Latest / Identity at the Center / #231 - Authorization 2.0 with Rich Dandliker of Veza

Transcript

#231 - Authorization 2.0 with Rich Dandliker of Veza · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:11
Am, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Steadman. Welcome to the Identity at the
0:21
Center podcast. I'm Jeff and that's Jim.
0:23
Hey, Jim. Hey, Jeff.
0:25
How are you? Not so bad yourself.
0:28
I'm doing great. I mean, there's been some
0:30
interesting news in the identity space recently with Tom Abravo
0:36
closing their deal to acquire Ford Rock.
0:41
It seems to me, based on my LinkedIn, that people from
0:45
paying and from Ford Rock seem pretty excited about, you know,
0:49
the the future. I mean, I've only seen positive
0:52
come out. You know, I don't know that.
0:56
I mean, everybody's speculating. What does this actually mean?
0:59
What is this going to look like in the future?
1:02
I'd like to extend an invitation to anyone from Tom Bravo or Ping
1:07
or Ford Rock who wants to come in and talk on the record on the
1:11
podcast to please reach out to to me or Jeff.
1:14
And we'd love to have you on, because people, we all want to
1:18
know what's going on. Yeah, I think people been
1:22
thinking about this for a while ever since.
1:24
You know, the, the intent was announced several months back.
1:28
Now at this point we asked the question on stage at Gartner to
1:32
our, you know, our friends Henrique and Becky.
1:35
They didn't know, right, just like anyone else.
1:38
I think we're starting to see it now, right.
1:39
So the deal is closed and I think almost immediately they
1:41
announced the, you know the the merging of the two companies for
1:44
drag and Ping and Andre Duran has been announced as the the
1:48
leader for. For that.
1:49
So it's interesting times. You know, it's never a dull
1:52
moment in the identity space. I think we kind of saw, you
1:55
know, like Okay, like what's the plan here, Be curious to see how
1:58
things continue to evolve in the space.
2:00
But yeah, definitely happy to talk with anybody from Ping or
2:04
Ford truck wants to come out and talk about it.
2:05
They wouldn't get Eve. Eve's always been good with us.
2:08
He's been great. Yeah.
2:09
I just don't know how much, you know how much freedom she'll
2:12
have to talk about that kind. Of stuff, but I'm going to go
2:15
out of limb and say none. I mean, it's companies, it's
2:19
corporate, There's money involved, right?
2:21
Stocks maybe. I'm sure we'll get company lines
2:24
and stuff like that. But it's seriously to see how
2:26
things will turn out. What's the plan here between
2:29
Ford Rock and Ping in certain areas?
2:32
They're definitely competitors. What's the plan to fold those
2:36
together and figure out how it makes each other better or
2:39
stronger or faster or something like that?
2:42
I mean the the, you know, the customer list of those two
2:46
companies now combined is just unreal.
2:49
But by the way, you did bring up Andre Duran.
2:52
If I could mention his identity at the center alumni, I'm sure
2:57
that was the highlight of his career.
2:59
Of course, up to this moment anyway.
3:01
As it should be for anybody. Yeah, absolutely.
3:05
So that's cool, cool news. I'm sure this is going to be the
3:10
biggest thing that folks are talking about at the upcoming
3:13
conferences. We've got quite a few of them
3:16
planned. I mean it's kind of hard.
3:17
It's it's the elephant in the room, the girl in the corner,
3:20
whatever the right analogy is. But I'm sure people are talking
3:23
about it, especially when we start talking about
3:24
authentication. So we've got a few things coming
3:26
up like that. But yeah, we've got conferences
3:29
coming up. So I'm going to be at Identity
3:31
Week America. That's October 3rd and 4th.
3:34
That's in Washington DC I'm hosting a panel discussion on
3:36
pass keys. Actually starting to get the
3:38
panel together later this week, so we're actually starting to
3:41
figure out what it is we're going to talk about and try to
3:44
put together, you know, a good discussion around pass key and
3:47
authentications, things like that.
3:48
So we've got a discount code that the fine folks over there
3:52
have provided to us. This works for both Identity
3:54
Week America and also work for Identity Week Asia later this
3:58
year. So if you use the code ID AC30I
4:02
DA C30 you get 30% off of your conference pass.
4:05
Yeah, we're actually dividing in conquering that week because I'm
4:07
going to be on the East Coast at DC at Identity Week America and
4:10
you're going to be on the West Coast over at Octane.
4:13
Yeah, I'll be at Octane. But one thing we will have in
4:15
common is we'll both have the new updated Identity Center
4:20
stickers and. What's the update?
4:22
You got to be clear what the update means.
4:25
The update doesn't mean that you look, you know.
4:27
But the old stickers had a fatal flaw, which was they were very
4:31
hard to get the backing off of. And so now the new and improved
4:35
stickers are super easy to get the backing off of.
4:39
And you look, it's like these little tweaks, it's like the
4:42
iPhone, you know, from iPhone 14 to iPhone 15.
4:45
I don't know what all the features are going to be sitting
4:47
here today, but they're probably going to seem like small
4:50
features that just make it so much nicer to have.
4:54
So anyway, well, you'll have stickers.
4:56
I'll have stickers. I'll be at Octane 2023 in San
5:00
Francisco October 3rd through the 5th and we have a discount
5:03
code for that conference as well, which is OKTNIDA C30 and
5:10
gets you 30% off your registration.
5:12
So the registration link is octa.com/octane and we're also
5:19
going to be Co hosting or Co organizing an event with our
5:24
friends from accents. We're going to be doing the
5:27
quote UN quote party bus, which shouldn't scare people, right.
5:31
It's not like we're going to be driving all over the city and
5:34
you know just going crazy. We're going to be doing some
5:39
cool sane fun things and networking and seeing some of
5:44
the highlights of San Francisco. I mean it's tech town, right?
5:47
So a lot of the corporate headquarters are there.
5:50
I think we're going to do some of that.
5:52
I look, I'm not the not the consigliare of the of the party
5:57
bus, but I'm expecting it to be a lot of good scene fun.
6:02
So anybody who's interested in that, check out my LinkedIn.
6:05
I've reposted the link to get registered, and as we get closer
6:11
I'll drop that more and we'll put it in the show notes as
6:14
well. Yeah, right on.
6:15
I saw pictures from the party bus in Vegas.
6:17
I didn't make it, but you were on there and.
6:20
It was interesting going around to see the sights.
6:22
It was a cool idea. I think it was kind of a a neat
6:24
thing that they did. So yeah, I mean we did things
6:27
like we went to the Welcome to Las Vegas sign, We all got to go
6:30
out and take pictures. And yeah, it just added another
6:35
element to the the trip For all the times they've been to Vegas,
6:40
which was like over 20 times, I'd never gotten to that sign
6:43
before. When you get there, you're just
6:45
like, Oh my gosh, it's just like I'm just some Rando St.
6:49
Yeah, I I've never been to it either.
6:51
So maybe someday. So we got that octane.
6:55
We've also got the Authenticate conference that we're going to
6:57
be at the week after that or a couple weeks after that.
6:59
That is October 16th to the 18th Carlsbad, CA and just north of
7:03
San Diego. We have a code for them as well.
7:06
I D AC15 podcast, ID AC15 podcast.
7:10
You get 15% off, which is very cool.
7:12
We're actually going to be on the mainstage part of the kind
7:15
of opening festivities and keynotes and.
7:18
We're going to do a live show in front of a live studio audience
7:22
and also broadcasted to the Internet at large for guests and
7:25
conference people and stuff like that.
7:27
I still have no idea what we're going to talk about.
7:29
We got to figure that out. That's coming up, but that'll be
7:32
exciting. Can't wait for that.
7:35
I mean, we are the official podcast for the Authenticate
7:38
conference and that that discount code of 15%, that's the
7:42
best discount code available anywhere.
7:45
So if you use that code, in addition to getting 15% off, you
7:49
get registered in a raffle of some sort that the conference
7:55
organizers are going to select one of the people and give them
7:59
a welcome gift of some sort. I don't know what the gift is
8:03
going to be, I don't know all the details, but use the darn
8:07
code because it's the best one out there anyway.
8:10
Yeah. And it supports us too, right?
8:11
Shows that people actually listen to the stuff and it's
8:13
worth our worth our time. And their time, right, to help
8:16
support that. So yeah, looking forward to
8:18
that. That's going to be a lot of fun.
8:20
Anything else you want to bring up before we get to our main
8:23
topic because we're going to talk a little about
8:25
authorizations? Well, yeah, I do want to bring
8:28
up one thing, just the thought that I have and usually I bring
8:31
this up at the end, which is if folks can get out there, if they
8:35
like the podcast, subscribe to it, leave us a 5 star review
8:40
would be appreciated. Let people know because that's
8:42
how people get to know about it. That's how when you go into the
8:46
podcast search feature of your your podcast app, we show up
8:50
first when someone types an identity and it's really, you
8:55
know, that's nothing that Jeff and I can do to improve the that
8:58
algorithm. It's really not yet, you know, I
9:02
got figured out. Maybe I could use the Flipper 0
9:05
somehow to to do that. Yeah, so far all you're able to
9:09
do is copy your hotel keys, but that's still a nice little
9:12
feature. Yeah, copied a hotel.
9:14
I've copied hotel keys and also the the badge system for my
9:20
inlaws housing complex. So definitely some things that
9:24
could be done there, but if I saw you at Starbucks, I would
9:28
not connect to the Wi-Fi. I did get the Wi-Fi dev board,
9:32
so I have been playing around with that.
9:34
There's a couple of, you know, interesting things you can do
9:36
set up like an evil portal. You can do a Rickroll attack,
9:39
which basically creates a whole bunch of fake access points that
9:42
are Rickroll lyrics. So I'm definitely not a hacker
9:48
in quotation works, but there's some neat things you can kind of
9:51
do that are fun and explain to people just why they should be
9:55
using things like MFA and things like that.
9:57
I think you are a hacker. I mean, you might be very green
10:00
in the hacker stack, but you're doing hacker things.
10:04
Okay. Well, I don't want this to be
10:06
evidence, so let's just keep going.
10:08
Let's talk about authorization and kind of calling this
10:11
authorization 2.0. I don't know if that will stick
10:14
or not. But to help us with this
10:16
conversation, we've got Rich. Dan Liker.
10:18
He's the chief strategist with Vasa.
10:20
Welcome to the show, Rich. Thanks, Jeff.
10:24
It's great to be here. How you doing, Jim?
10:26
Great to have you here. First of all, I love the radio
10:28
Pipes. You got a great voice for
10:30
podcasts. I will try my best to keep up.
10:33
I might, actually. I usually.
10:34
I'm trying to like, bring people's voices up, make the
10:36
sound, you know, sparkling, you know, right in the editing.
10:39
I might have to, like, do the opposite for you, so that there
10:42
isn't such a disparity between you, me and Jim.
10:45
But. Well, usually people only tell
10:47
me that I have a face for radio, but now now I also have the
10:50
voice. Well, that's what we always say.
10:51
We got faces for radio and voices for a silent movie,
10:54
something like that. Well, thanks for joining us and
10:57
spend some time with us here today.
10:59
We like to hit to really learn about the identity journey that
11:02
people have been on. And it's kind of tradition
11:04
around here when we have someone on for the first time to
11:07
understand what their identity origin story is.
11:09
So maybe you just spend just a minute or two kind of talking
11:11
about how did you get into the space of identity and access
11:15
management or digital identity or whatever the heck we're
11:17
calling this field today? Yeah, it actually started when I
11:22
was at Octa and I actually back in 2014, I went and joined them
11:28
and I led the product management team for about 4 1/2 years
11:31
through the IPO period. And so, you know, I think
11:34
Identity had definitely, you know, struck A chord with me and
11:38
that was one of the things I would did a stint in data loss
11:41
prevention. And really seeing how, you know,
11:43
sort of network based security tools were just not the thing
11:47
you really wanted to see. You wanted you needed to get
11:49
down to the person and that was really hard.
11:51
You had to go through proxy. You had to do all sorts of fancy
11:53
dancing to get there And so that, you know Identity was
11:57
definitely something that was like top of my list.
11:59
And then Ochter really cemented that for me.
12:01
And I think it was, it was a it's it's been a fantastic
12:04
journey and you know my my early on in my career, I definitely
12:08
said wow, this is a lot more complex than I thought it was
12:10
when I started. It always is.
12:13
I think the definition too, of kind of being an identity has
12:15
changed. A lot of people find themselves,
12:17
they just were in it all of a sudden, they didn't like, pick
12:20
it. It was just, oh, I I guess I'm
12:21
in identity now and now you're a chief strategist for an identity
12:26
company. So I love titles because some of
12:29
them are very cool. Some of them like okay.
12:30
What the heck does that even mean?
12:32
What does a chief strategist for an identity company like Visa
12:36
do? That's a great question because
12:38
I definitely find it a strategy means lots of different things
12:41
at lots of different places. It could mean a whole lot and it
12:43
can mean a whole lot of nothing. But for us at Vasa, I tend to
12:47
split my time between a number of different pillars.
12:51
First is really around sort of high level product marketing and
12:53
messaging. So I think a lot about how we
12:57
position the solution that we provide, how we talk about our
13:00
customers, how we talk about the space that we're in.
13:02
So that bleeds into a lot of analyst relations and speaking
13:05
to the folks like Gartner and speaking to Enrique as well as
13:09
sort of looking at the market as a whole and you know, so we're
13:11
kind of getting into a competitive analysis as well.
13:14
So that bleeds into the second pillar which is helping out our
13:17
sales team. So you know, really being sort
13:18
of more out on the front lines, helping to, you know, to guide
13:23
the folks that are actually talking directly to prospects
13:26
about sort of how to talk about things, how to, how to position
13:29
things, what people care about and and what identity folks.
13:32
Really wanna you know what's top of their list And then the third
13:36
is on product strategies. So actually building new
13:39
product, working on some of the advanced things that we wanna
13:42
get done that are critical for sort of that long term
13:46
positioning in the market and sort of really helping take us
13:49
where we wanna go in the long term.
13:52
So Speaking of products, you've got this company called Vasa
13:55
VEZA. I'm sure you get confused with
13:59
Visa. A lot people saying it.
14:00
So let's get the word out there, right?
14:01
It's pronounced Vasa. For those people who are not
14:05
familiar with what Vasa does, what's the elevator?
14:08
Pitch 30, let's say 62nd elevator ride up.
14:12
What do you guys do? Yeah, I think the way I like to
14:16
talk about it is really that we help.
14:18
The company's operationalized least privilege.
14:20
So we do that by really putting together a graph around
14:25
authorization that shows you not just what you have across all
14:28
your different systems, but where it's wrong, where you need
14:31
to fix it right. So we have a core technology
14:35
which is our authorization metadata graph, where we really
14:37
put together all the different pieces of information about
14:41
authorization from users to groups to roles, all the way
14:44
down to specific resources that might be in a particular system.
14:48
And the permissions down to you know can you read, can you
14:51
write, can you head it, can you delete and putting that together
14:54
and I think I think that combination makes a really a
14:57
really powerful solution to both see what you've got as I said
15:00
fix it and also get to compliance, right.
15:03
And that's a that's a frequent driver for a lot of customers
15:06
and we have a, you know we're we came out of stealth last year.
15:08
We've got a number of big customers like Wynn Resorts,
15:11
AMD, Intuit, Blackstone. Amex Global business Travel and
15:16
Zoom. So it's something that's really,
15:19
I think resonated in the market because it's so hard just to see
15:22
what you've got and that's often where customers start with us.
15:27
Yeah, I think a lot of people think identity, they think
15:28
authentication, it's the next step.
15:30
After that, it's really where you're going.
15:32
It's the authorization side. So where does the name Vasa come
15:36
from? Yeah, well, actually it's an
15:39
interesting, interesting story. When I first joined the company,
15:42
we had a different name. We were called Cookie dot A I,
15:45
and this is even before Chachi BT.
15:47
So it was prescient in one way about, you know, having the A I,
15:52
the, the the the dot A I there. But you know, obviously Cookie
15:56
dot A I has a lot of, has a lot of baggage.
15:58
So that was one where I was like, yeah, I don't know if
16:00
that's going to really fly long term.
16:02
And so I actually helped drive that the new naming and Vasa
16:07
comes from the Zulu word meaning to reveal.
16:11
So I was like wow that's pretty cool.
16:13
If I had to pick a language that I, I based the name on Zulu's
16:16
probably Yep that's about the the peak of it and it has like a
16:19
it has a good meaning you we could we could get the.com
16:23
domain for not an outrageous amount of money and the ticker
16:27
symbol was available. You know, you always got to be
16:29
thinking ahead. Hey, rich, authorizations really
16:33
seem to have blown up in the past year or so.
16:35
And if someone asked me, you know, what's hot in identity
16:40
right now, I run down a list of, you know, converged identity,
16:44
which I don't think is that exciting decentralized Kim, ITDR
16:50
Pastor list and authorization. And it's like that whole list I
16:55
went through until I got the authorization.
16:57
Those are all new things, right? They're all things that have
16:59
kind of happened in the past several years, but
17:03
authorization's been around for pretty much the beginning of
17:08
identity. And so I'm wondering, what do
17:11
you attribute this blowing up of authorization, as I put it?
17:16
What do you attribute that to? I really think it's a
17:20
consequence of most organizations really pushing
17:24
forward with authentication and props to Octa, props to
17:29
Microsoft really for driving forward the world of SSO with
17:34
SAML and OIDC and getting MFA implemented and driving forward
17:39
on password lists. So most companies that I talked
17:42
to have really you know how they've kind of gone through
17:44
that and they've said Yep, we've done, you know we've done the
17:47
lion's share what we need to do around authentication and wow
17:51
things aren't fixed yet. We still, we still have all
17:53
these issues. We're still getting either we
17:56
have security tax, we still don't really have a handle on
17:59
identity. It's not just a, it's not a
18:00
solved problem yet. And so it's just as you said,
18:03
it's a very natural thing when you after you've you've gone and
18:05
tackled authentication, authorization is the next step.
18:09
Right. And so I think that that natural
18:10
sort of like you know what do we do next.
18:12
We know there's something here. We know how core identity is to
18:16
all these different things to the you know to the IT stack to
18:18
the security stack and yet you know it's it's not we.
18:21
We know we're not done. Now Rich, when we talk about
18:25
frameworks for authentication some of the the ones that our
18:28
listeners may be familiar with our our back a back P back, some
18:33
some of those people might not be familiar with.
18:36
Could you help us define each one of those and helps which
18:40
one's the best one? What a loaded question.
18:45
That's awesome. So yeah, RBAC is a role based
18:48
assets control. So this is, this is probably
18:51
what I see as the most commonly used one.
18:53
And you'll be, you know, you'll be used to this in an enterprise
18:55
scenario where you'll have some sort of description.
18:58
You know, I might be like a, you know, W marketing or you know,
19:01
I'm a super admin and that sort of gives you based on a role.
19:06
There's some, ideally there's some commonality across an
19:09
organization that collects up a bunch of different permissions
19:12
that's organized in sort of your function at the organization
19:14
into a role that's the ideal state.
19:17
Then you have things like a back, which attribute based
19:21
access control and that's where you're not doing it necessarily
19:24
in a role, but typically more dynamically like you can think
19:27
of. I think the best analogy is.
19:30
You're used to this around sort of, you know, attribute based
19:33
authentication, right? It might be geolocation based
19:36
right, where you actually you're pulling in some attributes,
19:39
oftentimes dynamically and making a decision about, all
19:42
right, is this person actually allowed to get to certain
19:45
resources and take certain actions and certain resources
19:48
based on the value of those attributes?
19:49
So there's it's typically done more at runtime and more
19:53
dynamically. And then policy based access
19:55
control where you're it's a it's a pretty similar kind of thing
19:58
and a lot of similarities to a back, but it tends to be a bit
20:02
more around design so that you can actually make broad policy
20:07
based changes across the organization without having to
20:09
go through and rejigger all your roles, right.
20:12
So it's sort of more, you know, a goal and A and a target
20:16
design. From.
20:17
From what I've seen RBAC is the most commonly used one and you
20:22
know. And I know we, we talked about
20:24
this, it's like for for being, for me being in in in the
20:28
authorization space. I'm amazingly not opinionated
20:31
about which one is best. So that's a tough question for
20:33
me. But I know that my my favorite
20:35
one was like that's I was listening to one of this one of
20:38
the C shows I was talking to. He says our back, yeah really
20:41
bad access control. And I think I have a strong
20:45
resonance with that because even though that's the most commonly
20:48
used one that's you know that's the one I see most often.
20:51
It's just has so many gaps and so many holes.
20:54
Can you have least privilege without RBAC?
20:58
You know least privilege is obviously it's a you know it's a
21:01
big slope. And I think really that the
21:04
trick is like you know, and this and this is also, you know, I'm
21:07
don't want to, don't want to pitch.
21:09
But you know it's like everybody agrees least privilege is
21:11
something you need to get to. But getting it in practice and
21:15
and you know, how do you actually get an operational
21:16
program. You know we've we've all gone
21:19
through those compliance surveys and said, hey do you follow
21:21
least privilegedly? Yes we do.
21:24
But what does that mean? Like you know and how do you
21:26
know and where is it off and how can you get better.
21:29
Those are the, you know, when the rubber meets the road.
21:31
I think those are the most important questions.
21:34
So I I see it as less of a, you know, are you using RBAC or A
21:38
back or P back? It's more around do you have the
21:41
tools and the processes and the people to actually get to least
21:45
privilege? Least privilege is the goal, no
21:47
matter which of these frameworks you're trying to do.
21:50
Jeff Rich refuses to answer my question.
21:56
It's baby back. What's the best back?
21:54
What is the best? I mean, without question.
22:00
Got back and that is the winner folks.
22:06
OK. So Rich, it seems like that in
22:08
the past at least in my experience authorization was an
22:13
area focused on for CIM customer I M and less so for enterprise.
22:20
But it seems like this blowing up that I refer to is really a
22:24
reversal of that trend and it's becoming more of a shift toward.
22:30
Enterprises doing more advanced authorization projects or taking
22:35
that authorization focus, is that right?
22:39
Do you agree with that? Yep, I do.
22:42
And I think I think traditionally authorization has
22:44
been sort of front and center of a of a CI AM project because
22:48
when you're building a custom application which is typically
22:51
with those things, what's involved there, you you can't
22:54
not build authorization in, right.
22:56
You've got to have something and so you you have to build some
22:59
sort of structure or some sort of componentry.
23:01
I think to be fair I'd say that you know the the the CIAM types
23:06
of projects haven't gone away and actually we're seeing a
23:09
really strong push here, not so much in terms of sort of the
23:14
bulk users that are going into an application.
23:17
For instance, if you're, you know, if you're a customer, a
23:20
consumer facing company and have a CIM application, you've
23:23
generally done a pretty good job of separating and isolating
23:27
customer one from customer two. Like I if I'm going into
23:30
Expedia, I can't get to Jeff's travel profile and access Jeff's
23:33
credit cards and then for the most part that's a well
23:36
understood problem. The trick and I think the sort
23:39
of the frontier for that on the CIAM side is really things like
23:44
help desk people, right? If you have or you have admins
23:48
or DevOps people who are logging in and sort of getting access to
23:52
customer data, getting privileged permissions into some
23:58
of these things, potentially cutting across multiple
24:00
customers, doing some sort of operational management.
24:03
And of that, I think I find a lot of customers are really
24:08
weren't they weren't thinking about that.
24:09
That's not sort of the primary use case of authorization in
24:12
that custom app. And so it's they often have very
24:15
little visibility, especially when you get to the security
24:17
team, you've got the developers, you're kind of, you know,
24:19
there's one guy who knows exactly how it all works.
24:21
But then when you go to the security team, they don't have
24:23
visibility, they don't have logins, they don't know how it
24:25
works and that that's a real, real gap there in the CIM side.
24:30
But to your, to your point, I think it's now also hitting on
24:34
this sort of the enterprise application side.
24:36
And I think there's a lot of crossover because some of the
24:39
data storage systems like going to the cloud platforms of AWS
24:42
and Azure and Google Cloud, those are now sort of crossing
24:46
over where they're being used for enterprise data.
24:49
They're also being used for customer data and so you know
24:52
you, you really see a lot of commonality in leveraging
24:55
similar platforms across the the internal enterprise, traditional
25:00
internal enterprise applications and consumer applications and
25:02
customer applications. So when I talk about
25:05
authorization with people, I my mind shifts back to the
25:09
framework around the insaccharable standard and you
25:12
know, Policy Decision Point, Policy Enforcement Point, and
25:16
again like my reference point is a lot on customer I am.
25:21
And I've always thought like, OK, externalizing and
25:25
centralizing the policy decision point is pretty drastic.
25:30
You know, if you've got a couple of, you know, business portals
25:34
for transacting, whether it's placing orders or warranty, it
25:39
depends on what business you happen to be in.
25:42
But a lot of times those applications were built
25:45
individually. They're right.
25:46
They're not just one big portal that does it all.
25:50
And to centralize all that, I always thought to myself like
25:55
okay, that probably makes sense for like the FBI or something
25:59
like that where they want to have a centralized log of those
26:02
policy decisions. So to me, the policy decision
26:05
point was always like the the big most important component of
26:11
that framework. The way of thinking about
26:15
Zackamal and I'm wondering like does that.
26:19
Framework still hold value. Do you still use that framework
26:23
and that type of those terms, Policy Decision point, Policy
26:31
Enforcement point, things like that?
26:33
And you know, is the policy decision point still the most
26:38
important concept of that standard or is this something
26:42
else now? Yeah, that's a great, a great
26:45
question. I think.
26:46
I think those especially those concepts are very valid today as
26:50
valid as they as they were when the, you know when the standards
26:53
were being developed there. And I I think that that sort of
26:55
methodology and that that conceptual division makes a ton
26:59
of sense. And I find that you know it's a,
27:02
it's a still a small fraction of folks we we tend to not talk
27:05
about those things as explicitly in today like in our in our
27:10
marketing and documentation materials.
27:12
But I definitely run across plenty of customers who still
27:14
talk about it and say hey you know give me know tell me how
27:16
this fits into that world. And so I think it's they're
27:19
definitely folks out there who still think about it this way
27:21
and I think if you explain it to them it, it makes a ton of
27:25
sense. Here's one where I actually am
27:27
opinionated and this is 1 where I'm actually, I'll put in my
27:30
vote for my favorite, my favorite component is the, the
27:34
policy administration point. And that's one where I think the
27:37
issue with the with sort of centralizing as you pointed out
27:41
with the decision point, you know it's it's really, you know
27:46
you have there's a performance issue you you're generally
27:49
you're looking at that with the with the enforcement point
27:52
potentially and putting those things together I think tends to
27:55
make a lot of sense. But trying to reroute the
27:57
network and trying to you know channel everything to A to a
28:00
single choke point, that's not how, that's not how the modern
28:04
cloud architecture and modern day, modern day systems are
28:07
working. And as you said like once you've
28:09
got it up and running no one wants to rearchitect that stuff.
28:12
No one wants to put a new a new component in the middle of
28:16
something especially when you're talking about sort of customers
28:19
and you know and production data or actually getting transactions
28:22
done. It's a really hard pill for
28:24
folks to swallow. So I think you know.
28:26
Multiple applications that could be.
28:29
Posted around the world you can have scalability, reliability,
28:32
network type issues. That's right.
28:35
That's right there. Just there's so many other
28:36
things that sort of drive that. And you know and you know I can
28:39
imagine like an enterprise architect trying to go say hey
28:42
we want to centralize all this to a single point and get thrown
28:44
out of the room because it's just like it.
28:46
There's so many other factors in there that that drive it.
28:49
And so I think my personal take is attacking it at the
28:52
administration point is the is the right way to go.
28:55
We've been talking a lot about, I guess.
28:58
Theory, for lack of a better word, right.
29:00
How things should work. I always like to hear like
29:02
what's the real world doing in this space?
29:05
You mentioned some of the clients that you've worked with
29:07
in the past and some customers you've got.
29:10
What are some of the use cases you know that you've seen where
29:13
an authorization tool has helped solve some of these real world
29:17
problems that we're seeing out? Because, you know, I think
29:20
everyone points back and say, oh we're we're a role based access
29:22
control company. Okay, Are you really?
29:25
And how good is it? It usually sucks and it's a
29:27
pain, pain in the butt to maintain and you know they kind
29:29
of gave up maybe after. Oh yeah, we have 5 rules, right?
29:32
Something like that. And I feel like it's it's a
29:35
struggle for a lot of organizations out there.
29:38
They every every company that I talked to says that they are or
29:41
they want to be role based and it's hard in the real world,
29:45
especially when you have these applications that are using
29:47
their own authorization schemes and they have not moved to.
29:51
You know a centralized policy, decision point or access point
29:54
or engine or whatever it may be. What are you seeing in the real
29:58
world around this space? How are you know these?
30:01
How are these things moving forward?
30:04
Yeah, I I find that you know one of the big issues and I
30:07
mentioned this before about you know the the really bad access
30:10
control crack. But that one of the one of the
30:13
challenges is you know you can you can do it at a point in
30:15
time. And typically I what I hear is
30:18
like you know hire a systems integrator like Accenture to
30:21
come in and get you know and get like a whole raft of you know
30:26
warm warm bodies from from the consulting or to go and have
30:30
tons of interviews with every organization across you know
30:33
across the company. And that's a tremendous amount
30:35
of work and they. Better yet, hire our son to do
30:38
it. There you go.
30:40
There you go. But then you get drift over
30:42
time. And then you get, you know, you
30:44
get people you know and say, well, you know, maybe I'll use
30:47
this role for something it wasn't quite intended for, but
30:50
it sounds about right. Or things get tacked onto the
30:53
role and so the permissions change and actually what's in
30:56
that role changes the use and the and the and what it's what's
30:59
being applied for changes. And you know, essentially, you
31:02
know, then then you're going or you, you know, you get someone
31:05
who says, you know, oh, I need this new role for this new
31:07
purpose. And this sounds about right, but
31:11
man, I don't really know what that role does.
31:12
Let me create a new role. And so then you get this
31:15
proliferation. And So what I find is that most
31:18
organizations, even when they want to be a role based access
31:21
control company, they're trying to manage it just on the name of
31:24
the role. Like when you're trying to say,
31:27
hey, is this right? It's like the role is named
31:29
super secret admin #2 okay. Like what does that mean?
31:34
And people have no idea. And so the thing that surprises
31:37
me I think around all this and the real world customer examples
31:41
that I see is that oftentimes the things that customers are
31:44
struggling with is so much simpler than you would ever
31:47
imagine. And you know, so one example we
31:48
have a, you know a very large Fortune 500 company and they
31:53
actually went through this and that, you know they came to us
31:56
and said hey you know can you tell tell us when a new admin is
31:59
created in Salesforce, We're like yes, we can chew that.
32:03
And what it turned out to be is that they had an IGA, a very
32:08
large IGA company that you would the name you would know as a
32:11
leader in the IGA space and they were using that to provision
32:14
Salesforce. And yet they found that when
32:18
someone went around that provisioning process, the
32:20
approved process and went directly into the Salesforce
32:22
console or create a new admin in there, their IGA solution
32:26
couldn't tell them And they would go around this and they
32:29
tried to actually custom code some solutions to do it.
32:31
And there were just so many different ways to do it.
32:33
They couldn't find that. They could plug all the holes.
32:35
And what it turned out was that they had failed two socks on it
32:41
because of that, right. And so it sounds so simple and
32:44
you take someone outside of identity or peripheral identity
32:47
and say you know, do you know, how can you not know when a new
32:51
admin is created in Salesforce? Like how is that possible and
32:53
yet that's the thing that these very large, very sophisticated
32:57
companies are struggling with. And so you know, so that's what
33:01
we hear, see is sometimes it's a compliance driver.
33:03
It's like when, you know, when your auditor gets the the taste
33:06
of that and they know that you don't have controls, you can't
33:09
demonstrate controls like that is a big deal and they will,
33:12
they will drive that and companies are very, very
33:15
motivated to fix that. Other times it's just a
33:18
visibility thing. And I know there was a former
33:21
SISO of a very large telco that was telling me a story about
33:25
sort of when he came to believe in, in authorization as sort of
33:30
a really key thing. It was actually after an
33:32
incident. And so they had, They'd had an
33:34
intruder come in. They'd had an account takeover.
33:36
And they ended up being able to block that and and locked out
33:40
that account before they they lost a lot of data.
33:43
But he was doing a postmortem with all of his direct reports.
33:46
And so he had them. We were all in a room.
33:48
And he says, all right, here's the first account that got taken
33:50
over. What did that have?
33:51
What did this account have access to?
33:53
And they all look at each other and they say, we don't know.
33:56
He's like, okay, here's the second account.
33:58
How about this one? We don't know.
34:00
He's like, how is this possible? How can we not do this thing
34:04
that's so fundamental to security and being able to
34:07
respond to these types of incidents.
34:09
So I find it, you know different different organizations and
34:12
people come at it from different sides.
34:14
But inevitably when they dig down and really see what's there
34:18
and see what they know and what they don't know, it's a little
34:21
terrifying and and you know it's it's such a basic thing you
34:25
imagine like you know how how is this possible that we can't do
34:28
this and yet it's incredibly hard it's made it's been a lot
34:30
harder with the with the cloud. Rich, just thinking like you
34:37
just told the story. I'm thinking, man, this folks
34:39
who are in that room said, we don't know.
34:41
That must have been just like such an embarrassing and painful
34:44
moment for them. It's like it's your job, you
34:48
know? I mean, look, I'm not saying,
34:50
like I would have gotten it right.
34:52
I'm just saying that I'm sure, I'm sure glad I wasn't in their
34:55
shoes at that moment. Because, you know, when you
34:58
think about identity, it's ensuring that the right people
35:02
have the right access. You know, knowing who has access
35:06
to what and when you can't answer that question, like, wow,
35:09
that's that's downright embarrassing.
35:12
It. It really is.
35:13
And I think I think it's, you know, it.
35:15
It underscores the fact that like just the the tool set has
35:18
just hasn't been there. Like, you know, it's like we've
35:21
done all these advances and you know, like we were talking about
35:23
before, authentication has come a long way in the last five,
35:26
five, 6-7 years. The tools that we got available
35:29
are so much better. And I think, you know, that's
35:33
another common thread is that the tools for authorization have
35:36
been pretty stagnant. There just hasn't been a lot.
35:39
And so, you know, I think back to another, another guy who was
35:43
in, he actually leads the engineering team at his at his
35:45
organization. He was telling me a story about,
35:48
you know, when they didn't have any tools.
35:50
He said, yeah, the auditors asked me for, you know, everyone
35:53
who could access this one database.
35:56
We had to really get in and the auditor was like would not let
35:58
it go. And in order to answer that
36:01
question of like who has access to this database, what can they
36:03
do in this database, He said he had to take his best developer
36:06
off for a week of custom scripting to go answer it for
36:09
one database. So now multiply that across, you
36:12
know your entire environment and you just can't do it.
36:16
Like, you know you can get the answer, you can figure it out.
36:18
But the amount of time and effort and energy it takes to do
36:21
it without a good tool set is brutal.
36:24
Well, I think this is where the fundamental question that.
36:27
I always ask folks is you know, can you answer this question?
36:30
It's very simple. Who has access to what and how
36:35
quickly can you pull that answer together?
36:37
And how accurate do you think that data is?
36:40
Because if you can't answer that question, my mind your identity
36:43
and access management program is failing.
36:45
It's a basic question, right? And it's.
36:48
I also find you really need to dig down because most people
36:51
will say, well, yeah, I know you know these, the people in these
36:53
groups, OK. But you know, like, dig it.
36:57
Let's dig a little deeper, like. Nested groups?
36:59
What does it even mean? It's been you know, that group
37:02
is used for eight different things, one of which was the
37:04
original intention, right? Stuff like that, that's right.
37:08
And you know, it comes down to, you know, to brass tacks.
37:10
Usually it's like, you know, pick your, you know, your most
37:12
sensitive, you know, data element, whether you know it's a
37:15
table, maybe it's a box folder, you know, maybe it's a, you
37:19
know, a data lake, you know, in Snowflake or something like
37:21
that. And say like who can get to that
37:23
and exactly what they, what can they do, right.
37:26
And like it's going, but it's going down to these data
37:28
elements. Because you like, I think
37:30
everybody has somewhat of a handle around users and groups
37:33
and some connection to role. But I find the biggest gap is
37:36
what does that role actually do? What does that mean?
37:39
Like what can you actually get to with permissions?
37:42
And then you get all these other things like what about local
37:44
permissions, what about local users?
37:46
What about system accounts and machine identities?
37:48
And like you know now it's pulling on all those threads
37:51
where you know it's not in the 70 or 80% solution, but it's at
37:55
the edges. And those are typically the
37:57
biggest issues when you when it comes to security and
37:59
compliance. Those are the ones that you
38:01
really need to worry about are those ones that you?
38:03
You. You know you.
38:03
Most of the time you don't. You have no idea.
38:06
Well, you've got the point in time definition.
38:09
And then what are you doing to make sure that that definition
38:12
stays the same? Because things change, right?
38:15
Exactly. Do you find that there is a
38:17
particular platform or system or something?
38:20
That is like the hardest thing to include when we start talking
38:22
about authorization, maybe even as a program.
38:25
I think people think of identity as a program.
38:28
Authorization as a program might might need to be a thing as well
38:32
considering you know that's that's really the keys of the
38:34
castle, whatever, you know, what are people getting access to.
38:36
But I know I found you know doing integrations different,
38:40
you know technologies out there. There are some platforms or
38:42
systems that are just. Of real pain that you know what
38:45
and it's either not well documented or you can't do
38:49
certain things because API's aren't available, whatever it
38:51
may be. But what kinds of platforms do
38:53
you see as, like the hardest to include as part of this, this
38:57
capturing of who has access to what?
39:00
Yeah, from a from a tactical standpoint, the hardest ones are
39:03
definitely the, you know, the old and crusty on Prem ERP
39:08
systems. You know, those are the ones you
39:09
know there's no Restful API like they've been, you know they've
39:13
been cut, they've been you've had an SI come in for eight
39:16
years and is you know is custom fine tuning it.
39:18
And so it ends up being something that has very little
39:22
commonality with anyone else's deployment.
39:25
And so it's just a tremendous amount of customization and the
39:27
hooks are not there. So from a tactical standpoint,
39:30
those are the hardest ones or custom applications as well.
39:33
They're just, you know, they're kind of, there's snowflakes,
39:34
right. Nobody else has it And so there
39:36
it aren't a lot of common tools that still like you to
39:38
integrate. But from a program perspective
39:41
actually find it's the other way where you see that you know a
39:44
lot of times when you look at you know identity governance
39:46
programs they've got like the ERP system that was always the
39:50
number one thing that was so that's priority one.
39:52
So they've actually this you know gutted it through and you
39:55
know by you know really you know brutal house to house search
39:58
they've they've gone and figured that out.
40:00
But then you say well you know how many apps do you need for
40:03
socks or relevance for socks compliance and are subject to
40:05
that And and you know those is like well it's like you know
40:07
it's like 30 apps. How many do you have covered in
40:10
your Identity governance program?
40:11
Three. And what are you doing about all
40:14
the rest? And so from a program
40:15
perspective, it's actually that longer tail.
40:17
It's the stuff that's still relevant for compliance and it
40:19
knows there's critical data in it.
40:21
But usually the lift is so heavy to get these things integrated
40:25
into an identity governance platform that they have huge
40:29
gaps and they know that. Yeah.
40:30
You know, I kind of, I think one of the things about
40:34
authorization is. You have to make a decision on
40:39
how far you take your authorization program.
40:42
So let's say we take one of those apps that you just
40:46
mentioned, custom build. App developers have been
40:49
hammering away on it for decades.
40:52
Maybe building like, oh this view and that view and like
40:56
things that are not standard. Or take something that's
40:59
out-of-the-box that I thought you might.
41:02
Answer that question with which is like ERP systems where
41:06
especially older ERP systems where you say you have access to
41:09
this table, this screen, this business unit.
41:12
So now it's like multidimensional access and it's
41:15
like that's just you know if you spend your IEM program focus on
41:21
nailing the authorization for that, that is all you're going
41:24
to get done like you might have an IM program with.
41:28
A handful of people. So to me it's kind of been like
41:31
okay, so, So what is our I am program going to do?
41:35
It's going to take it this far. It's going to provision a person
41:38
into these right groups or it's going to in real time present
41:43
the application with some assertions of authorizations.
41:48
But they're going to be at this level.
41:49
It's not going to be like they should be able to see all these
41:52
tables and things like that, so. I guess to translate that back
41:56
into your real world story where this uses like Okay, we're going
42:00
to take this application, take this account that got
42:03
compromised. What did they have access to in
42:06
our ERP system? I would say the I M team should
42:10
say, well, we sent these authorizations or we put the
42:14
person into these roles in these groups and then somebody from
42:18
the ERP side should said be able to say.
42:21
And that gives them access to these screens and these database
42:24
tables or things like that, right?
42:26
But somewhere along the way. So do you have a rule of thumb
42:30
or is it really just having that that knowledge should be able to
42:37
say, all right, here's a couple of rules of thumb that we're
42:39
going to apply. Yeah.
42:42
The, the rule of thumb that I find is, is sort of the
42:44
commonality. If I look at customers who have
42:46
been the most successful at doing this kind of thing, it
42:50
it's absolutely prioritization is the name of the game.
42:52
I mean, that's the first thing is you cannot do everything
42:54
right. And so you have to pick your
42:55
battles. And I find that the one of the
42:58
most valuable things is actually going, you know, you know,
43:01
starting at the end, right. And like looking at like, OK,
43:03
what's the most critical data we need to protect, right.
43:06
And that that's typically the thing that's fundamentally like
43:10
the board cares about, you know the see, so the CIO care about
43:14
and so hey let's figure out like what roles give access to that
43:18
and what can they do, right. And so typically that's that's
43:21
where I found it, it's most valuable is kind of starting at
43:24
the end. But to your point, Jim, I think
43:27
a rate you raised a great point is like a lot of times this data
43:29
to put that whole story together and to get their true visibility
43:32
all the way down to the data level, It's on different teams,
43:35
right. It's in different systems,
43:37
they're different groups. And you know, does the identity
43:40
group really understand the inner workings of the ERP system
43:43
authorization scheme? Like heck no, right.
43:46
And so and every single system is different, right.
43:49
You know, just because you know, one system like you, you got to
43:51
kind of be an expert in each one And that it's that that
43:54
translation across systems, that's also really, really hard.
43:58
So now you think about, you know, now you boil it back up
44:01
and now you're a see so and you say, hey, you know I just want
44:05
to make sure that no contractor in China gets access to my
44:08
customer data. Let me make that happen.
44:11
Now you think about like what do you have to do in terms of
44:12
technical controls on every system that might have customer
44:15
data. What do you, what knob do you
44:17
actually tweak, what's the JSON actually look like for that?
44:20
That's a really hard thing to answer, although that's, again,
44:22
it seems like a very simple kind of thing that's, you know, that
44:25
that's would be very reasonable for a SISO to want.
44:28
And yet bringing that and actually putting that into
44:30
action is super, super hard. That's a great answer.
44:35
You know the other thing that was as we're talking about, we
44:39
kept talking about authorization as a program.
44:42
And I'm not recommending that folks go out there and spin up a
44:46
program and have an authorization program manager,
44:49
but it reminded me the of the impact that authorization has to
44:55
humans. I'm also sure that the impacts
44:57
on the end user. But definitely the application
45:01
owners and these application teams and making sure people are
45:05
clear on roles and responsibilities and to make
45:09
sure that where I drop it, you pick it up, etcetera.
45:13
What are your thoughts on that impact?
45:15
Is there an impact to end users? And then the app owners, who are
45:19
app owners, developers and database administrators, all
45:22
those folks, yeah, absolutely. There's impact on end users
45:26
because usually it's like, hey, I need access to this thing.
45:30
I need to get my job done and I need more access.
45:32
That's typically how it goes. So you know, obviously you start
45:35
off with birthright access, you get a bunch of stuff right out
45:38
of the gate, but it's never enough.
45:40
And it's designed not to be enough.
45:42
You gotta go typically and ask for more and so then the trick
45:46
is okay, how fast can I get that done, right.
45:49
If you're a developer that's working on a critical project
45:52
like I guarantee you got a, you have a lot of organizational
45:55
push behind you to get that access quickly, right.
45:58
It's like if it, you know, if it's a revenue facing project
46:01
and you know they need to get it done like they you will, they
46:04
will push and they will get a lot of backing you.
46:06
It's really hard to say, hey hold on, we got to figure out
46:08
our role structure. That's not going to work right.
46:11
You got to get access. That reminded me.
46:13
I actually have another customer example where they started using
46:18
better tools, right? And just having more insight
46:21
into what roles actually did can be extremely powerful even in
46:25
the provisioning process, right? So their problem was they had
46:28
Snowflake and they had developers that would come in
46:31
and actually ask for additional access to something.
46:34
It might be a table, it might be a database in Snowflake.
46:37
And so the challenge that they had and actually the
46:39
provisioning was done by the Snowflake team just for this
46:41
very reason because they were the only ones who sort of
46:43
understood the inner workings of snowflakes.
46:46
So the IT team couldn't do it right then.
46:48
So they actually had to take down on themselves.
46:51
Back to your other second part of your question is how does
46:53
this actually impact app owners and and and data owners.
46:58
They were actually the ones doing provisioning and more than
47:01
not because it was typically such a mission critical thing
47:04
that was time sensitive, They over permissioned right.
47:07
And that's the reality is like, well it's like gosh, I got all
47:10
these roles. I got like 80 roles.
47:11
I don't know which one gives access to this table.
47:14
Let me just give them the real, you know, let me give them the
47:16
good stuff. Let me you know, let me let me
47:18
give high level access. And So what they were able to do
47:22
when they actually had some tools that were that allowed
47:25
them to see what these roles actually did, like what did this
47:28
role actually give permissions to and had that that sort of
47:31
instant level of visibility, they were able to reduce that
47:34
down. So once they granted a new role,
47:37
they could really find the one that best conformed the least
47:40
privilege, right? They could find the one that
47:42
gave access to that table but as little else as possible.
47:45
And just by sort of implementing that, by having the tools around
47:48
visibility, they were able to reduce the total number of
47:51
permissions on Snowflake by 80%. That's what they told us.
47:54
I mean, so it's you can really see the effect of that.
47:57
It's not just, hey, does someone have access to Snowflake or not,
47:59
but what role do they have and is it enough for them to do
48:01
their job? This is least privileged at its
48:04
heart. All right.
48:06
One last question around authorization for wrap things
48:09
up, but it wouldn't be an Identity at the center podcast
48:12
without mentioning of AI at this point.
48:14
So what do you, how do you see AI impacting this space of
48:19
authorization? Yeah, I mean, I I think about
48:23
this a lot as everybody, everybody who listens to this
48:26
podcast does. And I think, you know, there's
48:28
certainly going to be a lot, some good stuff into like role
48:31
mining and cluster analysis. And I think there's a lot,
48:33
there's a lot of of goodness there.
48:35
And also, you know what we were talking about before, we're
48:38
getting to the human component. When you're doing things like
48:40
access reviews, which is almost always a component of any sort
48:44
of governance program around authorization, it's really
48:47
alleviating that that human burden.
48:49
And I think A, I can do a really good job there where A, I, A I
48:51
might not be able to do that, give you the full answer, but it
48:54
can at least guide you and say, hey, you probably don't need to
48:56
spend a lot of time on these. Here are the ones that really,
48:59
you know, look suspicious, right, or look like you should
49:02
give it a little more time. I think you were using it for in
49:05
those kind of those kind of situations are really great.
49:09
And you know, I think the best example I heard about the power
49:13
of a I was really, it's like having unlimited interns, right?
49:17
And so you can do things that are sort of like this, these
49:19
sort of relatively relatively menial tasks, but you could do
49:23
it really fast. You can do it really cheaply.
49:26
But there still are things where, you know, humans are
49:29
still better at doing the, you know, the, the outliers, right.
49:32
The, the really edge case things.
49:34
You've got to have some humans involved in a lot of those
49:36
cases. But A I can take a lot of the
49:39
burden there. The other component and the
49:41
other side of it is, you know, is what, you know, what's what's
49:44
going to be the bigger security concerns around authorization,
49:46
protecting a I programs, right. And so that's another
49:49
interesting one where you now see all these things around, you
49:53
know, the, you know, like like the weights like after the, you
49:56
know these training runs that some of these really large
49:58
frontier AIAI companies are doing.
50:02
You know it costs like a billion dollars to run some of these
50:05
training things. And so that you know the weights
50:07
that file that records all the essentially the results of that
50:11
training that is incredibly valuable intellectual property,
50:14
right, you know, perhaps bigger than anything we've ever seen in
50:17
history. And so and then you have nation
50:21
states that have stated goals around becoming a I leaders and
50:26
that combination of having these treasure troves.
50:29
I think it's going to be a, you know, it's going to really bring
50:32
security to a whole new level because the value of the thing
50:35
that we're trying to protect is so large and it's going to be
50:38
way beyond even customer data and credit card numbers.
50:41
And so I think what we'll see is it's really going to force
50:45
security providers and identity, identity people, identity teams
50:49
to think about securing this stuff beyond just typical IT
50:54
level security, but really break, you know, bringing it up
50:56
to physical security, getting it closer, closer with a lot of
51:01
sort of the three letter agencies that are actually
51:04
protecting it. I think there's going to be a
51:05
lot of more crossover between typical espionage scenarios and
51:09
risk profiles and what's normally been IT security, not
51:13
having to worry as much about physical security.
51:15
I think those things are really going to converge around a I.
51:19
And I feel like we're headed to a future where an organization's
51:23
a I become sort of like their OS and is their secret sauce
51:27
hopefully not as bad as like I robot goes a little bit nuts has
51:32
your definition of a I changed within the last couple of years
51:36
because I feel like mine has and I've talked about this before
51:38
where pre you know ChatGPT pre large language model being
51:43
available to the general public. I thought of AI as okay.
51:46
That's cool. It's it's like machine learning
51:48
and pattern matching and stuff like that.
51:50
And then you get something like, you know, ChatGPT or similar,
51:53
you know, functionality where now it's available to the public
51:56
and it's this conversational interface.
51:58
I find myself using it more and more and more for important
52:03
things and not important things. And my thought process now is
52:08
that's AI. I don't think of AI as
52:10
necessarily just machine learning and padding matching.
52:13
And I'm curious if if if you've thought about this from a
52:16
definition standpoint of, OK, you know, what is AI?
52:19
Because they feel like no offense.
52:21
You know, a lot of vendors have thrown the word AI on the box of
52:24
their product for years now. And now we're going to the point
52:28
is like, oh, OK, well that's interesting.
52:29
You know, what is, what do you mean by AI?
52:31
I'm just curious if your definition has changed since the
52:34
advent and the availability of these things.
52:36
Yeah, I I think it has. And certainly the way I think
52:38
about it, you know, I think before ChatGPT, the ChatGPT sort
52:42
of evolution, you know, I was just, you know, I was always
52:46
felt embarrassed about using the term A I that's what that's what
52:48
it felt like it was marketing. It felt like it was you know
52:50
something in the future and not here yet where ML sounded you
52:53
know much more reasonable and like yes, that's a much more
52:56
precise term. I think now I feel very
52:59
comfortable using the term a I and I think maybe it it's just
53:04
that it's still so new and still revolutionary that it feels very
53:07
very different and you know and that's I've I've seen that quote
53:11
before where it's you know AI is anything that's just new and and
53:14
not in the current capability set.
53:16
And it it feels like we're still getting our heads around what
53:19
this really implies. And really I mean it's it is
53:22
mind blowing even though it's a, you know it, you know a next
53:26
word prediction model. It feels like so much more and
53:28
it and it looks like so much more from every every angle.
53:32
It looks startlingly like you know an intelligence behind it.
53:37
So it certainly has changed the way that that I I treat things
53:41
and I talk about it. We're going to start to wrap
53:45
things up here and I guess kind of going on the lines of when I
53:48
think of AI and where things are going as well.
53:51
I think about the word longevity because I could see a point
53:54
where you know, everyone's got their their own AI and maybe
53:59
there is a. You know, Jeff, A I at some
54:02
point in the future, that list that you know exists long after
54:04
I'm gone, right. And it's this, you know,
54:07
facsimile of what, you know, my personality is like or whatever
54:10
it may be. What's one of the most important
54:14
things that you think you've learned about longevity?
54:18
Yeah, I think it's, you know, my, I know we talked about this
54:22
before. This has definitely been a
54:23
passionate of mine to to think about this and and and learn
54:26
about it. And I think it's really, you
54:29
know, in the end longevity is important and longevity is
54:31
great. But you know what really matters
54:33
is what you do with that time, right?
54:35
It's like it's not about just living longer, but it's like you
54:38
you've got to put it to some use, you got to put it to some
54:40
value. And I think it's that, that
54:42
perspective combined with the fact that, you know, if you look
54:45
into there are few, you know, very simple worms out there that
54:50
actually don't have programmed cellular death, right.
54:54
And so you look at this, he's like how can that be?
54:56
And you look across all these different species and
54:59
organizations and I've actually come to the personal perspective
55:02
and I've never really heard it stated this way but that, you
55:05
know, that a limited lifespan is is actually a it's a it's a
55:10
feature, not a bug. And it's actually something that
55:13
we've evolved. And so you know and you can, you
55:16
know, you can look at it from an evolutionary standpoint, it
55:18
makes perfect sense. It's like you know you got to
55:19
make room for the new the new era for the new folks, for the
55:22
young people. And and so I that's that's come
55:26
and that's been a that's a bit of a shock to say like wow.
55:29
I'm sort of you know thinking about myself is supposed to have
55:32
a limited shelf life and I think it just puts a a finer point on
55:36
on that. You know like if we if we all
55:37
knew we were going to live forever would we really get get
55:40
anything done what we needed to get done today Like if like well
55:43
I can always do it tomorrow. I think it's it's really, you
55:46
know, thinking about it that way, I think, I think makes you,
55:50
you know makes you use your time that you that you have better
55:53
and I think that's it. That's a good perspective from
55:55
from my my point of view. Well, time's one of the only
55:58
resources that you can't make more of.
56:00
Really, right? Everyone's got a only scarce
56:02
resource. This time.
56:03
Yeah, that's right. And I think, you know, it's one
56:05
of those things I think is, you know, as I get older, right, I
56:07
think about how much time do I have left?
56:09
Am I going to get all the things accomplished that I want?
56:11
And you're right, if I live forever and I would just keep
56:14
kicking that can down the curb, right?
56:16
And, you know, play video games all day or, you know, I don't
56:20
know, set up evil portals, whatever it may be.
56:22
Jim, what do you think about longevity?
56:26
Well, I. I really enjoyed listening to
56:28
what Rich had to say, because I think perspective about
56:32
longevity is so important. I think it changes over time
56:36
too. You know, I have in my mind I'd
56:38
like to live to about 80, feel like that's where the human body
56:42
wears out. But on my 80th birthday, am I
56:45
going to say, well, I'd like to die tomorrow?
56:47
Heck no. I'm going to set a new goal.
56:49
I'm going to find new reasons why, a new ways to find meaning
56:54
out of my life. But I will say.
56:56
You know had a a passing away happen in my family recently and
57:03
it got me onto a YouTube worm which was watching or rabbit
57:08
hole watching these videos. They were frontline videos.
57:11
Frontline has like some really great content on YouTube, but it
57:15
was you know about the aging process and going into like you
57:21
know when people die if they don't have a living will like.
57:25
Someone can decide, like keep this person alive for as long as
57:28
possible, and they're, they're a vegetable in a bed for five,
57:31
five years or whatever until there's nothing that can be done
57:35
to keep them alive anymore. So I know I don't want to be
57:37
there, right? I don't.
57:39
I also see, like, people in the nursing homes that just like
57:43
staring off into space. I don't want to be there.
57:45
So I want to live life to the point where I'm enjoying life.
57:52
And I think everybody has to kind of like assign to assign
57:57
meeting to like, yes, that's the kind of life I want to live or I
58:00
don't want to live that kind of life.
58:01
I don't know. But leave it to me to take the
58:05
lighter note and bring it there, Jeff.
58:08
Yeah, you're you're you're a real expert at that.
58:10
I was going to say I could pull a Seinfeld and like, you know,
58:12
grab the pillow And when you say it's ready, okay.
58:16
You know, put it over the face like, all right, we had a good
58:18
run, Jim. Years and one day.
58:21
I'm like, I set my calendar now. All right, here's a bonus
58:25
question. Let's see if we can try to
58:26
revive the lighter part of it. There's a lot of different items
58:30
out there where people are trying to live longer and with
58:32
the expectation that something in the future might help them.
58:34
And I'm thinking specifically on things like cryogenics, right?
58:38
There's, I don't know, Arizona or something like there's a a
58:40
warehouse full of people who have been frozen.
58:43
With the hopes that it's someday they'll be able to be woken up
58:45
to cure whatever, you know, issue that they had.
58:48
Some people, it's their entire body.
58:49
Some people, it's just the head, which I find kind of creepy and
58:53
very Futurama to some degree. Would you consider that?
58:58
I don't. I don't think I would.
59:01
I mean it's it's those things where again it's it.
59:06
Maybe it'll work. That's possible.
59:08
But you know, well, I guess maybe another good question is
59:13
like, yeah, would you upload your consciousness if you could,
59:15
Would you upload that into the computer?
59:16
Or just, you know, just save it as a backup somewhere?
59:20
Maybe I would do that somehow. That seems a little less creepy,
59:22
but when I think about it, it's probably just equally creepy.
59:26
Jim would you freeze yourself or I was thinking personally too
59:29
like that the you know the the Jeff A I right, the backing up
59:33
your personality somehow right where it's it's good but.
59:37
Would you? I wouldn't do that, but I I want
59:39
to. Store a few things out there,
59:41
some some such a an expert on this topic.
59:44
One is I think from like a supplement perspective, should
59:51
be taking vitamin D3 every day and in concert with vitamin K2.
59:57
I also think that there is a supplement called N acetyl, L
1:00:03
cystine or N A/C for short. It's very cheap.
1:00:06
It's. It's one of the.
1:00:08
The great advances and great findings in the area of
1:00:12
longevity. So check those out.
1:00:15
Do a little research, Watch longevity videos.
1:00:18
Man, there's so much out there. But it is another rabbit hole.
1:00:21
We're not a medical show. I take my Col. system is cheap.
1:00:26
I don't think anybody's making a lot of money on that.
1:00:29
Yeah, I'll make my pitch for fish oil too.
1:00:31
Like I have a hard time eating enough fish.
1:00:33
I think that's that's one of the best.
1:00:36
Best researched and most clear advantages you know.
1:00:39
Get your get your Omega 3S, take a take a couple tablespoons.
1:00:42
It's good for you. Agree on that.
1:00:43
I want somebody to create the brownie sundae that is healthy,
1:00:48
that I can eat a lot of. Then I'll be a happy person.
1:00:51
Nice. So Jeff, do you want to be
1:00:52
frozen or what? I don't know if I would be
1:00:54
frozen, but this idea of being able to somehow come up with
1:00:57
sort of an AI intrigues me. I would do that.
1:01:02
I think that would be interesting.
1:01:03
I think I would like to do it while I'm still alive to see how
1:01:06
it would work and kind of tune it right.
1:01:09
I don't know what would go into it other than, you know, I mean
1:01:12
at some point I'm guessing somebody could take all these
1:01:15
episodes we've done 200 + 231 I think is this one.
1:01:20
That's a lot of audio content that kind of shows, Jim, you and
1:01:23
I are personality and at least with, you know, the one that we
1:01:26
put out on the podcast, somebody could very easily take that,
1:01:30
dump it into a large language model and.
1:01:32
Create a, you know, replica based on what it understands.
1:01:37
I'm sure you know. Obviously there'd be gaps and
1:01:38
stuff like that, but I don't think it's too far off where you
1:01:41
know you'll be able to talk to yourself or a famous person,
1:01:45
right? Or whatever it may be where
1:01:47
there is enough audio or written or visual content that can be
1:01:52
consumed to create something. Well, then you just need to ask
1:01:56
Alexa to start recording all your conversations.
1:01:58
And you'll have more. There'll be more data.
1:01:59
Isn't she already doing that? I don't know.
1:02:01
I guess I thought that was already par for the course.
1:02:04
All right, let's go ahead and wrap up for this week.
1:02:06
Rich, thank you so much for being part of this.
1:02:08
It was a great conversation. We're gonna have links in our
1:02:11
show notes to a whole bunch of different stuff.
1:02:13
We'll have links to Rich on LinkedIn so you can connect with
1:02:17
him. Ask him questions.
1:02:18
Compliment him on his radio pipes, you know, whatever it may
1:02:20
be, we'll have a link to vasa.com VEZ a.com so you can
1:02:25
learn more and more about what those guys are sold over there.
1:02:29
We'll have a whole bunch of links to all the different
1:02:30
conferences that Jim and I mentioned.
1:02:32
Identity Week America, Octane Authenticate Conference.
1:02:35
We've got a bunch of discount codes.
1:02:37
If you're planning on attending any of those, use our codes.
1:02:40
They should be the best. And it also shows support for
1:02:42
the show, that sort of thing. And you can find us on the
1:02:45
Internet. Idacpodcast.com We're on Twitter
1:02:49
or X or whatever at IDAC podcast We're on Mastodon at IDAC
1:02:53
Podcast at infosec dot exchange. Of course we're in all different
1:02:57
podcast stores, like subscribe, all that good stuff.
1:02:59
That's what it keeps. Jim and I encouraged to keep
1:03:02
Keep this thing running along. Share it with a friend, share it
1:03:04
with an enemy. Don't care.
1:03:05
As long as someone's listening, we'll keep doing our thing.
1:03:08
And Jim, I didn't tell you this yet, but I am working on
1:03:11
figuring out how we get on YouTube.
1:03:13
So YouTube has made some podcast announcements recently, and so
1:03:16
I'm starting to slowly upload hundreds of episodes when I get
1:03:21
time. To have them on YouTube at some
1:03:23
point as well. So not ready yet, but it's
1:03:26
coming. It's in the future.
1:03:28
And I did recently create find a way LinkedIn page for the show.
1:03:31
I think right now you and I are the only people on it, but I'm
1:03:32
starting to tag it and sort of build it out and figure out how
1:03:35
that all that stuff works. So there we go.
1:03:38
All right, we'll leave it there for this week.
1:03:40
Thanks everybody for listening. And we'll talk with everyone in
1:03:43
the next one. You've been listening to
1:03:45
Identity at the center. We hope you've enjoyed the show.
1:03:50
Make sure to like, rate and review and we'll be back soon.
1:03:54
But in the meantime, hit the website at
1:03:56
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:04:04
See you next time on identity at the center.