Access Control

Access Control

By TeleportBusinessEntrepreneurshipTechnology
Download on the App Store

Access Control episodes

  • Governing the Future: Federal Cybersecurity in the Age of Edge and AI
    Intel's CTO on Navigating Cybersecurity, AI, and the Edge
    Governing the Future: Federal Cybersecurity in the Age of Edge and AI

    In this episode of the "Trusted Tech for Critical Missions" podcast, host Ben Arent interviews Steve Orrin, Chief Technology Officer at Intel Federal, about the evolving landscape of federal cybersecurity in the age of edge computing and artificial intelligence.

    Key Takeaways
    • Establishing a hardware-based Root of Trust is crucial for securing edge devices that may be physically accessible outside traditional network perimeters.
    • Protecting AI models requires governance throughout the entire lifecycle, from ensuring diverse training data to continuously monitoring models post-deployment.
    • Confidential computing, which uses hardware isolation and memory encryption, enables secure data sharing and analytics.
    • Engaging security, legal, and compliance stakeholders early is essential when developing and deploying AI solutions in the public sector.
    • Organizations should maintain an accurate inventory of all assets (including data) and leverage built-in platform security features.
      • Topics Covered
      1. Challenges of securing edge devices outside traditional network perimeters
      2. Importance of hardware-based Root of Trust for edge devices
      3. Protecting AI/ML models throughout their lifecycle
      4. Enabling privacy-preserving federated learning
      5. Transitioning from edge sensing to edge computing for real-time decision making
      6. Applying Zero Trust principles and confidential computing to protect data in use
      7. Engaging stakeholders early when developing AI solutions
      8. Tips for maintaining asset inventory and leveraging platform security features
        9. Resources

        Intel Federal Public Sector Solutions

        About the Guest

        Steve Orrin is the Chief Technology Officer and Senior Principal Engineer at Intel Federal. He leads technology strategy, architecture, and customer engagements for government and regulated industries. With over 20 years of experience in cybersecurity, AI, edge computing, and supply chain security, Steve brings deep expertise to help organizations navigate the evolving threat landscape.

        41 min
      9. From SIEM to Detection as Code
        Cloud-Native SIEM: Scaling Security for the Modern Era

        00:00 - Introduction to Jack Naglieri and Panther

        01:23 - Discussing the possibility of keeping pace with modern threats
        02:08 - Common reasons organizations seek out new SIEM solutions
        03:29 - The concept of detection-as-code and its benefits
        05:50 - Challenges of monitoring diverse cloud environments and SaaS tools
        07:17 - The importance of identity in correlating security data
        08:46 - Best practices for collecting and organizing security data
        10:51 - The essentialist approach to security monitoring and alert management
        12:46 - Team structures for handling security alerts and investigations
        13:48 - Recommendations for fine-tuning SIEM alerts
        15:35 - The role of SIEMs in threat remediation and prevention
        17:07 - Learning from patterns in security events
        19:20 - Views on AI and machine learning in threat detection
        19:59 - Log retention strategies and considerations
        21:12 - Addressing unknown threats and improving visibility
        22:55 - Using SIEMs for retroactive incident analysis
        23:31 - Current challenges facing security teams
        24:38 - Tips for transitioning to detection-as-code
        25:45 - Cost considerations when adopting new SIEM solutions
        27:21 - Jack's key tip: Focus on intentionality in security operations

        Key Takeaways:

        Detection-as-code offers improved governance, collaboration, and scalability

        Start with a clear understanding of critical threats to your organization
        Balance comprehensive monitoring with intentional, focused alerts
        Consider cloud-native SIEM solutions for cost-effectiveness and scalability
        Regularly review and update security playbooks and runbooks

        Resources Mentioned:

        Panther: Cloud-native SIEM platform
        Detection at Scale: Jack Naglieri's podcast and blog

        29 min
      10. Certificates, Keys, and Trust: The World of PKI and mTLS.

        Key Discussion Points:

        • Ben and Chris discuss their motivation for starting Anchor, stemming from frustrating experiences with certificate management and outages caused by expired certs throughout their careers.
        • The evolution of web cryptography is covered, from the early days of SSL to the modern era ushered in by events like the Firesheep exploit, Heartbleed vulnerability, and the emergence of Let's Encrypt.
        • Ben and Chris explain the benefits of using an internal PKI and private CAs rather than public CAs for back-end infrastructure. Private CAs enable shorter certificate lifetimes, protect information about internal infrastructure, and allow customized issuance flows.
        • To help improve the developer experience with local TLS, Anchor launched lcl.host which provides an easy workflow for developers to use real certificates during local development.
        • Security best practices are discussed, including using name constraints to limit certificate scope, employing a multi-layered security approach, practicing key rotation and disaster recovery scenarios.
        • Advice is given for teams new to PKI and MTLS, emphasizing the importance of hands-on experimentation in dev environments to build understanding.

          • https://lcl.host/

          50 min
        • Security as a Service
          For this 22nd episode of Access Control Podcast, a podcast providing practical security advice for startups, Director of Product at Teleport Ben Arent chats with Rob Picard. Rob is the CEO of Observa, a company that can build and run your security program — helping early-stage companies improve their security, get compliant and ultimately help both secure and grow their businesses. Prior to starting Observa, Rob was a security lead at Vanta, a leading SOC2 compliance platform. Rob’s experience bridges pentesting, app security, and varied experience from working in both B2B and B2C apps.
          42 min
        • Securing the Open-source Future
          Cryptography, Trust, and Open-Source with Filippo Valsorda

          Throughout this episode, Filippo offers a comprehensive view of his professional journey in the field, from his initial intrigue with cryptographic algorithms during his high school years to his pivotal role in the Go Team at Google. Key discussion points include:

          • Key milestones in web cryptography include HTTPS, WebPKI, and the impact of messaging protocols like Signal and WhatsApp on end-to-end encryption.
          • Looking to the future, Filippo discusses the importance of transparency mechanisms in cryptography and highlights the need for accountability.
          • Filippo advises against rolling one's own crypto but encourages collaboration and learning with experienced individuals to build a feedback loop for secure implementations.
          • Filippo shares his thoughts on the current state of Certificate Authorities (CAs).
          • Filippo explains the accountability established by transparency in open source and compares it to closed-source software.
          • Security patching is addressed, highlighting the need for a balance between stability and urgency when applying patches.
          • Filippo explains the potential threats posed by quantum computers and the ongoing efforts to implement post-quantum key exchanges in protocols like SSH and TLS.
          • Cryptographic concerns in cloud computing are discussed, focusing on the importance of trust in cloud platforms while acknowledging the shared responsibility model.
          • In a practical piece of advice for improving security, Filippo recommends being deliberate in trimming dependency trees to reduce vulnerabilities.
            • 59 min
          • From Orange Book to Identity-Native
            Access Evolution with Ev Kontsevoy

            Access Control Podcast: Episode 20 - From Orange Book to Identity-Native

            • Access control consists of four technical components: Authentication, Connectivity, Authorization, and Audit.
            • Multics, an advanced operating system, serves as inspiration for Teleport's approach to scaling access control. Multics introduced the concept of a reference monitor as a central point for policy evaluation and enforcement.
            • The Trusted Computer System Evaluation Criteria (TCSEC), known as the Orange Book, set basic requirements for assessing the effectiveness of computer security controls.
            • The CIA triad (Confidentiality, Integrity, and Availability) is presented as the foundation of trustworthiness in computing systems.
            • Teleport provides identity-native infrastructure access to servers, cloud applications, and web applications. Teleport's implementation of zero trust involves technical aspects like reverse tunnels to establish connectivity behind firewalls.
            • The concept of true identity should be differentiated from the common practice of associating identity with electronic records or aliases.
            • The use of shared credentials or shared identities across various systems is a common anti-pattern.
            • The state of authorization in current systems is broken, and it's difficult to synchronize role-based access control (RBAC) rules across different layers of technology.
            • The discussion challenges the current emphasis on visibility and audit logs, suggesting that once authorization is properly solved, the importance of observability will decrease.
            • A collaborative and trust-building approach between security teams and engineers is critical. Security measures should not hinder productivity but should be designed to work seamlessly with the broader computing ecosystem.
              • 42 min
            • Multi-Layered Security
              How Sendbird adds layers to their zero-trust security program.
              Key topics on Access Control Podcast: Episode 18 - Multi-Layered Trust
              • Sendbird provides APIs and services for chat and products to integrate into applications.
              • As Sendbird is B2B, B2B2B, and B2B2C, its customers use Sendbird to build chat applications that their own customers use, resulting in a lot of data that enters Sendbird's system and that needs to be secured.
              • Compliance and security go hand in hand. You determine how compliance requirements fit your business and use them as a baseline to improve your company's security posture.
              • Two guidelines for access control are a multi-layered design (where more than one thing should go wrong for something bad to happen within the company) and keeping things as simple as possible.
              • A sound access control philosophy ensures that people in the company have access to what they need to do their jobs.
              • Security is always should be a balance between usability and providing security.
                • 33 min
              • Access at Scale
                How Jump Trading Group uses Teleport to access at scale

                With Joseph Conti, Systems Engineer and Linux enthusiast with 15+ years of financial industry engineering experience, and Chris Spann from Jump Trading Group.

                Watch a video version of this panel on Jan 26th https://goteleport.com/teleport-connect-virtual-2022/

                36 min
              • Platform for HyperGrowth
                How to plan, build and grow a platform team for HyperGrowth companies.

                For this 16th episode of Access Control Podcast, a podcast providing practical security advice for startups, Developer Relations Engineer at Teleport Ben Arent chats with Lukáš Hrachovina. Lukas is an Engineering Manager for the Cloud Engineering team at Productboard. ProductBoard was founded in 2014, and is a product management system that helps organizations get the right products to market faster. Lukas has been at the company 2 years and has helped keep systems stable as ProductBoard has entered into hypergrowth. This episode dives into how to plan, build and execute a platform team to help support a growing organization while keeping systems as secure as possible.

                Key topics on Access Control Podcast: Episode 16 - Platform for HyperGrowth
                • Productboard is a product management system that lets organizations get the right products to market faster.
                • Productboard is transitioning to Backstage, a tool from Spotify, to build a developer portal, and has moved its documentation there as well.
                • To securely offboard engineers, Productboard uses a variety of tools including Okta and Vault.
                • Productboard chose Teleport to improve their security as the number of engineers grew and since the company works with customer data, so it's critical to protect that data and prevent any possible leaks.
                  • 37 min

                About Access Control

                From the publisher's feed

                Access Control, a podcast providing practical security advice for startups.