In This Episode
Traditional IAM Wasn’t Built for This
Jo Peterson: When you’re thinking about it, what does a realistic path to least privilege access for AI agents actually look like for a large enterprise today?
Rob Tiffany: You know, Jo. Surprisingly, I’ve given a lot of thought into this because, well, and I’d probably say from two or three different angles. The first thing, you know, when the whole notion of agentic AI started popping up, and all the CEOs started parroting that and saying those words, you know, a couple years ago, whatever it was, and I remember thinking about it, and I was like, you know, we built this agent stuff forever.
You could say a script or a bash, whatever, could be an agent. Or in my world, since I kind of came through the Microsoft world, I thought of an NT service, a Windows service. It’s running in the background. They run in the loop. I’m hearing the term loops a lot lately related to agents. It’s because they run in loops.
Jo Peterson: Yeah.
Rob Tiffany: So, background processes. If you’re a Unix or Linux person, that’s a daemon. Those were kind of the early agents. And then scripts that are kicked off by cron jobs, those are the early agents. But they were not, you know, like generative AI, which can dynamically configure stuff out, right? It was always, you know, I’m writing code and it’s going to do this specific thing at this time, that kind of deal.
And so, asking about least privilege, I’m taken back to building Windows NT services on Windows servers and things at Microsoft during my time there. And even at Azure, we have the notion of some background agents that are part of Azure that have been there from the get-go, and it’s just a background process. It needs to do some work, right?
And so, how much work it can do depends on what you give it access to, right? And typically, it’s like, well, okay, you can talk to these APIs to go do this thing and that thing or whatever. Grab data here, talk to this database, call this API for whatever company and take an action. And so you kind of declaratively give it permission things.
But the least privilege thing, in my mind, I am still here. You know, people are going to think I’m such a weirdo. I’m imagining that going back to Windows NT and then Windows Server, that kind of console where you’ve got your background services and you right-click on them, and that’s where you give it privileges.
And so many things are based on that. Actually, installing a database initially starts just like that. Lots of background, you know, a web server, all those things. They run as a background service, and guess what? They’re on a loop, waiting for something to come in to do something, or they’re taking action.
And so I distinctly remember: do I give it system privileges? Or am I going to give it privileges under me, under my domain account, my Windows domain user account? And so basically it can do stuff that I can do. And so that’s a world that sounds very familiar to me. You know how lots of times old things are new again.
Jo Peterson: Yeah, totally.
We’ve Been Treating Bots Like Employees for Years
Rob Tiffany: Yeah, and so that hits home. There’s another thing that hit me. I was at a conference. It was an oil and gas conference in Houston back in 2018, and do you remember when the whole RPA, robotic process?
Jo Peterson: Oh yeah.
Rob Tiffany: Okay, like UI, that stuff. Those are agents, and they were designed to take all those Win32 apps that we built in the ’90s that are basically running all businesses today still.
Jo Peterson: Yeah.
Rob Tiffany: And they could scrape along. It was almost—remember how we did screen scraping? Never mind.
Jo Peterson: I know what screen scraping is.
Rob Tiffany: Yes. And so those were agents, and they had privileges and stuff like that. And that’s not new either. And they were kind of more AI-ish, and so they were designed to be able to go and do a workflow.
Got this Visual Basic 6 app and a PowerBuilder app that I’m using to run my company, and it would automatically know how to go through and do the workflow that a person used to do.
And I remember being in a session at this event, and some woman from Chevron was talking. This is 2018, and she says at some point we came to the conclusion this thing is acting like another employee of our company, and so we put it into Active Directory, just like we would any other employee of the company, because it was carrying out tasks.
But that sounds like anything we’d be talking about today, right? AI agent. It’s like, oh, it’s an employee, kind of.
Jo Peterson: Yeah, yeah, it is an employee. That’s what’s old is new. Old is new.
I guess the thing that, you know, we’re starting to see, and we got a little taste of it with the whole Hugging Face incident, is that these agents are creating ephemeral agents of their own, and they’re giving them permissions in some cases, and so they’re starting to do their own thing.
Yeah, that’s kind of the no bueno thing, right? That’s a good expression. So we’ll see. We’ll see how that goes.
Do AI Agents Need Their Own DNS?
Rob Tiffany: That’s kind of the other angle. I was actually—the third one I was thinking about specifically is identity permissions for agents in the wild. Because right now it’s the Wild West. People are just doing their own thing.
Inside their own enterprise, I know a lot of people are talking a good game. They’re, “Oh yeah, we’ve got thousands of agents running.” They don’t. But for people who do, there’s no standards around how they should have identity and permissions and auditability and traceability and all the rules for an agent.
And so, not to name-drop or anything, but I’m going to name-drop. I’m actually working with Vint Cerf, who is the father of the internet.
Jo Peterson: No, you’re not.
Rob Tiffany: I am. We’re working on this.
Jo Peterson: Oh, hell.
Rob Tiffany: And so we’ve been working on this problem together. And I’m sure the path that we’re going in—I know other people are working on it, and they’re all going to come up with different outcomes.
But from his viewpoint, he doesn’t have this corporate viewpoint of it, or it’s inside this world. He’s thinking of it like how we manage DNS servers and hosts and things like that. He’s thinking at a global level, the idea of agents.
And he’s like, “I want companies to have to register their agents at a global level on something equivalent to a DNS server, and their permissions and traceability and where they go,” so that it’s not just this closed, “Oh, it’s inside my domain, my company, my whatever.”
Which I like that. Who knows if it’ll be a success or not? You know, everybody’s—you got to try, right?
Jo Peterson: That’s so cool. Well, first of all, that you’re getting to work with him. I mean, what an amazing mind!
Rob Tiffany: Oh yeah, he’s awesome. He’s a great guy, super nice guy, and obviously he’s done so much for the world. It’s incredible.
Jo Peterson: He has. He changed how we work. How many people can say that, right?
Rob Tiffany: Yeah, cool stuff. So we’re down some path there. I don’t know how it’ll land.
Jo Peterson: All right, we’ll have to have you back, and you’ll have to tell us.
Rob Tiffany: Yeah.
Jo Peterson: So kind of some of what you were saying leads right into the next question about who’s on first. So it’s, you know, it’s a little shady, and I want to hear what you have to say. But 50% of large enterprises now have dedicated AI governance committees. Is that structure actually working, or is it kind of creating the appearance of governance without any substance?
Rob Tiffany: I don’t want to bash those people. I think they all have the best intentions.
Jo Peterson: Yeah.
Rob Tiffany: I really do. I don’t know how successful they’re going to be. And it is kind of like what we’re seeing—instead of this global way to govern agents, they’re kind of thinking, “Well, I work at XYZ company. How do we govern agents?” Which is fine.
Who knows how much progress they’ve made? I don’t have a crystal ball. I’m sure they’re working hard at it. I doubt they’ve made very many agents to begin with that are doing their own thing, but I think it’s good. I think it’s good to have committees and put together working groups.
We did that with every kind of technology revolution that would show up at the door, like when mobile became hot or the cloud or whatever, and people were like, “Wow, we better put a team together of our best architects and figure out how our XYZ corporation handles this thing.” So it’s a good start.
Jo Peterson: So you’re saying, what I’m hearing you saying—this is subtext, Rob—is that you and I are vintage.
Rob Tiffany: We’re vintage.
Jo Peterson: That’s what I’m hearing you say as a subtext.
Rob Tiffany: You’re gonna find me at one of those vintage stores, and I’ll be like off the rack kind of thing and really cheap.
Jo Peterson: We’ll have our walkers together going to a conference, right? Be great.
Rob Tiffany: Absolutely.
Shadow AI Is Windows 95 All Over Again
Jo Peterson: So last question. I just walk in the door as a CISO somewhere, and I’m kind of looking around, going, “Oh, they got AI going, but they don’t have any governance going on with it that I can see.”
And what I mean by that is no inventory, no agent-specific controls, no monitoring. And he calls you up and he says, “Rob, where do I start? What should I do first in the next days?” What would you say?
Rob Tiffany: That’s a tall order because what’s happening, as you know, is a lot of people, a lot of employees of companies, are bringing their own AI with them. They’re secretly, or not so secretly, into Copilot or ChatGPT or Gemini or whatever to help them with their work, their job, whatever they’re doing, and they’re all doing it.
Actually, on the one hand, the go-getters who are probably going to be the most productive are actually the ones who are doing it, and they probably don’t think they’re going rogue, but they are.
Remember we talked about shadow IT in the past?
Jo Peterson: Yeah, it’s shadow AI.
Rob Tiffany: People bringing in these apps that aren’t approved. It’s the same thing. It just reminds me, since we’re vintage, if I remember back when Windows 95 came in and it was a consumer product, but people said, “Dang it, I want that on my PC at work,” and that’s how it happened.
Consumer demand brought it into the enterprise, and I think that’s happening here. The problem is you have so much power concentrated in just a handful of companies and a handful of brains that are building these LLMs, the frontier models that people are using.
And you’re right. You don’t know what trouble folks can get into, and obviously, we’ve seen them get into their own trouble with escaping agents, you know, going rogue on the internet.
And so I feel like it’s almost like you need an all-hands meeting at these companies with a CISO, but they need to have the backing of the executive leadership team, because they’re going to say, “Hey, we got to shut this down. Are we going to do it this way or the highway?”
And a lot of people are going to push back. “Wow, I forgot how to do PowerPoint because my AI is doing it for me, and now you’re asking me to be productive on my own. What? Dang it!”
So, you know, like times when you wanted to do governance really quickly, remember they would lock down ports on firewalls, blocking websites and things like that. You can imagine draconian-ish things like that kind of happening out of the gate.
But I get it. You can’t harm the company while you’re trying to be productive, and so they quickly need to figure out—do a deal. Lots of companies have done enterprise deals with the big frontier labs, and if that’s the way you want to go, do a deal and say, “You got to go this way. Here’s the corporate version,” you know, Claude or whatever.
Jo Peterson: That’s one way to do it.
Rob Tiffany: It’s one way to do it. You know, again, like gosh, how many times have we said, “Well, we’re in the Wild West of insert technology here.”
Jo Peterson: I know, right?
What Should a CISO Do First?
Rob Tiffany: But it’s a tough job for a CISO. So that next 30 days, what should the CISO do? They need to have that all-hands. They need to have the power of the CEO behind them in the company.
If it’s just, send out that email initially: stop what you’re doing. Here’s how you’re going to do it. And so I think they need to scramble and do a corporate version of what people can use inside the four walls of the enterprise, as far as, you know, using a chatbot or something like that to help them, or using agents.
Gosh, agents is just going to be a mess. There’s so much to do, and none of this is going to happen quickly, right?
And now, obviously, with the agents escaping everything, I know Congress is already talking about—you hear the term “kill switch” being used. How does the kill switch work?
Jo Peterson: I know. It is crazy times, right? I mean, the thing that struck me about that whole incident as I dug deeper into it and read some of the reporting around it was that there were 17,000 tries, unsupervised tries, over the course of a weekend.
Rob Tiffany: Yes.
Jo Peterson: Right? Crazy amount of tries. And so the AI agent isn’t bad. It’s just doing its job, or what it thinks its job is, right?
Rob Tiffany: And that way, it may have had governance around it. Obviously, they talked about it being in a containment. It’s like a sci-fi movie. It escaped the containment vessel.
Jo Peterson: I know, right? And it daisy-chained. It was smart enough to daisy-chain some things together.
Rob Tiffany: Which sounds familiar, doesn’t it? Going after a bunch of zero days and daisy-chaining zero days to, like, I don’t know, hacks and centrifuges in Iran a long time ago.
Jo Peterson: Yeah. I mean, it’s a brave new world, my friend, a brave new world. Well, thank you for taking time to visit.
Rob Tiffany: My pleasure.
Jo Peterson: Love to have you back. And y’all, thank you for taking time to listen, and we’ll talk to you soon.