Cracking the Complexity: Teleport CEO Pushes Identity-First Security  ## Metadata - Author: [[The New Stack Podcast]] - Full Title: Cracking the Complexity: Teleport CEO Pushes Identity-First Security - Category: #podcasts - URL: https://share.snipd.com/episode/58403817-92dc-4fef-91fc-5e22b9910b6a ## Document Notes ## Highlights - **Trustworthiness Requires Identity** - Infrastructure is not trustworthy due to anonymity and complexity despite being made of trustworthy devices. - Adding an identity layer creates a secure, trustworthy environment with higher engineering productivity. Transcript: Ev Kontsevoy And the reason why we're working on this problem is because the stats that you just quoted, I'm actually surprised that breaches are only growing at 10% year over year. It should be way faster than that. It's because our infrastructure fundamentally is not trustworthy. And there is a somewhat formal definition of trustworthy computing. Our laptops are trustworthy. Our cell phones are trustworthy. This is why no one is breaking into a phone wirelessly. But paradoxically, when we take these trustworthy computers and we combine them into computing environments, like data centers or AWS accounts, those environments are not trustworthy. And the reason why they're not trustworthy is because there is a lot of anonymity happening. And that's the problem we solve. So by adding a layer of identity into your infrastructure stack, you're creating a trustworthy environment, which is incredibly, incredibly hard to hack into and also has a very nice Side effect. In fact, extremely nice. These trusted environments that we create make engineering's productivity and happiness much, much higher. Heather Joslin So, it's a big important topic. Let's get started. What are some of the biggest challenges around governing access to infrastructure? Ev Kontsevoy There is just one. One kind of root challenge that has all kinds of sides that we see. And that challenge is complexity. I oftentimes use this example, but like when Mark Zuckerberg started Facebook back in the day, you only needed to learn four technologies to start and build a multi-billion dollar Company. It was the LAMP stack, remember? Linux, Apache, PHP, MySQL. Learn how secure are those four things, and you're off to the races. But today, if you talk to an average attendee at KubeCon and they ask them how many technologies you have in your computing environments, they're going to be talking to you for an hour, Layer after layer of technologies, and every single layer listens in the network socket, has its own user management, has its own privilege management, has its own audit implication, Has its own required expertise to secure. That complexity is the overwhelming challenge. Complexity breeds human mistakes. Complexity breeds fragmentation of identity, fragmentation of policy, fragmentation of access. That, again, breeds more and more human errors. ([Time 0:01:59](https://share.snipd.com/snip/7aee4a79-276b-45a4-a1ed-8de95142d787)) - **Complexity Breeds Security Risks** - Complexity in infrastructure leads to fragmented policies and identities, causing human errors. - Attackers exploit these errors, making complexity the root challenge in access governance. Transcript: Ev Kontsevoy Is just one. One kind of root challenge that has all kinds of sides that we see. And that challenge is complexity. I oftentimes use this example, but like when Mark Zuckerberg started Facebook back in the day, you only needed to learn four technologies to start and build a multi-billion dollar Company. It was the LAMP stack, remember? Linux, Apache, PHP, MySQL. Learn how secure are those four things, and you're off to the races. But today, if you talk to an average attendee at KubeCon and they ask them how many technologies you have in your computing environments, they're going to be talking to you for an hour, Layer after layer of technologies, and every single layer listens in the network socket, has its own user management, has its own privilege management, has its own audit implication, Has its own required expertise to secure. That complexity is the overwhelming challenge. Complexity breeds human mistakes. Complexity breeds fragmentation of identity, fragmentation of policy, fragmentation of access. That, again, breeds more and more human errors. And that's what attackers are looking for. They exploit your human mistakes. Then they steal some kind of credentials, some kind of secret. Then they use that secret to get back in, into the foothold of your infrastructure. ([Time 0:03:28](https://share.snipd.com/snip/d61b87c9-37bf-4e08-a35b-9ab1c5a7180a)) - **Mistakes from No Environment Identity** - Engineers often accidentally delete production data mistaking it for staging. - This arises because environments lack distinct identities, relying only on conventions. Transcript: Ev Kontsevoy Complexity, again, causes human mistakes, and those human mistakes can take all shapes or form. Talk to any engineer here, and everyone will share a story of them or their friend accidentally dropping a production database because they thought by mistake that, oh, I thought it Was staging environment. So where is that mistake coming from? It comes from the fact that your staging and production environment don't have any identity. Like they only separate it by a process or by convention. So it's really easy for engineers to make a mistake and accidentally delete customer data. ([Time 0:05:18](https://share.snipd.com/snip/f9d986a7-6217-4f1c-89f7-e6c8a1713495)) - **Zero Trust Depends on Unified Identity** - Zero Trust means authenticating and encrypting every connection between parties. - The identity fragmentation across systems prevents full Zero Trust implementation. Transcript: Ev Kontsevoy Well, zero trust originally came out of paper published by Google, so we can talk about all these different kind important bullet points that was in the paper. Yeah. But for, like, just to make this conversation easy to understand and kind of entertaining for the audience, Zero Trust is fundamentally a very simple concept. Yeah. Which means that every network connection between two parties must always be authenticated and encrypted at the end of the day. It's not a technology. We already have technologies to encrypt and authenticate. Zero Trust is an approach. It's an architecture. So you must make sure that all connections are authenticated and encrypted. What problems, what organizations are struggling with is to actually implement zero trust. You cannot have zero trust connectivity by just buying a product. Again, because zero trust is not a technology. Zero trust is a process, is an architecture. But because of all this complexity that you have and because of all this fragmentation of identities, for example, identities of engineers are usually managed one system, something Like OXA or Active Directory. And identity of their laptops is managed by something else. Identity of servers managed by something else. Identity of workloads, identity of AI agents. So all types of identities, and if they're all managed by different systems, which means that they are anonymous to each other. Because these are not integrated. So you cannot implement zero trust fully, fully everywhere in your infrastructure. ([Time 0:06:26](https://share.snipd.com/snip/5e5a2a70-e081-4070-9f49-aab8948ee08e)) - **Adopt Strong Identity Implementations** - Use strong identity implementations based on physical and cryptographic elements instead of just passwords. - Strong identities like TPM and biometrics resist cloning and reduce identity compromise risks. Transcript: Ev Kontsevoy So when we're talking about compromised identity, it's important to also talk about quality of identity implementation. All identities are not created equal. You might have weak identities on one side and strong identity implementation the other. So a weak identity example is a username and a password in some kind of database. So then you can improve it a little bit by adding maybe a multi-factor authentication. And we all know how hackers, how creative they can be to exploit that identity and effectively steal it. Okay. So what I propose, not just me personally, I'm just saying that there is a strong identity implementation, which is based on essentially hardware or on a physical world where I could Say that my identity is combination of my fingerprint and a trusted platform module on my laptop. You see, this identity is impossible to download, upload, clone, because it's not information. It's physical objects. My finger is an object. TPM on my motherboard of my laptop is an object. They exist. They are both singletons. You cannot clone them. So that's a really strong implementation of identity. So that identity is extremely challenging to exploit. ([Time 0:08:11](https://share.snipd.com/snip/2a41ec48-e330-468a-a779-ea00e87b5810)) - **AI Amplifies Security Challenges** - AI lowers cost and increases frequency of identity attacks through automation and deepfakes. - AI infrastructure itself is vulnerable to both human trickery and malware attacks. Transcript: Ev Kontsevoy I would maybe talk about two things when it comes to AI. Kind of offense versus defense. On the offensive side, generative AI drastically lowers the cost of mounting an identity attack. Because today, if you're like a criminal organization and you're going after a sizable company, you actually need to employ people, you know, criminals, because you need to be watching Social media accounts of the employees. Essentially, you need to have people who would be watching employees of a victim organization to make a mistake. So that mistake could later be exploited. So by leveraging AI, you could just automate a lot of that kind of surveillance process. And obviously, you could do deep fakes and stuff like that. So on the offensive side, AI is going to drastically lower the cost of mounting an attack, which basically means increasing frequency of the attacks. Now, if we look at the defensive side, AI itself represents yet another piece of that growing complexity of infrastructure. Because look, running an LLM is not that easy. It's a pretty demanding technology. So it will be attacked itself. And here's an interesting thing about AI agents. Because typically, there are kind of roughly two ways to attack a computing infrastructure. You're either exploiting mistakes in human behavior. So you're kind of tricking humans into making mistakes. Or you're exploiting bugs in software, the malware types of attacks. So it's identity type of attack and a malware type of attack. And LLMs are vulnerable to both types of attacks. Because you can trick an LLM to do something it's not supposed to do. So this is you attacking LLM as a human. You're tricking LLM into making a mistake. Right? Right. Or the way LLM is hosted, run, and operated itself might have vulnerabilities. So there is a malware vector as well. So that's kind of the role AI plays. ([Time 0:10:18](https://share.snipd.com/snip/289cc7f2-ac7e-4235-891b-6df496a19740)) - **Treat Everything as an Identity** - Treat humans, laptops, servers, and AI agents uniformly as identities to control access effectively. - A unified identity layer enables consistent policy enforcement across all infrastructure elements. Transcript: Ev Kontsevoy Fundamentally, before we even talk about teleport technology, when I meet someone first, I need to encourage them. I want to encourage them to adopt a certain way of thinking, which is you must treat everything that is involved in the process of computing exactly the same, which means that a human Is no different from a laptop, is no different from an AWS account, is no different from a server, is not different from a database. In other words, software, hardware, and peopleware, they're all the same from a security perspective. So you must think about them all as being just identities. They are no different. You need to move away from traditional fragmentation of identities. So then if you do that, now you have this layer of identities that are implemented in a strong way. So using cryptography and attributes of physical world, like TPM, HSM, biometrics. Once you have this layer established, then LLMs or AI agents, they become no different. It's just yet another actor in your computing infrastructure. So it needs to have a strong identity. It needs to have policy applied to it. So by doing it, you're making the cost of securing your infrastructure flat over time as complexity increases. You have to separate these curves because right now they can align. So you go and employ 20 different technologies and AI could be one of them. So you need to come here and look for 20 different security solutions to secure every single one. So the complexity curve and the curve that represents the cost of securing your infrastructure, they are the same. And that is terrible. So by treating all identities the same, you're kind of fixing your security posture and the cost of securing your infrastructure to be always the same, which is a beautiful thing. And then on top of this, what Teleport does, then we provide you with a zero trust access implementation that's built on top of the strong identity. And then we provide identity security capabilities and policy management, and all of these kind of usual things, like non-human identity access, for example, that people usually Expect to have in their environments, but the key difference is that all identities are treated equally. And it totally makes sense. Let's say you want to implement a policy that says developers should never access production environments unless there is a ticket assigned to them and they're using a company-issued Laptop. To enforce this policy, you don't even need to be a computer scientist or cybersecurity expert. ([Time 0:12:46](https://share.snipd.com/snip/e4d31e11-6b3b-448e-830a-585f02452c0c)) - **Teleport 17 Elevates Non-Human Identity** - Teleport 17 release emphasizes non-human identities equally with human ones. - It integrates deeply with AWS identity management to avoid identity silos. Transcript: Ev Kontsevoy So that release was interesting for us because this is when we started to elevate the importance of non-human identities in our marketing materials. And we added a lot of capabilities to the 17 version to make it even from a user experience or from documentation experience or from API experience to elevate the importance of non-human Identities and make them exactly the same as human identities. So that's just like overarching, just a color of that release, 17. But also we built a pretty deep integration with AWS identity management. So because again, we believe strongly in breaking silos and having an integrated single source of truth, identity story. So if identities are defined in Teleport, then we could feed into your AWS identity center. So customers don't end up with different kind of silos of where identities are stored. ([Time 0:16:20](https://share.snipd.com/snip/25482e28-ed82-454b-9ead-8a924b7d22b4)) - **Implement Continuous Identity Security** - Teleport aims to monitor security posture to detect unexpected access changes. - It plans automatic rollback to safe states to maintain secure identity control over time. Transcript: Ev Kontsevoy So there's an interesting standard now that's being quickly adopted. Well, you know how in tech everything is just like suddenly everyone is talking about something new? So the MCP protocol, so the kind of API that AI agents use to interact with the outside world. So we're looking into how we integrate it into our system. But also I would say that Teleport by now is pretty widely adopted by the most beloved brands that everyone is aware of. And we're now starting to have very different conversations with customers where in the early days, people needed a little bit of kind of education, like how to implement strong identity. How do I treat humans and machines exactly the same? But now we have plenty of customers who already implemented all of these best principles. And when I meet them, let's say one year, two, three years later, they're now in a completely different state of mind. Because once you have a solution like Teleport implemented, it gives you this like really nice, warm, fuzzy feelings like, oh, I'm so secure now, all my engineers are happy. But then next year, you feel a little bit worse. And the following year, you feel a little bit worse. And you ask them like, what's going on? And the answer is, I don't know, maybe something changed. You know how digital wrought that term? Like, what if someone tweaks configuration? What if we hired an intern and that intern accidentally made some bug in Terraform script or deployed some kind of bastion host that I don't know anything about? If somehow, somewhere, someone created another alternative way to access critical infrastructure, how can I ensure that over time Teleporter remains the single source of truth For access, for policy, for identity? So this is why we're now investing more and more capabilities into initiative we call identity security, where we can identify, oh, someone placed an SSH key on the box. That's not supposed to be there. So essentially, we want to take a logical snapshot of your security posture, which we know is in a good state because you just implemented it. And then if something changes in the future, first we want to notify you. But then later, we want to automatically roll you back to a safe, secure state. ([Time 0:17:46](https://share.snipd.com/snip/924eeddc-e91b-433d-a04c-64cc705e4c06))