(upbeat music)
>> Narrator: Live from New York City
It's theCUBE, covering CyberConnect 2017.
Brought to you by Centrify and
the Institute for Critical Infrastructure Technology.
>> Hey, welcome back everyone.
Live here in New York
is theCUBE's exclusive coverage of Centrify's
CyberConnect 2017, presented by Centrify.
It's an industry event that Centrify is underwriting
but it's really not a Centrify event, it's really
where industry and government are coming together
to talk about the best practices of architecture,
how to solve the biggest crisis of our generation,
and the computer industry that is security.
I am John Furrier, with my co-host Dave Vellante.
Next guest: David McNeely, who is the vice president of
product strategy with Centrify, welcome to theCUBE.
>> Great, thank you for having me.
>> Thanks for coming on.
I'm really impressed by Centrify's approach here.
You're underwriting the event but it's not
a Centrify commercial.
>> Right
>> This is about the core issues of the community
coming together, and the culture of tech.
>> Right.
>> You are the product.
You got some great props from the general on stage.
You guys are foundational.
What does that mean, when he said that Centrify could be
a foundational element for solving this problem?
>> Well, I think a lot of it has to do with if you look
at the problems that people are facing, the breaches are
misusing computers in order to use your account.
If your account is authorized to still gain access
to a particular resource, whether that be servers
or databases, somehow the software and the systems that
we put in place, and even some of the policies need
to be retrofitted in order to go back and make sure
that it really is a human gaining access
to things, and not malware running around
the network with compromised credentials.
We've been spending a lot more time trying to help
customers eliminate the use of passwords
and try to move to stronger authentication.
Most of the regulations now start talking
about strong authentication but what does that really mean?
It can't just be a one time passcode delivered
to your phone.
They've figured out ways to break into that.
>> Certificates are being hacked and date just came out at
SourceStory even before iStekNET's certificate authorities,
are being compromised even before
the big worm hit in what he
calls the Atom Bomb of Malware.
But this is the new trend that we are seeing
is that the independent credentials of a user
is being authentically compromised with the Equifax
and all these breaches where all personal information
is out there, this is a growth area for the hacks that
people are actually getting compromised
emails and sending them.
How do you know it's not a fake account if
you think it's your friend? >> Exactly.
>> And that's the growth area, right?
>> The biggest problem is trying to make sure
that if you do allow someone to use my device here
to gain access to my mail account, how do we
make it stronger?
How do we make sure that it really
is David that is logged onto the account?
If you think about it, my laptop, my iPad, my phone
all authenticate and access the same email account
and if that's only protected with a password
then how good is that?
How hard is it to break passwords?
So we are starting to challenge a lot of base assumptions
about different ways to do security because
if you look at some of the tools that the hackers have
their tooling is getting better all the time.
>> So when, go ahead, sorry. finish your thoughts.
>> Tools like their HashCat can break passwords.
Like millions and millions a second.
>> You're hacked, and basically out there.
>> When you talk about eliminating passwords,
you're talking about doing things other than
just passwords, or you mean eliminating passwords?
>> I mean eliminating passwords.
>> So how does that work?
>> The way that works is you have to have a stronger
vetting process around who the person is,
and this is actually going to be a challenge
as people start looking at How do you vet a person?
We ask them a whole bunch of questions: your mother's maiden
name, where you've lived, other stuff that Equifax asked--
>> Yeah, yeah, yeah, everybody has.
>> We ask you all of that information
to find out is it really you?.
But really the best way to do it now is going to be
go back to government issued IDs
because they have a vetting process where they're
establishing an identity for you.
You've got a driver's license, we all
have social security numbers, maybe a passport.
That kind of information is really
the only way to start making sure it really is me.
This is where you start, and the next place
is assigning a stronger credential.
So there is a way to get a strong credential
on to your mobile device.
The issuance process itself
generates the first key pair inside the device
in a protected place, that can't be compromised
because it is part of the hardware, part of the chip
that runs the processes of the phone
and that starts acting as strong as a smart card.
In the government they call it derived credentials.
It's kind of new technology, NIST has had described
documentation on how to make that work for quite some time
but actually implementing it and delivering it as a solution
that can be used for authentication
to other things is kind of new here.
>> A big theme of your talk tomorrow is on designing
this in, so with all of this infrastructure out there
I presume you can't just bolt this stuff on
and spread it in a peanut butter spread across,
so how do we solve that problem?
Is it just going to take time--
>> Well that's actually--
>> New infrastructure? Modernization?
>> Dr. Ron Ross is going to be joining me tomorrow
and he is from the NIST, and we will be talking
with him about some of these security frameworks
that they've created.
There's cyber security framework,
there's also other guidance that they've
created, the NIST 800-160,
that describe how to start building security
in from the very start.
We actually have to back all the way
up to the app developer and the operating system developers
and get them to design security into the applications
and also into the operating systems in such a way
that you can trust the OS.
Applications sitting
on top of an untrusted operating system is not very good
so the applications have to be sitting on top of
trusted operating systems.
Then we will probably get into
a little bit of the newer technology.
I am starting to find a lot of our customers
that move to cloud based infostructures,
starting to move their applications into containers
where there is a container around the application,
and actually is not bound so heavily to the OS.
I can deploy as many of these app containers
as I want and start scaling those out.
>> So separate the workload from some of your infostructure.
You're kind of seeing that trend?
>> Exactly and that changes a whole lot of the way
we look at security.
So now your security boundary
is not the machine or the computer,
it's now the application container.
>> You are the product strategist.
You have the keys to the kingdom at Centrify,
but we also heard today that
it's a moving train, this business, it's not like
you can lock into someone.
Dave calls it the silver bullet
and it's hard to get a silver bullet in security.
How do you balance the speed of the game, the product
strategy, and how do you guys deal with bringing
customer solutions to the market that has
an architectural scalability to it?
Because that's the challenge.
I am a slow enterprise, but I want to implement a product,
I don't want to be obsolete by the time I roll it out.
I need to have a scalable solution
that can give me the head room and flexibility.
So you're bringing a lot to the table.
Explain what's going on in that dynamic.
>> There's a lot of the,
I try as much as possible to adhere to standards
before they exist and push and promote those
like on the authentication side of things.
For the longest time we used LDAP and Kerberos
to authenticate computers, to act a directory.
Now almost all of the web app develops are using
SAML or OpenID Connect or OLAF too as a mechanism
for authenticating the applications.
Just keeping up with standards like that
is one of the best ways.
That way the technologies
and tools that we deliver just have APIs that
the app developers can use and take advantage of.
>> So I wanted to follow up on that
because I was going to ask you.
Isn't there a sort of
organizational friction in that you've got companies,
if you have to go back to the developers
and the guys who are writing code around the OS,
there's an incentive from up top to go for fast profits.
Get to market as soon as you can.
If I understand what you just said,
if you are able to use open source
standards, things like OLAF, that maybe could accelerate
your time to market.
Help me square that circle.
Is there an inherent conflict between
the desire to get short term profits
versus designing in good security?
>> It does take a little bit of time to design,
build, and deliver products, but as we moved
to cloud based infostructure we are able
to more rapidly deploy and release features.
Part of having a cloud service, we update that every month.
Every 30 days we have a new version of that rolling out
that's got new capabilities in it.
Part of adapting an agile delivery models,
but everything we deliver also has an API
so when we go back and talk to the customers
and the developer at the customer organizations
we have a rich set of APIs that the cloud service exposes.
If they uncover a use case or a situation
that requires something new or different that we don't have
then that's when I go back to the product managers
and engineering teams and talk about adding
that new capability into the cloud service,
which we can expect the monthly cadence
helps me deliver that more rapidly to the market.
>> So as you look at the bell curve in the client base,
what's the shape of those that are
kind of on the cutting edge and doing
by definition, I shouldn't use the term cutting edge,
but on the path to designing in as you would prescribe?
What's it look like?
Is it 2080? 199?
>> That's going to be hard to put a number on.
Most of the customers are covering the basics
with respect to consolidating identities,
moving to stronger authetication,
I'm finding one of the areas that the more mature companies
have adopted as this just in time notion
where by default nobody has any rights
to gain access to either systems or applications,
and moving it to a workflow request access model.
So that's the one that's a little bit newer
that fewer of my customers are using
but most everybody wants to adopt.
If you think about some of the attacks
that have taken place, if I can get a piece
of email to you, and you think it's me
and you open up the attachment,
at that point you are now infected
and the malware that's on your machine
has the ability to use your account
to start moving around and authenticating
the things that you are authorized to get to.
So if I can send that piece of email
and accomplish that, I might target a system administrator
or system admins and go try to use their account
because it's already authorized to go long onto the database
servers, which is what I'm trying to get to.
Now if we could flip it say well, yeah.
He's a database admin but if he doesn't
have permissions to go log onto
anything right now and he has to make a request
then the malware can't make the request
and can't get the approval of the manager
in order to go gain access to the database.
>> Now, again, I want to explore the organizational friction.
Does that slow down the organization's ability
to conduct business and will it be pushed back
from the user base or can you make that transparent?
>> It does slow things down.
We're talking about process--
>> That's what it is.
It's a choice that organizations
have to make if you care about the long term
health of your company, your brand, your revenues
or do you want to go for the short term profit?
>> That is one of the biggest challenges that we describe
in the software world as technical debt.
Some IT organizations may as well.
It's just the way things happen in the process
by which people adhere to things.
We find all to often that people will
use the password vault for example
and go check out the administrator password
or their Dash-A account.
It's authorized to log on to any Windows computer
in the entire network that has an admin.
And if they check it out, and they get to
use it all day long, like okay
did you put it in Clipboard?
Malware knows how to get to your clipboard.
Did you put it in a notepad document stored
on your desktop?
Guess what?
Malware knows how to get to that.
So now we've got a system might which people
might check out a password and Malware
can get to that password and use it for the whole day.
Maybe at the end of the day the password vault
can rotate the password so that it is not long lived.
The process is what's wrong there.
We allow humans to continue to do things
in a bad way just because it's easy.
>> The human error is a huge part in this.
Administrators have their own identity.
Systems have a big problem.
We are with David McNeely, the vice president
of product strategy with Centrify.
I've got to get your take on Jim Ruth's,
the chief security officer for Etna that was on the stage,
great presentation.
He's really talking about
the cutting edge things that he's doing unconventionally
he says, but it's the only way for him
to attack the problem.
He did do a shout out for Centrify.
Congratulations on that.
He was getting at a whole new way
to reimagine security and he brought up that civilizations
crumble when you lose trust.
Huge issues.
How would you guys
seeing that help you guys solve problems for your customers?
Is Etna a tell-sign for which direction to go?
>> Absolutely, I mean if you think about problem
we just described here the SysAdmin now needs
to make a workflow style request to gain access
to a machine, the problem is that takes time.
It involves humans and process change.
It would be a whole lot nicer, and we've already
been delivering solutions that do this
Machine learning behavior-based access controls.
We tied it into our multifactor authentication system.
The whole idea was to get the computers
to make a decision based on behavior.
Is it really David at the keyboard
trying to gain access to a target application or a server?
The machine can learn by patterns and by looking
at my historical access to go determine
does that look, and smell, and feel like David?
>> The machine learning, for example.
>> Right and that's a huge part of it, right?
Because if we can get the computers to make these decisions
automatically, then we eliminate so much time
that is being chewed up by humans and putting things
into a queue and then waiting for somebody to investigate.
>> What's the impact of machine-learning on security
in your opinion?
Is it massive in the sense of,
obviously it's breached, no it's going to be significant,
but what areas is it attacking?
The speed of the solution?
The amount of data it can go through?
Unique domain expertise of the applications?
Where is the a-ha, moment for
the machine learning value proposition?
>> It's really going to help us enormously
on making more intelligent decisions.
If you think about access control systems,
they all make a decision based on did you supply
the correct user ID and password, or credential,
or did you have access to whatever that resource is?
But we only looked at two things.
The authentication, and the access policy,
and these behavior based systems,
they look at a lot of other things.
He mentioned 60 different attributes
that they're looking at.
And all of these attributes, we're looking at
where's David's iPad?
What's the location
of my laptop, which would be in the room upstairs,
my phone is nearby, and making sure that somebody
is not trying to use my account from California
because there's no way I could get
from here to California at a rapid pace.
>> Final question for you while we have
a couple seconds left here.
What is the value propositions for Centrify?
If you had the bottom line of
the product strategy in a nutshell?
>> Well, kind of a tough one there.
>> Identity? Stop the Breach is the tagline.
Is it the identity?
Is it the tech?
Is it the workflow? >> Identity and access control.
At the end of the day
we are trying to provide identity and access controls
around how a user accesses an application,
how we access servers, privileged accounts,
how you would access your mobile device
and your mobile device accesses applications.
Basically, if you think about what defines
an organization, identity, the humans that work
at an organization and your rights
to go gain access to applications is what links
everything together because as you start
adopting cloud services as we've adopted mobile devices,
there's no perimeter any more really for the company.
Identity makes up the definition
and the boundary of the organization.
>> Alright, David McNeely, vice president
of product strategy, Centrify.
More live coverage, here in New York City
from theCUBE, at CyberConnect 2017.
The inaugural event.
Cube coverage continues after this short break.
(upbeat music)