Akeyless Executive Conversations

Adam Arellano, Global CISO and Oded Hareven, Akeyless CEO & Co-founder

Oded: Hey, Oded Hareven, CEO and co-founder of Akeyless. Join me for another episode of our fireside chat, this time with Adam Arellano. Adam, welcome.

Adam: Good to be here. Thanks for the invitation.

Oded: Yeah, of course, it goes without saying, but before I’m going to start, what are those crazy cool shoes?

Adam: See, these are called Grandma’s Couch by Adidas.

Oded: All right. Is this the couch?

Adam: Actually, named in the back, I don’t know if you can see it. But right here across the back it says, “always be a good boy.” All right. And then, right here, Adidas in grandma’s handwriting, but, very rare shoe that one of my friends saw go online pointed out—so they are rare, although they’re commercial.

Oded: Yeah, but they’re very rare.

Adam: All right. They only made a certain number of them. I’m not sure how many.

Oded: So being a good boy, was it? Always be a good boy.

Adam: All right, all right. We’ll take that together with us.

Oded: So, Adam, tell us more about yourself, right, your background and how the grandma shoes goes with the background of security.

Adam: Yeah. It’s a long story, so I’ll tell you the short version, and you can ask questions if you want. But it all started back, early 2000 or late 2001. September 11th happened. There was a big, big moment for people of my generation. I was in South America at the time for whatever reason, and came back to the United States after that and knew that I needed to do something.

I’m actually a card-carrying pacifist. I don’t believe in violence at all. I think, generally speaking, violence is something that weak men use to stay in power. But, country had just been attacked, and I felt like I needed to participate. So I decided to join the Marine Corps as a pacifist.

Oded: That’s a weird move. Does it work?

Adam: I fooled them for a long time. Okay, okay. 14 years as a marine. Six as a sergeant. So, sergeant, staff sergeant enlisted. And then I commissioned. Got my degree in social work and became a communications officer, which is how I got into cybersecurity in the first place.

So they shoved an entire computer science degree into my face for six months. All right. Four hours a day, classes, you know, seven days a week.

Oded: Because of your being communication officer.

Adam: Because of the communications officer. Right, right. So I went and did that, was a platoon commander in Afghanistan. Met, much better marine than I was. Much smaller, but cute. Married her. And then she got asked to go be the aide of a general. Okay. And she was like, okay, but I married this weirdo, and they were like, whatever. Bring him too, put him in the basement. Literally put me in the basement of the building. And it happened to be a cyber security role. And so I was the head of security for the Marine Corps Recruiting Command, which is like a half civilian, half military network.

And so that was my first exposure to being a real CSO type role.

Oded: And connect to the network with a military, a connection as well.

Adam: Both. Yeah, we had both classified networks and others. And so that’s how I kind of got into the whole cloud security scene.

They sent her on to go get a master’s degree, and, they did not send me. So I was like, okay, I’m out. So I got out of the Marine Corps, went to Salesforce for a while, a company called Baritone that dealt with artificial intelligence, was a CISO at a foster care and adoption company, and then most recently was at PayPal for a stint that is now over and headed towards the next thing.

Oded: All right. Now, mostly if, you, you know, different CISOs comes from different backgrounds, right? And some are coming more from the risk. Other… Some are coming from… Some are coming from application security. And, you know, there are plenty of those. How would you classify yourself?

Adam: I got my technological start working on F-18s. So I used to work on the micro miniature repair electronics in F-18s. Interestingly, most of the equipment I worked on was made in Israel because it was all lasers and targeting.

But that’s where I got my start, was on physical, actual hardware, fixing it at the, you know, at the tiniest levels. So when I became a communications officer, my focus was very physical. I used to build data centers, design battlefield, communications networks and things like that. So I come from a very architecture heavy background where…

Oded: And networking as well?

Adam: Yeah. All right. Tons of networking going across satellites, going across radio, going across, you know, point to point systems and things like that.

So when I actually became a communications officer after, you know, learning how to work on these electronics and jets, I really focused on the architecture and networking and the way that you could communicate from, you know, an empty field of grass… We would show up with some trucks and 24 hours later have a full fledged network that was going across different lines of communication to where we could be command and controlling trucks if it were like a 500 square mile area 24 hours after landing in an empty field.

And so when I came into compliance work, which was my first role outside of the Marine Corps, I understood architecture really well. I hated compliance, but that’s why I was so good at it. Much like, you know, judges and cops, the ones that hate it are the best ones because they just try to do the right thing instead of, you know, for the sake of it.

So I did, you know, compliance work and so I’m really good at that and the architecture part, and that’s kind of where my strengths lie as a leader in cybersecurity, as I really understand the larger picture of how the network is laid out. And that way I could make more intelligent decisions about the way that things could improve, could change, and go forward. And so that’s kind of where I put myself.

I never have been a reliable coder or developer. I’ve learned probably 4 or 5 different coding languages and completely forgot them all because I just don’t use them. Heavily into, very deep into the infrastructure itself. So like the data centers and how they operate and networking and all of that.

Oded: Tell me more about your transition to the enterprise world, where things are a bit different, right. More of the software on top of everything, and the latest other, you know, challenges with the security that you’ve seen when you moved into that more enterprise software security realm.

Adam: Yeah. And it was an interesting transition point in my career because I was, this was like 2013. So the cloud was like there, but not everybody was aware of what exactly it could mean. But that’s when I started at Marine Corps recruiting command. And they handed me this data center that was in a carpeted closet behind a punch code door inside a building with sprinklers over top of it. And I was like, oh, you want me to secure this? And they were like, yeah, it should be fine. And I was like, oh, no, this is not fine at all.

And the system of record that we were working on was from 1998 was the first version that was written, and we were still trying to limp it along. So I was like, okay, I need to solve this huge problem. I’ve got a really crazy bad data center. We would go down for days at a time and like all recruiting across the Marine Corps would stop. So I was like, well, I need to think about this in a different way.

And that’s when I started digging into virtualization. Then I realized the cloud was going to be the step that we needed to take, and I spent three years just banging my head against the Marine Corps as resistance to change, trying to get the Marine Corps to actually accept cloud technologies as the next step. This was right when FedRAMP was coming up. This was when the very first forays into government of, like, using cloud technologies.

And I basically got told by several different generals to like, sit down and shut up because they were like, no, we don’t do that. We stay on prem. But that’s when I tried to expand, and I really got deep into Salesforce, like learning different things about cloud services, which is a natural transition for me to work there.

Oded: Sounds like you were pushing the boundaries of security within a highly classified networks as well.

Adam: Yeah. And we’re going to do that. You know, despite what you were, thought that you would do or not.

Oded: Yeah.

Adam: And the moral of the story is that every branch of the service, Army, Navy, Marine Corps, actually not the Marine Corps, Army, Navy, Coast Guard and even Space Force, now. They all use cloud computing for their recruiting. Except for the Marine Corps.

Oded: All right. Everybody else did it except for us.

Adam: Questions about whether you want or not, but at least you tried.

Oded: Yeah, I did everything I could, but my plan that I wrote out is actually the basis for the rest of the recruiting command’s actually going towards it all.

Oded: Yeah. Oh. That’s… okay. Look, this is, this is quite interesting. And to see the transition from that, you know, we just mentioned how you saw the… within the enterprise challenges. Let’s go for your own. The things that you’ve seen as challenges as a CISO, right, as a senior security executive right. That sees the challenges around the things that you need to secure.

Adam: Yeah. What were those that you’ve met in the last, “you know, years that were… My degree is in social work.” You know, my entire focus of my brain since I was a little kid has been around the social aspects of the way that people interact with systems.

And so when I look at a problem from a technology standpoint, I always see this system interaction with the human or the human interaction with the system or the system and system interactions. And so I always approach it from that lens and almost every single time that there’s a security problem, it’s also a people policy procedure problem as much as it’s a technology problem.

And so if you step back and take a holistic look at these, at these different issues, you quickly notice that that’s where the problem lies. It’s not necessarily that the technology isn’t perfect, it’s that it hasn’t been implemented well, or that the company or the, you know, whoever is using it just isn’t employing it the way that they should be.

Oded: So people, policy and procedure, what would be an example for… a technology example that explains it? What would you use?

Adam: The example that I always come to is the way that access is granted into an environment. So let’s say I get hired on Akeyless tomorrow, like, whoops, since you’re offering me a job today, right? So tomorrow I start, you’re going to grant me access to everything I need to have access to. Well, let’s say that I want to then have access to a production server. You can, if you want, grant me that access and then remember to revoke access. But it’s unlikely that you’re going to do that because you have everything else going on.

And so that’s where policy is that you only grant for the time that’s needed. The procedure is that you grant and then revoke. But the right way to do that is to automate it as much as possible, to remove the ability of human nature to make a mistake in those situations.

The way that I always see this is that people will tend towards the easiest path. And so the real trick of being a good security person is to make the easiest path, the most secure path. And that’s where good technology comes in, where, you know, the difference between using Slack or straight email is that Slack is just easier to send quick messages back and forth to people, whereas an email does the exact same thing. It sends letters that make words, that make sentences to people, but it’s more difficult, it’s more cumbersome. But Slack is easier. So you make that the most secure way to do things. And that’s where people will tend.

And that’s the real trick to like any kind of good enterprise cybersecurity is making sure that the user experience is top notch so that they do the right things every time.

Oded: So I guess this is most relevant for… You know, it can be relevant for everything that human interacts with, right? Like endpoint security, I guess, right. Or privileged access and things as such. Right. But what happens with, you know, with the current days with all of those worries around, you know, machines? That’s the big question.

Adam: I think that in the industry in general the old idea that a single identity or that a username and password is sufficient, or that, you know, the idea that you can grant permission or grant access to something once and then just leave it is is not safe anymore. And so that whole construct needs to be rethought because it just doesn’t work that way.

And when we start talking about what’s going to happen, you know, with different technologies that everybody’s talking about all the time, that’s going to be an even bigger thing. Because what happens when my, you know, my AI agent that’s my assistant contacts you and says, let’s go have lunch tomorrow. How are you going to know that you should listen to what my AI agent is asking you to do or not? There has to be some kind of relationship there that’s built.

And that’s where technology around identity is important. But I think people need to understand the philosophy of identity. That’s much different than that. And so when Claude, for example, that’s made by Anthropic can now take, take control of your mouse and move around, and do things on your computer, no one else knows whether that’s you doing that or it’s Claude. You would have no way of knowing, because you’ve put your password in, you… You used your fingerprint to get in. It is effectively acting on your behalf.

Oded: Yeah. So how do you trust that? Well, to be honest, speaking about those agents, I’m mostly troubled with the fact that with time, we’re going to give them more and more permissions to do things on our name, under our name. Right? And more and more credentials to do so. So we’re going to connect them with our own personal password manager, whatever we’re using. Right. And we’re going to give them the permission to do so because you want to, we want it to be very sophisticated. Right.

Like, order something from Amazon or whatever, or bring me something or schedule or buy me tickets to whatever. Right?

Adam: Yep.

Oded: And you want it to have also your credit card permissions and maybe even your Social Security number because they would need to. Right?

Adam: Yeah.

Oded: How do you trust that. How do you secure that. How do you make sure that your AI doesn’t tell the secrets that you want to keep from others?

Adam: Well, that end… When my AI interacts with, like, you know, some company’s AI, and they’re talking to each other, it’s like a, an even larger, you know, it’s an even, it’s another layer of abstraction. Now, it’s even more difficult.

Humans do this naturally, like me and you, we do this. Well, we tag things as private, but in the soft thing.

Oded: Right.

Adam: Where I won’t tell you my whatever Social Security number, out of several reasons, but I know about it. How do you tell that to a machine? That’s a whole different thing. But you do it all the time. You’d call your bank all the time.

Oded: Yeah. All right. Well, but what validates the banking employees existence to you is that you called a phone number.

Adam: Yeah, that’s the basis of the trust. You have no idea if that person works there or not, who they are, but you still, they have control of your entire bank account, and we’re okay with that. Humans do this naturally, and I think that that’s where strong authentication isn’t enough. Contextual authentication has to happen as well. So it has to be in context of that scenario.

Oded: It’s very interesting when you think about it with machine identity, by the way. Because, you know, that whole discussion around humans can elevate the way they are authenticating using MFA and with maybe even context with understanding what do they do and whether they are there, despite that example that you get with the AI that moves the mouse right, and the cursor that change it, but with machines, the notion of authentication is much more, allegedly more complicated, because how do they how do they prove that they are who they are, given that they are just using API keys, or the more sophisticated way to use it in a secret list manner, which is leveraging their own, let’s say, cloud identity or whatever, SPIFFE/SPIRE, whatever the newer, the new way that they want to do that. Right?

Adam: Right.

Oded: How do you look at it, like, those challenges of the authentication of machines versus the authentication of humans?

Adam: In a lot of ways, nothing’s changed that much. So, before everybody and their mother started talking about large language models two years ago, the stock exchange, for example, was already completely run by machine learning algorithms. There’s very few people in this world. You could probably count them on your hand that actually understand what in the world those machine learning modules are doing behind the scenes in the stock market.

That kind of thing was already happening. Everybody was already using autocorrect. Everybody was already using, large language models that Google built when they’re doing searches on Google’s browser. And so, those things are not necessarily new. It’s how expansive they are. But I think, what to me, you know, the real big difference there is that people are now more aware that it’s happening and starting to think through it and how it should interact.

So I think the way that I approach, or the way that I want us as an industry to approach this, is that we have context. We have machines that can do multiple things with different authentication per action, as opposed to the machine has authentication to do whatever it wants, is to have authentication per action that it’s doing,

Oded: Which is the just in time factor, that factors into the equation. Right?

Adam: Right. Okay. Right. And not just for people’s just in time, but for the actual machine’s just in time as well.

Oded: All right. So we touched identity on from different angles. We spoke a little bit about the human identities and the machine identities. But let’s go one step back and ask what do you think that made identity as such a key issue within the existing security of today?

Adam: The real difference today from five years ago, ten years ago, when it comes to identity, isn’t so much that we need to identify different things, it’s that we’ve just realized that how critical it is to have identity play a part in almost every interaction that are either machines or people or services or whatever do. And I think that’s the biggest difference. Other than that, it kind of feels like the same problem.

Oded: Yeah. Well, the same problem. Well, what about you know, still that has, that have dramatically changed, right.

Adam: Yeah. Yeah. I mean scale, for sure. Like every single interaction that every machine has with another machine needs to come with some kind of authentication, whether it be a token or a key or handshake or whatever. Yeah, I think that is huge. And I think that leads to a different approach that you have to take because of that scale.

Oded: Yeah, you know, it brings me to a nice question. And I keep asking, you know, so there are now the buzzwords of non-human identity. And then people are talking about machine identity. And where are you at in this kind of debate?

Adam: Yeah. I mean, to me it makes most sense to say non-human. Yeah. Because the permissions that any given person has are fascinating but irrelevant compared to what they can do with the machines at their disposal. So anything that’s non-human and that doesn’t have to be a machine, that can also be just be an API call. Or it could be, you know, a random service that’s running from AWS or something like that. Now, huge numbers of those are relevant.

Oded: You know, it’s funny that, I was asking the question of, one Gartner analyst. Right. And it was like, you know, why people tend to call a non-human identity where, scale wise, The problem is now with millions of those machines, we actually need to call humans as non non-machine identity.

And so, and that’s very interesting. It’s very refreshing when you think of it. If you were measuring the problem with the scale problem. Right, the manual work or maybe some automated work that we’ve had with humans in terms of understanding the permissions, entitlements, right. The whole, the whole realm of, you know, IGA and all around managing the identity that started from a simple provisioning with an identity management system and then speaking about machines, talking about machines, it’s far more, with far more use cases.

Adam: Yeah.

Oded: With more, other machines that can provision other machines, how would a certain authentication would be provided for them? You know, an initiator of processes that create and provision other processes. Those are quite different in a way that it’s being managed, hence requires obviously new tools. Do you remember with one of the roles that you’ve taken, some challenges around it, specifically with those machines, how do you secure them even before the realm of secrets management and before they’re all machine identities and non-human have been around? Like, what are the things are basic that you remember that were the challenges around it?

Adam: I mean, inventory was everything. Like everything. And in inventory, being able to understand what you actually have online and active was always challenging.

Oded: Isn’t that like a CMDB thing, like just understanding where the applications are?

Adam: Yeah. I mean, a time tested aspect is being able to actually know what you have. And when it comes to secrets management, that was also like the biggest challenge, like especially on cryptographic, or especially on, classified networks. Okay, just understanding where your cryptography was and what you had on hand was super important. And also really difficult. The best way to get fired as a platoon commander was to lose some of your classified information or one of the keys or, you know, heaven forbid we had actual, physical, you know, encryption devices that you had to keep your hands on at all times. So worse than, you know, anything, was losing one of those.

Oded: So, let’s, you know, you’ve mentioned security, understanding with machine identities or non-human identities. How does that relate to the different type of work that is being done with organizations? With humans, generally speaking, you would change the way that they interact. You would provide some kind of a tool. I would need to educate them. But with machines now, it’s the aspect of developers of the DevOps. And tell me more about that journey that maybe you have experienced with implementing or with even, you know, designing those kind of systems that secure those machines.

Adam: Yeah. So I’ve, I’ve seen it done poorly a lot so that I can think of maybe 2 or 3 places where I’ve seen it done extremely well, where I was like, oh, wow, that’s that’s impressive. You guys did it right.

Previous role that I had, company goes unmentioned. But, basically the leadership prior to me had told the cryptography team that their responsibility was 100% uptime. And so what they didn’t do was they didn’t empower the engineers to actually understand how their applications were calling to get tokens, get their cryptography, whatever. They didn’t understand how that was happening, so the engineers wouldn’t design for it, and that cryptog… and that team struggled because they had to manage this whole thing by themselves, and nobody else knew how to do it.

Where I’ve seen it done really well is when the identity team actually informs and teaches the engineering teams how to self-service. And what they basically act is, is they’re like guides for the first time they have to do it. Keep everybody in the know and then maintain the systems that helped them do so.

What you can’t expect a software engineer or a product manager to design something well if they don’t understand where it all comes from and why it’s important that it’s done securely. And that, I think, is the secret to all that, is having a good place for those engineers, product managers, whatever you want to, you know, whomever to go self-service and understand where they’re pulling identity from, where they’re pulling permission from. That’s actually how to get them to design things the right way.

Oded: Yeah. You know, I wonder because you’re mentioning a lot of cooperation and collaboration between those teams. And this is something that traditionally between security application, security application guys, infrastructure people. Right. All of those traditionally have had some, let’s call it, not the easiest way to develop those communication skills all together. I wonder if you know from your experience what would be your tip to, you know, security personnel as well as infrastructure security guys that look at it? What do you see there that can help to ease the communication and make it more productive?

Adam: Yeah. And every single time the answer to that question is to go spend time with those groups. That is my, the one thing that I drive home to every team that I’ve ever taken control of, is for them to get out of their keyboard, walk over to, or in some way spend time with the teams that they’re serving.

So the way I see it, security as a service center, they’re actually providing help to other teams. They need to go understand their customer. One of the startups I worked at was a foster care adoption startup, where our intent was to help kids who are in foster care get to loving families faster. We spent so much time with social workers, so that we understood backwards and forwards. The group of people were trying to help, and I use that example because my teams need to do the same thing.

If you are supporting application engineers or software engineers that are building an application, you need to go spend time with them. Watch how they use the tool that you provide, you know, how are they interacting with the key management system? How are they interacting with, you know, the CI/CD pipeline? How, how how do they receive the bug tickets that you’re sending them? Understand that. Understand how to talk to them about it and let them know that you actually care and those communication problems magically disappear. It’s just a relationship thing.

Oded: Communication is key as we say. All the time.

Oded: Yeah. So, Adam, you know, from your perspective, let’s talk about breaches, right? The sexy part, which is sometimes not very sexy. It’s actually the painful part, for many people. Right. Breaches and the breaches are related to machines. From your experience, what did you see? If you take a look at the last two years of breaches?

Adam: There’s two common themes that I’ve seen. And this is, you know, I haven’t I don’t have exact numbers on this or anything, but the two things that I always see is that identity is is compromised at some level. And so it’s not much of a hack. It’s much more of a login after some kind of credential breach. They just get to log in and do it.

And the second thing is that APIs have been the vehicle by which data exfiltration has occurred. So every company or every, you know, system, every application has some kind of API that interacts with some other system or component. You can interrupt the authentication of that API or the identity of that API. You can do almost anything you want.

So, if you look at some of the bigger breaches where, you know, entire databases were downloaded, it was done through a compromised identity of an API, and they just pull the information right out as fast as they can.

Oded: Yeah, that’s very interesting because you’re mentioning two parts that… Some may think that API security that deals with a certain type of vendors might not easily be correlated, like in terms of the roles might not be necessarily correlated with secrets management machine identities. But what you’re pointing out is actually something that really combines the two.

Adam: Yeah. And honestly, like we turned on, at a previous company, we turned an API security tool on and we had 7000 hits immediately. 6998 of those hits were identity issues that happened to also be tied to APIs. So the API wasn’t doing a proper validation of who’s using it or what permissions they had. And so really what it comes down to is the fact that most of the problems that we’re experiencing from a, from an industry where security is involved are actual identity problems, authentication problems, key management problems, things like that.

That’s actually what’s happening. Nobody is actually finding, you know, the cool, you know, Zero Day that’s very rarely used. It’s almost always something much more mundane where somebody compromises an identity and gets their way through the front door, be able to do all that.

Security Tool Proliferation

Oded: Let’s have a moment with regards to another major thing that we see within the security industry, which is the amount of tools that we’re all seeing.

Adam: Yeah.

Oded: Some numbers speak about 5000 vendors. Some may say that it’s even more. How do you deal with that? How do you, what’s your tip for looking at the number of vendors and how do you deal with it?

Adam: Yeah. And by the way, one thing that you asked me earlier was as a new CISO, or as you go into a new area, what’s the first thing you do? This can be related to that, because this is one of the other things that I do after I start to fix problems, as a new CISO or new security leader, everywhere I’ve ever been, one of the first things I do is sit my staff down and we go tool by tool and ask, you know, what are we using this for? Is this what we intended to use it for? And is it giving us value? Because if it’s not, then we need to turn it off.

Never once in my life have I walked into a security role and had an increased budget, ever once. Every single time I’ve had to turn tools off so that I can spend money in different places. And so, for example, one of the more recent times that I walked into a new role, we sat down and we went through, and there was an entire tool there, and I was like, okay, well, what’s it…? Test it. Like, why do we have it? Oh, it’s a compliance thing. Okay. Well when was the last time we did anything with the results that it spat out, like, it detected something? But, when was the last time we did anything about it? You know, they couldn’t think of one. And I was like, well, turn it off. And they’re like, we can’t turn it off. It’s a compliance thing. I was like, well, we’re not using it, so why are we doing this?

And so going through, well, what I like to do is, is every time we come up on a, renewal cycle to reevaluate how we’re using the tool. Good companies that are in deep, you know, good security vendors, we’ll do an annual, like, let’s take a look at the state of your use and see where we can be better. But I like to turn off tools. It’s too complicated. Like, if you’re not using it and getting value out of it, then why? Why is it there?

And I think it goes back to the whole question of, you know, do you want to consolidate onto one vendor or do you want to have, you know, point solutions? And I think that there’s a balance to be had there, but there is definitely value in having a tool that can do several things well and have it all in the same place. The simplicity by itself, being able to maintain the system, keep it updated, all that stuff is much easier with a lower number of tools.

Oded: Where do you see this, the savings within, when you’re consolidating a certain, several use cases within the same tool? Where are the areas in which you actually can see the savings? Besides, I guess, you know, licensing and stuff like that?

Adam: Yeah. I mean, the licensing usually isn’t even the biggest thing. It’s time. Like how much time do my analysts or do my, you know, security engineers spend trying to maintain, you know, the rickety infrastructure that’s holding all these tools together and bringing them together? Like, how much time is that wasting? Because really, what it comes down to is, it’s not that, you know, the the licensing is everything, really. How much time do the security operations center analysts spend hopping from tool to tool, trying to establish what’s happening as opposed to having a consolidated view. That’s more valuable to me that they have the effective tools that are simple enough for them to actually action. That’s what’s important.

Oded: So Adam, thank you so much for coming today, right. For our great talk about AI and security, identity, machine identities. Is there anything, excited that you’d like to share with, with the audience?

Adam: Not that I can share today, but it’s going to be exciting. So you should follow me on LinkedIn. Follow me on Blue Sky, announcements coming soon. It’s going to be pretty exciting.

Oded: All right, stay tuned for Adam.

Adam: Yeah. All right.