I created the Non human identity management group on LinkedIn
back in May last year. I've been very surprised that
we're now close to 2000 members. A lot of people in the industry,
consultants, a lot of practitioners, pretty much the
who's who's now in them in that group.
And we've started to post a lot of content there.
But then I realized that's not really going to work.
Whilst you'll be able to disseminate kind of news, what's
going on in the industry, if someone wants to learn, they're
not going to go through a feed of hundreds of NHI posts from me
and others in the industry. And then I thought, look, let's
create a portal. And that's when NHIM g.org was
formed. And my mission was purely at the
time, all about education, evangelizing.
I was in a job and this was kind of a side hobby, a bit like what
you guys do at Idec. And it just sort of flourished
from there. I wrote more white papers, more
content, and there was a lot of good, you know, feedback.
I started talking to sort of folks in the market to say,
would you like to kind of share content as well?
And then that's really what I've been doing for the last 12
months and since January decided to go into this venture full
time and the mission hasn't changed.
It's to educate, evangelize. It's the kind of help the
industry come together. And I guess along the way,
someone, one of the vendors kind of just, and maybe a LinkedIn
post was said to me kind of verbally, Mr. Nhi.
And I started using the name and it's now now stuck with me
unfortunately. But maybe it's a bit better than
Mr. Sox. Yeah, Mr. Stocks kind of kind of
sounds like a Quentin Tarantino character for Mike Reservoir
Dogs or something like that. Or cat, a cat name.
Yeah, that's true spoiler right. If you're watching a video, I've
got a couple DJ cats in Amsterdam behind me.
So if you're if you're not watching a video, you're missing
out that that glorious scene. This is identity at the center
if it has anything to do with IAM.
This is the go to podcast now your hosts Jim McDonald and Jeff
Steadman. Welcome to the Identity at the
Center podcast. I'm Jeff, and that's Jim.
Hey, Jim. Hey, Jeff, how are you?
Oh, not so bad yourself. Doing great.
I feel like we're living in this weird time work kind of thing.
We're recording before Identverse.
It's going to be dropped after Identverse, but I want to talk
about Identverse. I mean, we're going to be doing
the identity squabble game while we're there.
I guess technically it's in the past, but hopefully we'll be
able to drop it as an episode. It's going to happen in the NHI
Pavilion at the Expo Hall. Really excited about what we're
doing at Identverse. Yeah, it's a very cool thing.
I I'll be honest, I'm a little bit nervous on how this will
come off. I dentist squabble as we're kind
of calling it. It is an extension of the Fido
feud that we did at the Authenticate conference last
year. But we are doing it all on our
own basically, right? No help.
We don't have like an AV team. It's going to be me setting up a
bunch of cameras and me figure out how to try to mic it up.
So, you know, we are a couple days away from that and
hopefully by the time people hear this, it turned out well.
I hope people, you know, are entertained.
You may not learn anything, but I hope they're entertained as we
go through that. So.
Yeah, I'm going to. I'm going to give my thank you
in advance to the CRA for I mean, look, we're doing so much
there. You and I are each hosting a
panel and we're going to be recording a bunch of podcasts
and have an opportunity in the actual hall to meet people, give
out stickers. I'm excited for the whole thing.
Yeah, definitely been a great experience.
Shout out to Shirley for for helping us out with this.
So if you see Shirley roaming the halls from CRA, give her an
identity at the center. Fist bump of gratitude.
How about that and just a fist bump.
Don't do anything else. Yeah, no, just fist, not fist to
any other part of poor Shirley. I think the other thing that
would be great is like if people got to meet us, people got to
and are listening to the show, go out, give us a a review on
whatever podcast platform you listen or give us a thumbs up
and subscribe on YouTube. It definitely helps get the word
out because I mean, the podcast has grown significantly over the
last six years and it's grown organically, right?
We don't run any ads. It's people telling people about
the podcast, people liking the podcast or giving us five star
reviews and kind of like working it up in terms of the algorithm,
yeah. No advertising.
The only advertising is what I see behind you, all the
different plaques that you've taken from, you know, the, the
different cocks we've been at. But definitely very cool.
And we are going to hit a couple milestones this year.
We're going to be celebrating 6 years, I think pretty close by
the time this one comes out. And you know, I'm going to
preview we're, we're probably going to hit 1,000,000 downloads
sometime later this year. So pretty pretty crazy.
Yeah, there's big, there's big numbers.
They keep coming. They keep coming quicker than I
expected them to come. So but that's, that's not a
credit to me and you, Jeff. That's credit to all the people
who listen. And I think the practitioners
out there who you know, let us know all the time that you know
how they feel about the content. 99% positive this.
That's a shout out and a credit to them.
Yeah, we like doing it and like the conversations we're able to
have. And, you know, that's that
what's that's what leads us to the conversation we're having
today, you know, especially like around, you know, NHI, which is,
you know, so hot right now if I want to steal something from
Zoolander. But why don't we pivot into our
conversation here with Mr. NHI himself, Lylett Choda.
He's the founder and CEO of the Non Human Identity Management
Group. Welcome, Lylett.
Thanks Jeff and Jim for inviting me to your identity of the
Center podcast. Real pleasure to be here and
talk all about NHIS non human identities or some will say
machine or workload identities whichever camp you're in.
Yeah, we're going to get totally into that.
I want to start though, with your background, because this is
tradition around here is the the identity origin stories for the
people in the space. So tell us a little bit about
your identity background. How did you get into this?
Is it something that you chose or did identity choose you?
It's probably the the latter. So I started my career 30 years
ago in investment banking, came out of university straight into
Morgan Stanley, was there for 18 years.
I moved into sort of the equities division running order
management systems. And I guess that was my first
exposure to sort of regulatory audit and sort of identity when
the infamous Sarbanes-Oxley Sox Act came and we had to make sure
our systems were Sox compliant, I was the only one in my
equities division that really took the Sox control seriously.
And ever since then, I was tagged in those days with a
different nickname, Mr. Sox. And ever since then, sort of for
the last 25 years, anything that was his regulatory order, you
know, compliance, operational risk, you know, I was involved
in. So I've run a number of large
feds and other large regulatory programmes for, for, for various
investment banks and then slowly went more and more into the
identity space doing human regulatory programmes, Pam and
I've done a number of NHI programmes along the way as
well. And when I did SOCKS 25 years
ago, that was actually my first time I actually had to deal with
Nhis or in those days we would call them technical accounts or
service accounts. So it's a little bit of my
background in terms of my identity journey until I became,
I guess, Mr. NHI. So how did you, how were you
awarded that title of Mr. NHI? Is this a, you know, something
that somebody gave you? You know, is it something that
you've kind of adopted as a moniker?
Tell me about that. Yeah.
So about a just a year and a half ago I decided one weekend
to write a white paper on how to manage non human identity risks.
I was just running in the middle of a very large regulatory
program at a large investment bank fixing the NHI issues.
And I thought, look, it might be worth writing some insights on
what we did, the challenges. And I probably said on LinkedIn,
I wasn't really a big LinkedIn follower or contributor.
And what surprised me was within a few weeks, you know, I was
getting pings from some pretty big industry heavyweights.
I'll drop a name, for example, you know, head COVID said
Silverthorpe pinged and said, love your white paper.
Let's chat. And after writing that white
paper, kind of a lot of doors started to open.
I started to talk to a lot of folks in the industry and I
realized what was going on. There'd been a huge growth in
startups and a lot of discussion around the non human identity
problem. And I then started to realise,
well look, if you're a customer you want to learn about the
problem, where do you go to understand about the risks, the
challenges, where'd you get guidance and advice?
And really there was nothing in the industry about just over a
year ago. And again, just one weekend I
thought, look, why don't I start and create like Anhi community.
So I created the non human identity management group on
LinkedIn back in May last year. And I've been very surprised
that we're now close to 2000 members.
A lot of people in the industry, consultants, a lot of
practitioners, pretty much the who's who's now in them in that
group. And we started to post a lot of
content there. But then I realized that's not
really going to work. Whilst you'll be able to
disseminate kind of news, what's going on in the industry, if
someone wants to learn, they're not going to go through a feed
of hundreds of NHI posts from me and others in the industry.
And then I thought, look, let's create a portal.
And that's where NHIM g.org was formed.
And my mission was purely, at the time, all about education,
evangelizing. I was in a job and this was kind
of a side hobby, a bit like what you guys do at IDAC.
And it just sort of flourished from there.
I wrote more white papers, more content, and there was a lot of
good, you know, feedback. I started talking to sort of
folks in the market to say, would you like to kind of share
content as well. And then that's really what I've
been doing for the last 12 months and since January decided
to go into this venture full time and the mission hasn't
changed. It's to educate, evangelize.
It's the kind of help the industry come together.
And I guess along the way, someone in one of the vendors
kind of just in maybe a LinkedIn post was said to me kind of
verbally, Mr. Nhi, and I started using the name and it's now now
stuck with me, unfortunately, But maybe it's a bit better than
Mr. Sox. Yeah, Mr. Sox kind of sounds
like a Quentin Tarantino character for Mike Reservoir
Dogs or something like that. Or cat, a cat name.
Yeah, that's true spoiler right. If you're watching a video, I've
got a couple DJ cats in Amsterdam behind me.
So if you're if you're not watching a video, you're missing
out that that glorious scene. But let me talk a little bit
here with you about NHI, which is why we're here.
I know we want to get probably a definition from you of what is
NHI. But before I get to that, it
seems like NHI is kind of having a moment right now, kind of like
identity at large is having a moment as like, hey, there's a
spotlight identity and people are trying to take notice of it
even though we've been here for years.
And I would argue the same thing for NHI.
But why do you think NHI is such a, a big deal right now?
Because it seems like every conference that we've gone to
over the last six months to 12 months has really started to put
more focus on NHI. And I'm curious, you know, if
you see the same thing and and if so, why do you think that is?
Well, there's only one answer. It's because of me and our group
and all the noise. No, that's not true.
Look, I, I think, you know, I do get asked this question a lot
about why now when you talked about identify earlier where our
groups are actually going to be hosting a big NHL workshop next
Tuesday and the pavilion you refer to we're hosting.
So it's going to be great to have you there.
Look, I think what's changed is the last four or five years
where, you know, this was always a problem, right?
As I said, I was dealing with this 25 years ago as part of Sox
controls to cycle NHI passwords and in those days, but before it
was all about an internal issue, right?
But with kind of the hyper fragmentation that we've now got
in the environment with you know, the multi cloud kind of
environment, SAS integrations, containerization, micro
services, you know, API based interfaces.
And I guess now, you know, more growth we're going to see with
Gen. AII guess all these kind of non
human identities, they're much more easy to compromise and
discover. There's a great start by a
company that produced a report in 24 saying that there were
24,000,000 secrets found in public GitHub repos.
So look, people have not implemented good controls around
managing NHIS or secrets. They're all over the place.
You know, we've got generally very weak controls around
managing the NHIS. So we're seeing, you know, a lot
of issues, breaches that are occurring.
That group recently published a 52 breach report to celebrate
our 52 weeks since we were formed.
And we're seeing breaches now occurring on a weekly basis
where threat actors are discovering these credentials in
repos, API keys, tokens. And it's an easy way to get in,
right? They don't longer need to, you
know, kind of compromise a human's credentials.
They just can get access to these NHI identities.
And you're in, right? And given, you know,
environments are so distributed with cloud and SAS, we're much
more significantly exposed than we were, you know, many years
ago. So I think just the explosion
and you know, and the micro fragmentation that we've had in
the environment has just now caused this this huge problem.
Lalit, so feels like you come to this with from the practitioner
perspective, and that's a big reason why Jeff and I wanted to
have you on this podcast because we've got a lot of folks who
come on with kind of the vendor perspective.
And you know, this is, and no way to disparage what they do.
They're out there building solutions, right?
But overall we're I, we're hoping to get out of this
conversation as kind of a framework for the practitioner
to wrap their brain around this NHI problem and how they can
solve it, right? Where do they use their existing
tool sets like IGA privilege, access management, single sign
on? Where do they need new tooling
or new approaches? And I'm going to start you with
a really simple question because I, I kind of feel like we need
to define NHI and you made a statement earlier.
Some people might call it machine identities.
Is that, is that what it is? Is NHI equal machine identity?
Yeah, look, there is still a lot of debate in the industry around
what's the the official term for this, this topic we're covering.
Obviously you know, which camp I'm in, which is the non human
identity camp. You know, I guess our friends
are gonna, you know, talk about machine identity is kind of the
descent of the universe. And then under there they talk
about, you know, where workloads and devices, where we started
non human and then talk about workloading devices under that.
Look, I think it's going to take a while for things to settle on
what you know will be the common term.
I think hopefully what may happen is that these become
interchangeable terms. You can to me non human machine
workload, it's all really the same thing.
And I think they can in some respects be used somewhat
interchangeably. But I guess to your question,
Jim, you know, what is a non human identity?
Look, it's a digital identity or a credential that represents,
you know, a machine, an application, some automated
process or a service that's used within your IT infrastructure
stack. And these non human identities
allow those machines and software workloads to securely
authenticate, you know, operate and perform tasks automatically,
including kind of, you know, authenticating to other
machines, processes and services without any kind of human
interaction. So that these are the
identities, the accounts they used to run all software, you
know, all around the world, you know, including IoT devices and
other devices, you know, in an automated way, right.
So it's what runs everything we do.
So they are pretty important from an identity standpoint.
So if you were back at Morgan Stanley or your advice for a
practitioner out there, right, they get stuck in a long
elevator ride with the CIO and he happened to hear about these
non human identities and like, hey, I'm in the elevator with
the identity guru. I'm going to ask Lala, what are
we doing about non human identities?
What's the right answer if you're a practitioner?
Like, how do you even think about that question?
Look, it's the we could talk for hours on this.
Doing an elevator pitch on NHIS. It's quite challenging.
You know, when we started an NHI program at a more recent
investment bank, my CSO said to me that why can't we fix this in
a year? And we then had an incident that
occurred a little bit later, which I can talk about if we've
got time. But look, the real fundamental
issues at the moment with NHIS is there's so many of them out
there, right, that the stats that will quote NHIS are number
human identities 25 to 50 X. Some will even quote 100X and
these numbers will go up, you know, significantly more as
we've got identic AI coming in. But generally non human
identities are unmanaged, right? They have very weak controls.
They're kind of the forgotten problem chart.
You know everyone focused on human controls and Pam and
protecting your barriers but managing non human identities
and the secrets that are associated with them.
Were typically not, you know, always an afterthought.
You know, focus was on just delivering software as quickly
as you can and security was an afterthought.
So you have a lot of issues, right?
With secret sprawl, you have a lot of weak control.
So look, some of the issues you're going to get with NHIS,
they're easy to discover. You'll find them hard coded in
source code repositories, Confluence, SharePoint, Slack
channels, you know, understanding how many you have,
right. There have never really been any
ways to kind of fully manage and inventory, you know, NHIS that's
very hard to do. You know, a lot of these
accounts are static in nature and that's kind of the core
issue with kind of NHIS. Whilst we can talk about what we
can do more strategically and zero trust maybe later in the
discussion, the vast majority of NHI stays static, right?
So they've been created, They have in most cases no ownership.
They may have been created 1020, thirty years ago.
People don't know what they are. Are they still used?
We've worked to organizations where 5060% of the accounts that
we've uncovered have not been used.
And clearly that increases the surface area of risk.
You know, you have humans that are using these accounts and
bypassing controls. We saw that when we turned on
Pam controls at a, at a bank, they said, look, we don't like
the Pam Corolla controls. So they started using NHIS as a
way to bypass, you know, entry to, to production.
You know, NHIS typically, right, because they're running your
crown jewel apps, they're going to have high privileges.
So again, these are targets for both internal and external
threat actors. And there's many other issues
that you have, you know, with with NHI.
So unfortunately, you know, they've always had these issues.
And now with all the hyper fragmentation that we've talked
about, the problems just kind of exploded exponentially.
So look, it's a huge elephant in the room.
I would say it's probably one of the toughest challenges you'll
face in your career in terms of solving much, much complex than
solving kind of the human identity problem, which is much
more mature. And a lot of the tool sets to a
point you made earlier just aren't fit for purpose or at
least the traditional tool sets. And we can talk about that if we
want to dig deeper to to meet the requirements around sort of
NHI life cycle processes. OK.
I think we're on the 1st floor now.
They've come all the way down on that elevator ride.
I kind of feel like the original NHIS, at least that I dealt
with, were service accounts, right?
So you had these service accounts and I, I kind of feel
like the life cycle is not probably managed all that well
in a lot of organizations, But you know, privileged access
management can do a good job of discovering and rotating
passwords. It still doesn't have MFA, but
you know, privileged access management probably knocks out
some. We could probably use the
governance processes in IGA to a certain extent.
I know there are some tools out there, but service accounts
isn't the whole ball game, right?
And and what you pointed out with like GitHub repos, you
could probably scan them and find these things like you could
put controls around them with existing tools or maybe adding
to your portfolio some. But I kind of feel like we're
entering or we've entered this era now where there's this new
crop of non human identities, whether they are device specific
or they are more or less like these ephemeral identities that
get created with like and infrastructure as a service type
platform where it's not going to create the identities to roll
out the cloud infrastructure that it needs and then
potentially deactivate those identities.
But you have to have your arms around it to some extent, right?
And maybe it's not just those things.
I mean, you just take in, take the whole cloud into scope and
man, there's just tons of identities there.
And I wouldn't think that the traditional privilege access
management tooling is going to do a good job at that.
So one thing, So OK, so that's one thing, which is that I think
there's all these new types of identities.
The other thing is, and this is what I've always kind of said,
would it be nice if we manage non human identities the same
way we manage humans, which is we have some source of record
like an HR system or something. That's where you start by
creating the identity there and then it gets provisioned, you
know, through automation, ideally to the point where you
wanted it. It can be checked on, the
password could be rotated. You no longer need it.
You're the source of record. Shut it off and it shuts it off
anywhere that's being used. But it's not really like that,
right? I mean, people spin up a server,
they either manually or by automation create accounts to go
and do those things, server or database or whatever they're
spinning up. So the approach to managing
these non human identities is not like linear where you start
the process here point A and then the end of end of life is
point Z. It's you're finding these things
and then you have to wrap them up in layers of security
management so that they are more secure.
And I don't think it goes from like not secure at all to 100%
secure. But to me, that's the the big
thing is that, hey, there's these new identities and they
are not easily managed and the tools you have today don't do a
good job of managing them. And that to me, that's like why
it's hot. It's like all of a sudden we're
inundated with all these places that are now creating identities
and none of the tools that we have traditionally do a great
job at managing them. Did I get that right?
Yeah. Look, I think you've summarized
that very, very well. Look, even if you look at the
human space where you've got all the cloud tools that are out
there, right, that have come along because sort of, you know,
move beyond sort of the traditional IGA and Pam even for
just kind of the human use case, but with kind of non human
identities. You know, there isn't a single
source of truth like you might have with human identities.
You know, there's going to be many places where they get
provisioned, you know, in the cloud on your, you know, on Prem
environment, you can have a lot of local accounts, maybe on
legacy databases, Active Directory, you're going to have
many, you know, ID PS Right. So there's going to be like, you
know, 10s of places where a typical organization is going to
have these NHIS kind of provisioned.
But generally they get provisioned.
You know, they typically come if they're static with some keys
and passwords. They get shared around, you
know, maybe in an e-mail or in some other communication
channel, in a ticket to the requester.
So there you go. You know, problem one already,
right? The credentials are known by
humans. And then they'll, you know,
they'll take the easy route. They'll just put them into
source code, hard code, the credentials.
So you've got all the challenges around, you know, vaulting,
removing hard coded credentials. Look, so yes, a Pam solution can
help with some of that, but a Pam solution isn't really going
to solve your whole inventory problem.
And discovering all these identities that are out there,
you know, once you've discovered them, you need to understand
who's the owner, what's the level of permissions, how broad
is the access right? And classify them, you know, and
then you can start doing things like posture management, you
know, have they got excessive permissions, misconfigurations,
what's inactive, you know, what's shared.
And clearly, you know, with, you know, the growth in cloud, the
number of privileges that you can get in the cloud, just kind
of a crazy rather 10s of thousands of difference of
combinations. So people take the easy path out
and say, look, rather than following least privileged
principles, let's just go with, you know, an Uber kind of
privilege. So you see a lot of, I think the
clouds kind of encouraged kind of more excessive privileges to,
to these identities. So you've got, you know, them
all out there. And you, you talked about
scanning. You know, that's another area
that traditional tools would not have done right is to scan and
look for these credentials in source code, in repos and other
places. And then, you know, the big task
is once you've found all the things, yes, you can do some
hygiene, some clean up, but you're then going to secure the,
the, the secrets if they're hard coded.
You know, had a previous org that I wrapped up last year, you
know, we had to secure over 100,000 NHIS that we were
uncovered in source code. And our initial scan that we did
found over a million potential hard coded secrets passwords.
So you can see the size of the problem and then to make those
changes, move those credentials into a vault, you know, the
amount of changes you need to make to your code to remove
those credentials, the operational risk.
And then you talk to him about cycling right and rotating these
credentials 1 is securing them. But reality is people still know
the, the, the, the passwords, the secrets.
And as people leave, you know, and then with Cloud API keys,
you know, you can take that information with you, right, to
another organization or compromise those accounts, you
know, even if you've left an organization.
So rotation becomes something that you need to do.
And whenever there's a breach, right, the first thing is rotate
your keys. But again, you know how those
credentials used in many places in your code, How do you know
when you rotate? You know that all the code, you
know, is using the same, you know, vault solution to source
their password. If you miss one of those
dependencies out, you could end up causing operational impact.
And we've seen that so much have many orbs where you didn't
realize a credential was, you know, used.
You missed a piece of code or you found, oh, some other app
you've given the credential to, you know, like to another team
that needed to connect to your database.
You give them the password and they're using it as well.
So there's a lot of legacy that's been created and that's
why a traditional IGA or a Pam tool is not going to solve these
problems. That's why you've got a new crop
of pure NHI products that have come into the market.
And then also now we're seeing a lot of movement with the
traditional IGA and Pam players that are now investing
significant sums to build, you know, NHI capabilities.
So it's definitely the existing tool sets just could not support
these use cases. It's much, much more complex
then what we talk about for humans, you know, and then
you've got to think about monitoring, you know, if someone
inappropriately using your, your NHIS coming from some unknown IP
addresses that are human using them.
And then they are already being compromised.
And then you get into the, you know, what's the target state,
right, which is kind of ephemeral just in time zero
trust. You know, our previous org, we
also implemented prevent controls.
When you check in your code, we're actually looking runtime
to see, have you checked in an API key or a password to an NHI
credential? And we actually block the check
it. So if you look at the overall
life cycle, we've published one of these on our portal.
It's a huge, huge problem to solve if you want to try and
tackle the whole thing holistically from a life cycle
standpoint. So from an organizational
standpoint, I think you're going to take a balance, which is try
and do some things more strategically.
You know, do kind of dynamic ephemeral secrets with your
workloads. You know, more of a zero trust
model, maybe with your Genentech staff or your grand duels as you
re engineer. But you've also got to deal with
your existing kind of state that's out there, which is
static in nature, and you've got to get that under control.
So you're going to have to always think of a hybrid
approach to dealing with the NHI problem, you know, a lot of
legacy and figure out how you kind of strategically kind of
stop the bleeding, you know, over time as well.
So listening to a couple of points.
It certainly did, but it opens up some questions for me because
I'm listening to the two of you talk here and now I'm wondering,
you know, whose fault is this? Where does the blame lie?
Because I feel like this is where privileged access
management was supposed to have been the solution for this.
We've been sold this bill of goods by Pam vendors for decades
that hey, this is where you go to manage your non human
identities. We didn't call it that.
We called IT service accounts. We called it keys, right, All
that kind of stuff. But listening to the two of you
makes me feel like, OK, well, OK, what do you mean?
I thought Pam was supposed to do that and it's not doing it.
And that has opened up the door for these new vendors to come in
and specialize in this version of Pam 2 point O or three-point
O or whatever you want to call it.
But I almost have a feeling of a little bit of remorse here.
It's like, all right, well, Pam was supposed to do this.
Why isn't it doing it? And I don't know if that's a
fair assessment based on the conversation so far or just kind
of my my experience with Pam solutions, but I'm curious.
I'll like to see. Look, I think it's different.
Sorry to interrupt. No, please go ahead.
Look, I think, well, if I if you asked me did was Pam designed to
solve NHI, I would say partly. Like my background in dealing
with Pam was really driven from kind of a human standpoint where
you had like core admin accounts, ROU accounts, service
accounts, right, that I needed to operate, you know, your your
infrastructure, your software, you know, So the definition we
gave on NHIS, but usually the Pam element there was around
humans and controlling people that needed to elevate their
privileges, right to impersonate pseudo become that account, you
know, to maybe deploy the software or maybe when there's a
support issue, go in and, you know, become that account so
they could then deal with support issues.
So yes, it was there to protect kind of your keys to your
Kingdom, like your most privileged accounts.
But I think non human identities are much, much poorer than just
Pam, right. I think you know, like, you
know, if an application's got an account that it uses to connect
to a database, is that a privileged account that's really
just an account that that process needs to operate and
communicate with other services. Yes, it has privileges, but is
it a privileged account like in the traditional Pam sense?
I'm not sure it is. But yes, the the the the idea of
what Pam tools did, you could argue could cater for some of
the life cycle processes for an NHI.
But you know, again, like take a vote like Hashi, all they do is
capture the secrets, right? They don't deal with the life
cycle processes. They don't natively deal with
cycling or scanning or inventory or ownership.
So many of these existing tool sets only deal with a really
small part of the overall life cycle of Nhis.
Yeah. And I think that's go ahead,
Jeff. I say.
So I think the the important distinction here then is the
first word of Pam privileged, Does privilege connotate non
human identity? And then does non human identity
equate to privileged? Right.
I think that's kind of what I got from your answer was not
every, not everything is equal. You can have a non privileged
non human identity. I'm kind of thinking about what
maybe you can give me an example of what that might look like.
Because if I think of non human identity, I'm thinking of
something that's sitting behind the scenes.
It's a service account, it's a script, it's an API.
It's, you know, some sort of thing that is accessing a data
or a resource. And you know, I guess maybe it's
like what the cafeteria menu or or something like that.
I don't know what would be an example of a non human identity
that is not privileged. Well, I think every non human
identity will have privileges, you know, permissions, you know,
to whatever identity it needs to operate.
But I guess the privilege when I when I think of the Pam, it's
really, you know, where you're trying to elevate and you know,
get sort of higher privileges and what you had today as a
human right to perform some elevated role from your basic
credentials as you know, a human identity.
So I, my always view of Pam was around how you elevated, you
know, the human use case to, to, to, to get access to those non
human identities versus Pam being the, the, the thing that
managed everything, every NHI that's out there.
I'm not sure I've quite answered your question.
Well, I like how this I like how this conversation is going,
because I think we've as least privileged people as identity
people, lifers, if you will, we want everything to be done
great, But we know that the reality is that we have to take
some kind of a risk based approach.
And so it's all about setting priorities.
I was going to ask the question a more, you know, from the
beginning, like a huge elephant. I mean, when you talk about non
human identities and you talk about the the pure scale, even
in like a small to mid sized organization, we talk about a
large enterprise. You could be talking about
literally millions of identities.
How do you wrap your arms around that?
Where do you start? And I think it's got to be based
on risk you got to look for. And so when we talk about
privilege, I mean, of course, like every account has some
privileges, but we've got to go for those ones where it's like,
oh, that's. That's one or maybe it's the
type of an account where like, hey, if these got compromised in
our Active Directory, what? And like, I'm sure there's some
people out there scoffing at the Active Directory, but normally
when companies get completely ransomware and completely shut
down, it's because the hackers got the Active Directory.
They have control of the Active Directory and they can basically
turn off your business and make it so you, you know, your e-mail
doesn't work, People can't log into their laptops, can't get to
their files. I'm sorry, that's lights out.
And so whether or not you like Active Directory, hear me out.
Those kind of accounts have got to be like at the, the top of
your pecking order. And then I think it would be
applications that are, you know, the quarter of your business.
So do you agree that like that's how you go about prioritizing?
And I'm, I'm assume whether you agree or disagree, how do you
then choose your technology stack to solve that?
Because to your point earlier about Hashi, great, great vault
technology and maybe that, you know, you say I'm going to take
on risk #1 and that's what I need.
But then you can't be doing that evaluation each time you go.
Like what is your technology approach to make sure that you
have the right number and the right strategic alignment of
technologies in your portfolio so that you can manage your NHI
problem? Hey, look, it's a great
question. I get to ask this a lot and I
recently talked about this at AIC and next week I'll be doing
a seminar talk at Identiverse, A practitioner's guide to NHIS.
So look, when I ran my last NHI programme at a large investment
bank, you know, we took took step back first and took a
holistic approach and clearly our mantra was you're going to
take your risk based approach. You can't tackle the elephant in
the room. So some of the things Jim you've
talked about you have to look at where are your clearly your
highest risks. So you have to go after your
most privileged, you know, accounts like your admin
accounts, your domain controllers, you know, etcetera,
your root accounts on servers, databases.
And you know, the other thing you're going to need to do is
look at what controls you have around those accounts per
platform. Now, you may have interactive
logins enabled on your Windows service accounts, which we all
know is really, really bad, right?
So you can then interactively get in and start to become that
account, sort of. There's lots.
You do first need to understand what your control maturity looks
like. You know, where do you have
strong controls or processes? And maybe you know, your Linux
state might be very well secure because you don't have
interactive logins. No one knows the password for
any of the counts, but your Windows ADS, right, where
everybody knows the passwords and never cycled and they're
interactive, right? So you know, you need to
understand kind of your control levels across your tech stack.
You clearly need to go for your highest risk accounts, right?
You need to look at things like lateral movement, right?
Because typically folks will first find some non prod
environment and then laterally move.
You know, we see a lot of service accounts that don't have
environment segregation and that applies to any NHIS where the
same account has access to prod and non prod.
So once you're in, you can laterally move.
So you really need to understand all your controls and then come
up with more of a holistic approach of how you're going to,
you know, go for, you know, the areas that have got the biggest
risk exposures. Like at a previous org, we felt
the database estate was our biggest risk, right?
Because you can't turn off interactive logins there.
As long as you know the credential, the password, you
can log in and you know, you know, you can do anything once
you're once you're in. And then there's a lack of
monitoring of what you're doing. The other thing I think is
really important that people forget is you've got to really
look at this top town from a management standpoint.
Look at kind of your policies, your standards, your controls,
and make sure you educate folks. And look, you may not have all
the best tech stack out there. You may not even have a vault,
you may not have scanning in place, but you need to let
people know. Look, security first development
is the way to go, right? They have SEC OPS.
And while some of the automation through your CICD pipelines and
integration to your vaults and other controls may come over
time, they need to know that this stuff is unacceptable,
right? So we're checking in hard coded
credentials into source code. And you know, they need to
realise that our previous org, you know, we basically said to
folks, if you continue to repeat the mistakes of the past, you
know, you will be disciplined and even, you know, lose your
job. So we had those things top down.
Education training is really, really important.
And then it's about defining controls.
Like what is the bar that people need to adhere to?
You know, it was shocking. At a previous org, there was no
requirement to cycle passwords for NHIS.
As long as the password was 15 characters in length and
complex, that was it. No requirement to cycle.
And a regulator comes in and says, do you cycle passwords?
No bang, huge regulatory point. So you have to start with the
basics and to a point, Jim, you made earlier, a lot of the
controls are very similar from a human standpoint as well around,
you know, the life cycle processes, what is the way you
provision? How do you deal with the
provisioning? So always focus on the basics.
Make sure you've got the basic control processes in place and
then people process technology. Continue to mature out your
processes and then continue to mature out your tech stack.
And it may mean then you buy a solution and it may mean you
supplement your existing IGA products and Pam products or do
something in the middle, right? It really depends where you are
in your organization and the complexity of your environment.
So, you know, I think with anything, it's just start with
the basics first, right? The fundamentals.
I love the idea of the basics because it gets overlooked so
often. And it's, you know, the
fundamentals need to be there. You want to build on a solid
foundation. And if you skip that step,
you're probably going to have a bad time down the road.
And you can't just buy a product and say, well, this is going to
solve my problems. You know, there's a lot of, you
know, governance and the people in the process that go along
with that to actually address the issue.
I mean, I'll give you a great example.
Hashi, right? We used some of the previous
organization. Yes, you can put passwords into
a vault for service account and any other kind of NHIS, right?
But if you don't think about when you onboard that to the
vault, if you don't set up the right metadata, what is the
account name? Where is it used?
What database or server is it used on?
If you don't provide that metadata, I mean just Chuck in
the password and give it A tag like password 1, password 2 when
you don't need to move on to cycling.
Oh, I've got something in a vault, you know, I know the
password, but I've got no idea what it is that it's actually a
database account on server XYZ, right?
So again, you've really got to plan this stuff end to end.
And maybe some of this stuff is basic.
You think you would do that, but you won't believe the number of
groups that have just chucked stuff into a vault without
having proper metadata when it's really burnt them, you know,
later on. So you really need to think
about this from a strategy and architecture standpoint and
design your whole solution around NHIS end to end is is
what we would recommend. So why don't I ask you a little
bit of a deep question and then we'll end on a lighter note to
kind of get us out of the deep water.
And here's my deep question. Is there anything that scares
you about NHI? Look everything excuse me about
NHI. That's why anything that doesn't
I'm. Doing.
How about that? Maybe that's a better way to do
it. Look, but the problem that
scares me is, you know, the fact that this problem has been there
for 2530 years, ever since computers existed.
And we haven't really moved the needle that much, right?
And it's only really been in the last few years where some of the
vendors and the focus from everyone has been in the space.
And yes, there's vendors that deal with governance and posture
management. How do we deal with kind of zero
trust based architectures? You know, there's a lot of good
standards, spy, spy whimsy that are coming, right, that are
helping define how you can build kind of scalable workload
dynamic based kind of architectures for managing your
workloads and follow zero trust principles.
But all that stuff is still not baked.
But I think the one thing that's really scary, right, is kind of
obviously you're probably going to guess what I'm going to say
like a gentic AI and, and the ramifications for NHIS, given
that they're so weakly managed already, right?
So if you continue to use the same processes for your gentic
AI, they're probably going to be even more privileged, right,
than regular Nhis that are used. And as they become
interconnected and can elevate their privileges dynamically, if
you don't apply, you know, sort of strong zero trust privileges
around that, it's scary what could happen, right, with people
compromising AI agents, which obviously under the covers using
NHIS. So I think we've got a long way
to go that the agentic AI stuff is just moving so fast.
But I just don't think at the moment we've got the right
controls and solutions to solve NHIS fundamentally anywhere at
the moment, let alone, you know, the fast moving pace of agentic
AI. So that probably the thing that
worries me the most and probably is the most hotly discussed
topic at the moment in the kind of agentic AI and NHI space.
I mean, I can see a, a, you know, a scenario say, well, we
just built an agentic AI product to solve our agentic AI product.
OK, so you know, we're in this, you know, dog chasing its tail
type of scenario. I don't know.
All right, let's shift to a little bit wider note because I
know that's if for people who aren't watching this on YouTube,
you have a very impressive vinyl collection behind you of I don't
know how many thousands of records you might have.
First of all, let's talk there. How many, how much do you have
behind you? Let's start there.
I guess I've been collecting vinyls since I was a student at
university, so that's over 30 years.
So you can probably guess my age now.
But yeah, I've probably got somewhere in the region of about
2000 kind of LP's, 12 inch records.
So it's been a lifelong ambition to grow my collection.
It's all soul, swing, sort of hip hop, R&B.
The genres mainly in the sort of 70s, eighties, 90s kind of is
where most of my collection comes from.
I feel like vinyl's having a little bit of a resurgence here
the last, you know, few years, but it seems like it kind of
went away when C DS and, you know, the laser discs I think
were were part of that as well. But was there a lull in that
collection where it's like, man, it's just getting harder to
find, you know, modern artists putting out their content on
that format of vinyl? Yeah, good question.
I've not really been buying a lot of newer stuff.
It's mainly in that sort of 70s to 90s kind of era.
I did probably stop buying stuff for quite a few years as I was
working in investment banking. But then as kind of the last few
years, I started to grow my collection again and bought a
lot from, you know, the collectors on eBay.
And there's a great story where I ordered a batch of albums from
someone that I got to know very well.
And I was just going through them cleaning some of the
records, record cleaner and out popped out about 150 lbs in
very, very old British notes. So I went told the guy that I
purchased them, that I found this money in his in one of his
record sleeves. I went to the bank, got the
money converted because it was not legal tender anymore and
send the money back to him. So maybe tells you a little bit
about me that what I'm like if I'm in that kind of dilemma that
I would definitely give the money back to the the rightful
owner. But that was a big shock to find
money. And apparently he does quite a
lot hides money in his. He has 10,000 plus record
collection. So you might start buying more
albums from him and then any more money in all the secret
stashes. Now, yeah, I guess I probably
need to go through my 2000 now and see if there's any more I
can find in there. You never know, there might be a
few more looking out there. So of that 2000, I'm going to
ask you to pick your first what, what's the one that you remember
first getting? What's your best album or record
or vinyl, I guess? And then what's your favorite
one out of that set? Yeah, I'm not sure I can
remember my the first one, but it would probably be something
like Luther Vandross, Freddie Jackson, Marvin Gaye, probably
something in that kind of sort of era.
I think in terms of like kind of my most cherished kind of
favorite album for 12 inch is probably from a British band
called Loose Ends. Have a lot of great records out
there. And I had the fortune to sort of
see them play in a bar a couple of years ago and a big fanatic
of their music. I took all my kind of albums,
LP's with me and I was waving them around on the dance floor.
And then at the end of the night the bands, I said look, come and
join us. And then they signed all my my
albums, both on the outside and the inside.
So that was a real special moment for me.
So what was the other question you've asked her?
Is there a best 1? And I guess maybe best not the
same as favorite bike? Do you have something that's
like, oh this is a real find in in the space of vinyl?
I don't know if it's something rare maybe or something has a
lot of value other than sentimental.
There was one tune by a singer called Tammy Payne, and she
sings a song called Free that probably very few people have
heard, but it's just one of those classic sort of soul
songs. That first time I heard it, I
just felt I've got to have this and it's always been in my top
five. And it took me a year to sort of
source this when I was at university and as a kind of poor
student, I think I paid about 3040 lbs for it, which was a lot
of money in in those days for just one record, but it was from
a specialist kind of reseller. And then a few weeks later, I'm
rumbling through a sort of a record shop and I found another
copy of this same thing that I paid 3040 lbs for.
And it was on for like 50 P or a pound.
So I was guided that, you know, just in a week I played over the
odds. But you know, but that's the one
I probably cherish the most because it was the one I wanted
to to get for a very, very long time.
And it took me ages to find. But then I found two quick
succession. So you have one for playing and
then one for like display or you know, keeping, right?
Jim, I want to pay it over to you.
What is your first, best and favorite album?
I guess I'm not sure I know. I'm pretty sure you don't click
vinyl, but give me a first, best and favorite.
So I'm going to mention three and interestingly none of them
were vinyl. So the first one was 8 tracks.
And so get this, I don't know if you remember, but in the 80s,
early 80s to put in magazines, Columbia Records would put these
inserts where you can tape a penny to It was like a postcard
and mark off a bunch of albums that you wanted and you get them
in a track format or vinyl format.
So I ordered like, I forget it. I think it was like 6 for a
penny. I thought, look, this the best
bargain ever. I was like 6 years old and I got
Devo. You remember that song Whip it?
I got Michael Jackson, Thriller, and I got Led Zeppelin 4,
Stairway to Heaven and I loved it.
My mom was not happy because then she had to buy like 5 more
albums at full price, which I think was like $30.00 an album.
So anyway, yeah that was a funny story.
So that's first I think best I'm going to say.
So I had, you know, I was into hip hop music before they even
called it hip hop music. It was Beastie Boys licensed to
ILL on cassette. I played that thing and flipped
over my tape deck so many times that all of the ink on it was
worn off. So I mean, it must have played
that so many times. I think eventually the cassette
player ate the tape. Remember, that used to happen,
like, get garbled up. And then as far as favorite, I
think I'm going to go to my college days on CD.
I'm going to pick Pearl Jam 10 because I must have played that
a million times. And that was such like an anthem
of that grunge era. And I've loved music ever since.
And I've had other things. But those three events stick out
in my mind as first, best, favorite.
Jeff, your turn. Well, those are good ones and,
and I got into music probably much later than both of you.
I don't think I got my first album until I was probably
either senior in high school or just out of high school.
I just, it wasn't a thing that I did, but I very remember, very
much remember getting CDs. That's how I started.
I I mean, I had cassettes and stuff like that, but it was all
just like, you know, you'd tape it off the radio, you know, that
kind of thing. But the first C DS I bought were
two. It was Offspring, the smash
album and Green Day's Dookie album.
Those are the first two things that I ever bought.
So that's the first. Let's see.
The best is probably a box set from Metallica called Live Blank
Binge and Purge. And they had a double CD of a,
of a live show that they did. I think it was in Mexico.
It had a video performance. Yeah.
Just a great, just a great thing.
But it was like a full box set and it had like a, you know,
chest or whatever. And I don't know if I
necessarily have a favorite album.
I feel like there's so many good ones out there.
And my listening patterns have changed into more of a hunt and
Peck. You know, pick one song from
this artist and then go to this other song from another artist.
There's a lot of really good albums.
But you know, maybe it's actually, you know, maybe I'm
going to go with Korn. I love the Untouchables album.
I think it's fantastic. So I'm going to I'm going to go
with that as my final answer. Jim Korn.
You are a hard rocker, man. I got to give you that.
Give that to your three choices. We're all basically heavy metal.
It was a choice between, you know, rock.
There's some electronic albums I like too.
But yeah, I just remember playing the Untouchables album
over and over and over and over again in the car.
And, you know, that was on my, I think at the time I had like one
of those CD discman things, right, that you'd have in your
car and use the cassette tape adapter to get it into your
stereo and, you know, all that good stuff.
But I don't know allow it does does any of the stuff.
Just a final joke. Yeah, Yeah, I was just about to
say those are a set of non human identities that I don't
recognize and have not discovered.
You could argue, you could argue that all those things, vinyl, CD
are all potentially non human identities as well.
Identity, right? They won't have a code.
So. We got to hit stop and record a
new one where we argue about that for the next half hour.
But we want to establish provenance, right?
It's like also the same thing too.
It's like, what is the the provenance of this album?
Is it legit? Is it, I mean, at some point
it's going to be is this AI or is this X band right doing the
real thing? So that'll be interesting when
we start talking about non human identities for non human
identities. All right, this has been in just
a fascinating conversation. All that.
I'm glad you were able to get you onto the show.
I feel like kind of finally this happened.
So that's great. I'm looking forward to seeing
you on Identiverse next week. And for the time, people of
times listen this, you know, your workshop will have been
overdone have been done at that point.
So would encourage people to go check out the Identiverse.
I think things are going to be recorded.
I'm not sure if your workshop is going to be well let.
Do you know if that's if that's the case?
Yeah, workshop will be recorded, but the pavilion sessions won't.
But yeah, I'm looking forward to seeing you both there with some
crazy things that you're going to do at the Pavilion and
looking forward to spending some time with you next week.
Yeah, that's going to be a lot of fun.
So we'll go ahead and wrap it up for this week.
I'll have links in our show notes to while it's a LinkedIn
page, as well as the non human identity management group and
HIM g.org. You go check out there For more
information, which has a lot of good content.
So, you know, hats off to you for a while for really kind of
spearheading this and and taking the mantle of of Mr. Nhi.
So I'm not sure what the next step is past Mr. Would it be?
Do we just go to different languages like Senor NHI?
Do we go to like professor or doctor like have you?
Do you have a graduation strategy for Mr. NHI?
Someone's already started to call me the father of NHI and
then the Godfather of NHI, so maybe that's the natural
evolution. Godfather sounds nice.
I meant to ask, when you were in Germany, were you hair NHI?
No, that didn't come up, thankfully.
All right, next time. Well, thank you so much for
being with us here and yeah, spending your time and, and
helping us understand the space a little bit more.
We'll go ahead and wrap for this week.
You can find us on the web, IDC, podcast.com.
Do all the things that Jim asked you to do earlier in the
episode, like subscribe, share with your friends, share with
your enemies, share with your agentic AII don't care.
As long as people listen, that's all that matters.
So with that, thanks for watching and or listening and
we'll talk with you all in the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review, and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com.
See you next time on Identity at the Center.