Tech Talks Daily
00:13:17 · Neil C. Hughes
[00:13:17] S0: Yeah. And I think it's safe to predict that we're gonna see an explosion in identity management concerns, I should say. We've already seen a lot of solutions that are rising to meet those concerns or or the fear that surrounds it. So for business leaders listening, though, what are the most common warning signs that permissions and conflicting access rights have have actually begun to grow beyond an organization's ability to manage them?
00:13:45 · Chris Radkowski
[00:13:45] S1: Well, this is a growing challenge, and, conflicting and toxic access used to be kind of related to, well, just the ERP system. But but now as we... As we're seeing the compliance regulations evolve, there are additional systems that are coming into scope. You know, Ariba, you know, SAP BTP, Salesforce, and other kinds of systems are all coming into scope. So that's why it's so important to have a system in place where you can detect detect certain kinds of toxic access behind the scenes based on log data, based on transactional information, and monitor that activity so you can advise basis teams, the business on exactly what's going on. And the challenge with the challenge with AI is that a lot of users don't understand the security implications. And so you can grant an AI agent access if you give it your credentials. And that AI access will act just like a user would. It's hard to tell the difference when you're looking after the fact that, you know, it's a user that's, you know, in... Or an AI agent that... That's executing those transactions. And so you need a combination of administrative controls that controls who can grant those credentials and monitoring of the transactional, you know, events that are going on. So I think most business leaders are all in the same boat is that they're watching us very carefully. And, you know, maybe if they haven't worked on a corporate policy, they are thinking about it and what's acceptable and what isn't. Because users are just concerned about getting the job done. If they can do it easier, they might cut corners. And so I think a lot of organizations are are are dealing with that at the moment.
00:15:34 · Neil C. Hughes
[00:15:34] S0: Yeah. 100% with you. And why is it you think traditional point in time access reviews? Why are they struggling in an environment where identities, integrations, and machine access are are constantly changing? What are seeing here?
00:15:48 · Chris Radkowski
[00:15:48] S1: That's a great question, Neil. And so point in time, you know, typically organizations would go through a user access review or a certification on a sort of twice a year basis. Right? But there's a lot of things can happen between that... The... Those particular, reviews. Right? You have a long period of time where entitlements can be assigned to users that shouldn't have, and, you know, events can occur, and the risks the risk is much higher the longer those entitlements or incorrect entitlements have been assigned. And so I think that, given the fact that the scope of the operations that we're all in the systems that we all have to manage has grown so much that ensuring that you have a solution in place that can go through and check these certifications on a more automated basis is essential. I think, before and still, a lot of organizations are doing this manually. You can imagine. They're pulling spreadsheets of users and role assignments. They're trying to upload that into some master spreadsheet, which they send around to reviews. I've seen I've seen a lot of these types of... This this process, user access review, kind of partially automated. But, you know, there are solutions out there that can do this, you know, fully automatically. And one of the key things, I think, with AI that's that's becoming critical is if there is something... If you're monitoring your system and you do find some kind of anomaly, you wanna have a... You wanna have a point in time review. You wanna you wanna be able to initiate that process right away and say, hey. This user has access. It's maybe not consistent with others on his team. You know? Do we need it? Do we need to remove it? And has has anything anomalous been executed? And if so, we better take a look at that. And I think more so this year, I've been I've been seeing, I've been seeing customers that are challenged with look backs. And for those of you that aren't familiar with lookbacks, lookback is when you've had a user access review and you found an anomalous transaction, something a user shouldn't have. Did they execute that? Did they create a PO? Did they, you know, manage a vendor? Did they, you know, change their address since they had that particular assignment maybe months ago? Or somebody left the company and they still have access. Were those transactions executed?
00:18:23 · Chris Radkowski, Neil C. Hughes
And often to do that, it's a massive manual manual ask to have someone go pull data manually from a system into a spreadsheet to review it. So so those are those are two two critical reasons that organizations are are dealing with now, with respect to point in time access and ensuring that ensuring that, you you know, they have a a system in place to govern that access and check to make sure that no anomalous activity has been has been assigned. I mean, real true point in time access with, you know, dynamic authorization where there's a system that just evaluates, you know, whether you're granted the role or not, I think is... I mean, theoretically possible, but it very, very seldomly implemented in any form or fashion out there with with the current business application environments that we're all in today. [00:19:17] S0: And everything we're talking about here is something that will be impacting every business in every industry of every size. So what does continuous access monitoring look like in practice right now realistically? And how can teams avoid creating just another dashboard that nobody has time to watch because they're suffering from alert fatigue from all the others?
00:19:39 · Chris Radkowski
[00:19:39] S1: That's a great question, Neil. And I would say that, continuous monitoring involves looking at, and and getting a signature on the the transactional data and characteristics that are going on. And I think you wanna try to have an understanding of what what activity is going on and being able to kind of get a signature on what that looks like so you can identify any kind of anomalous transactions. And there's controls in place to make sure that you kind of got guardrails on your process. You know, I mean, spending levels and limits and, you know, volumes of transactions. You know, you have this sort of metadata that you're looking at. And then, you know, increasingly, you know, what Pathhawk has done is done deep integrations with, oh, a 150 plus business applications. And when I say deep integrations, it's being able to to do fine grained user provisioning and, and integrate with the, the activity and transactional logs that these applications are creating. And I think when you have those two sides of the coin, you can really do a deep deep understanding of the activity, through that... Through the through the data that you're collecting. And once you have that data, I think data is data is king, kind of, and you can run all kinds of run all kinds of AI on it to make sure that everything's functioning as it should.