►
From YouTube: Matt Bromiley (SANS) & Sandro on Secure Cloud Infrastructure Access through Identity & Authorization
Description
In this First Look webcast, SANS Analyst Matt Bromiley talks with Sandro Janita, Zero-Trust Solution Architect, about how Appaegis Isolation Access Cloud (IAC) can help security teams improve their security posture and reduce operational complexity.
Specifically, they discuss:
* Consolidating access to critical resources and infrastructures by securing access for general users, DevOps teams, and external consultants
Implementing zero trust and enforce least-privileged access to protect against data loss and lateral movement of malware and ransomware
* Utilizing browser isolation for agentless deployments to enable easy access to infrastructure, platforms, and applications
* Improving visibility for auditing and compliance with detailed activity logging and session recording
A
A
If
during
the
webcast
you
have
any
questions
for
our
presenters,
please
enter
them
into
the
q
a
window
at
any
time.
Please
note
that
this
webcast
is
being
recorded
and
a
copy
of
the
slides
and
recording
of
this
webcast
will
be
available
for
viewing
later
today
and
can
be
found
on
the
sans
registration
page
and
with
that
I'd
like
to
have
the
webcast
over
to
our
presenters.
B
Let's
try
that
again,
shall
we
hey
everyone
good
morning,
good
afternoon
and
good
evening,
depending
on
where
in
the
world
you're
joining
us
from,
I
noticed
that
my
microphone
was
not
going
up
and
down,
but
I
look
and
now
it
is
so.
I
think
we're
here.
My
name
is
matt
bromley
and
I'm
with
the
sands
institute
as
carol
specified
and
I'm
excited
today
to
be
joined
by
sandra
sandra.
How
you
doing.
B
B
The
solution
towards
you
know:
information
security,
security
and
the
assets
inside
of
your
environment
and
helping
you
kind
of
redefine
what
that
environment
actually
is
sandro.
I
know
we've
got
a
lot
of
stuff
packed
into
today's
presentation.
I
know
we've
got
some
slides,
lined
up
we're
going
to
have
a
demo
in
the
latter
third
of
this
as
well,
but
before
we
do
that,
I
wanted
to
just
give
you
a
chance
to
introduce
yourself
tell
us
a
little
bit
about
who
apiges
is
what
you
all
do.
C
Yeah
sure
again,
thanks
for
the
time
man,
my
name
is
sandro
ginita,
I'm
with
the
solution
architecture
team
here
at
apiges,
background-wise
I've
been
working
in
security
space
for
close
to
20
years
now,
if
not
longer,
you
know
start
off
with
firewalls
migrate
for
like
app
id.
You
know
more
recently,
I've
been
you
know,
knee
deep
into
cloud
type
security
technologies.
Now,
with
the
pages
really
interesting
technology,
and
what
kind
of
drew
me
to
this
space
was
you
know?
C
Zero
trust
has
a
strategy
right,
it's
kind
of
nice.
It
looks
good
on
paper,
but
you
know
there's
still
a
lot
of
problems
to
be
solved
right,
and
you
know
my
feeling
was
that
pedes
with
the
founders,
they
really
solved
a
lot
of
the
the
problems,
the
one
with
getting
started,
but
also
is
how
do
you
take
zero
trust
and
you
know
make
it
more
consumable,
but
more
importantly,
is
how
do
you
take
it
from
concept
to
actually
implementation
as
far
as
helping
customers
with
their
zero
trust
strategies?
B
Yeah
for
sure,
I
think
that's
I
think
you
you
called
out.
Perhaps
one
of
the
most
important
parts
of
this
is
making
xero
trust
approachable,
easier
to
implement
easier
to
understand
and
things
along
that
line,
and
I
think
that
is,
I
think,
that's
probably
one
of
the
best
ways
to
catalog
what
it
is
we
actually
want
to
cover
today.
Is
you
know
a
lot
of
folks
out
there
have
heard
of
this
particular
type
of
approach.
B
Maybe
they've
started
to
implement
this
type
of
approach,
they're
playing
around
with
it,
and
now
we
want
to
be
able
to
go
through
and
talk
about
ways
to
implement
it
and
ways
to
go
about
doing
that.
So
you
know
we
can
go
ahead
and
start
to
roll
some
slides
if
you
want
to,
but
I
want
to
make
this
more
of
a
discussion
between
you
and
I
and
everything,
and
I
want
to
first
start
out
with
the
idea
of
zero
trust
as
kind
of
a
strategy.
B
How
do
you
see
you
know,
given
everything
you've
seen
during
your
career?
How
do
you
see
zero
trust
strategies
evolving
from
a
security
perspective
from
an
implementation
perspective?
You
know
and
some
of
the
various
things
that
you've
been
exposed
to,
but
how
do
you
see
zero
trust
like?
How
did
we
get
here
right?
How
do
we
get
to
this
topic.
C
Yeah,
I
mean
there's
a
lot
of
factors,
but
you
know
the
one
driving
factor
that
I've
been
tracking,
that
I
see
a
lot
of
customers
kind
of
moving
towards,
which
is
hybrid
cloud.
In
other
words,
you
know
customers
are
migrating
their
infrastructure
they're,
taking
advantage
of
cloud
right,
in
other
words
the
agility
kind
of
the
cost
savings
things
like
that
right
and
that
definitely
provides
advantages
for
customers
in
terms
of
accelerating
the
business
models
and
so
on.
C
But
from
the
security
perspective,
it
really
does
create
a
nightmare
because,
thinking
like
traditional
terms,
you
know
your
legacy
kind
of
segmented
network
based
on
vlans
ip
addresses.
You
know
those
perimeters
really
just
kind
of
go
out
the
door
right.
You
know
once
you
start
migrating
the
cloud
where
your
resources
are
kind
of
agile,
you
know
they
could
be
across.
You
know
multiple
clouds.
They
could
be
even
within
the
same
cloud.
C
They
could
be
deployed
into
multiple
regions,
multiple
azs
and
so
on,
and
that
distribution
of
where
your
data
is,
you
know
where
your
resources,
your
applications,
are
right.
It
becomes
even
more
important
to
implement
something
like
zero
trust.
Where
now
you
know
where
there
are
no
very
well-defined
boundaries,
the
only
well-defined
boundary
now
is
me
as
a
user
right,
in
other
words,
my
identity
and
then
the
permissions
that
I've
been
granted
or
entitled
to
access
the
resource
and
application
and
so
on,
and
so
in
this
day
and
age.
C
You
know
as
far
as
where
we're
at
you
know,
as
far
as
I've
talked
with
a
lot
of
customers
in
the
past
few
years,
and
I
don't
think
I've
talked
with
one
customer
that
has
not
had
like
you
know
a
toe
or
a
foot,
or
you
know
into
the
cloud
right
and
so
yeah
needed
right.
You
know
that
we
move
in
this
direction.
B
I
was
actually
just
on
a
webcast
yesterday,
where
we
were
talking
about
exposure
into
the
cloud
and
we
were
talking
about
cloud
footprints
and
everything
and-
and
I
think
the
smallest
number-
the
smallest
representation
I
had
of
yes,
we're
in
the
cloud
was
like
94
or
something
like
that.
You
know
it
pretty
much.
Is
everyone
that's
out
there,
so
all
right?
Well,
let's,
let's,
let's,
let's
stay
on
that
kind
of
cloud
thing
that
cloud
topic.
If
you
will-
and
you
know-
we've
got
a
lot
of
organizations
and
and
I've.
B
B
So
why
should
xero
trust,
be
something
that's
in
the
conversations
when
we're
talking
about
this
cloud
migration,
whether
it's
hybrid
multi-cloud
infrastructures,
you
know
whatever
approach
my
organization
wants
to
take.
Why
should
we
be
talking
about
zero
trust
while
we're,
while
we're
planning
for
this?
What's
the
value
there.
C
Yeah,
you
know
from
the
extreme
side
I
mean:
let's
talk
about
cyber
attacks,
you
know
they're
not
going
away.
In
fact,
they're
only
increasing
you
know,
especially
with
what's
been
happening,
the
past
two
years,
with
the
workforce
being
distributed
and
now
they're
no
longer
in
that
same
perimeter
right,
and
so
it's
created
a
lot
of
vulnerabilities
for
companies.
You
know
to
kind
of
manage
access
right.
C
It's
centralized
access,
more
importantly,
to
put
some
controls
in
place,
and
you
know
in
the
past
couple
years
a
lot
of
it
teams
that
we
saw
were
kind
of
scrambling
to
kind
of
patch
work,
patch
security
together,
just
to
kind
of
react.
You
know
to
this
kind
of
remote
work,
kind
of
environment
right
and
which
again
is
not
going
away
and
combine
that
with
migration
of
the
cloud.
C
You
know
it
really
gets
to
the
point
now,
where
a
lot
of
security
admins
that
we
talk
with
is
they
kind
of
have
an
idea
as
far
as
where
the
resources
are
and
who
should
have
access
to
what?
But
there's
a
lot
of
gray
area
as
far
as
you
know,
long
term
and
so
on.
Who
really
should
have
access
to
this
resource?
You
know
this
data
and
so
on
right,
and
so
it's
not
just
a
single
snapshot
in
time
kind
of
security
mindset
right.
C
It's
something
that
you
really
have
to
think
about
long
term,
and
this
is
where
zero
trust
you
know
with
proper
auditing
visibility
and
so
on
can
really
help,
because
you
know
in
the
history
of
security,
it's
never
been
a
a
static
kind
of
configuration.
You
know
back
in
the
day,
we
would
talk
about.
C
Router
configurations
were
somewhat
straightforward
and
you
know
they're
so
much
set
and
forget:
that's
really
not
the
case
with
security,
I'm
sure
you're,
aware
of
that
right
where
you
know
your
applications,
change,
people
move
and
so
on
you
know,
access
has
to
kind
of
migrate
with
your
business
right
and
so
zero
trust
really
is
more
aligned
operationally
and
also
security
wise.
You
have
to
kind
of
move
with
your
business
these
days
as
opposed
to
something
like
a
legacy
vpn
or
a
traditional.
B
Yeah,
certainly,
no,
I
think,
that's
a
that's
a
very
valid
valid
way
to
consider
it
as
well
as
kind
of
that
approach.
Well,
okay,
so
I
I
do
want
to
make
sure
we
take
a
chance
to
focus.
Maybe
I
think
you
brought
up
some
very,
very
good
points
and
we
can
take
kind
of
a
security
bind
or
an
operational
mind
on
that
either
one
you
outlined
there.
I
think
we
did
kind
of
talk
a
little
bit
about
why
zero
trust
you
know
has
should
be
involved
in
security.
B
Conversations
should
be
involved
in
security
strategy
and
things
like
that.
But
I
mean
are
you
seeing
based
on
what
you
said
and
I
know
a
few
minutes
ago
you
said
you've
yet
to
meet
someone
who
isn't
in
the
cloud
in
some
way,
shape
or
form.
Are
you
seeing
there
that
that
folks
are
still
hesitant
to
adopting
zero
trust,
because
if
I'm
moving
more
and
more
towards
the
cloud,
I
would
feel
like
zero
trust
would
be
something
that
would
kind
of.
B
I
could
just
like
kind
of
tag
on
to
that
approach
and
just
be
like
hey.
Do
this
too
right,
but
then
again
I
take
the
very
naive
aware,
mind
frame
that
every
time
something
is
deployed,
the
security
team
has
full
visibility
to
it
as
well
and
again,
I'm
aware
of
the
the
how
naive
that
seems.
But
what
what?
What
hesitation
do
you
think
you
see
out
there?
B
You
know
when
it
comes
to
kind
of
zero
trust,
and
what
I
want
to
do
sandra
with
this
question
is:
I
want
to
use
this,
maybe
as
a
way
to
say,
hey,
here's
the
things
that
you
should
be
thinking
about
from
an
operational
perspective,
then,
if
you've
got
anything
to
support
this
discussion
as
you
go
through
it,
please
feel
free
to
change,
slides
and
bring
over
to
that
as
well.
Yeah.
C
C
You
know
they
understand
the
security
benefits
and
so
on,
but
there's
that
operational
hurdle
of
how
do
I
get
started
with
this
right,
because
you
know
what
they're
used
to,
for
example,
with
legacy
vpns
even
ztnas,
it's
a
pretty
long,
drawn-out
process
to
deploy
at
enterprise
scale.
You
know,
even
for
a
small
office
right,
there's
a
lot
of
things
that
have
to
align
almost
perfectly
to
actually
start
deploying
even
ztna.
You
have
to
align
things
like
os's
right.
C
You
have
to
line
agents
with
those
os's
patches
and
things
like
that,
and
then
you
have
to
align
the
infrastructure
with
the
deployment
of
things
like
connectors
and
so
on.
Right-
and
you
know
some
ztna
vendors,
even
you
know,
require
things
like
public
ip
addresses
to
be
published
and
so
on.
So
you
know
that
biggest
pushback
from
what
I've
seen
is.
You
know
I
want
to
get
started.
You
know
not
with
the
least
amount
of
effort.
You
know.
C
I
don't
like
to
use
that
word
easy,
but
you
know
I
want
the
least
impact
on
my
users,
my
infrastructure
right,
because
for
me
you
know
as
a
security
admin,
a
small
team
or
big
teams.
You
know
these
are
things
that
get
in
the
way
of
allowing
you
know
their
users
to
do
their
jobs
right
and
whenever
you
introduce
something
like
that,
there's
always
kind
of
a
long,
drawn-out
design
process,
and
so
that
operational
aspect
of
how
do
I
get
started
to
reap
the
benefits
of
zero
trust?
That's
usually
been.
C
You
know
one
of
the
biggest
concerns
that
I've
had.
In
addition
to
that
is
you
know
with
security
in
general,
whenever
you
put
something
in
line,
is
you
know
what
is
gonna
break
right?
You
know
I
still
have
incompatibilities
and
things
like
that
and
yep.
You
know
kind
of
leading
into
where
we're
at
you
know
we
can
address
those.
You
know
in
in
some
of
the
later
slides
as
we
kind
of
go
along.
B
C
Yeah,
and
so
you
know,
the
founders
they're
really
focused
on
a
couple
of
things
right.
One
is:
how
do
you
kind
of
take
the
next
step
with
zero
trust
and
improve
the
security
that
it
offers?
But,
more
importantly,
is
how
do
you
get
over
that
friction
of
you
know,
helping
customers
deploy
it
in
a
very
easy,
simple
way.
You
know
straightforward
and
so
on,
and
so
you
know
from
from
a
high
level,
you
know
a
p
just
access
platform.
C
You
know
with
our
solution,
which
is
to
help
customers,
simplify
the
onboarding
of
zero
trust
and
we'll
go
into
some
use
cases,
always
identity
based
access,
in
other
words,
zero
trust
principles
and
so
on.
But
more
importantly,
you
know
what
we're
doing
is
we're
actually
kind
of
translating
that
to
across
the
board,
so
across
web
across
ssh
rdp
kubernetes.
Now
we're
actually
getting
a
lot
of
inroads
into
dev
and
devops
and
ops
access
and,
more
importantly,
this
is
kind
of
our
secret
sauce
here,
which
is
our
prevention
mode.
C
You
know,
if
you
kind
of
frame
things
as
far
as
permission
abuse.
You
know
that
really
can
manifest
itself
in
a
lot
of
vulnerabilities
in
the
sense
of
if
I
have
a
a
exploited
endpoint,
for
example,
and
I
connect
using
a
legacy
vpn,
I
more
or
less
have
network
connection
at
that
point,
and
so
the
ability
for
a
an
infected
endpoint
to
infiltrate
the
internal
resources
really
is
magnified.
C
You
know
with
legacy
vpns,
whereas
you
know
what
we're
doing
with
our
iac
or
our
ice
isolation
access
cloud.
This
is
really
where
we're
kind
of
taking
our
flavor
of
zero
trust
down
to
the
resource
level,
and
what
I
mean
by
that
is
one
of
the
core
technologies
of
our
secure
access
platform
is
browser
isolation,
and
so,
whenever
a
user
connects
to
our
portal,
we
will
connect
them
to
your
resources
internally.
But
what
we're
doing
on
the
back
end
for
security
reasons,
is
we
are
spinning
up
a
container
for
that
user?
C
So,
whether
they're
accessing
web
ssh
rdp
kubernetes,
you
know
what
we're
doing
is
we're
providing
that
browser,
isolated
access,
and
that
has
multiple
benefits
in
terms
of
operational
and
also
security.
So,
let's
drill
into
security,
for
example,
and
as
far
as
the
permission
abuse
and
the
prevention
of
things
like
ransomware,
so
browser
isolation
as
a
technology.
C
It's
very
mature,
now,
10
plus
years
now,
no
known
exploits
of
ransomware
being
able
to
move
laterally,
in
other
words,
from
an
infected
endpoint
through
a
browser,
isolated
access
to
an
internal
device,
and
so
you
know
that
is
probably
one
of
the
use
cases
that
we
talked
about
security
wise
benefiting
from
using
browser
isolation.
But
there
are
many
others.
C
So,
for
example,
if
you
think
about
identity
theft,
one
of
the
common
ways
that
identity
theft
is
is
is
executed
is
say,
a
user
uses
or
loses
their
laptop,
for
example,
or
the
handheld
devices.
What
will
happen
is
you
know
an
attacker
may
harvest
the
information
in
their
cache
a
lot
of
users.
These
days,
unfortunately,
will
store
passwords
in
their
browser.
Right,
definitely
not
best
practice,
but
it's
common.
C
You
know
in
this
day
and
age,
and
so
it
becomes
an
easy
target
to
harvest
credentials
and
so
on,
but
even
those
cases
if
the
user
is
logged
off,
there's
no
shared
passwords,
usually
there's
some
remnants
of
corporate
information.
You
know,
based
on
the
applications
that
they've
accessed,
that's
still
in
the
cache.
With
that
browser.
C
You
know
browser
isolation
really
solves
that
problem
in
the
sense
that
you
know
all
the
information
is
kind
of
in
the
container
that
we
spin
up
for
the
user
and
all
of
that
information
as
far
as
cached
no
password
management
use
cases
and
so
on.
You
know
that
is
really
kind
of
negated
by
using
bi
in
the
middle
there.
But
more
importantly,
now,
in
our
case,
it
actually
allows
us
to
implement
even
deeper
temperature
permission
controls.
C
Whereas
now
we
can
provide
transaction
level
activity
monitoring
and
what
that
means
is,
as
a
user
is
transferring
files
as
a
user
is
utilizing
applications
in
rdp,
we
can
make
those
visible,
but
more
importantly,
is
we
can
stand
in
line
and
prevent
things
like
permission
abuse.
In
other
words,
does
that
user
really
need
to
download?
C
You
know
this
many
files
in
fact,
do
they
even
need
to
download
files
right?
You
know
which
causes
data
sprawl
and
so
on,
and
you
know
what
we
found
is
that
definitely
legacy
vpns
are
somewhat
limited
or
very
limited,
but
even
current
gtna
solutions.
You
know
they
may
provide
those
type
of
permission
level
controls
for
web
applications,
but
certainly
now
for
ssh
and
rdp
and
kubernetes,
and
so
you
know
this
is
where
we
kind
of
take
our
flavor
of
zero
trust
and
extend
it.
C
You
know
not
just
to
the
authorization
of
access
to
an
application,
but
now
the
fact
that
we're
always
in
line
the
fact
that
we're
always
monitoring
the
transactions
and
the
permissions
activity.
You
know
we
can
go
a
step
further
without
zero
trust
down
to
the
resource
level
down
to
the
click
level.
Almost
you
know,
whenever
a
user
accesses
an
application
and
a
lot
a
big
part
of
that
is
kind
of
brought
on
or
enabled
you
know,
with
our
browser,
isolated
access,
I'll
stop
there
for
for
comments
and
feedback.
B
No
all
good,
that's
exactly!
I
think
what
we
wanted
to
hear
and
see
was
you
know
exactly
how
about
the?
How
do
you
all
go
about
doing
exactly
this?
I
think
there's
a
lot
of
good
takeaways
for
our
audience,
attendees
here
and
I'm
guessing
you're,
probably
about
to
jump
into
your
demo
sandra.
But
before
you
do
I'll,
just
you
know
kind
of.
Let
you
let
you
get
ready
for
that
number
one
and
then
number
two
also
kind
of
talk
about.
B
You
know
I
really
like
what
what
I
really
liked
about
getting
hands-on
with
this
platform
and
getting
insight
into
it
is
really
just
kind
of
the
the
sprawl
of
coverage
that
you
all
have
on
board
and
I'm
kind
of
talking
to
the
screen.
That's
here
and
I'm
glad
you
started
here
because
I
wanted
to
bring
this
up.
B
But
you
know,
if
you
think,
about
the
varying
and
the
amount
of
so
think
about
the
different
types
and
the
quantity
of
you
know,
cloud-based
or
or
I
should
say,
applications
and
services
and
things
that
are
out
there-
that
organizations
are
taking
on
board
managing
access
to
all
of
these
managing
permissions.
Managing
controls
ensuring
that
the
right
people
are
doing
the
right
things
and
only
the
right
things
are
done
by
only
the
right
people.
B
These
are
lots
of
complicated
questions
to
to
answer,
and
I
really
like
the
insight
that
that
the
platform
gave
us,
and
I
really
like
the
integrations
that
it's
got
as
well
and
judging
you
know
talking
about
the
technologies
you
had
listed
up
there
earlier.
These
are
exactly
the
things
that
I
want
to
be
able
to
get
arms
around
as
an
organization,
I
want
to
be
able
to
lock
down
my
remote
access.
B
You
know
you've
got
the
capability
in
there,
which
is
great
I'm
going
to
let
you
go
ahead
and
walk
through
the
demo
sandra
I'll
jump
on
when
you're
done
and
I'll
be
happy
to
kind
of
take
us
out.
I
think
you've
got.
We've
got
about
10
minutes
left,
which
is
exactly
the
amount
of
time
you
need
but
feel
free
to
take
it
away
to
our
attendees.
Just
a
quick
fyi.
B
I
think
the
rest
of
this
presentation
is
probably
going
to
be
mostly
the
demo,
if
not
a
little
bit
more
back
and
forth
between
sandra
and
myself.
But
if
you
do
have
any
questions
or
comments
or
anything,
I
do
have
my
eye
on
the
q
a
window.
Please
feel
free
to
go
ahead
and
ask
them
and
I'll
bring
them
up
live.
If
I
can
otherwise,
sandro
show
us
the
magic
and
how
it
works.
C
All
right,
thank
you
again
yeah,
so
I'm
gonna
walk
through
two
use
cases.
One
is
for
you
know:
how
do
you
control
permissions
for
what
web-based
applications
and
then
the
second
use
case
that
I'll
walk
through
here
as
far
as
the
configuration
will
be?
How
does
you
as
a
security
admin,
for
example,
enforce
best
practices
and
we'll
see
that
in
the
ssh
demo,
so
you
know
with
our
browser-based
access,
we,
you
know,
allow
users
to
secure
access
both
to
sas
based
applications
and
even
more
so,
for
internal
based
applications
as
well.
C
You
know
just
for
the
sake
of
example.
Here
we
do
have
customers
that
are
using
our
systems.
On
top
of
you
know
what
they're
already
using
for
their
sas
based
applications
as
well.
I'm
gonna
go
ahead
and
just
log
in
here
sorry
about
this.
You
have
to
wait
for
my
code,
but
this
actually
serves
as
a
good
example
of
our
tracking,
but
also
our
controls
as
well.
C
So
I'm
going
to
log
into
my
onedrive
here
and
you
kind
of
think
of
the
point
of
you
know:
how
do
you
enable
your
users?
You
know
to
do
their
jobs,
but
at
the
same
time,
how
do
you
allow
security
teams
to
enforce
security
best
practice
as
well?
So
for
me,
as
a
user,
for
example,
you
know
I
have
full
capabilities
here
to
you
know
access
the
data
and
resources
that
I
need
for
my
jobs.
You
know
I
can
edit
this
and
so
on.
You
know
I
can
save
it
and
so
on.
C
I
can
manipulate
things,
but
do
I
really
need
to
do
things
like
you
know,
download
this
file
or
you
know
from
a
catalog
perspective,
do
I
need
to
be
able
to
you
know
download?
You
know
many
versions
of
this
file,
for
example
right,
because
what
will
happen
is
you
know
once
this
this
sheet
goes
through
iterations
there
may
be
more
corporate
data.
C
You
know
that's
added
here
so
in
this
curve
policy
here
I'm
able
to
download
the
files,
but
if
I
go
in
here,
you
know
really
quickly.
If
I
change
this
to
just
access,
no
uploads
downloads-
and
it
is
this
quick-
you
know
the
impact
on
the
user
here
is-
I
don't
have
to
ask
them
to
log
out
log
back
in,
but
now
you
know
I
do
have
the
controls
to
you
know
prevent
this
user
from
being
able
to
download
this
file
here
and
then
you'll
see
it
pop
up
here.
C
So
this
is
actually
gonna
fail
here
and
what
happened
was
that
the
controls
were
put
in
place
and
at
the
same
time
I
have
full
visibility
of
this
action,
and
then
I
can
alert
on
this
as
well,
and
so,
if
you
go
to
things
like
the
data
inspection,
so
just
fyi
on
top
of
our
own,
you
know
file
based
access
transaction
level
access.
What
we're
doing
also
is,
you
know
we
have
by
default,
enabled
our
dlp
engine,
and
so
what
we're
doing
is
we're
tracking
personal
data
within
the
files.
C
If
you
kind
of
track
this
here,
this
full
feature,
you
know
we're
full
we're
doing
full
decryption,
full
analysis
of
the
files
and
so
on
to
determine
you
know
the
the
internals
and
looking
for
specific
patterns
and
so
on.
So
this
is
always
on.
You
know.
In
our
case,
it's
not
an
afterthought,
but
now
from
a
bigger
picture,
for
example-
and
this
goes
back
to
security
teams
needing
to
have
visibility
into
the
user's
activity.
C
But
more
importantly,
is
you
know
how
do
you
continuously
audit
access
to
be
able
to
narrow
down
access
even
further
and
so
we'll
provide
a
full?
You
know
very
detailed
list
of
access
from
a
specific
user,
also
from
teams
and
groups
and
so
on.
But
if
you
look
at
our
daily
activities
for
the
specific
user
here,
you
know
we
provide
a
lot
of
detailed
information,
and
this
is
actually
where
we
get
a
lot
of
interest
from
customers.
C
So
as
I
go
to
ssh,
we
have
one
devops
customer
where
you
know
their
goal
was
to
remove
any
type
of
you
know
bad
practice,
and
what
that
means
is
the
use
of
things
like
shared,
shared
passwords,
static,
passwords
things
like
that,
and
what
we've
done
with
our
configuration
here
is,
you
know
we
have,
or
the
admins
are
just
allowing
access
to
these
internal
applications.
It
could
be
a
router,
it
could
be
a
switch,
it
could
be
a
kubernetes
stack,
it
could
be
a
server
access.
C
You
know
in
the
cloud
and
so
on
right.
What
we're
doing
is
now
the
admins
can
enforce
best
practice.
Let's
use
key
based
access.
I
do
not
want
to
allow
things
like
shared
passwords
or
static.
Passwords
because
doors
are
like
the
bane
of
security
teams,
because
once
those
are
lost,
then
those
are
like
losing
the
keys
to
the
kingdom
right,
and
so
this
is
the
benefit
that
you
know.
B
C
Okay,
perfect,
perfect,
and
so
you
know
changing
access
for
this
again,
it's
just
very
dynamic,
and
so
let's
take
a
look
at
this,
for
example,
here
with
this
ssh
now,
let's
say,
for
example,
you
know
you
may
be
in
a
incident
response
type
scenario
where
you
have
to
quickly
shut
down
access-
and
here
you
can
do
this
centrally.
This
can
be
based
on
the
teams
that
have
access
to
this
application
to
the
users.
You
know
once
I
click
save
here,
you
know
boom.
You
know
those
controls
are
gone.
C
You
know
you've
revoked
access
pretty
quickly
here,
and
so
you
know
that
idea
of
life
cycle
management
for
access
right.
You
know
we've
really
taken
that
to
heart,
because
you
know
with
the
auditing
that
we
provide
and
the
controls
that
we
can
apply
dynamically.
You
know
onboarding
is
as
quick
as
verification
as
well
right
and
so
that
that
that
type
of
balance
are
some
of
the
controls
that
you
know.
C
C
You
know
they're
providing
some
very
broad
permissions
right
for
files
data
within
the
network
and
when
you're
managing
permissions
at
scale,
it's
really
hard
to
get
an
idea
at
times,
as
far
as
who
really
needs
access
to
what,
and
so
this
could
be
a
starting
point
where
now
you
can
put
some
guard
rails
first
on
alerting
you
and
then
later
on.
You
know
you
can
deny
you
know
based
on
certain
parameters
as
well,
but
then
what
that
will
look
like
you
know
from
a
learning
standpoint.
C
Is
you
know
these
can
be
sent
via
email?
You
know
the
log
information
that
we
viewed
earlier
can
be
sent
to
your
syslog
for
correlation
and
so
on,
and
so
from
a
kind
of
a
security
ops
perspective.
You
know
a
lot
of
the
data
alerting
that
we
provide
as
well
is
we
definitely
want
to
help
our
I.t
security
teams
manage.
You
know
not
just
getting
started
with
zero
trust,
but,
more
importantly,
is
you
know?
C
How
do
you
just
continuously
kind
of
refine
the
rules
now
from
an
onboarding
percep
perspective?
We
do
provide
agentless
access
and
what
that
means
is
the
users
you
know
as
they
log
into
our
portal,
they
will
have
full
access
to
the
applications
and
what
that
means
is
even
if
a
user
has
a
legacy
vpn,
for
example,
using
our
agent-based
access.
C
What
some
of
our
customers
are
doing
is
they're
allocating
access
to
specific
applications
that
they
may
have
tagged
to
be
more
critical
than
others
to
use
our
service,
where
we
can
add
mfa
on
top
of
that,
where
we
can
enforce
best
practice
for
accessing
those
type
of
applications.
At
the
same
time,
you
know
with
our
portal-based
access
we're,
not
interfering
in
any
way.
There's
no
impact
on
any
type
of
legacy:
vpn,
clients,
you
know
that
may
be
installed.
C
You
know
on
the
endpoints.
At
the
same
time,
we
do
have
customers
that
are
allowing
dev
access
and
I'm
sure
you
know
that
dev
engineers
are
very
specific
in
particular
about
how
they
access
their
applications,
meaning
that
they
want
to
use
their
own
local
environments.
You
know
they've
customized,
you
know
some
of
the
scripts.
They
have
some
automation
that
they
may
have
built.
We
can
facilitate
that
as
well.
We
do
have
an
agent
that
we
call
that
unity.
C
In
fact,
we
just
released
the
the
1.0
version
a
couple
weeks
back
and
what
that
entails.
Basically
is
it's
a
lightweight
agent,
and
so,
if
you,
if
your
dev
engineers
do
want
to
use
their
local
terminals,
then
we
can
facilitate
as
well
that
way
they
can
use
their
own
local
environments
and
the
impact
to
those
type
of
you
know
I'll
call
them.
Power.
C
Users
is
very
low
because
again,
it's
very
seamless
to
them,
and
so,
if,
if
you're
looking
to,
you
know
manage
that
aspect
of
you
know,
how
do
I
not
slow
down
my
dev
engineers?
In
other
words,
how
do
I
still
enforce
security
best
practice,
but
not
kind
of
infringe
and
impact
their
product?
For
me,
you
know
with
our
unity
agent
that
we
just
recently
released.
You
know
we
can
facilitate
that
balance
as
well.
B
Awesome
sandra,
thank
you
so
much.
We
are
right
at
time.
Actually,
so
I'm
gonna
go
ahead
and
say
on
behalf
of
sans.
Thank
you
so
much
for
joining
us
folks.
We
did
just
get
a.
Let
me
see
we
did
just
get
a
couple
links
posted
into
the
chat
there.
They
are
one
of
them
about
the
first
look
paper
associated
with
this.
The
other
one
is
about
the
iac,
the
pieces
iac
that
sandra's
been
talking
about
on
behalf
of
everyone
here
at
san
sandra.
B
Thank
you
so
much
for
giving
us
a
chance
to
get
hands
on.
Thank
you
so
much
for,
like
you
know,
giving
us
a
chance
to
kind
of
see
what
y'all
are
working
with
and
really
come
across
a
better
way
to
deploy
and
configure
and
look
at
zero
trust,
and
I
hope
you
know
a
lot
of
our
attendees
are
gonna,
find
some
comfort
in
that
and
give
you
guys
a
call,
but
with
that
said
sandro.
Thank
you
again
for
joining
me.
Thank
you.
B
A
All
right,
thank
you
so
much
matt
and
sandro
for
your
great
presentation
and
to
appeages
for
sponsoring
this
webcast,
which
helps
bring
this
content
to
the
sans
community
to
our
audience.
We
greatly
appreciate
you
listening
in
for
a
schedule
of
all
upcoming
and
archived
sans
webcasts,
including
this
one.
Please
visit
sans.org
forward,
slash
webcasts
until
next
time
take
care,
and
we
hope
to
have
you
back
again
for
the
next
sans
webcast.