EP218 IAM in the Cloud & AI Era: Navigating Evolution, Challenges, and the Rise of ITDR/ISPM

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Risk Analytics in Google CycOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we are talking about one of my favorite topics today, ITDR, XDR, and analysts. Oh shit, that's 3 of my favorite topics. Sorry, I can't count.

No, no, no, no. XDR was not officially on the roster. XDR snuck in.

It snuck in.

I tried to kick it out like a little rat, but ultimately we failed. And the thing just like— the thing is stuck with us for the show. So I wouldn't call it officially an XDR episode.

It's not an XDR episode. It's an identity episode.

It's an identity episode, but it does feature more analysts, more ex-analysts than PMs on this show.

I was outnumbered today.

Yes.

And it also had people who created acronyms and lived to tell the tale.

And it features a story, listeners, about an acronym which did not come to be thanks to me noticing something our branding person missed. did not. So maybe with that teaser, let's turn things over to today's guest. I am delighted to introduce today's guest. Today we are joined— well, I say delighted, but wait for it. Today we're joined by Henrique Teixeira, Senior Vice President of Strategy at Savant. And unfortunately, listeners, today I am outnumbered. We have 2 former Gartner analysts on the call with us.

I think it's a good thing. So much more insight.

Yeah. Oh, so much more insight. Listeners, let us know in the comments if we got more or less insight than usual. Thanks to our Gartner analyst stacking. So I want to kick off with IAM. And how have you seen IAM evolve over the years, especially with the shift to the cloud? And to me, this question is kind of funny because in my mind, IAM is cloud, but I am dimly aware that IAM does in fact predate cloud. So tell us about how it's evolved.

Hey, Timothy, that's basically the story of my life. And just not to date how old I am, but no, identity has been around for a while. And as a matter of fact, the password was invented, I think, in 1961 by an MIT professor. So as long as there was an identity, there were passwords. So it is as old as that. But the way I summarize the evolution of the whole thing into a market, if we look in the '80s, right, we had mainframes and all those passwords within Rockef, ACF2, top secret. They were centralized in a single place. And then in the '80s happened what happened, the decentralized compute revolution with PCs and all that. So instead of having one central place for passwords, you have like hundreds, thousands. So the first identity management, user provisioning type of solutions started back then in the '80s just to recreate that facility of spreading out and keeping those passwords in sync and lifecycle. What's interesting then, 20 years after that, around 1990—

What year is that? What year is that? At this point, I'm like, my '90s jokes are way outnumbered.

Yeah. Okay.

2000.

1980. I'm talking about the year 2000, right? The bug of the millennium. So, year 2000, a couple of funny things happened. Number one, Salesforce was invented. It was the first SaaS company. 2002, it was AWS, I think. So, the first infrastructure as a service as we know it. was around the year 2000, at the same time that Enron— if you guys remember Enron, they decided to commit fraud.

Okay. Please help us understand the connection between IAM and Enron.

Yeah.

I was, like, so much asking the same question.

But with all this thing that happened with Enron was they created the law. Sarbanes-Oxley was created because of that. So, and with that, all these lifecycle management tools, provisioning tools, they evolved into what they call we call today IGA, identity governance, to help with compliance with SOX and other regulations. So Tim, fast-forward 20 years after that, and we have around the year 2020. What happened then? We are right after COVID. We had perhaps the biggest hit on breaches. They are now identity-generated. So we saw this inflection of, identity threats becoming top of mind. So from the very early beginnings in the '80s, from the 2020, 2022, we have that. And it's always conflating with something, right? 2022, there was also another very funny shift, which was AI with ChatGPT. ChatGPT came. So everything is new again for us. So we had the mainframes, decentralized systems, we have the cloud, and we have AI coming up as this new wave. So it's just to tell identity was always present throughout there to the millennia, if you will. But that's why I joke sometimes, and that's how I introduce myself and how we describe that. I describe myself, Tim, as pretty useless.

Me too.

Not how my wife describes me, but useless outside of identity. I've never done anything else, so I'm pretty useless if you talk to me about firewalls or anything else. I just did that. as a profession, and this thing kept moving, which was so interesting, so exciting for me to be here.

Well, I love this I am answer because it literally started the year of my father's birth. So that's how old passwords are, listeners. They're as old as Tim's dad. Anton, you've got a question you want to ask here, and I love this question.

Yeah. The thing is that we have a secret we know about Enrique, and that the secret is he invented the term ITDR.

Do we know his password?

No, no, no. I don't know his password, but I do know that he invented the term ITDR. And I remember when I— I think I read his Gartner piece at the time when he introduced it. I was really quite unhappy about it. And I felt like this is— and, you know, as a person who kind of invented EDR, I should be supportive of everybody inventing something DR. But this particular DR just triggered me the wrong way. And I was, like, agitated, and I wanted to write some kind of a blog criticizing this. And of course, I thought better of this because, like, why do that? But here we have inventor of this term. So, could you justify this a little bit? And I think that we now have, you mentioned IGA. IGA was the original new, but now old term over IAM. But now we have ITDR, we have now ISPM, which is not ITSPM. But at least explain why this is needed. Do we really need this and why it helps?

Very much, Anton, and very, very glad to walk us through this rabbit hole. And I'm sorry to generate such a, like, how can I say, a very visceral reaction from you. I wish we spoke back then, but I should have to brew this thing for how many years?

Yeah.

How long ago you left Gartner? I left last year. But the reason, Anton, Tim, is that if you look at those waves that I described, right? And the big thing happening in the year around the year 2020 was very, very clear to me. Identity was growing up in the priority, not of the CISOs, but in the priority of attackers. Attackers, they found, okay, why should I have to walk around this door if I could just steal and force in the lock? And when we look at that and the power that Gartner has or an analyst has in this type of industry is to, hey, we were here to help clients. And there was this void, this empty space between the SOC and what SecOps they were doing in terms of very broad controls around endpoints and applications and data security and network security and cloud security. And I am in a very vertical and deep protection of, okay, we do governance, we do certification campaigns, we do RBAC and all these things, but we never look at this threat. So if you—

What about the YUBA?

YUBA.

It was still very generic. It was very much across the board.

And YUBA, or U-E-B-A, My original Yuba was Yuba, yeah.

Yeah, I remember that. So they were trying to correlate IP addresses with AD accounts. I said, no, that's not the solution. That's not it. So the reason that say, hey, it's time to refocus on ITDR, and when we say we as an industry and buyers, too, is that, hey, to the point where Verizon was publishing things like 60% of the breaches, the vector was an identity misuse. We got to look at that low-hanging fruit. And yes, what is the best way to call attention to the market? We got to build tools. We got to build processes. We got to build expertise around the topic. So yes, the acronym came—

So wait, hang on, hang on. I agree with you that there's a problem here, but I totally disagree that because there's a problem, we therefore, as an industry, need a tool. You could totally do ITDR as a function within your SIEM or your SOAR tool, or your SecOps tool, or your cloud detection response tool? Why does it need to be its own thing?

I can answer it. The other half of the ex-Gartner crew can answer that.

Oh, boy. I have to fight 2 analysts. This is like my worst nightmare.

My answer would actually point out that that's how all the horror movies start. Somebody says, we don't need a tool. We can just do it with this existing tool. And ultimately, over time, everybody just nods and secretly works in their basements to build a new tool.

Okay, but I'm going to use your own spells against you, Gartner analysts, and say this isn't a product, this is a feature. Why does it need to be its own product? I really don't get it.

Officially, it was never a product. It's a discipline. It's a discipline, right? The way we wrote it, it was ITDR is a discipline that includes process and knowledge base and tools and people, everything that's necessary in this discipline. The tools are necessary, right? There are things, especially with the volume and types of attacks, and then we compound that with the risks of machine identities. There are 20 times more volume than human identities. It is humanly impossible cognitively to just detect things by hand on an Excel spreadsheet, right? I would argue—

Well, I would never ask for an Excel spreadsheet.

But not by hand, by SIEM or by CDR. We never really said—

Yeah, why not by SIEM?

I would argue, yeah, XDR. Controversial question. Anton, do you think XDR is a real thing?

I think I left Gartner in 2019, and I think it predated the XDR brouhaha, and you left much later. So you survived through XDR, Gartner kind of embracing XDR despite it being kind of a Forrester creation, right?

Okay.

But I don't know what it is. I still don't. And I think that this can be easily another episode.

Isn't XDR just a lousy SIEM sold by an endpoint vendor?

That's one take, which we've heard many times.

Or extending detection response capabilities to other disciplines, right? So it could be XDR is a combination of endpoint and data and network, right? Security. And then ITDR, it'll be just another sensor under XDR. If you think from a product architectural way of designing this, it'll be a sensor in there in a more—

Why? Why?

But wait, wait, wait. More than that, Functionally, right? I would see ITDR as a bridge between an IAM team of people and a SOC, SecOps teams, because—

So that I buy.

That I buy. I easily buy that.

Yeah.

I easily buy that.

That last part I buy, not the separate sensor part. But I want to pick at something you said earlier before we get down this XDR rabbit hole for the rest of the episode.

Let's not.

I want to shift gears. Back to cloud and back to something you said about machine identities.

Yes.

Tell us about what's hard about machine identities because we did a whole episode about this and we got to talk about turtles and solving for bottom turtles. Tell us about machine identities and what goes on there.

Yeah. The thing is, when we started to create the construct of credentials and identities to represent humans, the idea is that you have an account. You could have multiple accounts associated to a person. And I think a lot pushed by cloud and DevOps and the developer persona having to be, hey, I need to create this new concepts within Kubernetes and other things. There started to be little things like a Lambda function in AWS, or it could be an S3 bucket. They run with their own credentials and identities. So they started to gain properties of, well, it looks like a credential. It looks like an identity. And there are other types, too, like API keys. There are, for example, service accounts, right? Accounts used by applications. They're not interactive. Like, you don't log in with that, but the application uses that account to talk among them. So one app talking to another app, there's an identity. So those are the machine identities. And what the market is estimating, not only Gartner but other analysts, is that now, from 20 to 40 times more identities of those types over humans. So if we think about the challenges we have today of credential misuse or account takeover for humans, it's 20 times just the attack surface of machines, which is funny because whenever I come across a client and I'm talking about a client, hey, what are your plans about machine identity? What are you thinking about that challenge? And the answer is yes, right? So I'll say, what do you mean by that? No, we understand it's a challenge, but we're still solving human identity problems. We may tackle some service account challenges these days. So that's why perhaps you see, Tim, so much noise in the industry, like a lot of startups coming up, hey, I have an NHI, which is the terminology I don't agree. I don't think it's correct.

Non-human identity, NHI?

No, no, I prefer machine identities. That's how we are referring to that at Saviant. But it is one of those waves that people say, yes, we kind of, quote unquote, solved humans with MFA, SSO. What is next? Guys, there's a time-ticking bomb called non-human identities, machine identities that is just waiting to explode.

Yeah. So what should people be doing about it? How do they get ahead of that?

There are a few steps. I think the first one is visibility. And I think that's where a lot of my clients, they come to me and say, well, I don't know where they are.

Mm-hmm.

It could be a local machine in a Windows account, in a Windows Server. It could be an API key. It could be an OAuth token, right? So the visibility— so looking for ways to discover those machine identities would be the first step. The second one, and the most challenging one, is account ownership because a machine doesn't have a way to do MFA, right? A machine doesn't have a way to self-certify. So you got to attach that machine to a human. It is a step that is necessary to establish governance. So the same way you can have now campaigns that certify identities of humans, say, hey, all your employees that work for you, do they still remain in the company? So no, they have left Google. You could click and they are removed from the systems. The machines, they need to go through the same process of governance. So that's why those are the steps, Tim, that I would suggest. Visibility with discovery first, then account ownership, and then governance.

Yeah.

governance of those accounts.

So this is— I'm having a brief paranoid moment, which I didn't expect during the IAM ITDR episode, because I feel like we always talk about how human identities are over-provisioned with privilege.

Yes.

And then we say, we'll fix it with MFA or something. And then now you poisoned my mind by saying that we have this larger pool of machine identities that also have over-provisioned privileges, And we can't fix them with MFA. So now I feel like maybe I should go revisit my bunker plans under my house because this is a little— it starts to be a little like, holy cow, we're going to die.

This is such a wonderful example of human nature where we have a problem that exists, we have a new technology, we go, oh, good, the problem no longer exists. And we discover, oh, wait, it does.

We create a new one. Yeah.

It's kind of like when we had horses in New York City, we were concerned about their emissions. There was horseshit everywhere. But now that we have cars in New York City, we suddenly forgot about CO2.

Yes. And not to make your nightmare even worse, Anton, another thing about the machine identities is that, yes—

Wait, it can be yours? Stop, stop.

No. Just a little bit. It's the fact that there's an interesting discussion happening right now. And this is LinkedIn. This is current forums that I go to is that, should we even think about rotating passwords of machines?

Ah.

Think about that. Because for my entire career, I said, yeah, you got to rotate passwords, never reuse passwords, and stuff like that. But with machine identities, remember, those are used perhaps most of the time between machine-to-machine type of communications. If you change that, and that's why they're so critical, They are typically hardcoded within someplace because if they change the password, it may be breaking in a cascade effect of multiple apps. Multiple services will stop working if you rotate those passwords.

Hmm.

It is a complex problem. And I think this is just to make me feel better. That's why I'm telling you this in a way that I open this conversation with you guys, say, hey, I'm pretty useless elsewhere. And I've thought about switching careers at some point. Should I go to cloud? Should I do networking? But I kept coming back to identity because, like you said, we solved the problem with the horses, and then there's a new problem. And identity is that gift that keeps on giving, right? For professionals, but also to keep us doing interesting stuff, stuff that I appreciate doing.

What do you make of the NIST guidance that we shouldn't ask users to change their password every 6 months anymore?

That's humans. Yeah, that's for humans.

Do you think that's good advice or not?

I think it's good, right? Because— and that's what happens with my wife. If I say, hey, you got to change all your passwords, what do you think is going to happen? She's going to use the same password everywhere.

Yeah.

Right?

Or you're going to sleep on the couch.

The more you ask people to do that, they're going to be reusing more passwords and make it more easy to remember. Or perhaps they add a number 1 at the end and then a number 1 and an exclamation point, right? So by using—

I thought only I did that.

So NIST recommendations is, well, if we keep it more or less the rotation more static, you can use longer phrases, hard-to-break passwords. And on top of that, I would add, use a strong authentication method. Use phishing-resistant authentication methods, FIDO 2.0. So there are evolutions that help— they're helping us. By the way, can I make a shameless plug to your company, Anton?

Yeah.

Google, right?

Please.

I'm a Google, like, more not on the business side, but I use Gmail for my personal use. But that was the first time I saw passkeys in a more customer, consumer type of way. It was fantastic.

Fantastic, yes.

And I think that's the evolution of what we see, the adoption of good practices in identity security, is that something that is convenient, something that my mom would be comfortable enabling passkeys because it's, hey, it's going to be better. You don't have to take notes of your passwords anymore, and it's safer, right? So when we reach technology advancements that can hit those 2 areas of—

At the same time.

It's convenient. It's actually, it's more convenient and it's safer. I think that was a very big win for us. So Google, Apple, I think you're all commendable for doing that.

Well, thank you.

Right.

It made it a billion users. Billions of users started using this. And so, yeah, I think that's an excellent point about the passkeys. Let me briefly revisit one topic which we touched, and sorry, not XDR. I think XDR is kind of more or less, maybe not banned on the show, but we're not touching XDR. We are still a little—

We're back to ITDR.

Not fans. Yeah, but we want to touch on ITDR's brother, ISPM, which I initially mistakenly called ITSPM. Of course, there's no T in ISPM. Would the posture assessment tooling help with both human and workload identities? And if we sort of talked about ATDR versus CDR, YUBA or SIEM, what about ISPM versus IGA? You brought up IGA or even IAM tooling, right? Surely posture assessment should be a part of the IAM platform. So why is ISPM a thing?

It's a great question. And that was part of research that I was supposed to be writing at Gartner before I left. So before I could publish this, But think of ISPM as the counterpart of ITDR. It sits at the top of— and it's not a replacement to all the good controls that you should do in single sign-on, access management, IGA, MFA, PAM. Those are all still very much necessary. But think about this. ITDR, it happens at the time of the boom. You're being attacked right now. So you detect that and respond to that. ISPM is everything you could do before an attack.

Yeah.

So things that keep you healthy, All hygiene type of steps. For example, am I removing unused accounts? So detecting those types of misconfigurations in the tool, as well. For example, I have a company with 10,000 employees, and I have half of those using OTP over email. That's dangerous. Boom. So it's not an IGA job to find that out, but ISPM is an example of where hygiene and discovery of Hey, you have 50% of your identities using a very weak MFA authentication method. That should be changed. So it will be a flag in ISPM because it's not an attack. An attack is not happening yet. It's before an attack happens. And it could send a signal back to IJA and say, hey, go and fix that, provision accounts into whatever, right? So ISPM, think of it as preventive things that you could do before you get ready for the fight. Right? You go to the gym, you exercise, you sleep well.

No, I'll go with that. I think that it's the— and I think that I can self-answer the question about why didn't IAM platforms build it in? Because ultimately, it applies to pretty much every platform vendor of freaking everything. Why didn't they build this feature, a security feature? It's across the board. Yeah. I think that makes sense.

So let me ask something about this whole episode, which is going to get a little meta. I would struggle to count how many acronyms we referenced in this episode. As 2 former analysts who are responsible, dare I say, for gifting our industry many an acronym, what goes into making a good acronym? And are there any acronyms that you regret creating for our industry?

Ooh, I want the regret part.

Yeah, I I created one actually, was not even— so the ITDR, I was a co-author of ITDR, but KIM, Cloud Infrastructure Entitlement Management, I was the lead author and I— you can blame me. I'm the culprit.

Wait, KIM is also you?

It was me. I'm sorry. Oh yeah, well now I have 2 reasons to dislike you.

How about that? Because that's the one I also didn't like because it clashes with SIEM too much and then not everybody pronounces it like KIM. Okay, never mind. I'll ramble now.

But I don't regret it. I think it served its purpose. And I think what makes a good acronym, it has to be sexy. And I think those are not. And that's what I regret, perhaps. It could have a cooler name, and it had. So when we look at, for example, things that Forrester came up with, like Zero Trust, right? That was something that is sexy. The whole industry just embraced that. That could easily have become an acronym, but they didn't make an acronym, so they called it Zero Trust. I don't like acronyms. And I also—

No.

We don't—

What?

Yeah.

They're going to revoke your analyst license for saying that.

I want to debunk another rumor. We don't get paid for creating acronyms.

So—

Really?

No.

Then no.

No.

I figured you all were like Charles Dickens. You know, he got paid by the word. You all got paid by the acronym.

So, so I think if I regret— if I regret something, it's perhaps I didn't fight the battle long enough to say, no, let's call it something more sexy. And that's it.

You know, I've got a funny story about that. I had a naming partner at Google once try to name a product of mine Security Threat Detection. And I had to point out that calling something STD was probably a bad idea.

Good call.

Right. And I think that security threat is already a little overloaded. But this discussion can go forever, but I feel like the 5-letter acronyms is the source of my actual ire. I can live with KIM, I can live with—

IGDR.

I can live with IGDR. We are friends and all that, but 5 letters is where it starts to look a little— Yeah, silly.

It's silly.

It is like, think about the CNAPP, Neil's favorite baby, I guess among the 70 others' favorite babies. I mean, would you call it CNAPP?

No, I wouldn't.

I guess you would call it CNAPP, yeah.

No, no, it would be something else.

But there are no 6-letter acronyms yet at Gartner.

No.

Give it time.

And I think Gartner now, if you look, I think there's a push for using actual English words instead of acronyms. We think it could be something, you know?

You're not seeing this, but my eyes are getting bigger and bigger and bigger, and I'm like shocked.

I saw that, yeah.

Yeah, listeners, we're both shocked. We are shooketh. Henrique, I hate to do this, but we're just about at time. I have to ask our traditional closing questions. One, do you have a tip to help organizations do identity better, maybe get IAM right? And 2, do you have recommended reading?

May I intrude very briefly?

Oh, please.

Can I also ask you for a bonus tip, being ex-analyst? And the bonus tip would be, How best to use analyst insight? If it's too much, if it's another episode, that's fine. If you have a 3-second answer, that's great. But can you please provide a bonus tip on how security people can best use research?

Okay, okay. Let's go. First one, how to be successful in IAM. I think that's the question Tim was asking about. I think to be successful in IAM, we cannot forget about the foundational elements of proper lifecycle and good hygiene of your IAM accounts. And that includes visibility, discovery, ownership, and all that kind of stuff. Sometimes we get too hung up on the next trend in AI. We see that, right? And then we lack on the basics. So I think that's one of the many things that we could do. But I'll say prioritize that visibility and discovery ownership. I think that could be a good starting point for many organizations. The second one was—

Recommended reading.

Okay. So this new job I have at Saviant, right? the shirt I'm using here. I'm running strategy, which is a very abstract concept as well for many people. So this book here, it's— I would recommend.

Yeah.

It's Playing to Win. Playing to Win: How Strategy Really Works. Funny tidbit, I'm not a reader. I have a very limited span of attention, but I do like biographies, which this is not. That's the one kind of book I can finish. It's a biography, a good biography. So I'm looking to read a few other biographies, but I remember Andre Agassi. That was a cool biography to read, you know, the tennis player. And then from an analyst, how to best use analyst advice? I would say go in with an open mind. I can't remember how many times I went into inquiries with a client with a preconceived idea and said, hey, I want you to reinforce how my idea is good, especially if there's a supervisor or somebody else on the call. And that's just— well, that's not helpful to anybody here, right? So I'm not telling you the truth. and you're not improving as a company. So I think going with an open mind, say, hey, let me listen without judgment, and I'll take what applies to me. And if it doesn't apply here, it may apply elsewhere. I'll just save this advice for the future. But I think those would be my suggestions.

I love that.

Perfect. That was really well. Thank you. This was lovely. And we would forgive you for mentioning XDR even because the rest was so amazing.

I'm so sorry. But guys, I had lots of fun. It was a huge pleasure. I was looking forward to this. Thank you, Anton. Thank you, Tim.

Of course. Thank you for joining us.

Anytime. Bye-bye.

Bye-bye. And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Juvaikin and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Security.