Episode 188 - GluuFederation/identerati-office-hours GitHub Wiki
Title: Linux Security: Face Issues Before Attackers
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Peter Cummings, Founder/CEO Linuxguard
Channels
Description
Most teams have a comforting story about Linux security on paper, but the reality hiding in sudoers files, SSH keys, and service accounts is usually very different — and that’s exactly what attackers target first. LinuxGuard focuses on the ugly reality of Linux identity and privilege sprawl: who can actually do what on your systems today, where drift has already created silent escalation paths, and how to fix it before an incident forces you to learn the hard way. We’ll dig into why Linux IAM is still the most under-monitored layer in modern estates, how to get continuous identity visibility without ripping and replacing existing IGA/PAM/EDR, and why “face your issues now or during incident response” has become the new security baseline.
Homework
- https://linuxguard.io/blog/ivip-beyond-the-buzzword-toward-identity-reality
- https://linuxguard.io/blog/the-sudo-drift-catastrophe-when-privilege-sprawl-becomes-your-worst-nightmare
- https://linuxguard.io/blog/stop-cosplaying-cybersecurity-and-start-fixing-the-real-problems
Takeaways
-
⚡ ~70%+ of enterprise workloads still rely on Linux. Is it really as under control as most enterprises believe? Linux remains a blind spot despite cloud, containers, and AI layers.
-
⚡ Traditional IAM models (roles, groups, directories) don’t translate cleanly into Linux, where sudo, local configs, and emergent privilege paths create access that identity systems cannot accurately model.
-
⚡ “Sudo drift” turns least privilege into full privilege. Even well-controlled environments often allow users to escalate to root without friction, effectively bypassing PAM, MFA, and session controls once inside the system.
-
⚡ Security failure is usually internal, not adversarial. Misconfigurations, sudo-drift, shared SSH keys, and unsafe defaults create more real-world risk than external attackers.
-
⚡ Continuous visibility beats periodic compliance. Snapshot audits (e.g., SOC 2) miss real risk; effective Linux security requires real-time, system-level observability and continuous validation of what is actually true in the environment.