Transcript
in terms of doing the essentials, doing the basics of cybersecurity being so vitally important in everything we do, but no more so than when we're talking about identity, because identity ironically has always been the center of everything we do in IT. It's just been a really difficult thing for us to cope with, so it's only now that this is beginning to coalesce into a kind of a singular activity. Now I've obviously lured you here with a title about weaving an identity fabric for today and tomorrow, and I really want to talk about some of the principles of really why we would do that and what we need out of it, and we start with that simple question, which is why do we need an identity fabric within our environments, and I think it's really simple and it comes back to some of those kind of basic things at the end of the day. Identity is critical to everything we do in our day-to-day operation as cybersecurity professionals, but the world in which we do it has continued to evolve. For many of us, we started probably in organizations with a relatively small number of people, and we had a relatively small number of identities to deal with. Hard though it may be to believe, I can remember back, my first computer didn't actually have a network connection. It didn't actually have a login because I was the only one at my desk, but these days, we've got a few more identities to deal with on a day-to-day basis, and this is just thinking about the human ones to start with. The non-human ones take us in a much more accelerated way towards massive, unimaginable numbers of identities existing within our environments, and our environments have changed as well. Again, for many of us, we can go back far enough, environments were relatively small. They were relatively simple. They were quite homely. I mean, I love this office. I'd love to work in this office. It looks really, really nice, but our infrastructure has grown quite dramatically, and obviously is a metaphor, but we are now dealing with metropolises. We went from almost single offices, not even towns or villages. We went from that to this now. There are so many systems. There are so many identities, and that leads to a situation of ever-increasing complexity, and it's interesting because complexity, while we always think of it as being complex, it's actually the simple thing because if you don't plan well and if you don't structure your cybersecurity strategies, if you don't get the basics right first, complexity is inevitable. I've often used the paradigm of walking into a boardroom and thinking of the big boardroom table as the attack surface of the organisation, and I have a sheaf of papers, a collection of papers in my hand, and each one represents one of the tools in a large organisation that they might use in their environment, and if you throw them onto the desk, and they all scatter around, that's a pretty good representation of most people's coverage of their attack surface. There will be bits of paper laying on top of each other. There will be some slightly overlapping, but on the whole, there will be big gaps on the table because it's really hard for us to see what we're doing in the full picture, and so that's the complexity that comes out of us not really getting the forward traction we need in our planning. Some of that is driven by what I think is sometimes a misunderstanding of what our role for cybersecurity is within our organisations. We get hung up in the technology. We get hung up in the new shiny thing that's available, and we forget those basics, but this is what our job is. It's no more complicated or advanced than that. Our job as cybersecurity environments is to allow our company of people to continue to do business safely and securely because none of us want to be the one on the front page of the newspapers or on the news articles on television or streaming services who've been breached. We want to keep doing business. Some of that also comes from the way we talk about these things, and there's two phrases that I kind of think are actually better names for what we do than cybersecurity, and those are business continuity and business resilience, and this is about changing how we talk to our businesses about what we do. We talk in their terms. Business continuity, good cybersecurity defends against the attack. It allows the business to keep moving forwards, to keep generating revenue. Business resilience, good cybersecurity, again, when it's done well with those foundational elements will also provide mechanisms to recover quickly, to contain breaches so we can recover quickly as well, but when we start talking in those terms to our businesses themselves, we actually get better engagement for them. You're more likely to get your funding, those sorts of things, because we are giving them information the way they want to consume it, so that's kind of why we need an identity fabric in a way. We need to be able to reflect that what we're protecting is actually enabling the organization to continue moving forwards, because I don't really mind which report you look at. When you actually dig into the attack chain for most breaches, you have a vulnerability, human or technical. You have a look for privileged elevation so you can move laterally across the environment. That privilege elevation invariably comes from some kind of identity breach. That initial human vulnerability is often an identity breach, and identity is the key place in which most breaches start, and certainly in those that grow. What do we need in an identity fabric? Now, I played a little bit earlier with the term of complexity, and now I'm going to go to the other end of the scale. This is one of my favorite quotes in the world, and it goes all the way back to 1987 when I first started in the industry. I had the first PC on my desk, and I wondered why it came with a 600-page manual, because it's just a tool at the end of the day, and no hammer I've ever bought comes with a big manual. It needs to be simpler, so simplicity is something that we need out of any identity fabric. We need this thing, this thing we're building to kind of take all of that massive data, that tsunami you encounter every time you come into your offices, and boil it down into something that's actually consumable, something you can make good decisions quickly from. Now, getting to simple is the key thing that Steve kind of puts out in this quote. It's really, really hard to sit down and go through all of your company needs, your business requirements, and boil the whole model down into something you can then build up from in a very simple way. It's really easy when we're doing requirements gathering to throw it out to all of the stakeholders and say, give me your requirements, put it into a nice big list, and ship it out to the vendors and say this is what we want, but the truth of the matter is there's probably five per cent of that that actually is business need. The rest of it is wants that people would like to see in an environment. Need is where the value is to your business. That's where you're going to find the money to actually buy these things, so it's important that you boil these down. I absolutely agree here with Steve that when you do get to simple, you really can move mountains, but it is really hard work, and you have to stick with it. It really comes down to making sure we understand where we're working, what we're trying to do, and what our world looks like. Here we have our world, and those eagle-eyed among you will be able to see the tiny red pin in the middle there, which is right here, right now, because this is the centre of our world today, but we're here because this is actually the centre of our world. It's an identity conference, and identity, as I said at the beginning, is being recognised now as the centre of cyber security. I love Zero Trust. I think it's one of the most practicable and sensible approaches to cyber security I've seen in years, and it relies on the fact that identity is valid, and is properly authorised. That is obviously core to what we're trying to do. We're trying to make sure that the IDP is valid. It really should be called One Trust because, at the end of the day, you have to trust the IDP. Now, an identity by itself does nothing. Doesn't matter which way you look at it, it's useless, unless you do something with it. There are only two things you do with identities in this world. We manage them. The life cycle, so join, move, leave, birth, life, death, whatever set of terms you want to use for that. They come into your organisation, they move around in your organisation, and they leave your organisation. We need to make sure that we have good structures around how that identity is managed. The only other thing we do with identity is we provide access controls from it, because, really, that's the only purpose of your identity, and I'm being kind of flippant here, but it doesn't matter whether we're talking digital or physical. I used my passport to get through border control to come into Germany. That proved my identity. That gave me access into the country. For those of you who live locally or in Europe, you will probably use your credit card to buy a train ticket or put fuel in your car. That credit card validated your identity to provide access to your funds. Identity at every stage just provides access into something. You log into your workstation. It gives you access to your workstation. If it's a network login, it gets you some access into other things, systems beyond it. This is boiling down the problem into the very simplest form. That's IAM. I would challenge anyone here who can think of something in the IAM sphere that doesn't actually fit into this. We need some mechanisms around this, so we need some mechanism for being able to grant those accesses into the environment. Now, across the IAM space, there are lots of different terms for this piece. IGA, I think, frames it best in terms of entitlements. Every access you grant is an entitlement that you give to a user. We simplify the message. We're only dealing with entitlements. It doesn't matter if I'm talking PAM, if I'm talking IAM, if I'm talking end-point privilege management, if I'm talking directory access, whatever it is. It's an entitlement that I've given. I will call out one particular type of access management. I spent a lot of time over the past two years actually trying to call this impersonation rather than privileged access because I didn't want it to be different to access management. The only difference between using a normal access management system and privileged access, in my experience, is that, when I access Salesforce through our access management system, I'm Brian. When I go to that server to administer it, I might be admin, or I might be some other user who has the necessary privilege to gain access to what I need. I'm just being somebody else. It is impersonation. It is just access management at the end of the day, and the more we try and push those things apart, the more work we give ourselves in trying to manage it, especially as non-human identities begin to grow. That piece at the top would pretty much encompass most of what you're doing, but simplifying the message helps a lot. The last piece, to wrap this in and actually really put it in a nutshell, is to put the risk and compliance and governance around it. We need that for both the identity management and we need it for the access management, not only in how it's provisioned but also in how it's used. Again, I come back to this as a simple piece. That's IAM at the end of the day. This is your identity fabric. This is what you're trying to build, and you're trying to fit all of your use cases into this space, and it is possible. That's something I'd like you to have as a takeaway from this. But what does this look like in reality? As I build this out, you're going to feel that this looks like a slide you would have seen yesterday if you were in the talks about identity fabric. We have the users who need to access this. We have our human persons. That's the legal term for all of you good people here today. You are the legal persons. We have our non-human identities. Those are the machines, the incredibly rapidly growing sphere of machine identities that exist out there. What we need our identity fabric to provide us is what I'm terming capabilities. I don't want to think of them as modules. Modules is a terrible word. It's very boring. It's about what we need to do. If we think about the action, about the activity, the capabilities. So we have identity management, and you'll see here there's a few things in terms of capabilities for identity management that we would expect our identity fabric to provide for us. This is not an exhaustive list. Access management, and I've said including PAM just because it's a term we're so familiar with, but it's all access management. Here are a few of the things. This is not an exhaustive list. You'll get to feel that this is something I'm being repetitive about. And governance. Again, here are some of the things that we might do for governance, and again, it's not an exhaustive list. I'm not going to ask for audience participation on that. I think it's a little early for that, and the coffee is only just starting to kick in. We need some mechanism to access it, so a UI, an API. Users could use the AI. Non-human users could use the UI. They could both use the API. It really doesn't matter. It's just a mechanism that's unified across all of those capabilities, a singular kind of approach to it. And the capabilities themselves are the front ends. What makes an identity fabric different in reality is that the services that sit under it that turn it into a unified environment are all the same for all of the systems. There's an ellipsis at the bottom of that list because this is not a complete list. This is just the things that I'm currently looking at at the moment. But simple things like configuration, compliance, and reporting, those need to be the same across your identity environment because it's all in that one circular diagram I just showed you at the end of the day. That's what you're looking for, trying to build as far as you can. And obviously, all of those things provide you with the access into the end systems that you're actually controlling, both for their access to you and for your access to them. Now, this looks very much like Martin Köppinger's diagram of the identity fabric. Some of the columns are shuffled around to make a bit more sense for me from a vendor perspective. But that's how it looks. Now, I'm getting a bit short on time because I do like to talk. As one identity, obviously, as a vendor, we have a portfolio that can address the majority of what you need from an identity fabric to start with. And I put this up there more to show you the kinds of tooling that would be involved. There's an IGA layer across above the directories you have there. One login is an access management platform. You have your privileged access management with the safeguard privileged access and the endpoint privileged management. And then one of the things that I think gets overlooked a little bit in many environments, certainly the heterogeneous ones, is the use of directory accounts on everything you have in your environment. One directory account. I had the privilege of working for GlaxoSmithKline for many years. I left for 15 months, and when I came back, 6 out of my 7 privileged accounts still existed and were still available to me because they were on NIS, NIS+, and LDAP directories that our HR department didn't know about. So having a singular directory, an active directory, because that was the only one that got disabled, enables you to simplify your security model dramatically. And I would give that as another takeaway. Any time you're looking at a new tool, if it doesn't simplify your security model, look for something else. That's the purpose of these tools, and that's the purpose of Identity Fabric. We've been building an Identity Fabric. We started last year with what we call PAM Essentials, which is really the basics. Session access into your environment, management of the passwords, reporting, control, that kind of thing. We're adding some more stuff to that in the next year or so. We have Identity Essentials coming this year, which is really about ensuring you've got fine-grained access into the directories themselves, so only the right people have the ability to get to that most important thing in your environment, your directory. That's where all of your accounts are. We're adding some more to that as the next year or so comes. We're adding endpoint management to it. We're adding directory bridge now, not just active directory, any directory. This thing will talk to just about any directory you want, and we bring our access management into it. This is a product that we'll be launching later this year, which we call the One Identity Fabric. Stolen, absolutely. I told Martin Kupinger about it. He smiled wryly at me, and I'm very pleased about that. But it just makes sense. That's what we want and what we need. You can build one. We're building one that hopefully will help. Just a few things I want to finish up with with how important the things are. We need this to be powerful. We need it to be flexible, and you need it to be resilient. Those are three key things I would say you want to focus on when you're thinking about this. Lastly, simple. Don't forget simple. Always strive to keep it as simple as you possibly can. It will pay you dividends in the future. The moment you start down that complexity route, when you start building an identity fabric, you will fail. You will end up with something that is difficult to manage, and that just defeats the object. What I want you to do when you've finished building your identity fabric is I want you to feel satisfied. With my last slide, I stole a bit of video from a bunch of special effects guys who occasionally produce these videos where they try to produce the most satisfying render that just gives you that kind of mmm feeling. This hopefully will work and will leave you for the day with a very satisfying kind of feel. It's so simple, but when that just bounces down, that noise, I just kind of go, oh, man, I want my day to work like this. These things just drop into place, and my identity fabric builds itself. So with that, I'm going to say thank you, ladies and gentlemen. I really hope you enjoy the rest of the conference. Thank you. Thanks so much, Brian. Keep it simple, stupid is kind of one of my favorite sayings. Absolutely. I loved your example of the boardroom table, though, because I think that's a lovely image to an analogy to kind of describe how the coverage of many organizations are. I also like your focus on resilience, because we're keeping a cull. Obviously, resilience is one of the things we look at mostly. Just one strange question from the audience. Do you think 1IM as a product is simple? That's a really good question, and obviously from one of our users, 1IM is 1 Identity Manager is our IGA product, and it can be simple is the answer to that one. It's an incredible toolkit that really allows you to build what you want and what you need from your IGA solution. So if you keep your thinking simple and you build it simply, yes, it can be simple, but just like any good, powerful tool, and there are many in this space, it can be complicated if you don't plan well. And as a veteran as you are in the industry, I mean, we've been talking about technology, but we know that it's not about technology only. It's about people process. So what is the kind of thing that you would recommend, how you deal with the challenges of the internal resistance to, you know, it's all very well to say, okay, there's this identity fabric thing. We're going to have to make a couple of changes. Whenever you mention the word change, everyone goes, oh, no, not another change. So how do you kind of navigate that internal resistance to switching to kind of a new paradigm? Yeah, no, absolutely. I mean, it's difficult with everything you do, and I would say it's about making sure that when you start down that route, you properly understand what the needs of your business are and the benefits to your business of bringing this new thing on board. Then you can articulate that to your teams, finding champions within your organization to help keep that flow going because the grapevine will change the story as soon as you stop talking about it. But the more we can get those people to help push that message on, it's about benefit to the users. You know, I go back to when I first started with PAM, and it was very easy for, you know, admins to go, I don't want to give up my admin rights because I need it to do my job. But the tools actually help you by taking responsibility away. It means you still get your accesses, you still get to be productive, but you don't carry those responsibilities anymore, and neither should you. And so the same with all of the identities that exist in your environment. Let's make sure they're under the right controls. Everybody knows where they are, and that should help. Some great advice. Thank you. Thank you.
