Styra DAS Integration, Tim Hinrichs – Styra

This is texturing TV. Hey everyone, welcome to this Tech shark TV interview. I'm really happy to be joined by Tim Hendricks Tim is with styria co-founder and CTO.

I believe right Tim, right? Yeah. It's gonna be here Alan.

Thanks for having me again. Good to have you back God. Yeah we missed.

I I saw Bill. How did RSA I didn't see you. I was hoping to run into some of the folks, but maybe it's better we did it was a lot of people getting covid the less people.

I saw the better. I I guess I was in retrospect. But anyway, it's good to have you on here virtually where we'll vote safe and all good.

Yeah, for sure. Well, this will definitely have to sync up one of these future conferences. Absolutely.

So Tim look I we've been covering start strive for styrof since I think almost since you guys launch basically, you know, we've covered Opa and and I think our audience is well, you never know Tim. Let's assume some people don't know whose driver is an over and everything. Why don't you give him a little background?

Yeah, great. Good idea. Yeah, so star is a company that helps Enterprises by providing them with a unified solution to offerization right now authorizations on those terms that you know, sometimes people get confused about because there's a very similar one authentication.

So I always like to remind people what actually is authorization and authorization is just that that problem of making sure that you have controls in place over the actions that either people are machine take on software, right? So I always like examples of you know banking apps, you know, if I log into my bank account online, you know, can I withdraw money or transfer money from one account to another that's an authorization problem. And then the other one that I think is probably more relevant for today is sort of the actions that developers are taking while they're building and upgrading and running those those applications.

So every time they're trying to upgrade an app or spin up a new server or change the network configuration or attached storage. Those are actions too and and companies want authorization controls over over how developers are. Engine that infrastructure that's kind of what we do at styrofo is provide a unified solution to both those application Level authorization problems.

And what we sometimes call the infrastructure authorization problems. Absolutely, right? I think that you know, it's probably a good concise.

Definition of what you guys do there have been quite hard at that tight good. You guys recently announced some news though. Because well, let's go with the news and then we'll go into it from there.

Get him, right? Yeah. Yeah.

So the the news that we wanted to share was just basically a native integration between hashicorps terraform cloud and styria's product that declarative authorization service. And so the idea there is just now because we have that native integration. We've got both of those products working in tandem on the tear from cloud side what that means is that you know developers who are using terraform to spin up and manage new resources on the let's say the public Cloud can then couple that with styria's policies that allow that organization to put controls authorization controls over the kinds of resources, they get spun out the and how those resources get configured.

So, you know that those same examples that we just talk through are good ones, you know, making sure that you know, maybe the policies that people write say that all the servers it's been up and production have to use these trusted binaries or making sure that all the storage that's being used in production. Counts and production applications have to be encrypted at rest or something similar in a networking space. So that's kind of the idea take terraform Cloud which lets developer spin up new resources in public cloud and take styrof which allows the organization as a whole to put guard rails on how those resources are configured.

Overall developers spin up resources very quickly, but safely and securely at the same time. you know and and really to me we've got Two things kind of bringing together here. First of all is the issue of allowing developers to Configure in in the course of their development for these applications sort of access controls.

Right the based on policy which look you know, we talked about shifting left the earlier we get it in the easier it is. Right as things, you know progressively turn to more more chaos as they go right? But secondly, you know when we talk about Cloud security Tim really, you know the cloud has Change the security right?

We're no longer in this mountain castle with that big firewall and and the router in front of it and the IBS IPS and the utms and all of these things and really the you know, the big thing about Cloud security is identity and access control right who you are and based upon that where can you go and what can you do? What do you have access to what do you not have access to what can you set what could you not set and it's these I don't want to use the term Cloud gateways because it's not but it's the it's the it's the IAM aspect. of of you know of security that really is kind of the killer Cloud security app.

Now all too often we we think of IAM is okay two-factor authentication. Let's make sure Tim is really Tim and we don't spend enough time thinking about. Okay.

We know it's Tim and Tim's a good guy, but we still don't trust right? We we've got to make sure this is this is what Tim's this is where Tim's allowed to play. These are the buttons Tim's allowed to press right these there's some things Tim can't change and these sort of policies.

And quite frankly whether we're talking about Tim or or a non-human right a non-person kind of identity. those access controls are I mean vital right? It's the it's the big thing there.

Yeah, so I mean hit on two at least two great points there, right? I mean, I think the second one is is right on the money. Right?

Like I think that what we see is that as an industry. We're just creating more and more complicated software right? It's like if you think about the public Cloud as an example or Salesforce or any of these sass the software solutions that we use frequently.

They're just incredibly complex. And so like just doing authentication just convincing. The machine that I am Tim isn't enough anymore.

They're just too many buttons to your to use your analogy to me Buttons and I you know, I shouldn't be able to push them all you know, and and that's because the space of sort of buttons that exist is just so big and in today's modern modern staff software, so totally totally be there that and therefore the only way to sort of make sure that you've got reasonable controls in place over what buttons people can push is authorization to your point and I agree the more complex these pieces of software get the more important authorization becomes and You're right. Like, you know zero trust is a great, you know concept here in the sense that every piece of software should always support authentication authorization because if you do that very well and you've got finding enough brain controls on those authorization policies that people can set you've you've gotten a long long way toward actually securing your software and meaningful way. Absolutely, and let's spend the moment talking about terraform though, too.

com, he plus years ago. It was Chef it was ansible. It was puppet and that's how people were spending up instances.

in the cloud and and elsewhere You know puppet was recently purchased by drawing a blank this very second Chef is progress software. And so those fought a red hat obviously but really terriform is kind of taking the terraforms kind of what the cool kids are using a little bit right in terms of setting up their Cloud environments. Yeah, yeah.

And I think what what's really powerful about terraform in many ways is something is near and dear to my heart, which is that, you know, the way I look at it is that it lets developers declaratively spec out exactly what resources they want on the public cloud. And so they're terraform defines that nice file format for saying, you know here the servers. I want here this storage systems.

I want to connect here the you know networks that I want to set up and the terraforms job is to be able to take that spec and and render it into the public Cloud for example, and that's incredibly powerful because now you have this file format that's include entirely declarative. So now you can do things like apply policy checks to it to make sure that you know the servers and there are configured correctly or the networks or the storage are all configured correctly. It's also a file format that allows you to do things like check it in to get or any other source control and and that allows you to very easily do kind of a rollback as well.

So if some developer says hey, you know, we're running in production. I need to make a change everything looks right but The end of the day there's something wrong and they only find that out. Once they actually roll those roll that that change out to production then they can very easily roll back because they've got it version controlled.

And so that's I think some of the power the Allure of terraform is that it is that declarative specification for for public Cloud resources that people can look at that machines can look at and analyze and you did and that, you know, obviously for us that you can apply policy to to put a bunch of checks and guardrails in place to make sure that it's all configured the way it should be Absolutely. Tim I you know, you mentioned a native integration look in a world of apis that we live in is it not an API integration then is it a truly native? Oh, well, I mean, yeah, I agree.

Yeah just about every integration is an API based integration, but I think what what you'll see is like if you log into styrate as there is a section where you would go and configure, you know terraform Cloud. So in that sense, it's not it's a deeper integration and simply setting up some web hooks that would call each other's apis. So that's so And I haven't seen this so I'm gonna can't I need you to kind of explain to our audience here.

So you actually you actually spin up and configure terraform from within. Styrots. Well, yeah anyway around yeah.

No it is it is a synergistic relationship between the two products. Right? So a customer will go into terraform cloud and use that and have all their teams use that to go ahead and run terraform plans, right?

So they'll manage their terraform files there. They'll go ahead and execute those plans to create render those resources on on the on the public Cloud. But then with the also do is they'll configure that integration between terraform cloud and styrate Jazz so that every time developer tries to push a change to terraform Cloud care from cloud will call into to styrate as and ask.

Hey is this plan safe to execute before going to head to execute it? And so that's really the relationship there. So, you know, we do the thing that we do best in the world which is, you know, evaluate policy over rich and complicated, you know, configuration files like terraform plans and then and then hear from Does what it does best which is you know manage those terraform files and execute those plans.

I guess I got to ask as long as we're down the throat. Is there an additional charge for this integration are all starred that's customers able to use it. How's that being done?

Yep. So yeah, we we just license based on you know, basically the number of real world systems that you're you're managing policy for with started as and so this is just, you know, if you happen to be managing terraform Cloud policies through us and that's just one more of those. So yeah, it's it's yeah, you're just licensed based on the number of Integrations effectively that that you're that you're using.

cool And just to be clear this this public now available. Yep. Yep.

It's available now go ahead and you know, everybody should check it out. There's a I should say that there is a Dazz free a free version of jazz. Everybody can sign up, you know themselves and check out, you know terraform or you know, we've got obviously Integrations for kubernetes and Envoy and plenty of service message in Gateway.

So yeah, we definitely recommend you can check it out yourself. Where did they go to I'll go just chill in the audience. Okay.

com. That's why our a com right? Got it.

All right. Hey beyond the terraform news, which is great. By the way, anything else exciting you want to tell our audience about Well sure.

Yeah, actually, you know, if you go ahead and sign up for a free account. There's we actually just added some recent functionality that makes it especially easy to go ahead and kind of play play around and explore the product like in the past. We used to have like these tutorials where it's like you as a user would bring, you know a mini Cube and then we would give you sample data and Sample apps, so go ahead and run them and see how that Would help you manage policies for those different kinds of apps and infrastructure, but now recently at least you can go on and and we sort of run all that for you.

So we kind of give you sample data built in and so now you can you can give it a world without ever having to leave the the product so so that's pretty exciting and we think it's pretty easy to use. very cool, man Very cool Tim. Hey, I want to thank you for checking on checking in here with us.

Keep us posted of new styrenews and Oprah and best of luck to you guys. All right. Thank you Alan.

It's been a pleasure always man. Tim Hendricks Hendrix CTO co-founder styra here on Tech stroke TV. We'll take a break.

We'll be right back.