Identity Management Challenges with Zilla Security’s Deepak Taneja

This is Textron tv. Hey guys, thanks for the throw. We're here with Deepak.

Tunisia is the CEO for Zillow security, and we're talking about identity and what makes securing those identities tough, because I think we're all talking about it in the era of Zero Trust, but I don't think a lot of us know exactly how to go about doing it. Deepak welcome to show. Thanks.

Thanks, uh, Mike. Great to be here. I feel like, and this just may be an opinion of one, but in some sense feel like we're making a strategic withdrawal, right?

We couldn't secure the network perimeter anymore, and everything's coming over the top. So we need to, to find a different tier to secure. And I think we all landed on identity, and of course we've been trying to secure identities for a while, but maybe we're getting better at it.

Maybe it's even getting easier. But what's your assessment of where we are and why are we all suddenly obsessed about identity and security? Yeah, that's a great question.

Well, identity's been around for, for a long time. It's been, it's been a business enablement issue, right? Um, managing identities and giving people access to, to the applications and data they need to do their jobs.

Um, I think what's what's happened in the last 10, 15 years with the adoption of the cloud is that, um, identity has become, to use a cliche, the new security perimeter, right? So it's, it's, um, uh, I think Rob Joyce recently in the Wall Street Journal article, uh, called it the Greatest Cybersecurity Challenge, and indeed, it is becoming the greatest cybersecurity challenge. I think identity by its right nature is built into all, all aspects of a business.

It's, it's how business business runs on, on, on it and information systems. And unless identities are managed appropriately, uh, people in the business can't do their work. Uh, so that's, that's why it's, it's becoming so critical.

And of course, you know, we all have thought of the network as the foundation of enterprise security for, for a few decades now. It, the idea has always been keep the bad guys out of your network. Well, there is no network anymore, right?

The, the corporate network is sort of falling apart when it exists. It's augmented with this cloud and lots of different clouds, um, that, that organizations are, are using. So, so the core, the fundamental sort of construct in security more and more is becoming identity.

You know, people are coming in from work, from home, from Starbucks, from the road, they need to get their work done. And how do you, how do you help them do that? Well, you figure out the identity of, of, of the individual, and, and, and then you give them access.

You give them the right access, give them the, uh, access they need to do their jobs. And that's, that's why identity is becoming so critical. So what makes it hard to manage that?

Because, you know, on a certain level, we've been asking, you know, who goes there since the caveman, first grunted? So, um, how, what makes managing identity so difficult in the, in the current age of it? Yeah, right.

So I think we've been trying to manage identities for a while, but it all starts with figuring out if this entity, this person is who or is what, who or she claims to be, right? It starts with authentication. And to deal with authentication, you need a directory.

So that's the, that's sort of foundational. And then it goes from there. Well, once you can authenticate someone and you have to authorize them to, to access the right application or data that requires giving them permissions.

So now you've gotta manage those permissions. Um, and then of course, there's, there's people who are constantly joining, moving and leaving in an organization. So you've gotta manage those identities and those permissions.

And then of course, there's compliance because you have to prove to, um, to, um, to comply with all kinds of regulations. Organizations have to ensure that they review who has access to what, and that's becomes another, another process. Um, so it, it, it's, you know, there's, um, what makes all of this difficult and challenging is that identity is, is all about processes.

It's built into the fabric of an organization. And, um, while things like we have a, as an industry, we have a pretty good handle on the fundamentals of directories and authentication. We're still grappling with the governance processes.

How do you actually deal with compliance? How do you deal with provisioning, joiners, movers, leavers? How do you deal with the, uh, the security angle, the security posture around, around identity?

And while we're dealing with all of this, while we're grappling with all of these questions, um, the cloud has, has created, uh, this, this whole fabric that, that now, uh, involves not just human identities, but non-human identities. And in fact, the non-human identities, uh, service accounts, uh, and so on, tokens, um, um, they, they outnumber human identities by a factor of a hundred to 1000 to one, um, in many organizations. So, so it's becoming a bigger and bigger problem, right?

All those, if you're gonna govern just human identities and the access that human identities have, that's not enough. Now you've got this, this problem about non-human identity governance And those non-human identities, there might be more of them than there are people because they're essentially machines and human software components. So, um, it feels like this is a, a problem of several orders of magnitude greater than people might initially realize.

That is exactly right. And that realization is, is starting to hit security teams and security leaders now, right? This is, um, you know, that cliche, I used identities, the new security perimeters been around for a number of years.

The implications of that are only now starting to, to to be felt inside organizations. Um, and, and people are starting to say, well, well, this identity business is, is critical, and in fact needs to, uh, needs much more importance in our, in our security stack. Um, and, and in fact, it is the cornerstone of security moving forward.

Uh, which is not to say that you, you shouldn't, to the extent that you have a corporate network, you don't need network security or to the extent that you're using, um, large host systems, Unix, a mainframe, whatever, you don't need host security for them. Uh, you, you still need a lot of different elements of security. But the foundation increasingly is identity.

As we think all this through for a minute, um, are we too wedded to some of our legacy platforms for managing identity? 'cause I can go back in time and, you know, there's various directories that are 30, 40 years old technologies at this point, or so, do we need to rethink the platforms or can we extend those in a way that makes them still relevant? Yeah, and that's, that's the challenge that most organizations, particularly large organizations face.

Um, you know, the, the March of progress is, is, is so fast that it's outstripping the ability of, um, vendors to upgrade and update their old products. And, and so, and this is not new. Uh, I think we've, we've seen this in the IT industry for the last 50 years.

Um, um, the problems evolve and existing solutions, existing deployments inside enterprises can't cope up with, uh, with the evolution of those problems. And so the challenge is how do you, how do you evolve your, your infrastructure, your identity infrastructure, uh, to deal with that? And, and most large companies are, are, are trying to figure that out.

And, and oftentimes it's not a rip and replace, it's, uh, sometimes it is, uh, but oftentimes it's a question of, um, you know, figuring out what, what part of the problem your old deployment can, can deal with effectively, and how do you start to bring in newer tools, newer solutions to, to deal with other parts of the problem. And then perhaps there's a, a whole scale replacement over 18 months or 24 months. And we're, we're seeing that sort of thing a lot in, in the, on the identity governance side, uh, in the industry.

What impact do you think AI might have on all of this? 'cause I could think about it as both a negative and a positive, but it seems like maybe this whole thing could a, become easier to manage, but then again, the bad guys will be messing with their identities, right? That's right.

That's right. So, so AI makes things worse in different ways. Um, you know, the very nature of ai, you know, more tools, more services, more applications, all of that implies more identities, more permissions, more to manage, right?

And then to your point, um, AI can be, can be used, um, against the organization by, by bad actors. But AI also makes things better. It, it, it takes, it takes automation to the next level.

Um, AI can do what humans can, um, and, and AI can help every stakeholder in an identity management process or an identity governance process. So, um, you know, we are, we, we see a lot of benefits, um, accruing from the use of ai, and we're just at the beginning of that, of that cycle. I think, uh, there's been a lot of hoopla around generative ai and so on the last, um, the last year or two.

And, and that's, that's, that's good. I think it, you know, there's copilots and so on that have come out of that, that that can help. But I think AI is also, um, going to fundamentally create some automation that was impossible, um, five years ago.

And so, so there's, there's, there's pluses and minuses. I think overall, there's, there's a lot more, there's a lot more pluses. I think we'll be able to take a lot of what's manual today in identity management and identity governance, and we'll be able to entrust that to, um, to ai.

Um, not AI that is completely left to go off and do its own thing, but AI that collaborates with humans and, but does all the grunt work, right? And that's, that's, that's awesome. And won't each of those AI agents that's assigned something have an identity that needs to be managed?

Of course, of course. And that's what I said, that's, uh, that's the, the, one of the negatives that now there's more, more identities to be, to be managed, more entitlements to be managed. So, um, you know, um, that is certainly part of, part of the equation.

Have you given any thought to how many identities each of us has? Because I was just thinking about it before this call, and I was sorting it in my head, and it's like, so I have multiple roles and arguably multiple personalities for different jobs and functions, and each of those has an identity attached to them. So does the average individual, when you start thinking about it, have, I don't know, 10 hundreds of identities?

I I think you have to kind of separate, um, the, uh, consumer identity of a person from, from the business identity, right? So from a business standpoint, an organization really needs to be able to think about an employee or a contractor as having a single identity. 'cause that identity sort of represents the relationship that that individual has with the organization, the business relationship with the organization.

And then that identity might have 5,000 thousand different accounts in the organization, right? And so that identity, um, you know, your identity, uh, you have an identity, but then if you're using Salesforce in the organization, you have an account inside Salesforce. You could think of that as I, as an identity inside Salesforce, but really it's an account, right?

And so what, what businesses are trying to do across the board are essentially correlate all of this account information that they have about people, um, in, um, in the organization, correlate all of those accounts with a single identity, right? And that makes life much easier. 'cause now you can say, okay, what does Mike Baard really have access to across, across the enterprise?

And you can say, all right, right. Mike Baard has this title, this is his relationship to the organization, and he has access to 86 applications, and out of them, 30, 30 of them are privileged access, the others are not. And, and so on right now, that's the business identity.

I think consumer identity, it's a, it's a little more complicated than that, right? Because, you know, you're dealing with lots of different kinds of businesses out there. Consumers are doing all kinds of things in their lives.

And, and every, every system that they deal with, their bank has one, has an identity, has one notion of their identity, their gym has a different notion of their identity. And even there over time, what we might find is that, uh, certainly this is true in certain, in some European countries, that there's a, a government issued identity of some sort that, that starts to get used for consumers across the board. But, uh, that whole area is need, still needs, uh, needs a lot of work.

So what's your best advice to folks, or conversely, what are you seeing organizations that have a handle on all this doing well that others should maybe wanna copy or just be aware of? Yeah, so the thing that I think, um, first I think, um, realizing that identity is by its very nature, um, different from a lot of other elements of security. So it's not just a security tool that someone on a security team works with, uh, by its very nature, because it's built into, into all the aspects of a business.

There's a lot of stakeholders and identity. Um, you know, people themselves, the employees are stakeholders. Their supervisors are stakeholders.

The application owners in the organization are stakeholders. The data owners in the organization are stakeholders. The compliance team is their stakeholders.

The auditors are stakeholders. So identity needs to be thought of in terms of these different processes that engage multiple stakeholders. And that is fundamentally different.

It's, um, you know, we talked about how identity is becoming the cornerstone of security, and yet it's not like other security tools. You have to think about how you're gonna manage a process that might have, you know, 500 or 50,000 stakeholders, right? When there's a, to give you an example, if you think of an organization with, um, with 50,000 employees, and that organization for compliance reasons needs to do an access review every quarter.

Let's say it's a public company that, uh, has to comply with sox. Now, when an access review happens across 50,000 employees, you know, let's say ballpark five employees to a supervisor, there's 10,000 supervisors who are going to be engaged in that access review, right? Um, so, but to, to even get that access review off the ground, you need to go bring data from maybe 500 different applications in the company.

You need to bring them in, pull all that data together, then reach out to the, you know, all these supervisors and get there, get them to do the access review. So it's a, it's a very process oriented view of, of things. And, and I think organizations that, that are dealing with identity, well get that they realize that, um, they need to think in terms of processes.

Uh, second, I think organizations that are doing it well realize that, um, historically identity teams have been suffered from security teams, right? The, the, um, the, the security operations team, for example, doesn't understand identity in most organizations, and the identity team understands these processes and so on, but they don't understand remediation and, uh, response, immediate response to exposures, identity exposures. The organizations that are doing it well are starting to tie identity operations and identity team work to security operations.

'cause they realize the, the key tie in between those two, right? So that, that is really important. And then finally, I will say, uh, that the teams, that, the companies that are doing it well are giving identity.

It's due importance in their, in their stack. So they're, they, they're realizing that this is critical and we need to spend money on this. We need to, we need to take it seriously.

We need to track it carefully. We need to monitor it. Well, uh, we need to put as much automation as we can into it.

We need to get the right tools and platforms in place, uh, to make, to make that happen. If by now you haven't figured out that identities by definition are somewhat schizophrenic, you know, it's pretty clear that that's the case. But the funny thing about it is it seems like the best way to go about managing them all essentially.

And to figure out some way to put your arms around them all and understand the relationships they have and the dependencies they have with each other. 'cause that is gonna be the secret to cybersecurity success going forward. Hey Dap, thanks for being on the show.

Of course. Thanks Mike. And back to you guys in the studio.