Radio LogicSecurity Lessons From Biology

Anders Askasen: This is Radio Logic, the show about digital identities, the people behind it, the tech behind it. And in each episode, we’ll cover what works, what doesn’t, and what’s next. Let’s dig into it.

Welcome to Radio Logic, the monthly podcast where we break down identity into something that actually makes sense. I’m joined by Tom. Tom, you’re from FSP. Tell me a little bit about yourself, and welcome back to the podcast.

Tom Hebbron: Thank you. Well, FSP, we’re a digital transformation, data and AI, and cybersecurity firm based in the UK, but with offices all over the world. I’ve been in identity for—what, too long to mention—both as a consultant with FSP and previously with other firms, and also on the other side of defense as well. So, with Refinitiv and London Stock Exchange, sitting on the other side owning the controls.

Anders Askasen: Last time we were on the podcast, we heard some of the battle scars that you got from complicated role-based access control projects where, you know, you had the role explosion and the proliferation of roles—more roles than there were humans—and all the rest. And I thought it’s a good starting point to discuss because it is a pragmatic way of sort of encapsulating entitlements into something that is more abstracted away from the granular entitlements. You can assign that.

You can audit that role. You can, you know, vet that it actually contains the right thing. But why are we always ending up with these problems with role explosions?

Tom Hebbron: So I guess it’s—I mean, RBAC as an idea is pretty ancient, right? I think, you know, if you’re studying for your CISSP and so on, you look back at some of these sort of Department of Defense documents from, I guess, like the fifties and sixties—the real era of computing—where RBAC, as a way of managing that proliferation of who has access to what in a very regulated environment, was needed.

And I guess with the right amount of effort, it can be made to work in a quite static environment with static people, static systems, and static projects and so on. But as we start to sort of pour accelerant on that and get more complicated, it just becomes really difficult to manage.

Anders Askasen: Is that where we are right now? We’re kind of in the shift from static authorization to more agile, more real-time, more policy-driven, more risk-based types of authorizations?

Tom Hebbron: I think we’ve been there for a while, and that failure to keep up—you know, the static model of who should have access to what, if it was done at all, versus the dynamic reality of who actually needs access to what to do their job. And, of course, finding ways around that in unexpected ways.

You know, we’re about to do that with non-human identities, right? Agents finding unexpected ways to get the thing that you ask them to do done in ways that we couldn’t pre-state, couldn’t predefine that they needed this access to do that. And even if we did, part of the value of agency—whether that’s in a human doing a job or agentic AI doing a job—is we don’t know how they’re going to solve the problem. We want them to just get on and do it.

Equally, we can’t give them so much access, just carte blanche, access all areas, that if an attacker compromises that account, that identity, they can misuse it in every which way.

Anders Askasen: When I speak to customers, there’s essentially three different patterns that are emerging on how agentic AI is being deployed and how companies are—I wouldn’t say experimenting—but how they’re testing the grounds out a little bit. And you have that sort of in-the-browser type of agentic AI, where you kind of give the keys to the kingdom, and that allows that in-browser experience—or even OpenClaw, which is quite popular. But it’s only when you give all the keys to the kingdom that it becomes useful. It can do stuff.

The other pattern that I was seeing is that sort of orchestration layer—the n8n, Zapier, Bedrock of the world—where it’s kind of like workflow 2.0. And you and I have both battled workflow when it comes to joiner, mover, and leaver processes and all the rest. But all of a sudden, you have a nondeterministic AI agent that can make decisions in real time. And then the third pattern is you develop something yourself, and you need to think about all the security mechanisms. But is that how you see the world as well?

And where do these problems start appearing? I can see that if you give access to everything to an in-browser type of agent or an OpenClaw, you set yourself up for at least an increase in attack surface.

Tom Hebbron: Absolutely. And, yeah, you reminded me—I have a machine at home. I’ve been traveling this week, running the previous—what was called a week or two ago—with OpenClaw, so that needs to be removed from a few permissions, I think. I think it can only talk to me on WhatsApp, which is fine.

Just rewinding somewhat, we’re talking about agentic AI and the difficulty of understanding what they need, what’s appropriate, and containing it, which is really hard. But we never solved this problem with service accounts, when the workflows were deterministic, right? We didn’t really apply least privilege, and we could have known for most service accounts in the last twenty years: What does this service account do? What does it connect to? What does it need to do? How often does it do it? And we could have had that kind of activity bill of materials and said, right, so applying least privilege and even just-in-time, it gets these things at these times.

But of course, doing that and defining that ahead of time, and providing that from the vendor to the organizations deploying these tools, was hard and it wasn’t done. So, you know, far too often we saw, just give it domain admin, then it works.

Anders Askasen: And now we’re taking that workflow concept. We bolt in an agent. So instead of having that static if-then-else type of conditions to steer the workflow, we have a nondeterministic agent that, with eighty-seven percent probability, is probably the best approach to do this activity.

Tom Hebbron: Yeah. So, I mean, really what we’re doing with non-human identities now is we’re bringing the same problems that we haven’t really solved for humans and the access they need throughout their life cycle, and running it millions of times faster at much greater scale. Depending whose stats you look at, how many non-human identities to human identities there are in the average organization was already forty, eighty, one hundred to one—and that’s before we bring agentic AI in. The whole benefit there is that you, as an individual, might have dozens of agents going off, inheriting certain delegated permissions from you and doing stuff across the business to make you more effective.

So we can’t do, you know, any kind of static pre-definition of what these agents can have access to. It just won’t scale.

Anders Askasen: So how do we solve it?

Tom Hebbron: I mean, this goes back to a conversation I think we had possibly a year ago, but this is back to my kind of pre-cyber, pre-IT industry life as a researcher in bio-inspired algorithms. So my research was around immune systems. And if you look at biological systems and how do they solve this problem of, “I can’t pre-state the problem. I don’t know what all the pathogens are going to look like, and they evolve thousands of times faster than me.” What’s the life cycle of a bacteria? Twenty minutes? And our generation time as humans might be twenty years, right? And your immune cells, several days.

But we’re not overrun. We’re here. So we’ve solved the problem enough to stay alive.

And it’s change over time. We are able to adapt to danger signals. So we’re able to keep a baseline of things that are definitely bad and are always blocked immediately at the edge. If the agent starts trying to connect to things we’ve said, absolutely not, it’s compromised. Kill it.

If it starts doing things that are kind of questionable, and again this is where we need the sort of higher-level, “What is the intent of this agent? What should it be doing?” If it’s supposed to be booking flights for me and it starts going off trying to look at who are all the users in the business or do some sort of inventory that looks kind of attackerish, then that’s probably a danger signal and we need to shut it down. But again, it’s really difficult because we need to have this kind of library, just like our immune systems have a library, of these are bad things—if you see them, shut down immediately.

And then that understanding and, again, this observability of context and something funny is going on here. It’s not already a known bad, but it doesn’t look great. So let’s raise the defenses a little bit, start to slow the agent down. And we’ve learned some of these lessons as well on the internet.

If you think about some of the early worms on the internet and the defenses that were put in were: if we start to see this behavior, it might be legitimate kind of email traffic moving between servers. But if it looks kind of, yeah, it might be another worm attack, we just slow it down. And that’s enough time for a human to jump in the loop and go, “This is bad. Kill it.”

Or actually, no, this is just, you know, a big email was sent out.

Anders Askasen: It seems like you’re making a lot of analogies with how nature works and how bacteria are kind of ephemeral in that sense, and that resonates with agents who are here and now and they need just-in-time access to something and then they disappear. Or they link up and chain up with other agents and it becomes a mesh of access that is hard to observe and hard to kind of untangle.

How should you even think about and approach that type of—

Tom Hebbron: So how do we actually take those sort of biological ideas and turn them into things we can use in computing?

So again, looking at the different timeframes, there are things that are known bad.

There are, you know, if the agent starts running this piece of code, if it starts connecting to these kind of—

Anders Askasen: But you need to define it.

Tom Hebbron: Oh, absolutely. But these are things that we’ve already learned, right? We have—this is like your innate immune system. If the bacteria has these molecules on its surface, it’s known bad and it’s killed immediately. We don’t go and learn about what it’s going to do. It’s just gone.

Anders Askasen: Is that something that customers are actively right now trying to put in place or using AI to address that part?

Tom Hebbron: I mean, AI is just software, right? Bottom line is it’s just software. If it starts behaving in a way that a piece of malware behaves and we have those behavioral signatures in our endpoint detection tools today, then we know it’s bad. Obviously, that is going to have to develop over time. And in some cases—and I suspect we’ve already had some in the press—where agentic AI has been used to carry out an attack.

Certainly, in the next couple of years, we’re probably going to see somewhere that’s a much clearer story and less kind of hype.

And we will see, yeah, agentic AI has been compromised, run within an organization, has had access to assets that it legitimately should have had access to, and has then done something that it wasn’t supposed to do.

Anders Askasen: But it boils back to the statement that I made: in order for an agent to actually do some good and some useful stuff, you kind of need to give it access to execute on what it needs to do. And that’s in the case of OpenClaw and your server back home that is currently open. And I see you’re looking at the watch and like, “Am I going to come home and find my house exploded or gone or missing?” Is it a ticking time bomb? Are we giving away too much access? Are we still in that transitory state where we experiment and we try to figure out where the boundaries are?

Tom Hebbron: Definitely. And the way that we learn where those boundaries are, and that balance between agency to do good and agency that went too far, is by, yes, pre-stating some of the hard boundaries that we don’t go past. You can’t do this and you can’t do that, and if it’s detected, shut it down.

And the ones where, well, that’s too much friction, we lose the value of the agent if it can’t do anything, connect to anything.

I think for a lot of organizations, the first time they realized that their internal data governance and who has access to what was probably a little bit too loose was first of all when the techies got a look at Delve in Office and could see who has access to everything and who’s been working on what files. And it’s kind of, should we really be able to see what the CEO has been opening for the last week? Maybe that’s a little bit too open. But if, of course, people were aware of Delve and the metadata that surfaced, then when Copilot came along and you thought, well, the Copilot has access to all of that information, is able to use it but go really fast. So it’s that realization that maybe the data governance and who should have access to what was way too loose and that needs to be reined in.

Equally, as we start to deploy agentic AI, we’re going to realize that there are limits to what we should give it by default. So it’s probably okay for Claude to be able to talk to me on WhatsApp, but probably not to have free access to my WhatsApp to send whatever it decides to send to anyone in my address book. Right? Could get embarrassing.

Anders Askasen: Have you dared give your credit card number to OpenClaw?

Tom Hebbron: It does not have credit card numbers.

Anders Askasen: So you cannot WhatsApp it and order a—

Tom Hebbron: No. But you can see the attraction why people are taking some very laissez-faire limits with giving access to everything, because that’s cool. And, you know, I saw a video the other day—and you don’t know what’s real anymore, right?—but the guy said, “OpenClaw is ringing me because overnight it signed up for a Twilio API token and decided to start making phone calls. And it won’t stop.”

Anders Askasen: And I guess with the deepfakes that you can generate, I mean, you can literally tune in to a minute clip on YouTube where you’re talking like we’re doing here, grab that voice and clone that, and it will be at the quality where people can’t really make a difference of whether that’s actually Tom talking or whether that’s an AI talking.

Tom Hebbron: Yeah. And I think whilst we’ve made some great—and we talked about this last podcast—great improvements in authentication and proving that it really is me, and then we get onto the hard problem of, “And what should I be allowed to do now that you’re sure of that?” I guess a lot of biometrics and so on, we’re now starting to see the deepfakes and so on. It’s going to help us to bypass that.

So a problem we thought was solved and could move on to the hard form of authentication that we thought was solved is back on the table.

Yeah. I mean, okay, some of the rules, mathematics, and so on aren’t broken yet. So the crypto that works with a FIDO key and public-private key pairs, that’s safe for now.

But who knows, with quantum improvements made there, that—we’re working with clients on post-quantum crypto, thinking about their certificate estates, and again this is back to an asset-management problem. Do you know where your certificates are? Do you know when they’re renewed? Do you know how they’re used?

Anders Askasen: And this is all topics that, at least from a Radiant Logic perspective, we always talk about the three identity problem, and it kind of flirts with that movie about, I think it’s Three-Body Problem, right, with three suns.

But it is really identity, but you kind of need to treat them as first-class identities, but they’re governed slightly differently and they portray slightly different risks. Your agentic identities, they’re more ephemeral in nature. Your machine identities, that’s more static—the API keys and the SSH certificates and all the rest. And then the human identities, which we thought was solved, but obviously there’s challenges in all three buckets.

Tom Hebbron: I think definitely. And actually, yeah, thinking about those buckets of identities, there was a really good session at the end of last year on non-human identities and thinking about, as we were talking about, the deterministic old-school service accounts. We could solve that problem and they will still be around, right? You do not need to run an agent to do everything. There’s plenty of very boring, very staid service accounts that will carry on doing what they do, and we can give them just enough access. That’s it.

But then you’ve got the agentic AI that’s going to be working towards some goal and, as we’ve talked about, understanding what access they need and whether they’re going beyond safe boundaries. And that very dynamic risk assessment requires a lot of contextual information about what it is that they’re doing and what it is that they’re supposed to be doing. And is there a gap between the two models where they’re sort of going out of bounds and need to be reined in?

And then there’s a third category, is kind of the agentic AI which is doing stuff on behalf of a human and inheriting that human. This is, again, the Claude bot. It’s doing stuff as me, and there’s going to be a lot of security systems out there that can’t tell the difference other than that I seem to be doing a lot more and much faster than I used to do it.

Anders Askasen: And at some point, you’ve endorsed that agent to use your credentials, whether that’s access to your calendar or access to your email account.

That must be something that the CISO is, when you talk to your customers and you address the CISO, he or she must be wearing—

Tom Hebbron: If that doesn’t give you an itch about, “I don’t feel comfortable about that because I don’t know everything that the API or the agent or whatever you’re delegating access to is going to do with it.”

I mean, we’ve all had those pop-ups where you’re signing in with your enterprise provider and it says, “Want access to your email. I want access to your calendar.” And it’s kind of, well, why do you need access to my calendar? You can have access to that one event that has anything to do with you, but quite often the protocols and so on don’t have the granularity that we need yet to do that kind of delegation that we’re comfortable with. Equally, that’s a lot of thinking you’re going to push onto the user about making those decisions about, “Am I okay to—”

We’re not. We’re absolutely not.

Anders Askasen: So the question is how do we move forward? And I guess as we wrap up our conversation, how should—if I assume the role of a CISO—how would you advise me? Because I have a mandate from the board and from the CEO that we need to push out more and more AI technology for operational efficiency and what have you. I don’t have a choice. I see the risks. I want to limit the attack surface, and I want to mitigate some of the problems, but the mandate is, you need to get this done. What would you advise me to do and think about identity and how to deal with this?

Tom Hebbron: Yeah. I think going back to that sort of immune metaphor of understanding, we don’t know what all the bad things are ahead of time. We do know what some of them are, so we can put different tiers of boundary in. So some things are just never allowed. You can’t do them. Some things we have to learn, and that obviously we can learn as a community: if you had a bot that did something bad, we can very quickly—not antivirus, right?—bring those signatures across, but these are more heuristic signatures.

And then some, we have to learn the hard way. Something bad happens, we look at the forensics, we go, could we have prevented this?

Okay. We need some new rules. And just like the three layers of the innate system, the adaptive immune system that learns when you get a bug and, over a few days, you start to fight back. And then our system, giving vaccines and so on, and as a community sharing that so we can prevent ourselves getting the illness in the future.

So I think there’s a lot to learn from how biology spent billions of years and billions of tries solving this problem where the problem can’t be pre-stated. We have to kind of learn the hard way what’s bad, what’s good, and then adapt to it.

Anders Askasen: Tom, I thank you for joining the podcast, and it’s always a pleasure hearing how you see the analogies with nature and what we’re doing in security and identity particularly. We can see that security is a layered problem and that you need to have that in multiple layers.

And that’s the only way to really preempt some of the attacks. And I can see, even though Tom might not be aware, that he’s up for some more scars moving forward in this space. There’s going to be a lot of challenges, a lot of problems to be identified, and it’s a very fast-moving and quick space right now. Tom, thank you for coming.

Tom Hebbron: It’s a pleasure.

Anders Askasen: Thanks for listening to Radio Logic. Subscribe now wherever you get your podcasts.