WEBVTT 00:00:00.000 --> 00:00:19.000 Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. 00:00:19.000 --> 00:00:21.806 I'm an analyst and advisor with KuppingerCole 00:00:21.806 --> 00:00:24.800 Analysts. My guest today, and I'm really looking 00:00:24.800 --> 00:00:28.097 forward to our conversation, is Warwick Ashford. 00:00:28.097 --> 00:00:31.600 He is the senior analyst at KuppingerCole Analysts. 00:00:31.600 --> 00:00:38.800 And we want to talk about a blog post that you have just written with the nice topic of 00:00:38.800 --> 00:00:41.583 IPSIE. And I love that word. So welcome, 00:00:41.583 --> 00:00:45.200 Warwick. Thanks, Matthias. So great to have you. And 00:00:47.200 --> 00:00:53.500 this topic came across twice in the recent weeks. So I've seen your blog post where you 00:00:53.500 --> 00:00:56.321 cover that as a standard, as a set of standards, 00:00:56.321 --> 00:00:59.200 as a set of profiles. And we had Dick Hart at the 00:01:00.100 --> 00:01:03.900 IFID, the Identity Fabric Impact Day in Munich a 00:01:03.900 --> 00:01:07.700 few weeks ago. And he's one of the chairs in the 00:01:07.700 --> 00:01:09.823 working group that is behind IPSIE. So now 00:01:09.823 --> 00:01:12.300 that I've mentioned it three times or four times, 00:01:14.200 --> 00:01:18.091 before we go into what it actually solves, what 00:01:18.091 --> 00:01:21.900 is IPSIE? What does IPSIE mean? Just before we 00:01:21.900 --> 00:01:26.900 explain what it is and say, okay, which problems is it solving? What does IPSIE actually, 00:01:26.900 --> 00:01:31.600 what is an acronym, right? Yeah, it's a lovely acronym. And as you say, the 00:01:32.200 --> 00:01:36.300 Dick Hart's presentation was really nice. I think he said kind of more IPSIE with less 00:01:36.300 --> 00:01:45.800 OOPSIE or something to that effect. It's actually quite a difficult acronym to 00:01:45.800 --> 00:01:53.200 remember the constituent parts. And I am trying to remember. Yeah. So I think it's a great 00:01:53.200 --> 00:01:57.090 initiative. And so it stands for Interoperability 00:01:57.090 --> 00:02:00.900 Profiling for Secure Identity in the Enterprise. 00:02:01.700 --> 00:02:07.600 So yeah. So we can dig into what that means a little bit later. Exactly. When one starts 00:02:07.600 --> 00:02:12.400 reading your blog post, which I really highly recommend, which is available on our website 00:02:12.400 --> 00:02:16.500 without subscription, just go there, search for Warwick and you will find all for IPSIE, 00:02:16.500 --> 00:02:19.584 which might be easier even because this word is 00:02:19.584 --> 00:02:22.800 not that often. You start that blog post with the 00:02:22.800 --> 00:02:29.500 sentence that identity is still one of the biggest vulnerabilities in modern enterprise 00:02:29.500 --> 00:02:33.400 cybersecurity. And that obviously is true, but 00:02:33.400 --> 00:02:37.300 that has even evolved with the introduction of 00:02:37.300 --> 00:02:40.330 more and more SaaS adoption. Why is that the case? 00:02:40.330 --> 00:02:43.300 Well, first of all, as you say, I think it's safe 00:02:43.300 --> 00:02:46.528 to say that identity is a primary attack vector 00:02:46.528 --> 00:02:50.100 because most cyber attacks still involve compromised 00:02:50.100 --> 00:02:52.950 credentials in some way, whether they're stolen 00:02:52.950 --> 00:02:55.800 or whatever. And that shows that authentication 00:02:55.800 --> 00:02:59.148 and authorization remain weak points despite 00:02:59.148 --> 00:03:02.800 the other security improvements. But as you say, 00:03:02.800 --> 00:03:08.000 the proliferation of SaaS applications has effectively multiplied the number of identity 00:03:08.000 --> 00:03:10.933 systems. So each one's got its own logic for 00:03:10.933 --> 00:03:14.000 sign-on, session management, and provisioning. 00:03:14.600 --> 00:03:17.914 So this increases complexity and the potential 00:03:17.914 --> 00:03:21.300 for misconfigurations. And we know that both of 00:03:21.300 --> 00:03:23.160 these things are well-known enemies of 00:03:23.160 --> 00:03:25.900 security. How long have we been saying complexity is the 00:03:25.900 --> 00:03:29.907 enemy of security? And so as organizations move 00:03:29.907 --> 00:03:34.000 to cloud-first environments, fragmented identity 00:03:34.000 --> 00:03:39.700 architectures make consistent enforcement of policies very difficult. And so this just 00:03:39.700 --> 00:03:46.200 amplifies the risks from things like identity sprawl and poor lifecycle governance. 00:03:46.200 --> 00:03:49.300 And we are preaching this concept of the identity 00:03:49.300 --> 00:03:52.400 fabric. And I think some of our audiences already 00:03:52.400 --> 00:03:56.600 have heard this once or twice from us. But to make sure that you have, on the one hand, 00:03:56.600 --> 00:04:01.800 a proper administration of identities, which is the IGA part. And on the other hand, 00:04:02.700 --> 00:04:10.100 the use of these identities in account-carrying systems like AD, Entra, but also in SaaS 00:04:10.100 --> 00:04:13.344 applications, as you've mentioned. This should 00:04:13.344 --> 00:04:16.800 actually be some kind of solution to the problem. 00:04:16.800 --> 00:04:23.400 But as you said, the more account-storing systems you have, be they in the cloud, be they 00:04:24.100 --> 00:04:28.901 local, complexity rises and we get to this kind 00:04:28.901 --> 00:04:33.600 of fragmentation. And fragmentation also means 00:04:33.600 --> 00:04:36.800 inconsistent standards, inconsistent profiles, 00:04:36.800 --> 00:04:40.000 inconsistent ways how we deal with identities, 00:04:40.000 --> 00:04:46.400 different ways of how we use MFA, etc. So what are the specific problems that come with 00:04:46.400 --> 00:04:48.450 this fragmentation? You've mentioned that 00:04:48.450 --> 00:04:51.200 already on a high level. Maybe you can dig a bit deeper 00:04:51.200 --> 00:04:53.498 into that. Well, you've also kind of touched 00:04:53.498 --> 00:04:55.900 on it too, because developers face integration 00:04:55.900 --> 00:05:01.400 challenges. Because as you said, that each SaaS vendor uses a slightly different version 00:05:01.400 --> 00:05:05.644 or interpretation of common protocols like SAML, 00:05:05.644 --> 00:05:09.800 OIDC, and SCIM. So this leads to repetitive and 00:05:09.800 --> 00:05:12.500 error-prone custom integration work. It has to 00:05:12.500 --> 00:05:15.200 be done for each one of these. So the security 00:05:15.200 --> 00:05:18.280 teams struggle to maintain consistent access 00:05:18.280 --> 00:05:21.500 controls and provisioning. And this results in 00:05:21.500 --> 00:05:24.510 things like orphaned accounts, weak session 00:05:24.510 --> 00:05:27.800 management, and poor visibility across systems. 00:05:27.800 --> 00:05:31.113 So this fragmentation leads to operational 00:05:31.113 --> 00:05:34.900 overhead, compliance uncertainty, and at the end 00:05:34.900 --> 00:05:37.571 of the day, a lack of trust that enterprise 00:05:37.571 --> 00:05:40.800 policies are being enforced correctly across all the 00:05:40.800 --> 00:05:47.100 different SaaS applications. Right. So this is a clear problem statement. So there 00:05:47.100 --> 00:05:51.455 is something to solve. There are issues that can 00:05:51.455 --> 00:05:55.900 be really addressed. And now we get to the point, 00:05:55.900 --> 00:05:59.296 enter IPC. So I look it up. Interoperability 00:05:59.296 --> 00:06:03.000 Profiling for Secure Identity in the Enterprise. 00:06:03.600 --> 00:06:10.500 There's a working group behind that, and they attack or address real-life problems. 00:06:10.500 --> 00:06:13.387 And how does... Oh, and to mention, it's a 00:06:13.387 --> 00:06:17.100 working group within OpenID, the OpenID Foundation. So 00:06:17.100 --> 00:06:22.500 this is something that has some visibility and also some kind of backing in the industry. 00:06:23.700 --> 00:06:26.944 And how does this IPC initiative try to reduce 00:06:26.944 --> 00:06:30.400 complexity and improve interoperability and solve 00:06:30.400 --> 00:06:32.668 everything that you've mentioned, all these 00:06:32.668 --> 00:06:35.200 different kinds of interpretations of standards? 00:06:36.400 --> 00:06:38.807 So, yes. So the mission is to create a 00:06:38.807 --> 00:06:42.100 unified sort of interoperability layer, if you will, 00:06:42.100 --> 00:06:49.600 for the enterprise identity ecosystem using profiles that define exactly how existing 00:06:49.600 --> 00:06:53.163 standards should be implemented consistently and 00:06:53.163 --> 00:06:56.800 securely. So these so-called opinionated profiles 00:06:56.800 --> 00:07:00.050 strip away all the optional features of standards 00:07:00.050 --> 00:07:03.300 to enforce secure interoperable defaults. So this 00:07:03.300 --> 00:07:06.831 introduces also measurable maturity levels for 00:07:06.831 --> 00:07:10.900 areas like SSO, account life cycle, and entitlements. 00:07:10.900 --> 00:07:13.722 And this gives enterprises a framework to 00:07:13.722 --> 00:07:17.300 assess implementation quality. So by enabling things 00:07:17.300 --> 00:07:20.501 like conformance testing and certification, 00:07:20.501 --> 00:07:24.000 IPC ensures applications can be trusted to meet 00:07:24.000 --> 00:07:27.341 uniform security and interoperability criteria 00:07:27.341 --> 00:07:30.900 across the vendors. And as you mentioned, I think 00:07:30.900 --> 00:07:33.820 the fact that it's backed by all these different 00:07:33.820 --> 00:07:36.800 organizations in very much the same way that FIDO 00:07:36.800 --> 00:07:40.440 was. You know, I think that's why FIDO has 00:07:40.440 --> 00:07:44.600 been successful, is that it wasn't just a single 00:07:44.600 --> 00:07:48.135 initiative. It was backed by the industry. And this 00:07:48.135 --> 00:07:51.600 is a rather young and upcoming initiative. So they 00:07:51.600 --> 00:07:53.840 are still working on that, but it's well 00:07:53.840 --> 00:07:57.200 published. So if somebody is interested in, hey, that sounds 00:07:57.200 --> 00:08:00.569 like a good idea to align these individual 00:08:00.569 --> 00:08:04.500 systems so that you have a single set of profiles 00:08:04.500 --> 00:08:08.086 for use of these standards, it's easily available. 00:08:08.086 --> 00:08:11.600 So and if you just google for OpenID and IPC, you 00:08:11.600 --> 00:08:19.600 should be there. So when we look at the maturity levels at the profiles that IPC provides, 00:08:20.100 --> 00:08:24.000 they are around session lifecycle management, account lifecycle management. 00:08:24.000 --> 00:08:27.119 What are the practical implications for enterprise 00:08:27.119 --> 00:08:30.300 implementations? How can you use this in real life? 00:08:31.400 --> 00:08:37.600 Well, it sort of creates a clear roadmap organization showing what a secure 00:08:37.600 --> 00:08:40.567 implementation looks like at different stages 00:08:40.567 --> 00:08:43.600 of the identity management maturity. So as you 00:08:43.600 --> 00:08:50.300 mentioned, for example, if we look at session lifecycle level one, it aligns with NIST's 00:08:50.300 --> 00:08:53.433 federation assurance level two requirements. So 00:08:53.433 --> 00:08:56.500 this is enforcing things like MFA and defining 00:08:56.500 --> 00:09:00.465 strict session lifetimes to reduce exposure. 00:09:00.465 --> 00:09:04.700 So higher levels of SL add capabilities such as 00:09:04.700 --> 00:09:11.000 session state communication between apps and identity providers. And so similarly, account 00:09:11.000 --> 00:09:18.400 lifecycle levels progress from basic user provisioning in AL1 all the way up to AL3, 00:09:18.400 --> 00:09:21.627 which extends automation to include role and 00:09:21.627 --> 00:09:25.000 entitlement synchronization, supporting things 00:09:25.000 --> 00:09:27.708 like least privilege and more dynamic access 00:09:27.708 --> 00:09:30.600 governance. Right. And I think I really get the 00:09:30.600 --> 00:09:37.300 point of where IPC really makes complete sense because people like choice hackers as well, 00:09:38.300 --> 00:09:45.200 because when it's not clear how one key configuration is made this way or that way, 00:09:45.200 --> 00:09:48.886 that's always leaves room for interpretation. 00:09:48.886 --> 00:09:52.900 IPC does not. It really says, OK, do it that way, 00:09:52.900 --> 00:10:02.100 and then you are compliant to IPC and at that specific level. And then you can assume that 00:10:02.100 --> 00:10:09.400 your systems are closer to each other and overall more secure. One point of criticism 00:10:09.400 --> 00:10:13.119 that you've mentioned or not criticism, but at 00:10:13.119 --> 00:10:17.000 least shortcoming as of now for IPC is that it's 00:10:17.000 --> 00:10:21.355 currently very much human focused in terms of 00:10:21.355 --> 00:10:26.000 employee workforce focused. Is this a limitation 00:10:26.000 --> 00:10:28.762 when it comes to the management of these? We 00:10:28.762 --> 00:10:31.900 have them overall in every news of these non-human 00:10:31.900 --> 00:10:34.485 identities. Yeah, absolutely. I mean, you 00:10:34.485 --> 00:10:37.700 know, as we said, IPC addresses real and persistent 00:10:37.700 --> 00:10:43.600 challenges. And by stripping out the choices and enforcing secure defaults, it reduces the 00:10:43.600 --> 00:10:47.000 likelihood of weak or inconsistent implementations, 00:10:47.000 --> 00:10:50.400 which is absolutely essential for interoperability. 00:10:50.400 --> 00:10:53.538 But as you say, the IPC scope is currently 00:10:53.538 --> 00:10:57.200 limited to workforce users and SaaS applications. 00:10:57.200 --> 00:11:01.143 It doesn't cover things like service accounts, 00:11:01.143 --> 00:11:05.600 APIs and machine credentials. And these form a large 00:11:05.600 --> 00:11:11.600 and rapidly growing attack surface. I think non-human identities are increasingly central 00:11:11.600 --> 00:11:18.700 to automated environments. Leaving them out just perpetuates blind spots in access control 00:11:18.700 --> 00:11:24.400 and lifecycle management. And so I think without expanding IPC's framework to include 00:11:24.400 --> 00:11:31.200 non-human entities, enterprises will need separate governance solutions. And then that 00:11:31.800 --> 00:11:33.522 opens them to risk of continued 00:11:33.522 --> 00:11:36.800 fragmentation, which is kind of not a good idea. Right. But 00:11:36.800 --> 00:11:41.000 if you think of a risk-based approach, and this is something that I've been preaching 00:11:41.700 --> 00:11:47.400 all my life. So I think some of the biggest risks that you've mentioned in the beginning 00:11:48.000 --> 00:11:52.696 are people risks, workforce risks, enterprise 00:11:52.696 --> 00:11:57.600 users, human risks in the end. So starting with 00:11:57.600 --> 00:12:00.615 that surely is a good approach. Nevertheless, 00:12:00.615 --> 00:12:04.100 from what we see right now, we said it's an evolving 00:12:04.700 --> 00:12:07.793 kind of standard effort. How can 00:12:07.793 --> 00:12:13.400 organizations still use these profiles, these standards as 00:12:13.400 --> 00:12:19.400 they are described, to increase, to improve their overall identity governance, maybe even 00:12:19.400 --> 00:12:22.500 over to non-human identities? Yeah, I think this 00:12:22.500 --> 00:12:25.600 is a case of one of those things where it's kind 00:12:25.600 --> 00:12:28.533 of better not to wait and see. There is this 00:12:28.533 --> 00:12:31.600 available. So organizations can use it as soon 00:12:31.600 --> 00:12:34.198 as it becomes available. They should start 00:12:34.198 --> 00:12:37.600 looking at it and start using the standardized profiles 00:12:37.600 --> 00:12:42.700 as kind of a foundation for secure SaaS integration. And then they can layer on 00:12:42.700 --> 00:12:45.706 additional controls for machine identity through 00:12:45.706 --> 00:12:48.900 things like lifecycle and secrets management tools. 00:12:49.500 --> 00:12:53.544 But integrating IPCC's compliant SaaS identity 00:12:53.544 --> 00:12:57.500 with an overarching identity fabric will also 00:12:57.500 --> 00:13:05.100 help to maintain consistent policy enforcement across human and non-human identities. And 00:13:05.100 --> 00:13:10.400 enterprises should complement IPCC with governance mechanisms such as automated discovery, 00:13:11.200 --> 00:13:17.100 least privilege enforcement, and continuous monitoring, of course, to achieve a unified 00:13:17.100 --> 00:13:20.031 zero-trust identity model. So it perfectly fits 00:13:20.031 --> 00:13:22.900 into this overall model, this overall identity 00:13:22.900 --> 00:13:25.221 fabric. And that is, I think, also the reason 00:13:25.221 --> 00:13:27.800 why you wrote about that and why we talk about it. 00:13:27.800 --> 00:13:32.500 Because it does not introduce a new set of standards that need to be implemented first, 00:13:32.500 --> 00:13:35.450 and new protocols and stuff. It does not. It just 00:13:35.450 --> 00:13:38.400 gives you guidance on how to implement that, what 00:13:38.400 --> 00:13:41.340 you already have, in a more consistent and, in 00:13:41.340 --> 00:13:44.600 the end, a more secure way. They still need support 00:13:44.600 --> 00:13:47.929 from end users, from people contributing to the 00:13:47.929 --> 00:13:51.400 working group, but also from vendors implementing 00:13:51.400 --> 00:13:54.208 that or integrating that into their framework. 00:13:54.208 --> 00:13:57.200 So there's still a way to go. But that should not 00:13:57.200 --> 00:14:00.647 hinder people in actually using that, right? 00:14:00.647 --> 00:14:04.800 Yeah, I agree. I think IPCC represents real progress. 00:14:04.800 --> 00:14:08.235 Right. So we will watch that space, as we usually 00:14:08.235 --> 00:14:11.600 do. So we covered that in your blog post. We had 00:14:11.600 --> 00:14:14.350 Descartes at the event, and we talked about it 00:14:14.350 --> 00:14:17.100 right now. So if you're interested in having a 00:14:17.100 --> 00:14:22.100 first look at IPCC when you're out there and watching and listening to that, of course, 00:14:22.100 --> 00:14:24.643 Memoirics blog post is a good starting point, 00:14:24.643 --> 00:14:27.300 also with the links to the sources. If you want 00:14:27.300 --> 00:14:30.823 to go directly, you should find it, as I said, 00:14:30.823 --> 00:14:34.500 via Google or the search machine of your choice. 00:14:34.800 --> 00:14:38.035 That should be easily doable, and the profiles 00:14:38.035 --> 00:14:41.200 are not that technical. They're easy to read, 00:14:41.200 --> 00:14:44.232 and it's really something where you can benefit 00:14:44.232 --> 00:14:47.200 immediately from and can improve your security 00:14:47.200 --> 00:14:49.940 posture. So yeah, I think that's it for today. 00:14:49.940 --> 00:14:52.800 We will watch that space. It will evolve because 00:14:52.800 --> 00:14:55.978 it has to. It is not yet fully complete. Not 00:14:55.978 --> 00:14:59.300 every level is fully defined, but what's there 00:14:59.300 --> 00:15:02.977 is ready to use, I think. So thank you again, 00:15:02.977 --> 00:15:06.900 Warwick, for being my guest today. This was fun, 00:15:06.900 --> 00:15:09.500 and really, it's so good to have something that, 00:15:09.500 --> 00:15:12.100 hey, there was an issue. Somebody tried to solve 00:15:12.100 --> 00:15:15.470 it. Here's the first approach. Use it. Isn't 00:15:15.470 --> 00:15:19.300 that great? Yeah. Right. So thank you for being my 00:15:19.300 --> 00:15:21.648 guest, and looking forward to having you in an 00:15:21.648 --> 00:15:24.200 upcoming episode very soon. Thanks, Matthias. Bye. 00:15:24.200 --> 00:15:33.100 Thanks, Warwick. Bye.