Latest / Identity at the Center / #329 - Discovering Effective User Access Reviews with Stephen Washington

Transcript

#329 - Discovering Effective User Access Reviews with Stephen Washington · Identity at the Center

0:00
The only reason financial services is doing it is because
0:04
they've regulators making them do that.
0:06
So 1, is that true? And you know, 2 like where is
0:11
the value? Is it just to be compliant with
0:13
regulation or is there something more?
0:16
Really good question and I'm thinking now don't want to
0:19
answer it positive or the way I already feel.
0:23
Let's go positive first. So you are absolutely correct in
0:27
terms of regulatory just environments, which has cost
0:30
multiple industries. There's a ton of value in use
0:33
access reviews because it is both a detective and really a
0:37
corrective type of control. The end of the day it's done to
0:40
say, hey, should Jeff and Jam still maintain this access?
0:44
And if they shouldn't let me create an action where I do an
0:48
attestation and say Nope, I want them out and then some
0:51
technology, some tool goes and remove them from that access.
0:55
And for small and mid sized companies, it works really well
0:59
because there's not a lot of bloat in small and mid sized
1:03
businesses. The larger the company is, the
1:06
more job roles of companies are really strong.
1:09
When I say on our back, you know Rd. based access control, the
1:12
more our back you use the larger your access role environment is
1:17
going to be, the more access certification use access reviews
1:21
you have. Once you hit that threshold, now
1:25
it becomes more of. Is there value in this or is it
1:28
just a checkbox activity? This is identity at the center
1:38
if it has anything to do with IAM.
1:41
This is the go to podcast now your hosts Jim McDonald and Jeff
1:47
Stedman. Welcome to the Identity at the
1:55
Center podcast. I'm Jeff, and that's Jim.
1:57
Hey, Jim. Hey, Jeff, how are you?
1:59
Oh, not so bad yourself. Doing good.
2:02
You know, obviously we always start every show off with
2:05
banter. So I was like, OK, what am I
2:06
going to hate you with this time?
2:07
And I was kind of thinking back to, you know, one of the areas
2:11
where I've really been wanting to put together an episode and
2:17
the topic is device identity. And So what I did this week on
2:22
Monday was I launched a, a poll question on LinkedIn.
2:28
So it was in your mind is device identity the discipline focused
2:33
on? And then I put a couple of
2:35
options like a device, a device's role in authentication,
2:40
the accounts local to a device, both or something else.
2:45
And it got 55 responses, they got 3 reactions.
2:49
So basically 3 thumbs up and they got over 1200 impressions.
2:56
I'm wondering what it was about how I put that poll question
2:59
together that didn't make it very popular to respond to do.
3:04
You think, did I respond to it? I feel I know I saw it and then
3:07
I don't remember if I clicked my answer or not.
3:10
Well, I don't know. I don't know if you did.
3:13
I don't have that data point. We'll just say I did because I'm
3:15
a, I'm a, I'm a good, you know, partner in crime on this type of
3:18
stuff. Yeah, yeah.
3:20
So, you know, I think with the whole non human identity topic,
3:26
right, that's getting all the attention.
3:28
But then we talked about device identity a lot and you know,
3:32
like my perspective has been, I don't really think a device has
3:37
identity and I'm starting to change that opinion.
3:41
So I'm, I think within the whole non human identity realm, you've
3:45
got workload identities and then you have device identities.
3:50
And really it's this whole, I think at the core of why a
3:54
device identity is even important is this whole shift of
3:59
identity is at the center. Identity at the center, of
4:02
course, is the name of our podcast.
4:04
We could take full credit for that from, you know, six years
4:07
ago, but the idea that, you know, firewalls used to
4:13
basically say, all right, you can either come in or not come
4:17
in based on IP address and port and things like that.
4:22
And now they're getting smarter where, you know, they can
4:26
actually use authentication. And then when you think about
4:30
zero trust, you're not just talking about the firewall, but
4:33
you're talking about the infrastructure layers below the
4:36
firewall and you're talking about traversing from one
4:39
network segment to the other. And should you simply do that
4:44
based on IP address and port? Like, no, some devices and some
4:49
identities should have access to certain network segments than
4:53
others. So to me, like there's where
4:57
we're kind of like circling in, but I'm still trying to wrap my
5:02
brain around this. And I would say basically the
5:04
community either, you know, is kind of like where I have been,
5:10
which is like, I don't even know what that definition is, or you
5:17
know, there's a mix of answers. I think most people came to a
5:20
divisive role in authentication, which kind of makes sense.
5:25
A few, only 5 people out of the 55 said the accounts local to a
5:31
device, which I think is this non human identity piece like
5:36
25% said something else. So anyway, you know, I think
5:40
that there's confusion on the topic out there and what I want
5:44
to do is have some podcast episodes where we talk about
5:50
this and kind of start to solve or at least put an answer behind
5:55
it. The official identity at the
5:57
center answer behind What is the vice identity?
6:01
Got it. Well, I just looked it up and I
6:03
didn't vote, but I just voted now.
6:05
And I think it, I, I tend to think of device identity as the
6:08
device's role in authentication because the other options were
6:11
the accounts local to a device. I feel like that's more like
6:15
local, local account management or something like that.
6:18
But I think this is an area where context matters maybe and
6:21
who you're talking to, because maybe I'm approaching, OK, well,
6:24
that's what makes sense to me from authentication standpoint.
6:26
You know, while somebody who maybe does like, you know, MDM
6:29
work all the time or, you know, endpoint management might be
6:32
thinking of a different way. I mean, IM community is really
6:35
good at having multiple definitions for the same thing.
6:38
So you kind of have to know who you're talking to and making
6:41
sure that you're communicating effectively to make sure you're
6:43
on the same page. That's, you know, I don't want
6:46
to one up you man, but you know, 1000, you know, impressions.
6:51
I had 5000 on when I asked this week.
6:54
I got a lot of really good answers to a question that I
6:59
posed on LinkedIn and I got to tell you that I am brain trusts.
7:03
The hive mind of people on LinkedIn came through.
7:06
I was asking a relatively vague question around device identity
7:10
essentially. So this idea of tap and go, but
7:13
without the tap part, almost kind of like an ultra wide band
7:17
key or some sort of proximity authentication.
7:20
The challenge being what if you have multiple people in the same
7:23
room? How do you identify the right
7:25
person as part of that? I gotta tell you, after 5300
7:30
impressions and a whole bunch of views and like 30 or some 40
7:33
comments so far and counting, I had so many good people like
7:37
reach out, put their thoughts into it.
7:38
So there's no way I can reach out to everybody and thank them.
7:41
So I'm just going to like as many comments as I can.
7:43
But if you're listening to this and you posted, thank you so
7:46
much. If you reached out to me on D,
7:48
you know, DMS or whatever, maybe I know I've got a couple
7:50
meetings already set for next week to kind of talk through
7:52
options, but it's something that's, you know, it's called
7:55
like AI don't call it a pet project, but it's something that
7:58
I've been thinking about. It was like, OK, is there an
8:00
option in this space where tap to go can be just go or be and
8:07
go or something like that? So shout out to the I am experts
8:11
on LinkedIn for, you know, for taking a look at that and taking
8:14
the time to to respond. So I appreciate that.
8:16
I think LinkedIn, like any social media platform, has
8:19
algorithms, right? So you posted that you started
8:23
getting comments. LinkedIn picked up, hey, this is
8:26
a really popular thread. We're going to show it to more
8:30
people. More people see a more people
8:32
comment becomes viral. Obviously I posted mine my poll
8:37
in it, but was not a very popular topic.
8:40
So maybe we should have a bunch of we should not have a bunch of
8:45
episodes on this. But I still think it's something
8:48
that we need some clarity around.
8:51
But maybe we should have something on top and go.
8:55
Yeah. Well, I mean, I don't, I don't
8:56
know what's there yet and what's realistic because I think some
8:59
of the caveats I throughout were like, OK, not proprietary, give
9:02
me something that's built off open standards.
9:04
You know, maybe it's something that we can use Fido
9:06
authentication for. Maybe it's something already
9:08
exists elsewhere, SAML open ID and it's just putting the pieces
9:11
together. But yeah, I mean, this is the
9:16
great part of running this podcast.
9:17
Like I don't have valid answers. You don't have answers.
9:19
Let's find smart people who do and get them on and, and ask
9:21
them about it because I'm sure other people have, you know,
9:23
somewhere or questions or, or things that they can contribute
9:26
to. So it's not a, it's, it's not a
9:28
race. I, I'm not, you know, it's, it's
9:30
not that I got five times as many impressions of you.
9:32
That's not what it's about, Jim. I've only said it like five
9:34
times. Hey, by the way, I did one post
9:37
one time and it got over 10,000. That's.
9:39
Great, I, I, I only, I only bring it up because like I've
9:42
never, I don't think I've ever had a post that had that much
9:44
traction. Like even when I do the podcast
9:45
weekly that's, you know, maybe a couple 1000 something like that.
9:48
That's just people, you know, checking out our new show.
9:50
So for whatever reason, this idea of non human identity and
9:55
password, more user friendly, password less right,
9:59
frictionless or friction, less friction I should say, from
10:02
authentication seems to strike a chord.
10:04
And I'm wondering if we can I, I let's put something up around
10:07
that. I think we should just show
10:08
about it. Absolutely.
10:10
So hey, if anybody's listening who has a strong opinion, vendor
10:14
agnostic, strong opinion, reach out to us questions at idac.com.
10:20
It'll get to Jeff and I and we'll try to do something.
10:24
Or if you're a vendor with a strong opinion, come on, we're
10:26
on a sponsored episode and we'll get your, we'll ask you
10:28
questions about it and get out there.
10:30
So absolutely, yeah, we got a couple conferences that we're
10:33
going to be at later this year. One that we're not going to be
10:36
at, but we do have a discount code for is the Gartner IM
10:39
Summit taking place in London this March 24th and 25th.
10:43
If you use the code ID AC425 you save and I'm not sure if it's
10:48
€425 or pounds, you will save 425 of some currency for that
10:55
region which is better than nothing for sure.
10:57
It might be rupees it. Could you know?
11:00
Who knows? Maybe it's, you know, League of
11:02
Legend gold coins. Who knows, You will say 425 of
11:05
those. It's not 425 bitcoins, I can
11:08
tell you that. No.
11:09
Yeah, if you got 425 bitcoins, you're probably doing right.
11:13
But that's a conference that has been nice to have to extend out
11:16
a conference code for people to take advantage of.
11:18
I'll have it on our, it's already on our web page,
11:20
idacpodcast.com. I try to keep all of our current
11:23
discount codes on that. So we've got the Gartner IM
11:26
Summit in London again, March 24th and 25th.
11:29
One that you and I are very excited to go out, we've talked
11:31
about a couple Times Now at this point is the European Identity
11:34
and Cloud Conference in Berlin, May 6th through 9th.
11:38
If you use the code ID AC25 MKO, you get 25% off.
11:44
And so you and I are going to be out in Berlin for a week
11:47
roughly. I think we're putting together
11:50
what some podcasts might look like and hopefully we even have
11:53
time to actually attend the conference and not just be in
11:55
recording room the whole time. Yeah, it's going to be so
11:57
exciting. I mean, I've never been to
11:59
Berlin for great things about the city and I've heard great
12:03
things about this conference. Heard that.
12:05
It's like information you know will be coming out of your ears
12:10
by the end. And I can say the organizers,
12:14
obviously, we've had Martin on the show, He's had us working
12:18
with this conference team. Marina has been super fantastic
12:23
about, you know, helping us coordinate our activities while
12:26
we're there. So yeah, we're going to record a
12:29
few podcasts on site and like you said, get to enjoy the
12:32
conference a little bit. So hopefully we'll get to meet a
12:35
lot of you there. And the conference code,
12:38
discount code will help you save a couple bucks.
12:41
Yeah. And then hot off the presses, we
12:43
have Ideniverse 2025 that is in Las Vegas, so June 3rd to the
12:48
6th. If you use the code IDV 25-I D
12:52
AC25, you get 25% off. I know that's a mouthful.
12:55
Again, the links will be in our show notes.
12:57
They'll be on our website and you can check it out there.
13:00
But that's another one we're looking forward to.
13:02
We've got some exciting plans that we probably shouldn't
13:04
announce quite yet until we have things kind of sign sealed and
13:08
figured out and, and well say delivered, but planned and ready
13:10
to go. But if you like prior conference
13:16
activities that we have done, we may be doing something similar
13:19
at ideniverse. Is that vague enough, Jim?
13:23
Yeah, I don't know. Anybody's going to figure it out
13:25
based on that? But two fives wild.
13:28
So that 25% off for ideniverse 25 IDV 25 dash IDAC 25 code.
13:38
I mean, look, it's if you, if you can get to a conference this
13:42
year, if you're US based, do it. It's a fun conference too.
13:48
There's a lot of really smart people that'll be there and you
13:51
learn something. So I'm a fan of it.
13:52
Obviously, hats off to them and thanks for them for their
13:54
partnership on it. All right, why don't we turn to
13:57
our guest because he's been patiently waiting in the wings
14:00
here for wow, over 10 minutes. I promised 5 to 10 minutes.
14:03
Over at 12 minutes. Let me welcome to the show,
14:05
Steven Washington. He's the head of IAM at Discover
14:07
Financial. Welcome, Steven.
14:10
Hey Jeff, Jim, pleasure to be here.
14:12
Looking forward to to a wonderful show you guys have.
14:16
Well, thanks so much for taking the time.
14:17
And is this your first time being on the show and hopefully
14:20
not the last. We'll find out at the end if you
14:22
still like us or not. But tell us about your I AM
14:25
Orange story. How did you get started in I Am?
14:27
Is it something that you chose or did it choose you?
14:32
It shows me, I went to college, I got my degree in computer
14:34
engineering. I wanted to be the best Java
14:36
program in the world. I'm like, yes, go Java 2, Struts
14:40
all the way. My first job out of college.
14:42
And they said, yeah, you going to start managing, you know, web
14:46
service like, OK. And then they said you need to
14:48
manage LDAP directories like LDAP.
14:52
What is a LDAP? And until this day, you know, I
14:56
I realized how the godfathers of I am basically was Novell, you
15:01
know audio dev directories and I still use it's called LBE dot
15:06
jar is why it was the greatest LDAP browser utility ever
15:10
created as I started using it in 2001 and I still have it on my
15:14
computer today. It can do wonders and it's a 25
15:18
plus year old Java Java. So I'm not familiar with this.
15:23
I guess what makes it timeless in your mind that it's held the
15:26
test of 25 years on your? And about two, about 2010 I
15:30
think Soft Terra must have found no way to take it because they
15:34
had the same exact interface. It was just modern.
15:37
But the thing about it is you was able to use every feature
15:41
possible in terms of certificates, you know, and do
15:45
things that you couldn't do with modern security controls.
15:49
So I was able to connect to almost any Active Directory
15:53
domain, you know, Oracle directory, I mean, almost
15:56
anything. And then I love virtual
15:58
directories. So I was able to actually use it
16:01
and kind of play around with, you know, multiple directories
16:04
or through one proxy, you know, way back in the early 2000s.
16:09
I remember Softerra, that was the.
16:10
I used their LDAP browser as well, but probably not to the
16:13
level you were. I was looking at maybe 1 or 280
16:15
domains and then I think I was using it all for.
16:18
Also maybe some sequel stuff. I don't remember, but I was
16:22
definitely not a pro with it. But you mentioned the word
16:24
software. I was like, oh, I just had a
16:25
flashback. No.
16:28
And I mean that interface was exactly the same thing.
16:31
It's just that this was a matter of fact.
16:32
It was Java Swing, you know, user interface.
16:35
So it was old school. So tell me about your role as
16:40
the head of IM at discover Financial.
16:43
What does that mean? You know, tell me, like, what
16:45
does your like day-to-day look like?
16:48
Managing the largest team in cybersecurity at Discover
16:54
because as you all know well, I am has the most challenges and
16:59
also the most opportunities. But we are deployment and I tend
17:03
to call I am cyber adjacent. Some people like it when I do,
17:06
some people don't, but I call it cyber adjacent because identity
17:10
is really a combination of infrastructure, services,
17:13
cybersecurity and risk. GRC like risk management, it's a
17:18
combination of both of all three.
17:20
So it is that it cannot fit in just one specific space, but
17:25
most times it's either infrastructure or cybersecurity
17:28
and that discover we are withstand cybersecurity so.
17:32
Cybersecurity adjacent? I guess I've always thought of
17:35
IM as in cybersecurity. What makes it adjacent for you?
17:39
So if you think about what the the major utilities, the Igas,
17:44
the IDM, the the vaulting solutions, they all are
17:47
basically shared services, which means they have a large
17:50
component, which is infrastructure base.
17:53
And you think about it gives more focus on resiliency,
17:56
operational overhead, consumption, you know, and those
17:59
are more infrastructure services.
18:02
When you think about cybersecurity, you're not
18:03
thinking about that. You're thinking about sometimes,
18:06
you know, governance risk, thinking about, you know,
18:08
security incident, response to tech, you know, response.
18:12
Those are kind of the areas of cybersecurity that most people
18:15
think about. But identity is kind of like the
18:17
that mixture of it has more products within it.
18:20
So managing a product life cycle you are already doing more
18:24
infrastructure based services than strictly cyber.
18:27
I was looking through your LinkedIn profile, doing a little
18:30
soothing and saying who is this guy?
18:31
Steven? I noticed you've spent some time
18:34
consulting and we have a lot of consultants.
18:36
Jim and I are consultants ourselves, you know, that are
18:38
listening and I'm curious what are some of the things that
18:42
prepared you for your role? Because y'all still work at
18:44
Freddie Mac and you would discover now, but what are some
18:47
of the things that you did as a consultant that really kind of
18:49
prepared you for roles, we'll call it in industry, right?
18:52
Or civilian lifes maybe I might call it.
18:55
No, no, I have a really good story about that.
18:57
I actually went from engineer, developer, architect, but I
19:01
wanted to learn more about, you know, how to run a business.
19:04
So if you look at it, my pathway went from big pharma, big
19:08
retail. Then I jumped to a startup.
19:11
After the startup, I spent a few years there and I understood how
19:14
to run a business when there's less than 10 employees.
19:17
You have to basically wear every hat when there's less than 10
19:19
employees. But then I went to Deloitte
19:22
after that because I said, OK, I know I don't run a business, I'm
19:24
learning it, but how do I articulate what it is that we
19:29
need? Like, how do I get people to
19:31
yes? My biggest mantra is I'm going
19:34
to get you to yes. People say no by default.
19:37
So as a consultant, the job is to understand how to do
19:41
PowerPoints, how to do decks, and how to communicate the
19:45
vision, the operator model to the right audience.
19:48
That's the most important part is to the right audience.
19:51
And when you focus on that, you can basically sell anything.
19:55
And I leverage that because now in financial services, everyone
20:00
wants to say no. It's just, I mean, it's
20:02
corporate America. It's easier to say no than to
20:05
say yes, so. I kick them to to yes by doing
20:09
one thing. If you tell me no, I say why you
20:12
give me data, I'll go back and use my consultant net and craft
20:16
another or a better story to come back to me and say, well,
20:19
you say no because of ABCI saw it for that and then here's more
20:23
data. Now do you say yes and at some
20:26
point in time that iterative process, they are going to say
20:29
yes or say, Steven, get the hell out of here.
20:31
So. Stop bothering me, Here you go.
20:33
Just get it done. One more question I want to ask
20:37
you. I know we're going to talk about
20:38
like user access reviews and, and maybe get some of that, but
20:42
so there's a lot of people that I've known as wanting to get
20:45
into IAM. What would be a word of advice
20:47
that you have for people who are looking to get into IAM as just
20:52
the start of their journey? Or maybe they're looking to
20:54
pivot into IAM from some other field?
20:57
That is one of my favorite questions, Jeff.
20:59
Let me tell you why is you can learn almost every other aspect
21:03
of cybersecurity through a class, through a course, through
21:07
some training, but you cannot learn I am through a single
21:12
entity at all. You have to be broad in your
21:16
skills to do I am. You have to know a little bit
21:19
of, you know, operating systems, you have to know about
21:22
directories, you have to know about networking, you have to
21:25
know about firewalls. I mean, especially today,
21:28
everything is cloud based. If you don't understand the
21:30
simple proxy, reverse proxy, how to open up a point, you're not
21:34
going to do well here. Even things as simple as IDP
21:37
configurations now from cloud to cloud, SAS to SAS, you have to
21:42
be well versed in everything. So one of my favorite sayings is
21:47
Jack O or trades master of none, but oftentimes better than a
21:51
master of one that that creates an iron professional.
21:56
You have to know a lot about a lot, but you don't got to be
21:59
super deep in any one thing to be amazing in this field.
22:04
Yeah, I really love that answer. I think what I would add to it
22:08
is you mentioned a lot of the technical skills you need, but
22:12
you also need to have business skills.
22:14
You need to know things about human resources and how the
22:19
business works. You have to at least be geared
22:22
toward that to be really great as I am.
22:26
I also thought it was funny when you're talking about consulting,
22:28
you brought it back to how do you sell things?
22:33
But no, how do you sell an idea? So that is pretty funny.
22:38
And as Jeff mentioned, I'm going to drag you down the route of
22:41
talking about user access reviews.
22:44
But before that, when we're talking in the beginning of the
22:49
show about the idea around device identity, it almost
22:54
looked like you wanted to jump right into the conversation at
22:57
that point. So I was wondering, did I, did I
22:59
see that right? And is there anything that you
23:02
you wanted to say or that you were chomping at the bit to say?
23:07
Absolutely, I said this is their show, so let me be quiet and
23:11
stay on mute until my time is up.
23:13
However, Matt Atkins, I'm going to have the floor.
23:17
I'll take it. But I think of device identity.
23:20
It's, it's so important that we think about every device we
23:24
have. I mean in my house alone,
23:26
there's probably 6-7 Alexis 810 series.
23:30
I mean every device has some type of access management
23:34
component to it. But I like what you said Jeff,
23:36
about when you think of it, you think about the authentication
23:39
piece. Well, what folks don't realize
23:41
is every device is doing a form of authentication, a lot of it
23:45
sometimes anonymous, a lot of it is some form of PKI, but is
23:49
doing something or phoning home. And that's the part where it's
23:52
tricky because most, most cyber professionals don't even use
23:56
those, you know, home utilities, like they say Alexa is disabled
24:00
anything else. But in general, Jim, I think
24:03
it's just device identity exists.
24:05
We need to find a way to actually manage the life cycle
24:08
just like we do human accounts and not human accounts, you
24:11
know, And it's only get to a point sooner than later where we
24:15
just have objects, identity, objects.
24:18
Everything is looked at through the lens of identity.
24:22
And ironically, I'm going to use your pun, but yes, identity is
24:25
at the center, the center of everything.
24:28
I mean, identity is the front door.
24:30
And what I say is to a house, identity is the front door.
24:33
But also when you go to each room, each lock on the door is
24:37
another layer of identity. And then over time we get to the
24:40
point where as you in your kitchen and just hanging around,
24:43
you would have something doing a check on should you still be
24:46
here? And is it still your own, which
24:48
is a deeper layer of identity. So it's it's definitely at the
24:52
center. Yeah, it's crazy.
24:54
You hear identity is the new perimeter, then someone will say
24:57
the next sentence. Identity is the center.
25:00
So it's like identity is everywhere.
25:03
Identity is the the whole kit and kaboodle.
25:06
This could have been that could have been the name of the
25:08
podcast. That's too long for that's too
25:10
long for a URL, so just keep it at IDAC podcast.
25:13
You can. You can use a TinyURL Jeff.
25:15
And you can use a TinyURL Sir. So.
25:17
Security people don't like tiny URLs because you don't know
25:20
where you're clicking on. We found that out early on where
25:22
I was like, all right, we had to think.
25:23
A sponsor gave us a TinyURL and I got so many emails about.
25:27
Secured. Yeah, you should not use tiny
25:29
URLs like I understand. I get it OK.
25:32
Yeah, OK, here's a QR code. So OK, let's talk about user
25:38
access reviews or what I've used traditionally called
25:43
recertification. I don't know if you even use
25:47
that term, but you would user access reviews, you know, you
25:51
see them used a lot in financial services and heavy heavily
25:55
regulated industries. I say 5-10 years ago outside of
26:02
heavily regulated industries, people question should I even do
26:07
this thing right? The only reason financial
26:10
services is doing it is because they have regulators making them
26:14
do that. So 1, is that true?
26:17
And you know 2 like where is the value?
26:21
Is it just to be compliant with regulation or is there something
26:24
more? We have a good question and I'm
26:28
thinking now don't want to answer it positive or the way I
26:32
already feel, let's go positive first.
26:35
So you are absolutely correct in terms of regulatory just
26:38
environments which is course multiple industries.
26:42
There's a ton of value in use access reviews because it is
26:45
both a detective and really a corrective type of control.
26:49
The end of the day is done to say, hey, should Jeff and Jim
26:52
still maintain his access? And if they shouldn't let me
26:56
create an action where I do an attestation and say Nope, I want
27:00
them out and then some technology, some tool goes and
27:03
remove them from that access. And for small and mid sized
27:07
companies, it works really well because there's not a lot of
27:11
bloat. And small and mid sized
27:13
businesses, the larger the company is, the more job roles
27:18
of companies are really strong. When I say on our back, you
27:20
know, Rd. based access control, the more our back you use, the
27:25
larger your access role environment is going to be, the
27:29
more access certification use access reviews you have.
27:32
Once you hit that threshold, now it becomes more of is there
27:37
value in this or is it just a check box activity?
27:40
So I have a person who I have people in multiple companies
27:43
that they have to attest or certify over 1002 thousand
27:49
users. And sometimes it's twice a year,
27:52
sometimes it's once a year, saying things like privilege
27:54
access, maybe every quarter, depending on the standards or
27:57
the requirements of the company. When you have to do something
28:01
this frequently, if the user interface isn't smart, most
28:06
people tend to just do a check box activity.
28:09
They say, you know what, we just got a blindly check it all
28:12
because I don't have the time, the bandwidth or the
28:14
understanding of what's needed. And when you think about that or
28:18
kind of, you know, like traveling that out, if that's
28:20
being done, let's say 50% of the time, where's their value in it?
28:25
But their value does come from the auditors, the regulators,
28:29
because that's something that they can say, how do I trust
28:32
that you're doing something? Something is always better than
28:36
nothing. I mean, we can all agree to
28:37
that, but at least I have a name associated to a decision.
28:42
And that's why the biggest value of use Access reviews is you
28:46
have a named resource making a decision on access.
28:51
Regardless of how they made that decision, that certification is
28:55
important. And that's needed because for a
28:58
regulatory body, they can say, OK, 99% of these folks attested
29:03
in the positive, great, 1% they're not.
29:06
But all the access has been certified.
29:09
I can take that and support any action or decision the company
29:13
needs to make. So it is.
29:14
So that's the value in that just overall.
29:18
So you're kind enough and diplomatic enough to take the
29:21
positive side, I'm going to take it down the negative side a
29:23
little bit and see if you agree with me.
29:25
Are user access reviews a reaction to poor life cycle
29:30
management? Meaning we have to do user
29:33
access reviews because we just don't do a good job of cleaning
29:36
up accounts and accesses that shouldn't be there after they're
29:39
no longer needed. I did not know that question was
29:43
coming, but I would say that that's a perfect segue to, to to
29:47
what my vision is in terms of what I've been designing for
29:50
user access reviews. You are absolutely correct,
29:53
Jeff, and I'll take the steps further.
29:57
The way that I think about this is the reason why they exist in
30:00
general is because now your life cycle management is really the
30:04
access chain is how do I know that Jeff is using his access?
30:09
So if you really think about it, let's give an example.
30:12
If I say, hey Jim, you have access to application A, but I
30:17
modified my standards, my requirements to say a user
30:21
should only have access to an application for 30 days.
30:24
After 30 days, the access is automatically removed.
30:27
That means that Jim access the application day one.
30:30
He gets in just fine. On day 32, he tries to access
30:34
it, he says access denied. But so that alone is great.
30:39
But then it becomes a really poor user experience because now
30:41
Jim has to go through a whole access request again.
30:44
No one wants that. But in terms of, I mean, we in
30:47
2025, we have so much tools out, so many tools out there that are
30:50
great. So let's add some orchestration,
30:53
some ID PS into it and say on day 32, Jim goes to the
30:57
application, the IDP says, Nope, you don't have the right claim,
31:01
the right access. However, it makes a call, was
31:04
Jim approved to have his access previous?
31:07
If that answer is yes, then they can actually go ahead and give
31:11
Jim the access again, because the standard states is only
31:14
going to be good for 30 days because of that.
31:18
That process makes it a great music experience.
31:21
Jim doesn't have to lose his access, but there's no standing
31:24
permissions. Jim doesn't have the access more
31:27
than he's needed. And if there's a need for a
31:30
certification, then it's probably going to be empty
31:32
because most people don't use applications, you know, day in
31:35
and day out. They already don't.
31:37
I didn't give you, I mean even AHR tool like a work day which
31:40
is really generic. Almost every company has it.
31:43
You use it maybe to do your goals or a check in right?
31:46
Like you're not using tools all the time.
31:50
Steven, I wanted to ask you what you meant about UI, but I think
31:56
that's going to be part of your answer to my different question,
32:00
which is, you know, so Jeff and I are very fortunate.
32:04
We get to go to a lot of conferences doing the podcast, a
32:08
lot of vendors reach out to us. We see a lot of demonstrations
32:12
of IGA products and the amount of innovation that's still
32:17
happening in the space. IGAI mean it's it's been around
32:22
for quite a long time, right, But people are continuing to
32:25
innovate. I'd say why is that?
32:29
What are the innovations that to you are exciting without getting
32:34
into specific vendor names, right, Yeah.
32:38
Yeah. No, no, no, no.
32:40
I think that the biggest one is the use of AI of causing ML
32:44
right the end of the day. Let's go back to the example I
32:46
said of the individual that had 1000 access request.
32:51
He had the test. Well, AIML now has the ability
32:55
to go look at it and do some of the things I mentioned.
32:58
Hey, when was the last time they used this access?
33:01
Hey, did all their team members use the same access?
33:04
So now we can have more smart IGA, more smart services to say,
33:09
hey, Jeff out there 1750 are because of the team name, the
33:15
team description and they're all operation and support.
33:18
They should have that. You can then say, OK, I'm going
33:21
to blanket approve that because those 750 I don't have to look
33:24
at now you're down to 250, which is much more manageable.
33:27
But then the AIML can do even more stuff and say, hey, only
33:31
about 25 of these are privileged.
33:33
So now that 1000 goes down to 25 and what you're doing now
33:37
hopefully is saying, let me, you know, you use a fine tooth comb
33:41
and go through those 25 each and hopefully remove actions that
33:44
shouldn't exist or just say, yes, they all should be
33:47
maintained. So that's really where the
33:49
innovation is coming from, Jim. Yeah, I think, I think that's a
33:53
a huge innovation is the AII also see back end changes that
33:59
are happening where it's like no longer are these IGA systems
34:04
running on a relational sequel database, right.
34:07
They're running big data platforms and allowing
34:11
organizations to identify what is identity data to them, what
34:16
is risk data to them or data that can be part of the risk
34:20
story. So if you start to say what is
34:23
not only what am I using, but what am I not using, that is of
34:29
relevance, right? So if I don't look at the
34:31
cafeteria menu or are you going to take the cafeteria menu away
34:34
from me? Like what's the point is 0
34:37
value? The value is I've got a very
34:41
powerful role in a very important risky system.
34:45
Now let's challenge on something like that.
34:48
Well, you know, I've got to be able to draw the connectivity to
34:53
that, that risk level and that might be very specific to my
34:58
organization. No, no.
35:03
I would say it is, Jim. I like it is really well around.
35:06
I love the construct of an identity data lake.
35:08
And what I mean by that is we need to basically put all our
35:12
identity data access management, data access row data request
35:17
data access chain and data. And you're right, seek SQL
35:22
databases aren't always the best for that.
35:24
Some of the new graph kind of DBS already good.
35:27
But the whole point of this is now if I have to do something
35:30
like give to a regulator one order, they say, hey Steve, I
35:33
want to know all the access that was provisioned for this
35:36
application over the last six months.
35:38
Well, right now I'm going through my tools and extracting
35:42
reports and doing some pivot tables or some V look UPS.
35:46
That's a lot of work. If we have orders in like a data
35:49
lake, I can easily create a query to pull that data, but now
35:53
I can also align and correlate it to an access request number,
35:57
let's say a service now that ServiceNow request and then they
36:00
can actually see that it was actually done and they can give
36:03
the reason and the description or in place.
36:06
So using that data from let's say a data lake, you can now
36:10
pull from now only the access request data, the life cycle
36:13
management data, any friendlers access as well as any
36:17
pre-existing certification data. All that is now combined in one
36:22
location where you can do easy queries to extract that and make
36:26
better fine grained decisions on the actual real data.
36:31
Yeah. So let me let me ask this
36:37
question. So obviously we talked about the
36:39
AI and kind of like narrowing the focus on the important
36:44
decisions. Is that really also being driven
36:47
in part by what we call identity fatigue?
36:51
Just, you know, it winds up in a large organization where there's
36:55
a few people who become I, I don't want to use the term
36:59
bottlenecks because it sounds so negative, but the idea that they
37:03
wind up becoming the person who approves or disapproves a large
37:07
amount of access and really trying to tailor identity
37:12
becomes an exercise so that they don't get overwhelmed and start
37:17
rubber stamping access. Is that kind of the driver in
37:21
your mind? That's the largest driver.
37:24
But I guess in addition to that, you also have identity.
37:30
I call it identity hygiene. Most people do it now.
37:32
It's the hygiene part has been what's been missing over the
37:36
last decade. We all, even tools, products,
37:39
vendors, startups, they all want to do the action.
37:43
Let's make a better IGA. Let's make a better LC and life
37:46
cycle management. Let's make better tools to
37:48
actually and better products so we can sell the product.
37:52
But what if we get is the cleanup is actually more
37:55
important because you can have one of the best products in the
37:58
world if you keep on provisioning, keep on adding and
38:02
never clean up or remove your actual audit data is poor
38:07
because the hygiene is poor. And that means that now more
38:10
people are doing request and guess what?
38:12
That leads to the fatigue because now it's saying, I don't
38:16
know why I'm improving this, but I've been doing it for seven
38:18
years. They could be no one even use
38:21
the application can be gone in the environment where people can
38:24
still be potentially approving that access because it's the
38:27
name you know isn't on the sheet that comes across every six
38:31
months. You know, I've, I've seen some
38:34
scenarios where the access review with AI looks like this.
38:39
So Steven, Jeff works for Steven.
38:42
Steven, here's the access that Jeff has.
38:44
And then AI highlights 3 or 4 entitlements that, hey, you may
38:49
really want to look at this. So if you're Steven, you're only
38:53
going to look at those three and ignore the rest, right?
38:55
So why even show the rest? Is it because some organizations
39:00
just say, hey, we have to, we have to check this box from a
39:04
regulation and compliance standpoint.
39:07
So we're going to show all 25, We all probably agree it's only
39:11
the three that matter. So it's, and I, I know I'm
39:15
asking a super generalized question.
39:17
It probably depends a little bit on the situation, but do you
39:20
feel like that's something that regulators are going to push
39:23
back on and say, no, sorry, the rule says you got to review the
39:28
access. So you need to look at all 25
39:31
and you can use AI, they kind of point people, but you can't
39:35
eliminate 22 of them. So really good question and I
39:40
have a great answer for that. If you think about this, Jim, if
39:44
he didn't change anything in the organization and you brought in
39:48
a tool to do that, that would not pass an audit exam, it would
39:52
not pass a regulatory exam, because even though it's better
39:56
and it's actually reducing more risk and it's actually a better
39:59
hygiene. Most companies, the auditors,
40:03
the regulators, their job is to validate what you have written
40:07
in your standards and your requirements.
40:10
Think about it as like a soft skills.
40:12
A lot of engineers like working and consultants like the hard
40:16
skills, the hands on, the tangible skills.
40:18
But even when it comes to things like access reviews or just
40:21
anything that's audit related, you have to focus on changing
40:25
your actual requirements and your standards and your policies
40:29
by changing that. If I just change the line, Jim,
40:31
and say we're going to certify multiple times a year, access
40:37
that is determined through a systematic slash AI generated
40:42
method, the ones that need to be reviewed, then I can now use
40:46
that because the auditor, the regulator has to look at what
40:50
the requirement is for our organization.
40:54
OK. So you have to kind of take that
40:55
step wise approach where you first change the policy and then
41:01
you comply with your own policy. That makes sense to me.
41:05
You got it. Last thing I want to kind of
41:07
explore when it comes to access reviews is what is your advice
41:12
for the practitioners out there who are maybe doing access
41:17
reviews the old fashioned way or let's call it IGA Gen. 1?
41:22
Are we really now at IGA Gen. 2? Do you think if I wait a couple
41:28
years, it's going to be dramatically better and I should
41:31
sit around and, you know, watch what happens in the market or
41:37
Yeah, what are? Your thoughts are, I would
41:40
think, I would say the last conference I went to a few
41:42
months ago, there was two complete rows of just IGA
41:47
startups and vendors. And even though to me that seems
41:52
like it's overkill, it actually gives us hope because that means
41:55
people are now invested heavily in doing this.
41:59
Not not the best, but doing it in a way that is modernized and
42:04
that's more efficient. So at some point in time having
42:09
access to the data is going to translate into leveraging tools,
42:13
slash processes to be able to make better decisions.
42:16
So right now we say IGA one is the normal HEXA certifications.
42:21
Do IGA two, we going to skip Gen. 2V2 because right now V2 is
42:28
now adding AIML into it, but it's still in its early states.
42:33
The next generation is going to have that more hard and fast.
42:36
I guess it's going to be modernized, it's going to be
42:38
tested. But even the vendors have to
42:41
understand it can't just be by the technology.
42:44
You have to look at it as how can you approach some of these
42:47
regulatory bodies and these compliance bodies and say, hey,
42:51
will you be OK if our solution shows you this?
42:55
Because that's how you really get to the next level is
42:59
companies can just say let's have the best product because it
43:02
does have the best product that can comply with water
43:05
regulations out there. Well, I think the best product
43:09
is what you can afford. Also, I think there's an
43:11
underserved market for IGA. Where you've got the big
43:14
behemoths and we all know who those people are.
43:17
Those companies, there's a lot of companies that can't afford
43:19
those types of things and there's a lot of good IGA or you
43:24
know, sometimes they're called IGA light vendors that are also
43:28
helpful. But even those vendors I'm
43:30
seeing kind of what their pricing has been and it's there.
43:33
There isn't a fine, there isn't much of A financial benefit to
43:35
just say, OK, well, for, you know, 10% more, 15% more,
43:39
whatever the number is, right? I'm just making them up.
43:41
I can go with a tried and true, you know, established, you know,
43:44
world class, you know, partner of this.
43:47
Or do I gamble on something that is nobody's ever used before and
43:51
they might have a great product, but trying to get in the door
43:55
without references, without a track record.
43:59
I feel like in that case, and I'm focused mostly on small mid
44:03
sized businesses, they don't have the money to afford, you
44:06
know, an upper right garden or quadrant for the most part,
44:08
unless they are heavily regulated or maybe they've had
44:12
an impact, you know, an incident or something like that, right
44:14
where they have to do something about it.
44:16
Do you have? Does that make sense?
44:18
It makes sense if I want to chime in on something from Even
44:21
Jim Said, how did the Kermit practitioners do this?
44:23
In most SM DS? A lot of people do.
44:27
This was just spreadsheets today.
44:28
So let's talk about tools. Spreadsheets today are easy.
44:32
Some of the easiest ways to go ahead and say, hey, I've done my
44:37
Access certification because depending on the volume, if it's
44:41
only to say 50 people in a company, you can do that for
44:44
these. Now most, let's say financial
44:46
companies or companies have the alliances, say PCI as an
44:50
example, PCI 4 point O, you know, rig was published and came
44:53
out truly like last year, but it goes into effect starting this
44:56
year. There's a requirement about
44:59
service accounts, not only my identities having to be kind of
45:03
certified. Most IGA tools today don't
45:07
really do service account or not humanities.
45:09
Well, like they're not because it's not as simple as just
45:12
pulling from an existing, you know, life cycle management tool
45:16
and it's showing on the screen, hey, accounts entitlements.
45:20
So because at PCI, four more companies are trying to not get
45:23
into service accounts or non human identities certifications.
45:28
And it's driven because now PCI is saying you have to do this.
45:33
So sometimes the regulations and the and the regulators kind of
45:37
help lead and define where the industry is going.
45:40
And that's a very positive thing.
45:43
That's a great point. Yeah, I mean, there's a lot to
45:47
unpack there and I think I want to try and take advantage of
45:50
your big brain when it comes to the stuff.
45:52
I, So we have a listener out in the western part of the US, Bert
45:57
and he and I were trading a couple of messages on LinkedIn
46:00
and he wanted us to do a podcast on how in scope companies can
46:04
comply with NYDFS. And I'll explain in a second
46:08
because one of their IM requirements is periodically,
46:11
but at a minimum, annually review all user access
46:14
privileges and remove or disable accounts and access that are no
46:17
longer necessary. So first of all, let me explain
46:20
NYDFS because we have people around the world and people not
46:22
being familiar with that. NYDFS is the New York Department
46:25
of Financial Services, and they have a cybersecurity requirement
46:29
for financial services companies that operate in the state of New
46:34
York where they have to have a cybersecurity program and
46:38
certain controls to, you know, maintain confidentiality,
46:42
integrity, availability, right, all those types of stuff.
46:44
And of course, if there are cybersecurity regulation, there
46:47
are IM components, and one of those is this idea of doing user
46:51
access reviews. So I want to bring this back to
46:55
you because obviously, you know, this is something that's
46:57
probably near and dear to your heart is can you talk about
46:59
NYDDFS and specifically the user access review component of that?
47:05
How should financial services firms be looking at how to
47:09
comply with that? What should we be looking at?
47:12
What should we be certifying? What should we not be
47:14
certifying? And are there any gotchas or
47:16
things or tips and tricks that you might have?
47:19
No, absolutely. So NYDFS, I've worked for a few
47:23
companies that have been in scope for that, but I'll make it
47:26
a little bit more broader for like the entire audience.
47:29
I mean, think about NYDFS, think about the Federal Reserve Board,
47:33
FDIC, you can think about even socks, you know, socks
47:36
compliance, sock one compliance. They all have these similar
47:40
requirements. And sometimes the best way that
47:42
tell people to kind of point them to is if you have a
47:46
security program alliance with the NIST cybersecurity
47:49
framework, you go into naturally 99% align to everything else, to
47:53
whatever it's already bodies because most of the bodies pull
47:57
from things like NIST, I mean, other frameworks as well.
48:01
But the NIST CSF Cybersecurity framework, especially that 2.0
48:05
is where a lot of the government cybersecurity programs, the
48:09
NYDFS and others are pulling from.
48:12
And they're really important of access reviews from NYDFS or
48:18
anyone else is really defining what is the scope of the access
48:24
video meaning newer heading Jim mentioned earlier or something
48:28
like Adobe or something like that.
48:30
Do I want to a test or certified Adobe Acrobat Reader?
48:34
What's the value of something like that?
48:36
You know, it's just a it's a product that most people have
48:39
Chrome, I mean web browsers though, is there really value in
48:43
it? Now there's a financial Sox
48:45
tool, there's a ton of value in a testing there.
48:48
The problem in the industry is this everyone have not scoped
48:54
out the applications or the access that truly require it.
48:58
So a regulatory body or an internal auditor or they can do
49:03
is say show me everything. And that's the.
49:05
That's the biggest issue. Without having that scope
49:08
clearly defined, you have to produce everything for because,
49:12
and it does make sense. It's like if you can't tell me
49:15
exactly what's in scope, I have to see everything.
49:20
I like that idea of scoping because I do see that as an
49:22
issue. I think one of the main things
49:24
to consider in this might be non public information, right?
49:28
Who cares about the stuff that is public?
49:30
It's public while you're reviewing that access.
49:33
But I think one of the areas that maybe helps fine tune,
49:37
right, what you should be looking at are what are the
49:39
things that are not public? And then from the non public
49:42
information, what are things that do carry the risk factors
49:45
that might be associated with either data breach or, you know,
49:48
maybe it's transmission of that data, obviously customer data or
49:52
you know, things like that. I love that idea of getting your
49:55
scope right because if you don't have the scope right, it's like
49:58
you said before, you know, my experience, auditors, they're
50:00
just checking what you're said you're going to do.
50:03
And if you haven't written your policy or your standard or
50:06
whatever it is that you do, you know, to to articulate that and
50:10
you leave it open to interpretation, that's where you
50:12
get into trouble. So I think if you craft very
50:15
well defined policy standards and processes around what are we
50:19
looking at, you know, and try to leave as few argument points as
50:25
possible that someone can go against, you'll be in a much
50:28
better position. Does that make sense?
50:30
No, it makes a lot of sense and, and even more so, there is so
50:35
much value in taking the time to architect and design the
50:39
processes for a program, for an identity program.
50:43
And what I mean by that is I'm teaching my own organization, my
50:46
team. Don't just look for technology
50:49
to solve the problem. Create a process that you want
50:52
to solve for and then you can look to see, do you mean
50:56
technology or do you just need, you know, people like not
51:00
everything is solved by having a just a big as hammer, you know,
51:04
and. But we bought IGA, it's going to
51:06
solve all our problems. If that was the case, the world
51:09
be in a better place. And I don't haven't talked to
51:10
any regulators or auditors in my life.
51:13
Unfortunately, even they don't like automation.
51:16
I mean, I mean we always have some automation and we got
51:18
scripting languages and we can do all these wonderful things.
51:21
Even when you give it to them, they are saying the next
51:24
question is, well, how do I know this is complete and accurate?
51:27
And it's like, oh, so the end of the day is trying to be fancy
51:32
with the regulators and the ordinance does not work.
51:35
It's. It's simply giving them your
51:38
scope and saying. This is what we're doing for our
51:40
scope. Now they could always argue all
51:43
their points, right? You should be looking to start
51:45
thinking, OK, well, that's a different discussion now.
51:47
It's not what we're looking at is what else should we be
51:50
looking at? Which is probably a better
51:51
position to be in. I guess I've, I've had the right
51:53
management responses in the past.
51:54
They're not fun. Oh no, no, they are not at all.
52:00
And at some point the, the world and the industry and everyone is
52:03
going to start shifting to automation and AI and all these,
52:08
you know, cool tools that are still relatively cutting edge
52:11
for a lot of organizations. And auditors are going to be
52:14
like, you know, that the policy or the configuration is going to
52:16
be all right. Well, we do this through our IJ
52:18
platform and it's all automated. At some point, the others are
52:21
probably going to ask more questions around the how is the
52:24
product configured? What are the configurations or
52:27
policies that you've set up within the actual tools?
52:31
Do you have any thoughts or guidance on how you might want
52:33
to address that in the future for people who are listening?
52:36
Yeah, one of the first things is you have to make sure that you
52:39
train your auditors. And I know that sounds kind of
52:42
funny, but the end of the day. It's absolutely true.
52:45
It's so a choice. How much time do you want to
52:48
spend every cycle teaching them about what you're doing?
52:52
But even things, I mean, we all know that a policy based access
52:56
control is probably the best thing, but it's so challenging
53:00
and difficult to get to policy based access control no matter
53:03
what tools exist, no matter how much you try, because RBAC is
53:07
just easier. I mean, RBAC is just easy, you
53:10
know, even attribute based access control, a back, even a
53:14
back is a little bit easier, you know, But when it comes to
53:16
policy based, that is where it's going.
53:19
And once we can tie together that a policy is almost his own
53:24
requirement and that requirement can be tied to a standard, then
53:29
the auditors can actually start to take that because they can
53:33
easily correlate and take and tie this policy here is
53:38
referenced in this standard or policy or policy.
53:41
And I can actually control and validate that myself.
53:45
So we need to get there and doing weed automation is going
53:49
to work is that we actually get to the point where they can
53:52
trust the policy. But that also requires a lot of
53:54
training and teaching to to to let them know how this actually
53:58
works. It's interesting you said our
54:01
back and a back are easier. I think they're easier to
54:04
explain to people, to actually be successful in managing them,
54:10
to get the results that you want.
54:12
I don't know that it's easier. Yeah, I know I would agree with
54:16
that. I would say that it's the, it's,
54:18
it's the name, you know, like everyone understands our back.
54:21
And when most, most people who call me to do an assessment,
54:26
they always say, Oh yeah, we can talk about, you know, the best
54:28
our back model to use. And whenever someone says our
54:31
back model to me in the last 2-3 years, how they condemn with
54:36
trepidation like are you telling me that are back that they use
54:40
right now with this whole cloud size base just in time, no
54:44
standard permissions, Are you sure you want to go in there?
54:49
It's hard. I think there's a lot of
54:50
companies who wish they were RBAC and there's a lot of
54:54
companies that are RBAC and wish maybe they hadn't gone on the
54:57
RBAC route. It's, it's difficult to do.
54:58
It's, it's why I typically will encourage organizations that are
55:02
starting on that road to maybe focus on attribute based access
55:05
control because they feel it's a little bit more of a, of a hill
55:08
versus a mountain. It still requires good data,
55:11
right? And the, the, the idea is like
55:13
throughout any of these back models, whatever they are, is
55:16
you still need data to drive that.
55:17
And I feel like most organizations, even if it's just
55:20
basic attribute based access control is, is the person an
55:23
employee or not? That might be, as you know, that
55:27
might be as grand or as you can get based on the data, But hey,
55:28
at least it's something and you start working with your business
55:32
partners on the HR side, right? Hey, if we got this data, we
55:35
could do this thing, right? And I think it's funny, you
55:37
mentioned training auditors and I think that is the importance
55:41
of establishing relationships with other groups, right?
55:44
If you are, if you have a good relationship with your auditors,
55:47
they can be advocates for you. I think a lot of times they come
55:50
in as the enemy to some degree. But if they understand how
55:53
you're operating and you've trained them, you've educated
55:56
them on, look, here's what we're doing and you actually engage
56:00
them in a pro proactive way and say, hey, here's what we're
56:02
doing, what am I missing? You're going to audit me, Tell
56:05
me what I need to be looking for, help me out here.
56:08
Their job isn't really to get you into trouble because most
56:11
likely, especially in the bigger organization, and feel free to
56:13
correct me, am I wrong? You have an internal audit team
56:15
that does like an internal check and then the external auditors
56:18
come in and those are the ones you want to be very concerned
56:20
about. So almost like a catch before
56:23
the real audit comes through. That makes sense.
56:24
Absolutely no. I tell everyone this internal
56:27
audit, which we call the DARE line of defense, their their job
56:31
is to be independent, but their job is the same job as first
56:34
line defense, which is normally us is to protect the company,
56:38
period. You know, when we look at them
56:41
as the bad cops, for example, we're not getting the best out
56:45
of the partnership. Yes, we can't share everything
56:48
because they have to still maintain independence and that's
56:51
important. Now the external auditors just
56:54
come in with industry best practices in the check box and
56:57
say we need to say are you doing ABCDENF?
57:01
And they're showing me that you're doing ABCDEN.
57:04
So you really can't build relationships with external what
57:07
it is as much where your internal audit program is there
57:11
to protect the company the same reason as you are.
57:15
Well, I appreciate you spending time with us.
57:16
I think there's, there's so much going on here.
57:18
And you know, this is one of those things where I wouldn't
57:21
say it's a sexy part of I am, but it's a necessary part.
57:24
It's plumbing, I guess how sexy it is, is based on the UI maybe
57:27
you've created, you know, maybe that can have, you know, some
57:29
bells and whistles on it. But I really appreciate you
57:31
spending time with us. I want to end the show on a
57:33
lighter note. We were talking and I just kind
57:36
of sprung this before we hit record here.
57:38
You mentioned that you are, you know, you're definitely into
57:41
fitness. You mentioned things like Tough
57:42
Mudder, Spartan Races, Pelotons, you know, working out.
57:47
Obviously, you and Jim can probably go on at this for about
57:49
an hour. I'll just kind of plot, you
57:51
know, not politely and stare at my Peloton row that's over here
57:54
that has been collecting dust. Tell me about Tough Mudder and
57:58
Spartan races and all these things that you're doing just to
58:00
sort of stay fit. And I guess explain them in a
58:02
way was like, OK, not everyone may be familiar with what these
58:04
are. Explain for people that aren't
58:07
familiar what a Tough Mudder is, for example.
58:10
So I get there. I want to talk about the why
58:13
behind it. The why is when you run large
58:15
organizations or just have a lot of work, I will work.
58:18
Cybersecurity is stressful. I don't care what anyone says it
58:22
is stressful is a lot of work and we all need a reprieve.
58:26
So if he would do that different ways, you know, health, healthy
58:30
ways are working out like crazy. You know, other ways are
58:33
drinking. I mean, whatever floats your
58:35
boat. But the end of the day, I got
58:38
into just physical fitness about five years ago.
58:41
Doctor was like, you had to want to make a change, Steven, or
58:44
you're not going to be around. So I said let me go all the way
58:47
in and make a change. But the Tough Mudder is an
58:51
afternoon course based race. You know my first one we did 3.1
58:55
miles like a 5K. But next we doing one in April
58:59
which is 15K. So you're close to 10 miles
59:03
roughly and it's about 25 obstacles.
59:06
And when I say that you get it's called Tough Mudder half the
59:10
half the obstacles that require some form of mud or water.
59:15
But when you already have mud and you go into a pool of water,
59:17
it will become muddy. And it's but it's fun because
59:20
it's not just a race. You got to work as a team, as a
59:23
group. And I think the reason I love it
59:25
so much is that it's about 10 to 15 of us who do it together.
59:29
And it's not about who can win. Because some of the races or
59:33
some of the after groups, you have to use 3-4 people to form a
59:35
base. Then two people have to climb on
59:37
top of them, then the one person have to climb on top of all of
59:40
them and then you got to pull each one up as well.
59:43
So it really is more teamwork in building that Comrado and most
59:47
of my workout partners, we all met during COVID 1 pedaton.
59:51
So a new one. COVID, no one was at gyms and we
59:54
just used the pedaton as a way to engage, interact.
59:58
Yeah, you know, Facebook groups. And it was, we said when it was
1:00:01
over, hey, let's meet up in real life and do some.
1:00:04
Physical activities, I love that.
1:00:07
And you mentioned you've got the whole peloton Armada between the
1:00:10
the row, the bike, the Tread, if somebody, which is your favorite
1:00:14
of those three because I've only used the the bike and the row.
1:00:18
So the tread is my favorite, but it's any any of the machines are
1:00:23
great. But I have such a competitive
1:00:27
spirit that the reason why I like Peloton is because the one
1:00:31
thing the leaderboard and some days I wake up and say I'm gonna
1:00:34
have a low impact day and I'll get on the bike.
1:00:36
We get on the tread. I do a nice job and if someone
1:00:39
will high 5 me which and like they're right next to me but
1:00:42
they below me in terms of like the output, but then they'll
1:00:45
high 5 me and then pass it. And my gut feeling is, is that
1:00:50
intentional? Like I'm fine.
1:00:52
That was like that peace dude, I'm flying past you.
1:00:54
I'm like, I'm fine too. So when I see that Jeff, it's
1:00:58
like here we go now turn everything up, take the shirt
1:01:02
off and now I'm just running. Now it's like now I was like,
1:01:05
OK, let me get to the six minute mile and let me see how long I
1:01:08
go with this and we out. I love that.
1:01:12
What's your What is your favorite and least favorite
1:01:16
Tough Mudder obstacle? The ice, the ice bucket, or the
1:01:20
ice pole is probably my least favorite.
1:01:23
OK, what is? What is that?
1:01:24
So is we ordered the ice bucket challenge from a few years ago.
1:01:28
We're basically in a bucket of ice or even going to like ice
1:01:30
bath is basically 2 ice baths put together and you got to go
1:01:35
underneath 2 walls or inside inside of the ice bath.
1:01:39
So you literally got to climb inside and then go under the
1:01:42
water. So it's all ice now and they got
1:01:44
to come up and then go under it again and come up.
1:01:47
And this is normally at the end of the race.
1:01:50
So it's you're already mighty. I mean it's just some people say
1:01:53
what is cleaning you up? No, it is still I can.
1:01:56
Think of better ways to get clean 7. 0° And what happens
1:02:00
right after that is the electrical shock.
1:02:02
So it's like a whole lot of strings of just electrified, you
1:02:06
know, tape and you got then went through that.
1:02:08
Have you just came out the ice mask?
1:02:10
So yeah, that is not the best part.
1:02:12
I think it was one obstacle that was fun.
1:02:15
It was huge tree logs and they had like little notches in it,
1:02:20
complete mud. And you have to literally throw
1:02:22
your body up or try to jump and grab on.
1:02:25
And it reminded me of when I was young.
1:02:27
I used to watch what is it American Gladiator and Jazz that
1:02:32
that show how we wanted to do things like that and you're
1:02:35
trying to like climb over, you know, like those rollers in
1:02:37
American Gladiators. So I always send a thing that
1:02:40
I'm back in the 90s and 2000s watching American Gladiator and
1:02:44
going crazy. Jim, I know you work out.
1:02:48
Jim, I've known you for what, nine years, 10 years, some like
1:02:51
that. And ever since I've known you,
1:02:53
you are religious about your workouts every day.
1:02:56
I don't know if you've ever done a Tough Mudder.
1:02:58
Is that something you would do? It's not so it's it's so funny
1:03:05
when I was listening to Stephen talk about why he started, how
1:03:09
he started, it felt like he was telling my story.
1:03:13
But I've been at this probably 15 years.
1:03:15
So I exact same thing. You know, I'd be in this
1:03:19
stressful world of IT and Infosec and I and the day like I
1:03:25
had to wind down. So it'd be a couple beers or
1:03:29
something and then you just start to realize like that's not
1:03:32
good for you. So I started running and you
1:03:36
know, I worked my way all the way up to doing marathons.
1:03:39
It didn't take really that long, maybe a year from going from,
1:03:44
you know, having a few beers after work to just I'm going to
1:03:48
go run for a couple hours. And what a stress reliever.
1:03:54
I did wind up hurting my back running and I started doing more
1:03:58
like cross training and trying to build up strength in my core
1:04:02
is what I realized was you get these really powerful calves
1:04:06
from running, but it doesn't necessarily build a strong core.
1:04:11
So I started building my core that led to more or less like
1:04:15
bodybuilding style workouts. And I love being strong.
1:04:19
I love seeing muscle in my body. It makes me eat better.
1:04:25
And you know, I truly used to do it because like I liked looking
1:04:31
better made me feel better about myself.
1:04:33
Now I just do it because it's like it's my stress relief.
1:04:37
It's my outlet and I don't know how I would deal with stress
1:04:41
without it. So yeah, that's it's very
1:04:46
similar story to Steven. But why I couldn't see myself
1:04:49
doing like Tough Mudder or something similar is like in my
1:04:53
old age, I've kind of realized like I can only do what I what I
1:04:58
do if I don't get hurt. So if I do something that's
1:05:02
going to risk injury, it doesn't mean you're going to get
1:05:05
injured. But you know, when I hear about
1:05:07
people doing things that are, you know, prone to injury, like
1:05:11
doing like dead lifting heavyweight and stuff.
1:05:14
Like jumping at a muddy tree log and trying to hang on.
1:05:16
That kind of stuff. I'm like, yeah, well, what if I
1:05:20
slip a disc or something and I'm, you know, out of the gym
1:05:24
for six months? I'm, I'm not going to do that.
1:05:27
So, you know, yeah, it's like super risk averse, but that's
1:05:32
kind of the reason reason I don't do things that are risky
1:05:36
like that. But that makes a lot of sense,
1:05:38
Jim. I mean, one other thing that I
1:05:40
thought about as you were speaking, Jim, is I also work
1:05:43
out about two hours a day because my vice is a grilled
1:05:47
cheese and French fries. So in order for me to maintain
1:05:52
when I'm traveling to have some fries when I want to pay to make
1:05:56
sure that I work out, but my 19 year old daughter says this
1:05:58
about me. She says my dad has two
1:06:00
explains. He's got the kids menu guy
1:06:03
grilled cheese and fries or he's like an 85 Wagyu steak guy.
1:06:07
And I said I mean she's not wrong, but it is like, hey, I
1:06:11
can go eat at any restaurant. There's a kids menu or I can go
1:06:14
to a nice steakhouse and enjoy myself as well.
1:06:18
That's actually. So now you're talking Jeff's
1:06:20
talk. Yeah, now I would say now you've
1:06:21
got me, now you've got me interested all.
1:06:24
Right describe your. Perfect grilled cheese What's
1:06:26
What's the right cheese for a Steven Washington grilled cheese
1:06:29
sandwich and the bread? Too So sourdough bread first and
1:06:34
foremost. I'm with you.
1:06:35
And now no cheese. Not better than American.
1:06:39
However, as we get older I realize American probably isn't
1:06:44
already cheese, but I'm say that for a different show.
1:06:47
OK so cheddar, white cheddar. I also like Gouda.
1:06:54
I like some Swiss and mozzarella so it's so it's a crazy
1:06:57
combination. But if I want to do 1 is like
1:07:00
the white cheddar. But I also enjoy Gouda cheese,
1:07:03
which is kind of odd because it's a more smoky flavor as
1:07:07
well. But sometimes I buy sourdough
1:07:08
bread and just cheddar cheese combination is great.
1:07:12
And some restaurants like like Melt is really awesome.
1:07:16
Even though if I had too much butter, I think they had like a
1:07:19
whole stick of butter for one sandwich.
1:07:22
But when you work out for two hours, you can do that guy.
1:07:25
You got a little leeway there. I'm with you on the sourdough.
1:07:28
I think sourdough is fantastic. I am a American and pepper Jack
1:07:32
mix because I want a little bit of a spice to it.
1:07:35
Not crazy, but enough there. And I'll never turn down ham or
1:07:38
bacon or something like that. But what I like is when we we
1:07:42
press the sandwich as thin as possible, like almost in
1:07:45
between, like not a Panini, but like pressed and man, I can, I
1:07:50
can put those away. No, no Jeff.
1:07:52
OK, so so now I got to add this. My my best thing is when I say
1:07:57
I've been fasting because I went too many fasting as well.
1:07:59
So when I eat, I eat a ton and sometimes like I want some
1:08:03
bread, so I get 3 slices of bread, lay a multiple layers of
1:08:07
cheese between each thing, some ham.
1:08:10
And then I really will have a press.
1:08:13
Not not convenient, but it's like a matter like a cast iron
1:08:16
press that I just put down on top of the skillet and I just
1:08:20
push that down. And as the best, most
1:08:24
unhealthiest thing potentially in the world.
1:08:26
So good. But it's so good.
1:08:29
All right, we're going to wrap up grilled cheese at the Center
1:08:32
for this week. Steven, you've been so great
1:08:35
with your time. Really appreciate it.
1:08:36
Looking forward to maybe giving you an official fist bump of
1:08:38
gratitude for being on the show at a conference at sometime in
1:08:41
the future. I'll have your LinkedIn profile
1:08:44
as well in our show notes, if that's OK.
1:08:45
People can reach out with questions or grilled cheese
1:08:48
recipes or whatever it may be. And then Jim, you and I will be
1:08:53
on the web as usual. idacpodcast.com, connect with
1:08:56
us. If you're listening to this, go
1:08:58
on over to our YouTube channel, hit that like and subscribe
1:09:00
button that's helping us grow and appreciate you sharing with
1:09:03
friends or enemies. We don't care.
1:09:05
Whoever listens as long as they like and subscribe, I don't
1:09:07
care. So with that, we'll go ahead and
1:09:09
leave it for this week. Thanks everyone for watching and
1:09:12
or listening and we'll talk with you all in the next one.
1:09:17
You've been listening to Identity at the Center.
1:09:20
We hope you've enjoyed the show. Make sure to like, rate and
1:09:24
review, and we'll be back soon. But in the meantime, hit the
1:09:28
website at identity@thecenter.com.
1:09:32
See you next time on Identity at the Center.