Tech Talks Daily
00:18:23 · Chris Radkowski, Neil C. Hughes
And often to do that, it's a massive manual manual ask to have someone go pull data manually from a system into a spreadsheet to review it. So so those are those are two two critical reasons that organizations are are dealing with now, with respect to point in time access and ensuring that ensuring that, you you know, they have a a system in place to govern that access and check to make sure that no anomalous activity has been has been assigned. I mean, real true point in time access with, you know, dynamic authorization where there's a system that just evaluates, you know, whether you're granted the role or not, I think is... I mean, theoretically possible, but it very, very seldomly implemented in any form or fashion out there with with the current business application environments that we're all in today. [00:19:17] S0: And everything we're talking about here is something that will be impacting every business in every industry of every size. So what does continuous access monitoring look like in practice right now realistically? And how can teams avoid creating just another dashboard that nobody has time to watch because they're suffering from alert fatigue from all the others?
00:19:39 · Chris Radkowski
[00:19:39] S1: That's a great question, Neil. And I would say that, continuous monitoring involves looking at, and and getting a signature on the the transactional data and characteristics that are going on. And I think you wanna try to have an understanding of what what activity is going on and being able to kind of get a signature on what that looks like so you can identify any kind of anomalous transactions. And there's controls in place to make sure that you kind of got guardrails on your process. You know, I mean, spending levels and limits and, you know, volumes of transactions. You know, you have this sort of metadata that you're looking at. And then, you know, increasingly, you know, what Pathhawk has done is done deep integrations with, oh, a 150 plus business applications. And when I say deep integrations, it's being able to to do fine grained user provisioning and, and integrate with the, the activity and transactional logs that these applications are creating. And I think when you have those two sides of the coin, you can really do a deep deep understanding of the activity, through that... Through the through the data that you're collecting. And once you have that data, I think data is data is king, kind of, and you can run all kinds of run all kinds of AI on it to make sure that everything's functioning as it should.
00:21:09 · Neil C. Hughes, Chris Radkowski
[00:21:09] S0: Yeah. And, you know, so much has changed, but, obviously, this is not your first rodeo, Chris. Well, as you said at the very beginning, seventeen years at SAP. So what have you learned about that gap between how ERPs control... Controls are designed and and how they operate in the real world? [00:21:28] S1: So so controls for everyone out there, you know, control can be anything. [00:21:35] S0: Yeah.
00:21:36 · Chris Radkowski
[00:21:36] S1: Control can be, hey. We, you know, we need to achieve the revenue objective this quarter. That's a control. And so a control is just a list of objectives, really, and requirements, and those can be implemented in various different ways. Some systems have configurations that enforce the control, don't allow that control to be performed. And other times, you have to go back and maybe perform more manual tasks. And I think, know, in today's environment, you have a fairly mature set of controls that are available for each of the types of regulations and security regulations. You... You'll probably hear the term ITGCs, I... IT general controls, SOX controls. You know, we talk a lot about SOX controls because these are the controls that go into your your finance process. And so you have different tools in your set of different tools you can you can use to validate that your controls are effective. And that's a key thing. I mean, that's like a a loaded term, controls controls, effectiveness. Oh, if we've had a failure of controls, that is a meaningful, event that occurs. And one of the things that I become fascinated with is is, is talking to people that ever... I have experienced these kinds of things behind the scenes. It's very revealing, and it's not very fun to have a controls failure or have some kind of audit finding or, you know, a material weakness is when you have to report a finding in your your 10 q, your quarterly reporting. And what happens when you have a material weakness is often the case where... And your your your your listeners will know this. Right? If you have a material weakness, it reflects badly on the company. It shows something isn't being well managed, and that affects your brand. It can affect your stock price, you know, the value of your of your company. It's... It can be profound. The impacts can be billions of dollars. Right? And so, I mean, ultimately, yeah, ultimately, we are trying to implement the controls that demonstrate our company is managed properly. And so that we don't have any kind of anomalous findings during... From our auditors that would result in anything we'd ever have to report to, report on our 10 q paperwork.
00:24:00 · Neil C. Hughes
[00:24:00] S0: You mentioned there something that really resonated as well because when things go wrong and that inevitable p one incident drops, technical teams can feel almost like that Spider Man meme with each member pointing at each other. So when something like that happens, where should responsibility sit across when we're talking about security teams, audit, compliance, and transportation teams? And that... So access governance doesn't become everyone's problem and nobody's priority. We've all been in those situations. Right?
00:24:28 · Chris Radkowski
[00:24:28] S1: Jeez. Neil, you've set me up for a softball question because it's a topic I'm fascinated by. You know? And I was at a conference, and I asked that question. I said, what do you guys do when something... Do things go wrong? You know? And and what happens when things go wrong? Yeah. And you can imagine. I mean, this really, really great customer, he's telling me... And he started he started telling me that sometimes the systems don't breathe. And I said, well, what do mean the systems don't breathe? And he was flapping his arms, you know, like like a bird, like a chicken, you know? I wasn't sure. It was a language difference there, but he he said sometimes the system freezes. And I was like, oh, okay. Everybody's experienced their computer freezing. You know? And what do you do? You reboot it. And... Well, okay. So if this computer is running your ERP system that's managing a giant supply chain, it triggers all... It triggers a process. And that process involves... And it happens within ten minutes. Yeah. So that process involves letting letting the, you know, the the the c suite know that there's been an incident. They they bring in, you know, IT experts to try to to diagnose the problem. And, I mean, it is it is a really big deal. Like, you you could have thousands of people, you know, waiting to screw nuts on, you know, with the chassis or, you know, you know, install the engine and so forth. You have a supply chain and an assembly process that's waiting for the system to come back up. And ultimately, in those cases, and there are very few, very rare, but they go in and they may spend two or three hours trying to diagnose the the the channel. Why is the system freezing? And you're turning off processes, turning on processes. We've all been in our computers trying to do that. And then ultimately, if they can't determine the problem, they'll reboot the system. I was completely amazed. So there's there's two there's two sides of the equation. So there's really critical and urgent events, and there's an entire process, and there's a communication chain that is that is created just for this. These are critical and urgent events that have to be dealt with immediately. Impacting your business. Your entire organization is aligned to make... Prioritize whatever activities to get that system up and running. And then there are other cases where may...