Transcript 0:00 The, the privacy regulations are mandating as code now, so they can be updated and authored and managed, right? Just like code is managed. So it's much more suitable for the environments that software is being built in. 0:15 Now, I've probably said a whole bunch of stuff that the average consumer I know is not gonna understand, but the point I'm making is that the way we've been doing policy and these compliance regulations in terms of implementation is also been wrong as well, because software is being updated so regularly that unless you have a different approach to even applying these policies, you're gonna be out of date in a day or so. 0:40 [upbeat music] Welcome back to The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. Hello, listeners, and welcome back to The Peggy Smedley Show. As always, I'm your host, Peggy Smedley. 0:56 My second guest has a strong enterprise security background, having held previous leadership positions, most recently at Centrify and CA Technologies. So please welcome Bill Mann, CEO of Styra. Bill, welcome to the show. 1:14 Hey, good morning. Good to be here. So Bill, we have a lot to talk about. You know, this whole cybersecurity thing has just been a little bit more than most of us should really have to handle. 1:24 I mean, it's been in the spotlight. Organizations, you know, it's kind of crazy. You'd think they've known about it all along that they need to really kind of focus on what they need to do to protect themselves. 1:36 But it seems like until we see some crazy hacking, Russia, China, whoever you want to say is hacking, but we know the bad actors are doing everything they can to penetrate our cyber defenses. 1:50 So unfortunately, whatever it is, whatever those bad actors, those nefarious characters, we are paying closer attention to our cyber. Why isn't authentication enough on its own, and how does authorization help here? 2:07 I mean, what do we really got to be doing? Sure. Yeah, that's-- there's a lot to unpack there, right? So, uh, so, you know, you know, firstly, you're right about the kind of the overall security market. 2:18 It's, you know, it's not that people don't care, it's, it's just getting more and more complex, right? 2:23 You know, it's like all of these things, as we get more and more technology, there's, there's more and more moving parts around, and it's getting complex for all organizations. 2:33 Now, when it comes to authentication and authorization, uh, let me just kind of like, you know, baseline here, you know, what they are first, right? 2:41 So authentication is, you know, the identity of an individual or a service. Authorization is what that person or that service can do. And there's two different things here. 2:51 You know, you know, let me just for the, for the, for the, for the audience, you know, let's-- why don't we talk cybersecurity for a second. 2:57 If somebody's coming to your house, you auth-authenticate them before they, they come to your house. But, you know, the rooms that they could walk in, that's authorization. 3:05 So authorization is just a, a large part of the security mix. 3:09 And one of the things to your earlier kind of remarks, right, is what we're finding is bad actors are getting into organizations, and when they do get through org-- They're getting through organizations by stealing identities and so forth, but when they're in the organization, they're able to traverse the organization, traverse and ac-have access to data because of the authorization problem, right? 3:33 You know, what can they actually do once they're in the organization? So that at the million foot level is what the difference between authentication and authorization. 3:43 And don't get me wrong, there's been great, great efforts, right, in the authentication space, you know, multi-factor authentication. We're all using, you know, our phones to authenticate and so forth. That's all great. 3:54 That's perfect, right? And m-I'm the first to say y-one, an organization has to implement them. 4:00 But now, you know, companies like Styra, we've started focusing on that second problem, which is the authorization problem, which is once a person's or a service is inside the organization, what can you do? 4:13 And, um, and I can speak a lot about that particular subject because it's becoming more and more important in the industry now, uh, for three factors. Uh, so the three factors are the following. 4:26 Number one is, as you know, we care way more about privacy and security than ever before. 4:32 You know, even as consumers, we're being, you know, even more, uh, diligent about, you know, sharing our photos and so forth, right? 4:40 And then you've got all these, you know, states who are now putting in place, you know, privacy acts and so forth. Well, that's like Colorado, right? I mean, I mean, that's one of the... 4:47 And we can talk about that, but that's what they're focusing on there, I mean, because we put out everything in this world today. That's right. That's right. 4:55 So that's one of the drivers for, for trying to solve the authorization problem, exactly what you've just mentioned in Colorado. But there's two other factors as well. 5:04 The second factor is the fact that all companies who are building software now are trying to build these softwares on what's called a cloud native application stack. 5:13 In, in simple words, everybody wants an, an application to kind of run and behave, you know, like a Google application. It, it's got to be mobile friendly. 5:21 It's got to scale up and scale down as users, you know, are added to the environment. So the, the technologies that are under-underpinning the application are now modern technologies, and there's m-lots of moving parts. 5:35 You know, you might have heard of terms like Kubernetes and service meshes and so forth. So that's the second thing. And then the third thing is we're all trying to innovate faster. 5:44 Uh, you've seen it in other industries, right? So, you know, software is, you know, you know, ruling the world now. So, you know, developers are pushing code into production faster. 5:53 You know, there's more and more releases happening on a daily basis and so forth. 5:58 So, you know, these three factors, you know, privacy, cloud native architectures, and the fact that developers are trying to push code into production faster, all means that this authorization... 6:09 problem, which we didn't solve in the old world, you know, and you can see that from all the breaches that were reported. 6:15 We're definitely not gonna be able to solve it in the new world, and that's the, the kind of the problem area that we're focused on solving. So you solve that, but now where does the ownership of this come in? 6:28 Do we have to have... You know, I hate to say this. Do we need more regulation? 6:32 I mean, because now we have, like what I just mentioned, earlier this month I think or, or, or, or maybe even before that, we had Colorado pass their own privacy. You have California has their Consumer Privacy Act. 6:45 You have the GDPR has their own. I mean, there's a growing number of these, and, and, and we, it, it starts to become like this whole potpourri of regulations, but then how do you manage all this? 6:58 I mean, are we really coming that we've gotta have all these consumer data regulations? How do you manage that? How do you really know what's happening? 7:07 I mean, it just becomes everybody's doing all these different kinds of things. 7:11 Now, you just described these, this three-pronged approach in some ways, but yet, you know, the bad actors are, are, are doing a lot of different things, too, but everybody's doing their own thing, too. 7:24 I, it, it seems like we're all going in different directions. Well, you know, I don't think we're going in different directions. I think these, uh, 7:31 these new, uh, you know, policies that are being put in place, like the privacy regulations are, are great things, are absolutely great things, but they're top of the, they're top of the stack kind of directions for organizations, right? 7:42 Yeah, maybe that's a better way of putting it. They're, they're, they're one way, but not... They're part of the pie. They're not the whole pie. 7:50 I guess that's maybe what I should say is, is just doesn't seem like we're, we're working together. I think we're all working in our own direction, but we're not working, we're not rowing in the same direction. 8:00 Maybe that's... I, I, I, I just feel like when we're all doing these ha- ha, we're missing, we're not all keeping our eye on the same ball. 8:09 Yeah, you know, I, I think it can appear that way, and, and certainly, you know, perception is reality, right? But I think that the industry, uh, is going in the right direction. 8:19 I mean, you need to have these regulations at the top level, but the, I think one, one of your frustrations, and I'm, and I, and I agree with you, is how do you implement these things, right? 8:28 And the implementation has to be done in the software itself, and the approaches to implementation can't be done in a, you know, in a fragmented way. 8:38 And the whole implementation has to be done in a different way as well. 8:42 And, uh, and I won't go into this in a lot of detail, but, uh, let me just point out one of the problems, right, which I, I am sure you'll agree with, which is, you know, at the high level you have these regulations, and at the low level within organizations you have developers who don't understand these regulations at all, and they're being asked to implement those regulations within the software that consumers are using. 9:05 And the approach that companies like Styra are taking are, is very different, right? You know, it's called policy as code, right? 9:13 They're almost treating these compliance policies that the, the, the privacy regulations are mandating as code now so they can be updated and authored and managed, right, just like code is managed. 9:27 So it's much more, you know, suitable for the environments that software is being built in. 9:32 Now, I've probably said a whole bunch of stuff that, you know, the average consumer I know is not gonna understand, but the point I'm making is that the way we've been doing policy and these compliance regulations in terms of implementation is also been wrong as well, uh, because, you know, software is being updated so regularly, right, that unless you have a different approach to even applying these policies, you're gonna be out of date, you know, in a day or so. 9:59 I mean, if you look at some of these breaches, uh, you know, last year when there was breaches around some of the, the Microsoft stack, and it was learned that, you know, the, the, the patches had not been, you know, fully, uh, implemented in the organization. 10:13 That's just an, an example of old software if it was patched, it would've been okay, but it wasn't, right? 10:19 And in this new world, you've got new software being published on a daily basis, you know, to get new features out the door and so forth. 10:26 And if you take that old kind of approach of, you know, implementing policies after the fact, you're never gonna get, you know, up to date with, you know, uh, the regulations and so forth, and you're gonna have bla- bad actors taking advantage of it. 10:39 So these kind of approaches that I'm describing here, which is policy as code, almost go back to the basic principles of saying whenever you're gonna release code, you're gonna implement policy then, so it's gonna be up to date all the time. 10:53 Does that make sense? Oh, absolutely. And it almost says to me, we almost have to look at that open source idea that you're describing because it sounds, as an industry, we have to be working together to implement this. 11:06 That's right. So, you know, I, I didn't mention that, but, you know, the, the, so, you know, if I, if I spend a couple of seconds on, on how we're doing this, and, uh, it, it's also very different as well. 11:16 So, you know, we're the company that created this open source project called Open Policy Agent, and, uh, it's part of something called Cloud Native Computing Found- Foundation, which is a Linux foundation, and it's an open source project, you know, which by definition means that, uh, there's a lot of organizations, you know, we're the creators of it and the maintainers of it, but there's a lot of organizations that have contributed to this open source project. 11:41 And one of the reasons we created it and actually put it into the open source is we as an industry can then kind of move the, the, the, the, the education and the benefits of technology forward rather than kind of keeping it closed source. 11:56 So that's another kind of dynamic which is changing in the industry, which is open source software used for security, which is gonna, you know, ultimately aid all of us around the world, right, in terms of improving our security posture.And I think it makes sense because it's, it's advanced other areas. 12:15 We've seen it happen when we look at other technologies when it's been open sourced. We've seen over the years we move faster when things are open source. Why wouldn't it be the same with security? Oh, absolutely. 12:27 I mean, you know, you're seeing all these, uh, rocket launches, what, the one today- [laughs]... as well. I mean, look at it. 12:31 I mean, it's all because of original kind of open source or, you know, technologies being shared across a community, and that's exactly what we're doing as well. We've created this open source community. 12:42 You know, there's, you know, large vendors like Microsoft and Google participating and lots of other participants, and absolutely, right? 12:49 Once you put something out in the open source, then, uh, great developers, you know, uh, start contributing it, and the whole project improves, which means that the security posture gets improved. 13:00 And as organizations start adopting it, for instance, we've got over 18 million downloads of Open Policy Agent now, and it's been used by a lot of the major organizations that are now building new, you know, applications on what I called earlier on the cloud native architecture, and they're using OPA as an authorization open source project within those, within those app stacks. 13:23 Do s- executives understand the investments that have to be made now? 13:28 Because over time it's been a secondary thought, I hate to say, but I think we're getting better to know that we've got to put the right eyes and minds and dollars behind keeping security foremost at, at every operation, every enterprise. 13:45 Yeah. I, I think they do. You know what? I think, I think it's naive now to think that na- uh, executives don't understand the importance of security and the fact that it's a, it's a budget... 13:55 It, it's a, it's a, it's a line item on their budget that has to be growing over time. I think, uh, the days, the days of them understanding it is gone. 14:03 I think now the complexity is what to focus on, uh, in terms of, you know, investment in security, and certainly, you know, authorization is a preventative control. 14:15 Uh, what I mean by that is, you know, when you put a, a, a really good lock on your front door at home, it, you know, it's only gonna pay off when there's a burglar, right? 14:25 There, there's preventative controls like cameras and so forth which can sense things. 14:29 So that's the kind of debate within kind of, you know, uh, o- o- office of the, you know, CSO now within organizations in how much dollars do you spend on preventative versus reactive kind of controls. 14:40 And certainly more dollars are being spent now over time on preventative controls 'cause preventative controls need more thoughtful, thoughtful kind of implementation. 14:51 Policy itself is a complex thing, defining who has access to what, what services can have access to other things. 14:58 Tools around those are important to implement within an organization, and we're finding a, a lot more adoption of these kind of technologies and a lot more budget being allocated in to these kind of technologies. 15:11 I have to tell you, Bill, this has been an amazing conversation. You will have to come back and talk more about this because I've learned so much. Bill Mann, CEO of Styra, thank you so much for your time today. 15:23 What's your URL so our listeners can learn more about what you're doing and certainly help them keep their enterprises safe and secure? 15:31 Well, the website for Styra is styra.com, and if they want to learn about the open source project, it's open s- openpolicyagent.org. Bill, thank you again. I appreciate all your time today. Thank you. 15:43 Okay, listeners, that's all the time we have for the show today. 15:46 You can share your thoughts with us at connectedwmag, which we'd love to hear what you thought about today's discussion, 'cause it was really, really educational, and I appreciate that. 15:54 But remember, we are broadcast live every Tuesday at 12:00 PM Central. Check out our website at connectedworld.com or the show website at peggysmedleyshow.com. 16:04 All right, this is The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. And remember, with great technology comes great responsibility. Have an awesome week. [outro music]
