purchase stuff through their apps.
They're a lot farther in your case, Jim, of where we at, you
go somewhere else like insurance.
Yeah, we're lucky if we see anything in the close fed space,
very similar. So many controls and rules,
they're not there. So they're different verticals
that push a lot farther. But we really run the gamut of
all all of those in between and I described as human problems
versus legitimate automated infrastructures, code CICD
problems. There's a full spectrum there.
You mentioned a couple of different verticals like
government and insurance compared to maybe retail and
sort of the, I don't know the the where they're at on their
journey either to or from the cloud, I guess would be the
right way to put it. A lot of folks out there
probably have a Pam strategy. I hope they do at least of some
sort and maybe it's been designed.
You know that was more focused on an on Prem versus something
that's more cloud focused. Does it make sense to have a Pam
strategy for both? Here is our Pam strategy for on
premise environment and then here is our Pam strategy for our
cloud environment. Are there parallels that could
be drawn between the two to say okay as a general rule of you
know, of of operating? We want to be least privileged,
right? Or if we can zero same
privileges, which I love, I love, I love.
You know the idea of that. I think I've been using it since
I heard you talk about it a couple years ago.
That's a great idea, right? That's this just in time axis
type thing. If I have a strategy that was
built for on Prem, how much of that translates to my Pam
strategy for the cloud? Yeah, Jeff, get me excited over
here asking the tough questions. So I would say almost 5% would
be applicable. Here's why.
Now traditionally, everyone should have an identity
strategy. You guys nailed it.
Jeff and Jim, you're here to hear first leaders in in the
right way to think about it, right.
It should be an identity strategy.
Why am I saying that? Pam to me has always been a
subset of that. And about 20 years ago, some
smart vendors, we won't name names, they created their own
market space for Pam and they created all the rules.
Well, those rules don't apply 20 years later.
Trust me, I very rarely encounter anybody who wants to
be held up having some virtual machine log into them as an
admin user because you have to pay for more admin accounts.
So those sort of strategies, you're correct, they should be
there. But what hurts the most is the
mandates, the compliance, the risk, the the regulations that
accompany Pam. So there's no way to escape that
strategy, but it does not in any way correlate 1 to one for
capabilities in the cloud. For example, you know 0 standing
privileges. We once showed an auditor when
we were working on our own stock two type 2.
They said, hey, let's do an audit of your environment.
Bright if we showed them and they said why do none of these
accounts have any permissions? This isn't even possible.
Where's the privileged accounts? We're like when we use this new
tool that we built and that doesn't work that way anymore.
So as times evolve, the traditional Pam idea, which to
me is a subset of identity, is not going to be able to keep up.
It's just not feasible. Well, I think a lot of
organizations run into this struggle of the definition of
what is privileged access, and sometimes it's like okay.
Well, because I'm an admin, I need that admin access all the
time. When do you really, I mean, you
know, sometimes it's you know, one transaction, right, you're
doing per day that requires it. Or maybe it is in an area where
you're constantly doing things and the end up as sort of like
this spectrum of different permissions.
And I think the reality if you really were able to get it down
to a fine grained point in time, minute, not even minute by
minute, but millisecond by millisecond in some cases, what
is your actual privilege profile look like?
There's probably a spectrum there.
Am I thinking about that right, or is there a different way to
that, that people should be thinking about that out there?
You're thinking about it right? And that's traditionally how I
came into it too, right? I kind of thought about it.
So this is where I ran into the conflicts, though, where I
pivoted to, well, what are the builders doing?
They don't care about an admin. They don't know the difference.
What they care about is access to resources.
So within any environment, any ecosystem, the data, the
resource is what can be classified as privileged, if you
will. How we get that, you know can
latch on to that easier than us. So let me put it a different
way. A lot of Pam and I am teams
think they ask me if I just had the context, if I knew what was
privileged, if your tool could tell me I could fix things.
That's never going to work. That's a never ending tale.
With every new cloud added, every new resource added, we say
hey, why don't you look at the resource itself and what they're
trying to do. When we build guard rails around
that, does that make kind of a sense around a different way to
approach the same problem? Yeah, I think so.
I think it's difficult in the real world sometimes, right.
It's how, I guess how responsive are your identity systems in
being able to manage that. It's typically the challenge I
see because the traditional method of doing this is I go
into a vault. And then, you know, first of
all, I log into a vault, and then I need to find my
credential and then I need to check it out like a library
book. Sometimes there's a form I need
to fill out that says, hey Jim, am I allowed to have this
library book out? And then we're waiting for Jim
to say yes or no, right? And then I get that account, and
then I do my thing, whatever it is.
And then maybe I keep that library book checked out for the
entire day, week, month, hour, whatever it is.
And then somewhere Jim, the mean privileged librarian comes along
and says give me that back, takes that, takes that book
back, that account back and changes the password on me.
So I can't use it. It seems like that that's not
super responsive in today's world.
And and I'm thinking about this this just in time, Access is
very in my mind. It's going to have to be very
data-driven, but it's going to really be a a different way to
think about how can we actually deliver on that promise of JIT.
And say, okay, well, here's here's what we've got.
And you know, your access is minute by minute, second by
second, really kept up to date because I think there is
something very powerful to say about, yeah, if if an account
gets breached, the account itself doesn't have any
permissions, which is great. It's very similar to kind of
this, this idea of passwordless or and I'll say true passwords,
meaning there is no password in the environment you're relying
on other mechanisms to do authentication.
So if you steal the database that has the credentials in it.
The pastor feel is blank, empty or just doesn't.
You know, it doesn't make any sense and is of no use to
people. I see kind of the same concept
here. Yeah.
So it's exactly that. It's just to add, like I like to
say, Better Together to add to what you're saying, right.
The Better Together story is if you looked at it this way and
when I talked to my customers, we don't have the content as
identity practitioners of all these vulnerabilities.
All the simplest way we can do it is say we have a production
environment, the developers or builders have the context of
what they need. What if we allow them to have
self-service to what they want with security guardrails to your
point, the security guardrails being you can build your own
access in this environment and you use JIT and you use our
policies and you plug into the SIM and you plug into SSO or
MFA. That is exactly where we're
fitting. We don't know what you're trying
to do. We want to give you the
guardrails to build it to be the most effective you can.
That is amazing. When we, when we our customers
specifically, that's what they're buying into rather than
identity saying you need to explain to me all these things,
Jim, why do you want this access?
I'm going to give it to you for 24 hours.
Instead it's saying, hey, why don't you build this, then you
use it. We'll keep an eye on it.
If it works, it works, everybody wins.
Does that make sense? Yeah, for sure.
I think there's another area that I kind of want to get into
a little bit and this is around. Data, because I think this is an
area where a lot of organizations struggle.
Back in the old days in quotation marks there were
things like data lakes with Hadoop, things like that and it
was still very much role based access to some degree, maybe
some attribute based access control.
And now we've got things like Snowflake and this potentially
is an area they think they could have a pretty big impact,
meaning just in time access into Snowflake environments and data
accesses. First of all, I guess for people
who aren't familiar with Snowflake and pretend I'm a
dummy, I know it won't be a big stretch for you.
What is Snowflake? And then talk about the impact
that something like either JIT or 0 standing privileges might
have on a solution like Snowflake.
Yeah, excellent. And I love these folks.
Never think anybody's a dummy. I get excited about it cuz I had
to start, you know, somewhere. So when I think about what
Snowflake is, so when I started out, I used to be in finance
before, actually before I came to the vendor side like 1012
years ago. And everybody knows what a DBA
is, right? Everybody knows what a database
is. Hopefully you store data in it,
you reference it, you need it for everything.
And that's how most systems, information systems work.
It's not really that much different.
Where Snowflake changed the game was in just charging pricing
model. I know I'm not making this like
a business conversation, but it's actually pretty important
rather than worry about tons of storage.
And this actually speaks to the difference between on premise
and cloud. Most of the time when you
worried about, and I I'd like to speak like a CTO, because it's
business value. When you have an application
that references data and databases you used to get
charged by storage. The more data you stored, the
more expensive it was. What Snowflake did is they said
that is a bad idea. Let's switch it where we're only
going to charge you when you access data, we don't care how
much of it you store. So that radically allowed
applications to be built in new ways.
We won't go too deep into it, but it's your idea of data
warehousing. It's still the exact same,
right? You store the data somewhere and
you get charged by compute. What this does though is it
allows organizations to get really business analytical and
think about what they're doing with the data and use it in new
and creative ways. So with Snowflake, you can store
all the data you want, you can distribute it how you want, you
want to protect it, but you're allowing folks to access it when
when they want, and they're only charged in in that time for
compute. Now why that matters?
Does that kind of make sense? Yeah, I'm thinking of my simple
brain, almost like a vending machine.
You've got a stock of soda inside the vending machine.
And you're only paying for the things that you're pulling out
of that vending machine 100% rather than paying for keeping
that vending machine alive and stocked and full where you may
not use it all the time. I only want a couple sodas.
So what that does though from a security perspective is it's a
little scary to traditional security practitioners because
now you have new ways of accessing snowflake tools like
Jupiter notebook that data scientists use.
So to your point earlier, Jeff, guess how they access this data?
They have one set of logging credentials, they use it in
these robotic processes and they fetch this data all the time.
Now that's good on the business side, but on the security side,
that's a little petrifying. Especially if you can run up the
bill or access data sets, you shouldn't be able to access it.
You do need some disparity there.
And again, it's the traditional concept of do you need global
admin to access every table and every entry to run this task
with one set of credentials or can we do it in a different way?
Okay. So I'm sold.
I need to have just in time in my environment, I need to have
privileged Access management environment if I don't already.
One of the challenges that typically see this is around
this concept of accountability versus ownership and
responsibility of delivering these services out to, you know,
the to the environment who runs Privileged Access Management.
Within an organization and part of that would be things like
services like just in time or 0 standing privileges or
traditional Pam right? That might be like a vault or
things like that. Cuz I feel like typically
infosec teams like to get their hands in there and say okay,
here's my tool right? And you developers need to use
this. There's another school of
thought that's like, well, it's the engineers are gonna be using
it, maybe they should own it and.
Information security, maybe provide some guidance or you
know some oversight over how it's used, right?
Things like that. Maybe it's someone else.
I don't know, like where do you see this, this, this.
I won't say battle, but this discussion taking place it is it
is a battle. So what my best recommendation
is as such. All right so and this is what I
tell the boards or sea level folks the job of a sea.
So in my opinion Chief Security Officer is to technically own
the tools that account for risk. They own the risk.
They do not need to have the context to understand what
exactly the CTO is doing in Snowflake right.
But he does own the risk of that access of that getting out.
So traditionally when we've seen it and you all probably have
seen the same thing, I am teams even their purchases go to the
see see so see so owns the product.
What is a happy medium is when you do say CTO or CIO, I'm going
to own the risk. Here's the tools I'm providing.
They will help you enable your task, your functions, MB, O's,
whatever, right The the CTO also has an objective, so does the
organization. That's what we normally see. 95%
of the time the see so owns the risk, they own the products.
But you have to work hand in hand with the business units.
The CTO normally that's executing these functions or has
to use them. I think this is an important
topic for people to really kind of understand because I ran a
workshop on this actually a couple weeks ago with a client
and we spent probably a good two hours talking about the racy
model of the IM program in the room was information security,
you know, general IT application developers, things like that.
And we kind of we had discussion around Okay.
Let's talk about these services for identity that we're going to
be providing and this isn't specific to you know Pam or JIT,
but I think it's it certainly applies is is really
understanding where do you fit within that racy matrix because
I think a lot of people and I and I'll, I'll blame not blame I
will I'll I'll drop this on my information security brothers
and sisters out there is there is this tendency that oh it's a
security tool so security should own it and operate it and blah,
blah, blah. That might not be true.
You might be accountable for the tool or the risk that the tool
is mitigating, but that does not necessarily mean you need to be
responsible for the delivery of that service.
So I think this is something that organizations really need
to start thinking about. If you're if you're running an
IM program or you're looking at getting one stood up, or anytime
you're building out a new service, really take some time
to think about that racy model. Because I think there's a big
difference between being accountable for risk.
And this is where I see the SISO and the CTO having the
accountability hat. And to me, accountability is
like Highlander. There can only be one, yeah,
you've got to have one person or one group that's that's actually
accountable for, you know, the risk of the service, whatever it
may be. Versus who's responsible for
making sure that service is up and running.
So I think this is an area where really think about you know, do
you really want to be accountable for it.
Because if you are, something goes wrong, that's, you know,
the group or the person that's going to be on the hook to talk
to others, to figure out what happens, go to the board.
Things may be now conversely, you know, typically that's the
person probably going to get the recognition for, hey, the
ServiceNow, hopefully that person.
That it's accountable to sharing that love downstream to others
as well. But I think that's something
important for people to think about is this concept of
accountability versus responsibility and then of
course the consultant in the informed part of that racy
diagram. But really think about where do
you really want to be, you know, with regards to that service you
did. You said it nicely, Jeff.
I was just taking it in watching the master teach.
Yeah, You didn't think you'd get out of here easy, did you, John?
I never do. It's fun though.
No, you know, you know I want to add something on this topic
which is I think privilege access management or just in
time access. This is one of those areas where
you know information security, if they're delivering single
sign on or identity governance and administration or what other
whatever other I M services they're offering, they just
assume okay, well we'll run the Pam system as well.
But what I found in my career is that Pam.
As seen by engineers or whoever's being affected by it
and going to have to use the tool as this is being done to me
and now I have to figure out how to do my job efficiently.
In light of the fact that you've thrown this obstacle in my way
and I'm going to figure out ways to work around it versus the
mindset, the mindset shift that can happen if you say no,
actually this is your tool, you run it, and now.
You can't skip a step, which the step is if you go into an
organization and the engineering team thinks, Oh well, John and
Jeff have worked here for 20 years, They're my best friends.
They would never. They would.
They would never try to rob the
company or do something bad or become an inside threat.
We trust each other. We share passwords.
We don't. If that's the mindset, no you
don't. You don't get to run the system
right and but you at least have to have like a management view
within that team that says, you know, I have people come and go
and you know like I can trust you with my lunch money, but
that's I'm not going to trust you with the keys to the Kingdom
of of the company. It's just the way it is, right?
So. Jim you and I had this
discussion a long time ago. I I remember this was an episode
I I don't know when it was. It was a long time ago.
We talked about this is related to remember when Tesla almost
got breached and basically there was this guy who was like an
insider threat and he was being paid or the the I guess the the
attempt was right is somebody would give him money to give him
information on Tesla stuff right.
And you and I had a conversation like, OK, so.
And my, my, my thought process was everybody has a number to,
you know, break their oath of security or whatever, you know,
privacy, whatever it may be. The number might be small, the
number might be a strong astronomical, but everybody has
a number. If someone came to you Jim, and
said, hey, I will give you $2 billion tomo bravo, If you're
listening to, you know, be part of an acquisition where they
acquire the identity of the Center podcast.
I think we would listen to that, right?
As much as like doing that, right.
We have a number that we like, all right?
That would be something like that.
And I think the same goes for anything.
Now, again, I'm not saying that people are bad inherently.
I try to believe in the good side, but I think everybody has
a number. And if you're relying on trust
to be your security platform, you know, in a physical, human
sense, I think you got problems. I think that's the case.
I think it's best run by the engineers because at 12:00
midnight, you know they're trying to solve a problem.
You threw the system at them. Either they're going to try and
work around or they're going to pick up the phone and call you.
And I think information security's role is to make sure
that the controls that have been put in place actually work, get
tested on a regular basis. The system is doing what it's
supposed to do, be accountable for the system.
In other words, the buck stops here.
But that doesn't mean turning the wrenches necessarily.
Right. Yeah.
And just to add to that, just to add highlight exactly what you
both are saying. The reason I took this role and
I wanted to get closer to the customers is because I
consistently see cloud teams pull away from they hear words
like Pam and Lee's privilege, they pull away, they're building
these tools themselves. Every one of my large customers
have built some version of the tool themselves because they
don't trust. Their cohorts and information
security because it's just slowing them down and we don't
understand what they want. So that's if we can bridge that
gap going forward. Those are the most effective
customers I see out in the world.
Yeah, you talked earlier a lot about and I wanted to kind of
close this out in terms of the area we've been talking about
just in time Access. But shifting back to what you're
talking about with DevOps, you know, you're talking about the
conferences you're going to. To me this seems like that's the
sweet spot for Just in Time access is you know, especially
around non human accounts and not having them sitting around
with privileges to singing, you know, high power groups and
elevated permissions and doing it in a just in time way.
I'm wondering am I thinking about that right?
What is the role for just in time access in DevOps?
So yeah, So in the over 2 years I've been meeting with these
folks and you know, and they love the idea and but I think
again, I will say this bluntly and boldly, Identity needs to be
more in DevOps or I call them platform engineering builders.
I call them builders. They're builders and their
organization, the engineers, They're looking for identity
solutions. And they're not finding what
they're looking for. Matter of fact, case in point,
literally I heard it so much we actually built a request module.
Now we call it Access Builder in our own tool.
Because another thing they would tell us is the complexity of
requesting a simple access. Jeff needs access to XYZ.
I got her to submit a service now Ticket.
I filled it out wrong. I get it back.
I get the right details. He goes to someone who doesn't
know what I want. I get it back.
He goes to some cloud engineer to fulfill that.
He doesn't know what I want. I get it back.
So it's even in the complexity of requesting access that we
decided to build this product and it's hitting off like
gangbusters. And we're asking where is your
IGA tool? Oh, way too complicated.
Where is your ITSM tool? Oh, we don't even want to use
that if we don't have to. Can you just give me one line of
audit that says Jeff Steadman approved this thing?
That's all I need. I don't need the complexity.
So they're begging. Builders are begging for these
sort of solutions where they're just not happy with the current
state of things. And it is them.
They're the ones who are pushing innovation and making people's
lives hard in identity and infosec, right?
Yeah, I and I think from a CIO perspective, you don't want to
slow down like the engineers can move like at the speed of light.
Now with these cloud services and just roll out new business
functionality, even the CSO is minded from a business
perspective. I don't want to slow that down.
But at the same time just saying, all right, well I'm
hands off that that doesn't take away the the necessity to ensure
security controls are being followed.
So you have to find the middle ground and I think just time
access can potentially bring you a long way toward achieving
that. You need to have the paper
trail, but you know, counting on like a service desk ticket or
counting on your IGA system to provide a detective or even a
preventive control, it's just too slow.
It's. It's the worst break glass is
always my favorite. You you all pointed it out.
There's normally two guys in every shop or or ladies, you
know, two people who have the keys of the Kingdom for cloud
and they have it written down in the hopefully a little safe next
to their desk and they both know how to log in.
And that's how they still do it, because they don't trust even a
vault to get them to where they need to be.
They're like, man, you and me, Jim, we're going to turn the
keys at the same time and get in here.
But yeah, it's it's a tough and interesting place to be.
And just finding that happy medium is what I'm trying to do.
That's that's where I want identity to go.
It is, to me, the biggest rough spot of all enterprises I talked
to is the identity processes. Right now they're just complex,
mundane and misunderstood. And they may have its place in
finance, healthcare, there are compliance regulations and
mandates. Hopefully those change.
But where you don't have as much retail, manufacturing, things
like that, they just want to move fast, Give me what I need.
We're all getting paid. Give me what I need.
I love it. I think that's that's that's a
good way to probably close out that part of the discussion is
give it, give it to me when I want it and get out of my way.
So we mentioned at the top of the show we were recorded a
couple weeks early. It's September 7th, which is a
holiday in my household and maybe others, but it is opening
night for the NFL season here in the US.
So I'm a big football fan, been for years.
I have retired from the fantasy football game.
I used to run one for like 20 years.
I haven't done that in a long time.
Now I can actually sit and actually watch a game and enjoy
it rather than watching the little ticker at the bottom that
says, you know, so and so scored touchdown or receiving yards or
passing yards, whatever it may be.
So here is what we're going to end On a lighter note today,
we're going to pick a winner for this week's slate of games, week
one of the NFL. And because people aren't going
to hear this until, I think September 25th, Ish.
We're going to be able to find out right who is right, wrong
way off phase. And so you know, welcome to the
first ever Locktown episode of the NFL Weekly Picks with
identity at the center. John, who do you have your eye
on this week? Who is going to win?
So I actually do compete in the survivor pool, where you can
only pick one winner every week and you cannot pick the same
team. I did my research based on
degenerate gambling and sports betting and I'm going to go with
the Baltimore Ravens to at least get the win money line.
All right, who are the Ravens playing?
The Ravens are playing. Actually, that's a really good
question. I'm not.
Even that's probably a good. Oh yeah, the Texans.
That was. That was why I think
statistically the safest. Bet you are correct.
Yeah. OK, Jim, who is your lock for
the week? They are going to win their
opening game. Well, I I want to interrupt
first with I'm not a huge NFL fan until the college football
season ends. I'm a Georgia Bulldogs fan.
They are going to win every week, so we can put that in the
bank. I also am like super excited
about Coach Prime and what he's doing at Colorado.
They beat TCU last week. They're going to beat Nebraska
this week. NFL wise, Eagles first.
I grew up in Philadelphia and my number two team has been The
Jets because it lives in the New York metro area for a while and
they sucked big time when I lived there.
But now I think they're my pick for the Super Bowl, so.
You think The Jets are going to the Super Bowl?
I I think they're winning the Super Bowl.
Wow. And they're playing the Bills,
so that's a money night game. That's huge.
Obviously Aaron Rodgers going to.
The Jets is is a big deal and they're wide receivers really
good too, right? They're OK.
I thought like the one guy was like superstar.
I don't know. Like, it's not really my my cup
of teas, so. You're going to The Jets?
Well, you're saying you're picking The Jets of the.
Super Bowl, though, Who is winning this week?
They're going to play the Buffalo Bills.
You're picking the Eagles over the Patriots?
Yeah, that's safe bet. OK.
Yeah. All right.
So my two teams are the 49ers and the Bears. 49ers play.
Who do the The Steelers, who are bad?
They should win that game. But this is about passion, about
feeling. I'm going with my Chicago Bears.
Aaron Rodgers is out of town, and the Packers are coming in to
Soldier Field. I'm going Bears, baby.
I've drank the blue kool-aid the blue and orange.
Bears Lock it in. We're done.
Wait, how many wins did the Bears have last year?
I had a few I was just checking. OK, a few means three or more.
They have more than that, I think.
So here's here's the excitement in Bear Town.
It's we're not facing Aaron Rodgers or Brett Favre for the
last 20 years. So there's actually a legitimate
chance now that the I think the Bears can finally start to show
some progress against. The Packers, from a win
percentage, I think it's neck and neck.
I want to say the Packers took over like a one or two game lead
in the last couple years, but historically it's been like, you
know, 700 and 700. They've played so many games
against each others and it's been pretty even.
But I feel like this is the year the Bears turn the corner,
mostly because they're not facing Aaron Rodgers.
Again, feels like you're trying to talk yourself into this one,
but that's OK. Hey, so.
You're saying there's a chance? I'm saying there's a chance.
All right, we'll go and wrap it up for this week.
John, thanks again for coming back on the show.
We really appreciate the time you spent with us.
I'll have links to your LinkedIn and to to the bright of website
BRITIV e.com so you can learn more about what John's been
working on and some of the cool things that the bright of
solution does. We'll have links to all the
different conference things that we talked about early on.
So things like Identity Week America or discount codes for
that, Octane or discount code for that authenticate our
discount code for that. And of course, you know, you can
always connect with Jim and I if you've got questions, comments,
concerns, football picks. We're still looking for people
to send pictures of Whopper's candy to Jim, because that's his
favorite candy. And we'll go ahead and leave it
for this week. You can find us on the web, IDAC
podcast.com, Twitter at IDAC Podcast, Mastodon at IDAC
Podcast at Infosec dot exchange. Hit that subscribe button, like
share, you know, whatever you want to do to help us out, get
the word out for identity center in the gospel of identity and
access management to others is always appreciated.
So we'll help. Leave it for this week.
Thanks everyone for listening and we'll talk with everyone in
the next one. You've been listening to
Identity at the Center. We hope you've enjoyed the show.
Make sure to like, rate and review and we'll be back soon.
But in the meantime, hit the website at
identity@thecenter.com and find us on Twitter at IDAC Podcast.
See you next time on identity at the center.