The 48th Edition of the Identity Jedi Newsletter

Spicy Corner, 125 Miiiiillion Dollars, and dragons...yup...dragons

Author

David Lee
August 16, 2023

Wednesday 8/16/23 - Identity Jedi Newsletter - Subscribe

Hey Jedi welcome to the 48th edition of the Identity Jedi Newsletter! Summer is dwindling down, kids are returning to school and somewhere, someone is dreaming of pumpkin spice. The smell of fresh cut grass, and the sound helmets and pads colliding.

Fall is coming.

Doesn’t quite have the same ominous tone as “Winter is coming” but I digress. We’ve hit the 600 subscriber mark and growing! Let’s keep this party going! Share the love, contribute to the blog section, let’s take this thing TO THE MOOOOONNN!!!

Where all the cool Identity Nerds Hang Out.

So many good conversations in the IDPro slack channel. The only thing that’s missing IS YOU! Sign up today, and come join in on the conversations.

Let’s Get to the Good Stuff!

  • CISA Guidelines

  • VEZA 125 Million Dollar Baby

  • SPICY CORNER

CISA Guidelines and SCUBA

Ok so the Cybersecurity and Infrastrcuture Security Agency ( CISA ) is finalizing a set of guidelines known as the Secure Cloud User Baseline Assemement ( SCuBA)….oh the acronyms.

The gist: So managing identity and security in the cloud is a tad bit different than on-prem and we maybe, kinda, wanna put some guidelines out of exactly how to do that. I like this for one reason: Regulations,standards, etc drive behavior.

CISA has already published some resources on their way to finalizing SCuBa - A Microsft 365 Baseline Assesment Tool , The SCUBA Technical Reference Architecture ( ← that’s a PDF Doc Link BTW)

Maybe..just maybe we are starting to figure this thing out.

CISA Closing in on Final Cyber Guidelines for Microsoft, Google Cloud

The Cybersecurity and Infrastructure Security Agency (CISA) has led a handful of identity security initiatives over the past year, and, according to a CISA official, is closing in on finalized guidance on recommended cybersecurity configuration baselines for select cloud products – like Microsoft 365 and Google Workspace.

www.meritalk.com/articles/cisa-closing-in-on-final-cyber-guidelines-for-microsoft-google-cloud

VEZA gett 125 Million

Veza announces strategic investments from Capital One Ventures and Service Now Ventrues raising their total financing to 125 MIIILLION Dollars.

(That sound you heard was me typing to see if they are hiring…)

This all feels a little weird for me considering just a couple of months ago I had never heard of Veza, and now it seems like I seem them mentioned everywhere. It’s like the weird car phenomena where you never see a certain car on the streets unitl you decide to get one.

I digress.

What fascinates me about Veza is their use of graphs and relationships. Understanding the how and why someone has access goes a long way in applying proper controls, and it’s something that vendors just haven’t gotten into unitl recently.

What I found most interesting thought is this statement:

“Veza is designed to give organizations insight into who has access to what and why,” said Jaidev Shergill, managing partner, Capital One Ventures. “Governance policies and right-sized authorizations are fundamental as enterprises shift to the cloud. Veza’s Authorization Graph pulls from a range of deep integrations for a more complete access picture and shows early evidence that it can scale.”

Jaidev Shergill, Managing Partner, Capital One Ventures

Here’s what I pick up from that. A more complete access picture. For DECADES we’ve been giving customers an incomplete picture of access. Why? How? We didn’t give enough clarity into WHAT the entitlements where actually giving access to. Or how the entitlments granted that access. Said more succinctly.

Context.

We were not giving customers context in to what access really meant. That’s changing, and its about damn time.

Congrats to the team at Veza, now can they keep it up?

Veza's Financing Totals $125M, Supercharging Identity Security Efforts

Veza, the identity security company, is announcing a major financial milestone with strategic investments from Capital One Ventures and ServiceNow Ventures, bringing Veza's total financing to $125 million.

www.dbta.com/Editorial/News-Flashes/Vezas-Financing-Totals-125M-Supercharging-Identity-Security-Efforts-160047.aspx

🌶️ SPICY CORNER 🌶️ 

WELCOME TO SPICY CORNER

Where we list and grade the spiciest commentary from around the world of identity security.

Disclaimer: The following section is just hilarious to me. I advocate for no particular company, I just like seeing the petty and the spicy.

“CIOs and CISOs are struggling with traditional and legacy tools like IAM, IGA and PAM that have not kept pace with the modern era of multi-identity, multi-cloud, and hybrid cloud

Tharun Thakur, Co-Founder and CEO of VEZA

Unlike legacy identity solutions that use a relational architecture, Veza's unique approach to identity security leverages a revolutionary graph-based architecture, the Veza Authorization Graph. By creating a normalized data model for identities to access permissions to any system, Veza provides a 360-degree view of access across an organization. This enables customers to address key business challenges such as identity governance (IGA), privilege access monitoring, cloud access management, data lake governance, and SaaS access security.

This next piece is an ENTIRE page dedicated to one company. This is just a whole different level of petty…. I love it! But wait it’s get’s better. Check out the query links that you can add to get to certain sections of the page:

  • Don’t Compromise Get Sayvint

  • Sayvint is Better

Why Companies Choose Saviynt Over Sailpoint

Learn why companies choose Saviynt over Sailpoint for Identity Governance and Administration and compare features & capabilities of the two platforms.

saviynt.com/solution-comparison/saviynt-vs-sailpoint

Who knew it was getting so SPICY in these IAM internet streets! Look while this is all in good fun, the reality is the tides are shifting, evolution is coming and everyone is on notice. I’m just waiting for the Apple vs PC like Youtube shorts.

Please let this happen!!

NEW COMMUNITY BLOG POST!!

Big shout to new guest author Michelle Fallon of PlainID. Thanks for adding to the community!

The Benefits of Externalizing Authorization

Enhancing Security and Streamlining Access Control

www.theidentityjedi.com/p/benefits-of-external-authorization

The Rise of Synthetic Identity Fraud: How to Detect and Prevent It - CPO Magazine

Synthetic identity fraud, which takes advantage of flaws in conventional identity verification systems, has emerged as a major threat to cybersecurity. It is challenging to identify this kind of fraud using traditional techniques since it includes the construction of fictional identities using a combination of true and made-up information.

www.cpomagazine.com/cyber-security/the-rise-of-synthetic-identity-fraud-how-to-detect-and-prevent-it

How Zero Trust is changing the identity and access management landscape - Digital Journal

According to Cyber Insights 2023, Zero Trust doesn't replace Identity and Access Management (IAM) but extends its principles to continuously include everyone and everything.

www.digitaljournal.com/business/how-zero-trust-is-changing-the-identity-and-access-management-landscape/article

AI Steals Passwords by Listening to Keystrokes With Scary Accuracy

The AI model trained on typing recorded over a smartphone was able to steal passwords with 95% accuracy.

www.darkreading.com/attacks-breaches/ai-model-can-replicate-password-listening-to-keystrokes

‎Identity at the Center: #226 - Board Conversations with Baber Amin of Veridium on Apple Podcasts

‎Show Identity at the Center, Ep #226 - Board Conversations with Baber Amin of Veridium - Aug 14, 2023

podcasts.apple.com/us/podcast/226-board-conversations-with-baber-amin-of-veridium/id1564331550?i=1000624377016

‎The Didi & Lital Show: Systemic Failures on Apple Podcasts

‎Show The Didi & Lital Show, Ep Systemic Failures - Aug 11, 2023

podcasts.apple.com/us/podcast/the-didi-lital-show/id1654750986?i=1000624148408

Identity Jedi Show Podcast

The Last Word

Let’s be real for a second. Everything in technology changes. As soon as you build an application, your architecture is most likely outdated by the time you hit commit. So the pure fact is that if an identity company is over ten years old, the tech stack they are building on is at least 12 years old. Maybe, maybe they’ve rearchitected, but most likely, they haven’t Tech debt is a real thing, and it’s rare that a company actually spends the investment to fix it. So what happens when you combine old technology, industry leaders, and new modern companies?

DISRUPTION

The identity world is in for a massive shakeup, and it’s coming quicker than you think.

In the wise words of Samuel L. Jackson

Be Good to each other, Be Kind to each other, Love each other

-Identity Jedi

What did you think of this weeks newsletter?

Login or Subscribe to participate in polls.

The JEDI COUNCIL

How to train your dragon…I mean IAM team

Subscribe to Identity Jedi Newsletter to read the rest.

Become a paying subscriber of Identity Jedi Newsletter to get access to this post and other subscriber-only content.

Already a paying subscriber? Sign In

A subscription gets you:
Blogs
Expert Interviews
Expanded Commentary
Early Access to Identity Show content

Join the conversation

or to participate.