Unveiling the Complexity of Non-Human Identities in Cybersecurity with Evandro Goncalves

Hi everyone.

Welcome back to another episode of the Security By Default podcast.

It’s really great to have you all here and I’m always excited about fun episodes, fun topics and interesting guests.

So.

And I’ve got definitely one for you today.

So this podcast is all about really bringing knowledge to you.

And it’s about the goal is to make sure that everyone has the opportunity of getting security.

And that’s the theme of the podcast, Security by default.

Not just by design, but everyone should get security.

So welcome to the show.

Today I’ve got an awesome guest.

So, Avandro, welcome to the podcast.

Do you want to give the audience a bit of background about yourself, who you are, what you do, where you’re from and also your origin, how you get into the industry?

Absolutely, Joseph, thank you.

Thank you for the invite as well.

Thank you everyone that is listening to this podcast.

Yes, I today work as a security expert on Aseguru, a Latam origin company focused on identity security.

I started my career maybe 10 years ago, roughly 10 years ago, Sophos expert.

So working with endpoints, this was my kind of entry level on the industry, working with antivirus.

Then I jump into firewall security, network security on a distributor side, and there I have the contact with some other identity players, which got me very, very interested into the topic.

You know, remote access protection, password management, things like that.

So I received an offering to be here at Segura and then I decided, ok, time to move for a vendor experience, see how that goes.

And then I straight jump into this world of identity protection as kind of a consultant, sales engineer, solutions architect, kind of.

So that’s a little bit about my, I would say corporate background.

In the meantime, aside from being kind of an identity expert, I’m a gamer.

So if you’re watching this and seeing the whole retro.

So what, what, what’s some of the games you’re playing today?

What would be some of them?

I’m more of a hybrid kind of, you know, I don’t have any particularities in terms of whether it’s a new game or an old game.

Currently I play a lot of RPGs, so currently I’ve been playing the latest Monster Hunter series.

Kind of been addicted for a couple, you know, I reach at the 100 hours mark already this team, so I think I’m playing a lot, but that’s kind of the type.

Recently we had also Elden Ring, so those sorts of games, that’s, that’s more of my vibe things I’ve been playing recently.

And that’s What I do to kind of decompress, you know, take out all these traps from the day to day activities aside from being a pet owner.

So I have a couple of cats, a girl and a boy, just very, very young, seven months I think just got them into the house.

And of course my, my girlfriend, my, my company here that do me a lot of things day to day.

So that’s, that’s a little bit of myself.

No kids so far yet, but maybe in the near future.

That’s awes.

I myself I, I’m a big retro, retro gamer.

So I, I always pull out, I’ve got a retro, which I pull out once in a while.

Once, once I have a little bit of time.

And also I use it to decompress as well if I need to take my mind off and you know, if I, if I’m, if I’ve got a blocker when I’m writing something or creating something, it’s a good way just to kind of have the mind almost reset and think about something completely different.

So, so I usually pull out the retropod.

But I’m an old school, I go to like things like Street Fighter.

Yeah, I know.

I, one of my kind of old school games.

Yeah, I started my gamer career with a Super Famicom, a Super Nintendo, you know, Don Kong, Super Mario, all those games.

Sometimes I pull up some, some, some, some of those old boxes and, and play a couple.

Unfortunately they are too quick nowadays.

You know, those old games finish them in four hours roughly.

So they are kind of, you need to replay them a lot of times.

Absolutely.

But sometimes I also like.

Yeah, fantastic.

So, so for the audience, today’s theme.

The reason why I brought Evander on is myself and Evander.

Exciting times over the last two months, ever since I started with Segura as well.

And one of the things I wanted to kind of get into in today’s topic, and let’s start the theme off is, is around machine identities, sometimes referred to as the non human identities or non interactive identities.

So can you give us a little bit about, you know, what, you know, what is the kind of origins, help the audience understand a bit what is machine identities and what are they and where can they be found?

Yes, it’s a little bit tricky to go over kind of machine identities because there is also kind of some, some, some different interpretations you’re going to see on the market.

Right.

Some may consider that all machine identities belong to things such as, you know, workloads, applications, machines with kind of service account, desktop computers, things like that.

Some may go even above that looking to OT identities, things that you have running on OT environments and either other industries.

But machine identity from my perspective at least is all types of identities on an IT environment, most especially that you use without human interaction.

So things like app to app communication, an application connecting to something like a database or a service running in the background process that needs to consume local resources on a given workload and then it needs certain level of access.

Am I data to do this access?

So that would be a way to summarize from my perspective.

Yeah, that was always my kind of my interpretation as well when I always thought of machine identities was non interactive.

It’s from a human perspective.

It’s something that I don’t log on and use and is directly associated to me it’s typically some automation that needs to work in the background, whether IT being infrastructure, data services, API integration, cloud integrations, all that, you know, kind of help just it’s the glue behind the scenes of IT that humans don’t necessarily need to be involved in.

And what’s what you mean, what’s some of the.

The kind of typical, let’s say what’s the risks and challenges?

How do organizations tend to manage them today?

Or what’s what’s the risks that are found and what some of the challenges around managing these types of credentials?

Yes, so there is a lot of risks especially because when we take a look into the today’s market for machine identity in today’s thread landscape, there’s a couple of studies there from other security companies saying that for each human identity you have in your current organization, you might have up to 80 different machine identities.

So one person can lead to 80 times the amount of credentials you could have.

And the problem is it’s likely different from a human access that you do have more traditional concepts today kind of spread out, which is password management and things like that, changing passwords, managing passwords and also finding those passwords accounts to be managed.

It’s quite difficult.

You know, you always have the risk of executing something like a remote operation to manage on a normal sense and you could break a potential application because the time it takes for an application to access those credentials are immediately you have milliseconds.

It’s not like a user that logs into those remote services every 30 minutes or even once a day even it’s no, it’s milliseconds and it’s happening pretty much every hour.

So changing anything in terms of those accounts could lead to potential problems.

And that’s where you know Security concerns comes in.

You usually don’t have things like remote management or even just in time access.

This is what I see as a common on different customers and different interactions I have with different specialists on the segment.

This is one of the problems you don’t have, you know, smart ways or easy ways to kind of go into this management aspect.

And another thing that is coming up is from kind of a developer perspective this is where machine ideas are most present in development environment is each individual Today each developer pretty much have access to different technologies that going to assist them during development cycles and protecting those identities.

So a very common thing that became inside companies is you have multiple vaults identity vaults for machine identity, the secrets manager as they call.

And having this distributed aspect has been challenging because each tool the developer decides to use have different capabilities.

And there is no kind of one single solution for companies to kind of implement and stream down to users so they can have full visibility on everything that is going on in their environment.

So this might be the second risk that is raising.

Absolutely.

That’s one of the common things I hear a lot from organizations is lack of visibility of those machine identities and non human accounts.

And also ownership as well is the direct because a human we have an ownership tied to us with our credentials that we use on a day to day basis.

And we have different types of security controls that can be applied to them.

Whether being federated identity, single sign on recording the session and then also managing and rotating that password on our behalf as well.

A lot of the things become much more challenging when it gets to the machine identities is they may not be tied directly to a person.

So how do you make sure that someone’s accountable in owning those credentials?

You can’t easily apply mfa.

One positive thing that I do find with machine identities is that with human interactive accounts you can, you know, you have to go with the passphrase approach.

It’s something that the user needs to remember a lot of cases.

But we are moving to much more of a kind of passkey type of password list kind of approach.

But with machine identities you can have that password be as long as it possibly can.

The system can take which is great.

Which means is that and you can rotate it frequently because it’s not something that we as humans need to remember which is always that kind of pain of password fatigue.

So that’s one thing I do find there’s positives and negatives within the managing of machine identities which is also kind of something to do.

And then we also get into is when you Think about also the, you know, how they get configured.

One of the things I find in most cases, one of the biggest risks is they get misconfigured all the time in order to, you know, one of the points you made is that if you do rotate the password, it might break things.

And I was, you know, I spent a long time ago, I was at Symantec and we had products like Enterprise Vault and we had products like Backup Exec and netbackup, stuff like that.

And it meant that you had passwords that needed to be in five to 10 different locations and they all needed to be the same password and they all needed to be, you know, in sync and working in tandem.

And if you ever change one of those service accounts, it would break everything and, you know, people would be screaming and, you know, be problems and stuff like that.

So it’s really important when you’re managing service accounts, important to understand also the dependency mapping is where you know, which is the relationships between these accounts if you do rotate them.

What’s some of the kind of poor practices do you see with organizations managing them today?

Are they managing, are they managing them at all or are they leaving them poorly configured like a human account?

Sometimes they configure them as it is an interactive account, which means you can log on to check that the account actually does function.

So what’s some of the common kind of poor practices you see being done in organizations?

Yeah, so I think machine identities just now started to kind of getting attractiveness from different companies.

One, one thing that has been going on, and this is quite an old conversation, at least what I heard of the hard coded.

Right.

This is I, I think was one of the first use cases you would imagine as a machine.

Right.

To have your traditional scripts that you have passwords embed in, within them and they are potentially a problem in terms of security rate.

And companies deal with that because this is kind of an old topic right now.

You know, eliminating taking things out of the scripts, but now adding smart capabilities, the same capabilities that a PAM solution in general would cover in terms of visibility capabilities for a human and also management for a machine identity.

I’ve been seeing this being explored more recently.

So some companies are adopting technologies such as secret vaults, right, to have some levels of protection.

They are quite complex because of that, because, you know, needing to connect to a different environment, needing to rotate different types of assets.

So this is one thing.

And more recently, some companies are shifting to certificate manager management as part of identities.

But I’m seeing from our perspective especially Here at Segra, a lot of this movement happening on the enterprise level.

So companies that already have a PAM program established, they aren’t managing properly the human identities.

Now machine identity becomes a focus when you take a look into medium small business, they should be concerned about this.

But this is still kind of things administrators are getting into the topic, gaining visibility in machine identities.

Absolutely.

It sounds like enterprises have a bit of an advantage in that regards because the enterprises have invested in managing identities and managing privilege access and those solutions have extended to the ability to managing machine identities and non human identities.

If for an enterprise it’s a simple extension to an existing solution they’ve invested in.

It sounds like the SMB side of organizations which still might be kind of doing password management features, you know, whether managing passwords.

Those solutions do not expand to machine identities and non human identities.

So they now have to look at how to either invest in a new solution or expand and move beyond a password manager to a much more enterprise PAM solution that helps them manage that.

Is that something kind of you would.

You would agree with?

I would say yes.

This is definitely something I agree.

You know, from from small business perspective, the amount of I would say identities, it’s quite similar.

You still have the same challenges there.

So every small company or at least in general, it’s what I see have development teams or are moving assets to the cloud or at least and this is one very common use case I like to bring that that belongs to kind of machine identities and maybe few people are aware is that a simple integration between your communication apps, you’re using Slack internally or using teams or whatever solution and you have something like single sign on behind the scenes with say your Google account or even your Microsoft.

That’s a very simple example of machine identities that happens on pretty much everywhere.

So every company might have this type of integration from small to enterprise.

And there is a machine identity behind the scenes.

So there is something that tells Slack is a machine, is a sort of machine is a workload as we know and needs access to your Gmail account or to your Microsoft account.

So there is an authorization process happening there.

This is a very simple use case that goes from the smallest company to the smallest individual.

Even companies that have one, two persons going all the way to the enterprise level where things get more complicated, you have more accounts, you have more things connected to each other.

This definitely is a topic of concern.

Now the thing that becomes a struggle on the I would say small and medium sized companies is of course capacity.

Right.

So dealing, having teams dedicated to such solutions because it’s not an easy task.

Coming back to the topic of discovering those accounts, this by itself is challenging because one very interesting question I got from one of the Gartner specialists I had the opportunity to speak with with is what is a machine identity?

How can you identify them?

What defines what is this boundary between a human identity and a machine identity?

Because again, you have a lot of types of machine identities and you have a lot of resources talking to each other.

Is it a Kubernetes service account?

Is it a Slack integration?

Is it an API token?

Is it an oauth token?

So there’s a lot of types of things that could be considered machine identity with different formats.

Not only your username, password anymore, you have again all those types.

Certificates as a huge part of machine identity.

Certificates are being used in mutual tls on kind of microservices and they are machine identities as well.

So when you think on a small company that might be using those services, they might be developing things on microservices and having all those machines identities spread across with not much capacity to manage them, this is definitely something that it’s going to become a problem if already it’s not so, if companies not noticing that those are problems already.

Absolutely.

I remember, I mean I’ve worked in some interesting projects over the years and I’ve been fortunate enough to be kind of seeing some of these real kind of life scenarios.

You know, some of the ones that I’ve expanded on is in the maritime industry.

I worked on a project a number of years ago ago where a shipping, you know, a massive cargo ship that has hundreds, maybe even thousands of containers sitting on that vessel.

And each of those containers has basically an RFID and a sensor that’s, that’s basically sending a signal back to basically a central control on the vessel that’s telling it about moisture levels, location, temperature readings.

Because it might have food process in it, it might have electronics in it, it might have vehicles in that container, it might have toxins that if that sensors, you know, measuring the toxins that could be flammable.

So all of those things, if you think about each container having those tags, that is an identity.

It is a machine identity that you know, there all of a sudden you have a cargo ship that now has thousands of identities sitting on the vessel, all reporting back, all basically telling location, telling information about the signals that that actually identity is generating.

And then you have to think about, you know, managing that and then you get into even.

I remember a friend of mine who does Pen testing was talking about one time where he basically drove past a farmer’s field that had hundreds of cows in the field.

And each of those cows had basically tagged RFID signals, video signals, transmitting, all generating identities, all having identifiers so that the farmer knew kind of where that cow might be or when they’re coming through, basically for feeding and for cleaning and for maintenance and stuff like that, that they can actually he, you know, track every single cow as they went through, basically a reader.

And so it’s really impressive with that, you know.

And I always remember Felix’s image about machine identities.

I remember his social image about the farm and the zoo, which always made it makes me laugh a bit.

But in the reality, when we think about machine identities, you know, it does expand to many different things, whether it being a container on a cargo vessel or even a cow in a field.

It’s impressive kind of how expanding and to your point, that really gives you a clear idea of a farm that might have to manage hundreds and if not thousands of identities of cattle or a cargo vessel.

An organization who’s managing logistics and ships has to manage thousands and thousands of identities.

It might only be 30 people, 30 people on that cargo ship, 30 humans, but they still have over a thousand identities to manage.

And that just gives you the kind of acceleration and the visibility of how big this problem’s becoming.

Evander, one of the things I’d like to move into, some of the best practices about managing machine identities.

So what kind of.

Is there a lifecycle process?

Is there a step by step process?

I think one of the things we talked a little bit about, you know, discovery can you walk through.

If you were to go in an organization and start managing machine identities, what would be your process?

How, how would you go around in order to get the best practices?

Yes, there is a couple of them.

Now, the, the challenging with machine identities also comes because there is no standard ways of handling those identities, right.

And mostly because each company took the smallest to the enterprise level, have their own internal process on how they develop things or what types of business they are running, such as maybe a farm company is running a scenario and they might now need different ways to leverage machine identity.

So there is no, I would say one single rule that applies to everything.

So the thing we do here especially is more of a consultancy side on.

First thing is assessing, right.

So you want to understand as much as possible what, what types of technology are you running that potentially have machine identities.

And we gave a few examples, most commonly on development environment, most common IT scenarios, you have the CI CD pipelines as they call.

So it is a one single place of orchestration on most of the companies and within those types of services, services and solutions, even GitHub, GitLab, there’s Jenkins and others.

You are connecting to a lot of different things behind the scenes and, and it’s all automations.

So an automation scenario, it’s very propense for machine identities.

So that’s one thing we take a look into when we’re talking to customers.

Do you have any CI CD pipelines?

What are they connecting to?

Are they deploying things on the cloud for you?

So this is a often good starting place to see this is your core of connections, this is where everything pass through usually so gaining as much as visibility.

And there’s some tools of course that can help you with such as reading things from your pipeline, you’re reading things from your cloud environment.

Now moving to the legacy part, then you might need kind of a more, a little bit dedicated approach, delicated approach to kind of talk through your developers, talk through your different teams to understand how they are using identities, how they’re constructing.

Because one thing that definitely is machine identity is a, I would say requires multiple teams and multiple knowledge to kind of of address this.

It is usually an effort of multiple people inside of a company even to adopt some of those best practices.

Then once you have visibility now you understood generally at least how machine identities are being used, then you can develop techniques which could be similar to a PAM solution.

Right.

First thing would be have a way to vote all those.

One thing with topic.

So once you have general idea at least of your critical assets, I would say the best practices would be try to move them at least to a secure vault where you have encryption technology and you have the option then later to start adding some automation techniques.

And not to the sense of rotation, I usually don’t recommend password rotation on such scenarios.

What we are seeing as a more common approach is you have ephemeral accounts because again if you’re rotating something on an environment, you might break this.

So what we often suggest is you implement a process where when an application needs an account, it’s going to request one to be provisioned and then you have a time to leave.

So you have a time span in between those interactions and every time the application needs to connect to something, you’re going to create an account.

And this can happen in milliseconds there’s technology today that allows moving more just in time access.

Yeah.

So you would implement such techniques taking out the risks of if a password gets rotated in the middle of an operation, you break something.

Now you don’t have this challenge anymore, generally talking, of course.

And then now you’re gonna, once you implement this, you’re gonna see all those connections.

So visibility is something that of course, if you have the right tools, it’s a given.

So now that you have vaulted all those accounts, you know who is connecting to those vault vaults that you created and who is requesting credentials for what purposes.

In general, now you have all the visibility that you need from kind of a authentication authorization source.

So which applications you have on your environment, which types of scenarios.

So you can then adjust those kind of business rules that you might have.

Okay, and what about Ryan?

You know, a lot of times as we mentioned earlier, there’s two things.

There’s misconfigurations, but also a lot of the service and privilege accounts.

Those service accounts and machine identities typically are over privileged.

How important is to then start applying things like the principle of least privilege in order to make sure that they just have the right privileges to do the task or workload or action or automation.

So that’s very crucial.

Once you have this map of identities that you have and what they are being used for now you’re going to start reducing privileges.

It’s very important because one thing I saw on most companies companies is those credentials, especially those types of access they are, they suffer from privilege abuse.

Because when you’re setting up some sort of integration, of course there is this problem.

How much privilege do I need for this account in order to connect to a very specific service or an application call API?

So what usually happens is you create full administrator accounts and give that to a developer one because the developer gonna test a lot of things.

So it needs to be sure.

But you don’t have the time to I would say go all through this needs and beats of finding the right privilege for the right service.

Especially in cloud environment, you have thousands of thousands of privileges to select from.

So the common practice today is create an administrator account, give that to your developer.

Your developer gonna use that to test things to make sure the application he’s developing works correctly.

And then instead of okay, now that you test it out, we know the privileges, let’s switch back to a list privileged.

Sometimes what happens is you use that same account you created with full privileges on production.

So this is something definitely to avoid is moving now into this Least privilege scenario on cloud you have solutions such as scheme solutions that can help you with, even Segura can help you with that as well.

Well, finding the right privileges so you can kind of remove unnecessary access that a machine identity usually going to have.

It’s very, very common to, to have over privileges on such scenarios.

Yeah, that’s one of the things that you know, I’ve seen, I’ve, I’ve responded in a lot of inter response over the years.

And one of the common things is, you know, I do see the human identities being the initial access.

That’s where attackers are able to gain that initial foot, you know, kind of foothold in organizations.

But it’s the machine identities and service accounts where it allows the attackers to at look lateral move.

And I’ve seen cases where for example a financial database backup job that was running on a scheduled task was taking a backup of the financial database running as a domain administrator account.

So it was only a matter of time before an attacker was able to compromise that account and be able to extract a hash, be able to then get the password and clear text using tools like Mimikatz and then be able to laterally move.

Once that happens, then it’s literally endgame for the organization.

It’s, it’s a matter of time before disaster strike strike.

So, so it’s critical, you know, as your point, how these types of identities are crucial to the business, to functional and running, but also crucial to protect and managing and get accountability and visibility.

So just to summarize things is, you know, to go into a proper assessment into understanding about where machine identities might lie within your organization, what types of business and services and applications and IT infrastructure there.

Then to go through the process of then thinking about let’s get them discovered and then vaulted and protected, then going through the process of automation to then put, you know, get them automated in the environment and then moving away from having persistent controls to getting temporary controls and applying auditing and reporting visibility and ensuring to apply the principle of least privilege which is a crucial step on a zero trust journey.

So I want to move into the next phase and where we first got to work very closely together on was a recent event which was then the NATO lock shield.

So we both participated as Blue team members.

Can can you share with the audience a little bit about, you know, how much did you know beforehand and when did you realize how big this was and what were some of the your experiences that you had through the event?

Yeah, absolutely.

And I could keep talking about Lockheed Shields for a year unfortunately we do have of course a time interval, but locket shields.

It was my first contact with it.

I didn’t know such an event and what’s happening.

And I was missing that for, you know, again 10 years I’ve been working on in the industry and just now I got invited.

Thanks for that as well.

Joseph really changed my life.

And the thing started quite, quite strange for me because the first request we received from Marcus, our CEO is Evandro.

I need you to help Joseph.

Joseph is coming to the company.

We are working on a small project and he needs your help to.

To set up the instance or product on the environment.

And that’s the only thing I need you.

So that this was pretty much Mark’s wording, right?

Very simple task, just setting up an infrastructure so Joseph can take on.

So this is when we first talked about, and you explained me all the environment and the complexity behind this and more details about the exercise.

You know, being a full week that you have to defend a pretty much full functional.

Yes, yeah, two full weeks.

One of them just studying the environment, the second one actually doing the hard lifting.

So when we first talk, I thought to myself, okay, this is not just what Markus requested.

Maybe it might be a little more complex.

You know, it’s not just about setting up the infrastructure needed to protect those identities on such environment.

We actually going to need to be there on the operation.

It was quite a funny story.

Even internally, some people still struggles to kind of understand the complexity of that.

Mostly because.

Because we are still talking to people about this experience.

Right.

So the one that didn’t listen to the story still thinks, okay, it’s just a setup that Evander went and did and Joseph did all the things no one thought that I.

You know, sleep deprivation and things like that.

No, both of us, I think, yes.

When we put into kind of realization how big it is.

It’s thousands of people from all around the world participating in this.

Over 40 countries that set up and dedicate teams that sometimes work for and prepare for one year.

I know teams that’s already actually, I know teams that’s already started preparing for next years in training and simulations and preparations.

And it was 18 blue teams defending a small country that has pretty much all functions of a real country, from financial systems to air traffic controls to air defense, to energy grids and everything else.

It was.

It’s impressive that the.

The scale of the environment that you have to protect.

Absolutely.

Which has got over 300 something systems, over a thousand credentials.

And then during the live fire event, you get over 8,000 cyber attacks over the space of two days.

Yeah.

So the realization when that hits, it’s a big.

Yeah, it’s a big requirement and a big kind of pressure.

Absolutely.

Yeah.

And it was very, very kind of rewarding experience, you know, from the moment you have the opportunity to bring your tools and bring your solutions to this very complex environment.

You know, usually I, I’m very proud of myself because I have some environments containing 10, 12, 15 machines.

Now you have access to one that have 300 different types of assets.

Wow, that’s a huge playground.

So now you have the opportunity.

Yeah.

Test this on different, different technologies and.

Critical systems and scatter control systems.

And then we had a team of over 200 people all needing access and all working together and designated and allocated to different kind of rules and requirements throughout the environment.

Yes, it was a very fantastic.

Because of this and of course the experience in terms, because again, I, I, I, I hope it, you know, maybe one day we’re gonna have something like, okay, it’s just deploying your applications and then just doing the work.

Because it’s not only about the tools you bring to the table.

There is also, and I think even more importantly is strategizing on how you’re going to do this.

And identities, which was our topic, is again, something that go across all the teams.

So we had different pods, as they call.

Right.

And everyone needs access, everyone needs to be on their machines, log it into their machines to kind of defend and remove malware and threats.

So everyone needs access.

It’s something we need to think for the 300 different servers.

And we had more than thousands of identities there.

So communication, how you’re going to set up this, how your team’s going to access not only the blue team, so how the blue team going to fetch credentials, going to use those accounts to log in and prevent things, but also the user experience they promote.

So you need still implement identity security without disrupting user access.

So you have, you need a lot of communication.

You need to talk with a lot of different people handling different tasks, different experts in the scenario, and not all of them are experts in identity.

That’s why we were there.

You’re absolutely right.

One of the big things is the leadership side of things.

And, you know, the coordination.

For me, I think one is we had a lot of lack of sleep because we were, you know, the time zones didn’t fare well for both of us.

But I remember also, you know, for me, there was so many different channels that I needed to be part of and Listening to everyone going, I need the credential to access this server.

You know, this credential is no longer working or this system needs to be protected.

And it was just all that coordination and, you know, communication that was going behind the scenes.

That also kind of added to the pressure, but it also added to the experience as well.

Absolutely, yeah.

Because one thing I would definitely prepare myself for the next year and this is one thing I didn’t have the time to, was actually creating a strategy for identities.

Not only you have the environment and you have a general idea of what’s going to be there, but how are you going to talk to each one of those pods to kind of define strategies?

And you’re going to definitely require different strategies because there is not only your Windows and Linux services running.

You have you g telco.

You have other types of infrastructure, kind of OT environments available for you and they need kind of a slightly different approach in terms of machine identities and not machine identities and also human access as well.

So definitely what I would do is kind of creating strategies for those different environments before doing anything such as connecting and doing a password rotation.

Right?

Absolutely.

One of the things, and that’s because you’ve got so many attacks over that, you know, short period of time, I think you’re absolutely, you know, thinking about a strategy just for different zones or different operating environments as well, because there’s a lot, you know, Windows Active Directory, there was cloud environment, there was Linux machines, there was scatter controls.

So having a strategy kind of applies to, to do the best of each of those types of, you know, complexities.

Absolutely.

So one of the things that can, you know, many thanks for your amazing help during this year’s event.

It was definitely, it was a fun, fun, fun time.

Next year I’m definitely going to make sure I’m on the right time zone because that definitely makes a big difference.

And I’m pretty sure for yourself as well, it’d be great if we were able to get you in the headquarters, but with the team as well because that also means coordination is much more easier and simpler.

One of the things I’d like to kind of ask for you is what areas, how do you stay up to date?

What’s some of the places you go for knowledge and education?

What’s some of the things that, you know, you look to, to.

To kind of help you expand your knowledge?

Yeah.

So very recently I started digging into more of the threat scenario.

I’ve been working with kind of 10 years just on the protection side.

So I read A lot of, you know, techniques in terms of zero trust.

There’s awesome books there.

But now recently I started taking a look into more of the thread perspective.

So common threads and things.

There is data breach reports from Verizon.

This is a very important resource.

I read every year pretty much much and others that kind of keep me up to date in terms of threats and even you know, newspapers on customers attacks that, that potentially happen.

You know, not even customers, but companies attacks that happens every day.

So reading and understanding those as much as possible you have available on LinkedIn.

There is some very known thread, also newsletters.

But one thing I like to do a lot is I’m a very hands on type of, of a person to learn things.

So every time I see a new technology in general, I tend to do something like a laboratory.

So we spoke about machine identities and machine identities have very recent technology people it’s getting familiar with such as Pfinspire and how they’re going to behave and change the landscape of machine identities.

Right.

So one thing I love to do is every time I have the opportunity to explore a new tool or a new solution that is available there, I want to jump in.

So I want to create something like maybe a POC, a small test even for 30 days.

That’s, that’s usually enough for me.

So I like to take some time to create those environments, those laboratories and learn a lot from them and some books and maybe some YouTube videos as well to kind of guide me through the setup process so I can at least remove that friction.

But of course this other main resources.

So a couple of books.

Of course there is some courses I do behind the scenes, but mostly kind of of those thread reports and those news that we see daily.

Okay, fantastic.

Excellent Evandro.

It’s been a fantastic and a pleasure and honor to have you on the show this time.

And I look forward to doing more activities, more events with you in the near future.

If the audience do want to connect with you or be in touch.

What’s the, what’s the best way if the audience does have questions later, how can they get in contact with you?

Absolutely.

So I’m on LinkedIn again.

Evandro Goncalvesegura Security.

You can follow me there, you can ping, you can send me messages.

There is is my email as well.

So I have my, my business email which is a Goncalves with C S again at Cigarette Security.

People can get in touch.

I might.

I’m gonna give you some other kind of resources.

Those are the most ones I use.

It on my day to day activities, but there is some contact numbers as well for people if they want to get in touch more quickly.

So definitely I’m gonna share them with you.

So maybe you can add to notes.

I would say Gmail would be the preferable end link.

You can follow me there.

Definitely.

Fantastic.

Excellent.

I’ll make sure they get added to the show notes so the audience can easily get and reach out to you if they do have follow up questions.

So as many thanks for being on the show.

So for everyone, this is the security by default podcast bringing you different guests from around the world, different knowledge, different experience to really kind of provide you lessons and how to make the world a safer place for everyone.

Stay safe, take care and again, thank you and all the best.