Getting on Top of Machine Identities – Chris Hickman, Keyfactor

This is texturing TV. Hi everybody, Mike Rothman here with another interview for Textron TV today. I am really excited to be joined by Chris Hickman of key factor.

This is their Chief security officer and we're gonna talk a little bit about the state of machine identity. What else a machine identity is that you me or you know, are we talking Skynet here right where we have every everything is, you know self perpetuating and and AI we're not now, we're not gonna go there. So Chris welcome to Tech strong TV.

How you doing this morning when you introduce yourself and tell us a little bit about key factor share my happy to do so and thanks so much for having me. Yeah here today, you know as you mentioned Chris Hickman Chief security officer key factor key factor is an identity First Security Company, you know, we are our customers use us to establish digital trust and make sure that there is an identity associated with every single device workload and thing if you will That's in their environment. And of course every identity then needs to be managed in order to be trusted.

So yeah, our company's benefit from being able to know whatever thing is have the the trust behind that and to be able to manage those identities in a way that makes sense to their organization. Yeah, that's good. Let's dig into that a little bit before we talked and we definitely want to you know, spend some time talking about the the survey I think that there's some interesting, you know kind of dating findings there, but what's interesting so I've been doing this Cloud security thing for, you know, about 12 years 13 years at this point and one of the big jumps that folks really have to make to understand how things happen and how they're different in the cloud is the idea that everything has an identity, right?

You know, what's really means you can assign a role or an entitlement to pretty much anything from the smallest of security buckets to keys. Right? And obviously that's something you guys are focused on, you know, kind of secret Management on that front, you know to instances where I work loads even Serverless functions, right all these things have identities now, right which obviously creates a couple of different issues one is there's a lot of them.

We we thought you know, your typical large Enterprise as you know, 10,050,000 people. There's a lot of stuff to manage now multiply that by a factor of 10 50 a hundred right, you know kind of then we start thinking about just the number of you know identities we have to think about as as we start factoring your machines and then there's the complexity of all of these policies right to make sure that they don't overlap each other that you're not sitting there sitting one policy that makes things overly permissive. Well, you have other policies that get you know, obviated that try to you know, lock stuff down.

So how in general do you get folks to really understand, you know about what a machine identity is and and what kind of challenges that creates is. They think about, you know, their Enterprise security posture. And and I mean, I think you know you hit the nail on the head, right?

What is a Identity and that's an ever-growing and ever expanding Universe really in this space. Right? So yeah, if we think about machine identity we tend to think you know, our our thought goes to the traditional devices right?

I've got my laptop and I've got this and the other things that connected historically to the wire, you know, those were my my devices but then there's a sort of overarching group of assets that are really more workload oriented things like virtual machines and containers and an rpas increasingly coming into scope, you know applications of always been there, but they all require their own identity as well. You know, the the notion that an organization As you know infinitely more assets than they do people they have a finite number of people but they have an infinite possibility for assets really does sort of put it into this this notion of you know, how do I know? What all those things are, right, you know traditionally, I'd use Asset Management type systems and tie identity that but in a cloud environment the hybrid environment, I can't do that anymore.

Those those things are no longer identified as physical assets. So, you know machine identity has sort of become the prevailing way that I identify these things and then I use that machine identity to establish trust between endpoints in my organization. So that things can communicate securely, you know, and I know what should be communicating to what who should be communicating to what and I can start to make those those types of decisions most organizations though.

And this is the where we start to find the the report interesting don't even know how many, you know, for instance keys or certificates. They have they know they have more than they did last year. They know it's a burden manage them You know, I think is one of the results from this year was 74% of organizations said, you know, these things are our burden to my organization and it's only getting bigger because yeah, we're moving more workloads to Cloud.

We're doing things like containerizing so we can sort of go spin up and down things dynamically as we need to and it really is an area that has long been ignored by the organization because I get to because typically been tied to people entities not so much the machines the applications they use Yeah, and so let's dig into that right you mentioned the report. It's the one 2023 state of machine identity management report. That is a mouthful man.

You know, you should have the marketing folks take a look at that on that front. But but I know it's it's the third year you've been doing this. So now you actually have some trending data which is which is kind of Interest.

So just run us through some of the you know, kind of high level findings that you guys have come up with. Yeah, you know, the the there's not close the not surprising findings, right? There's more keys and certificates in the organization.

And when we do talk about machine identity, the vast majority of machine identity is as a result of a certificate, it's the sort of universal way to identify things in the organization and it could be leveraged for more than one purpose like setting up security between and secure channels between applications and users and things of the sort. So, you know, it's not surprising to see that this year. Once again, the average number certificates in an organization has increased Over last year, you know this year average number of certificates in the organization for the 1280 respondents to this this particular survey.

That stung by the Pokemon to develop. This report is 255,255,000 search is the average number of certificates that are being used in an organization today, which is a huge number. Yeah, coincidentally enough.

We find that too when we talk to people is that they sort of have a number in mind going into a conversation and when they sort of exit with the reality of what's going on in the organization, there's usually a as you mentioned a multiple of Acts, you know, often five to ten acts I call that an oh crap moment. Right probably wouldn't use the word crap, you know, it's kind of a similar type of thing. When you first put your first, you know, kind of ID or egress filter on and you're like what right or you know, kind of when you start to study what SAS applications you have your life.

Yeah, right. So once you get it out of these things, it makes the problem a lot more tangible, right and and you know again, especially with search you can kind of use them in a fairly limited and discreet, you know, kind of function or not, right? So so getting your act on on those policies now, we've got all these Cloud platforms that we're using and you know, these keys are intrinsic and where are they stored in getting visibility overalls and you all these just create huge, you know challenges and now that you And like that is a key element right is getting visibility over them.

Yeah most again. The vast majority of respondents just simply said we don't know how many we have right and and we have no visibility as a result. And if I remember correctly was I think 60 odd percent that that just said we have no clue, you know the consequence of not having a clue though is also driving some negative things in organizations, right?

So certificates have to expire it's kind of like a driver's license or a passport. You've got to renew them on a periodic bracelet to make sure that that the identity is is correctly reflected. It's not like a user that you know as longing on every day and changing their password.

We're talking about things that don't do that. So as a result, you know, when certificates expire it usually results in outages. And so yeah, one of the the interesting stats coming out of this report 77% of organizations that responded have had a significant outage in the last 24 months and all those outages 52% If I remember correctly have impacted customers directly.

So I mean these these have a huge impact to organizations. Yeah this year. We looked very long and hard at what the financial impact could be to an organization.

Well, we didn't try to do it in in a pure numeric standpoint. What we did ask was. Yeah.

How long does it take you to resolve one of these outages and and the answer was was well over four hours and you know, and that's sort of not just issue new certain get it there. It's figuring it out in the first place because the problem doesn't start as a oh a cert expired the problem starts as Wi-Fi's out. Yeah and and equally important, you know, so 42% said it takes more than four hours was one of the findings of that time organizations also said the highest wrong, we sort of said, hey tell us how many people are involved in this process and the greatest response was in the 11 to 20 people.

So if you're starting to tie up, yeah, let's say take the average there 15 people over. A course of four hours plus if there's any Revenue Associated that that's that's not being done. Yeah, there's these are big problems.

These are expensive problems and organizations. The the reason why they're happening is because people are still relying on manual processes. Now people are still trying to track identity in things like spreadsheets which in this day and age completely baffles me.

Yeah. And so, you know, it's kind of this this perfect situation the companies have created for themselves that that's report starts to highlight. Yeah, one other thing I would just very quickly point out is that you know, we all know that there is a new set of use cases up and coming around this we're seeing devops and iot driving more and more certificates being used.

Yeah. There's also the, you know ongoing cloud and you know move to zero trust and all these other initiatives going on. They're driving you so that number we expect to see going up.

Yeah combine that with the fact that we also know there's a labor shortage in cyber security. Organizations really need to start looking at how do I get people out of the day-to-day care and feeding of these of these credentials and and align my business that identity is a holistic view across the organization and manage in such a way where they can leverage things like Automation and and tools as such to receive that or get that kind of end result of not having to tie up their people running around with files trying to put them on servers, right because that's one of the big problems is that identity is this thing right and and kind of defining what that is and you know kind of helping folks understand all the different aspects of it right again, though just the name, right? I did anybody and access management, right?

So you've got obviously that identity who you are now, we're just talking about it's not just the people that are there it's all these different, you know, kind of devices and and you know, you start to think about it again, just think about iot, right, you know Millions possibly bill. Instead of different, you know kind of devices and other things with credentials with entitlements that you have to you know, kind of control so, you know when Phil so I have an identity problem. You know, what is that really mean?

Right and how do you really start to you know, help them understand that there are many aspects to this problem, you know, the machine identity piece of it is one of them obviously, there's a governance issue and there's you know, authentication a few minutes issue and you know, probably about 50 other ones, you know behind that and then you talk about, you know, kind of the you know, the skills shortage, right? So to me, it's an operationalizing issue, right? How do we operationalize a lot of these different processes that most folks don't pay much attention to Until It Breaks up.

Yeah, and we actually asked a question in the report very much along those lines to say. Hey, how many of you have an organization internal organization that's looking specifically Teen identity and not surprisingly majority did not a few did which is yeah, but there's certainly you know again, yeah the vast majority respondents were like, no, you know, what we we have something but it's fragmented or you know, it just doesn't have clear Direction and this is historically been a problem in pki anyways, so sort of a lack of clear ownership it, you know something obviously that is security-based but it's also identity based and so it tends to fall sort of in this odd spot in the organization yet, you're building your entire security network on top of these credentials that are being issued. So if you don't have clear ownership, it's kind of hard to get alignment in all the right places.

Yeah, no, no hundred percent, right and you know again now that you've got ways to issue these credentials that go on scene, right? You know, what about those, you know kind of customer generated certificates that drive storage, you know, We need AWS for example, right every bucket has a key is it, you know, is it a customer generated key? Is it a Amazon managed key.

I mean all of these things are considerations, you know for how you you manage those credentials every website you have internal sites, all these other things right? And and you know again, I feel this pain right because every so often I'll get, you know, kind of blasted with with emails about having a renew our certificates and then I call, you know, the IT guy, right? It was my former business partner and I'll say what's going on with these guys.

Yeah, I'll get to it. I'll get to it right and then one day you get to it is like site was down. It's just like dude, right and and we're just that we were just a small shop that I think about that in an Enterprise context and it gets pretty good.

Well, and if you think about it, too, you know, those are the things you can control there's the things you don't control right. So there's the evolution of Standards. We're starting to see this new, you know, a suite of crypto coming our way as a result of the standardization for post Quantum, you know, the the the various forums out.

There are looking to reduce certificate lifetimes for for you know to the starts to protect your website. All of this is sort of creating this this notion that it's it's very it's hard to manage this stuff and it's hard to manage through the change change and you know, if you're if you're process is email your it guy, you know, it's gonna break under the stress of change and it's not change that you necessarily control. It's changed.

It is coming your way as a result of other external decisions. Yeah. And yeah, that's why again, you know in the report we saw we ask a series of questions and it came down to you know about 50% of the organization.

I think it was 48 to be exact just simply aren't able to keep With the change in these areas, you know and a lot of that reflects the manual process a lot of that reflects the the things that are going on external that people are just going to have to deal with and you know, there's got to be a better and more sane way to do it. So there has to be so before we go because a couple minutes left, right? You mentioned that q word right Quantum cryptography and now you know, and I yeah, listen, I have engineering degree, but I'm no mathematician by any strictly matches.

You just give us a quick overview of what is in that means right and how that's gonna impact, you know, whether it's machine Identity or the you know, kind of protocols that we use to establish those trust relationships. It's a fantastic question and you and I can have a completely different conversation about that and I'm sure we'd feel another, you know, three or four of these sessions, but I'll try to keep it as high level as I can because I don't want to get into the math side of things. But the reality is is that you know, cryptography is going to change it's going to change because first of all the crypto we're using is almost 40 years old.

Nothing else to survived for 40 years in Tech period yeah with possible exception of me. Yeah, but the algorithms are going to change because they need to be able to mitigate the risk of quantum cryptography and Quantum cryptography basically is able to do really big math really fast. And therefore what we use for crypto today isn't going to stand up when that Evolution happens.

I'd evolution of computing the groundwork is being laid now for what those new standards are going to be and this is getting ready to release their second round of candidates have already released their first round of candidates, which will drive standardization which will drive adoption which will force organizations to rethink how they do crypto. Why does that matter from an identity perspective because as we've already mentioned a lot of these credentials are based on cryptographic keys that are derived from a pki and therefore how those keys are issued is going to change considerably and so, you know, there's a direct tie between the crypto and the identity piece, but you know, what I want to leave with is the changes inevitable. You can have the debate about when Quantum is coming.

It's the change that is inevitable and therefore organizations really need to think about how that's going to impact them and the timeline because it's a might be 15-year timeline for Quant post Quantum, but it's a 10 year adoption cycle for organizations to wholesale change their crypto and guess what? Nobody has ever gone through that before so it's now so time to plan and not panic but it is absolutely the the place into this whole how do I manage this stuff at scale interesting what thanks for that explanation Christmas, obviously something we all have to you know, think about on the long list of other things we have to think about that are you know a ways off until they're not right and that's funny thing about you know, these technology things that you know, we have time and you know, so getting ahead of that. So so Chris.

Thanks so much for for being on the show really appreciate you coming on and talking about the stadium machine identity and giving us, you know, obviously a lot of food for thought how Folks if they want to get access to the report or, you know, get a little bit more information on key factor. How should they do that? Well, our website is a great source to come to we've got you can you can get a copy of the report from there.

You can request it. We've got blogs there as well that speak to, you know, the both the quantum side of things and the and the Machine identity side of things lots of information there great place to start and you know, we'll be happy to to reach back out if you wish us to and and connect with you great. com Old School.

I like that old school Chris Eggman. Thanks so much for being on the show. And now let's send it back to the studio for our next interview.

Thank you, Mike.