Latest / Identity at the Center / #267 - PAM & IGA with Paul Mezzera

Transcript

#267 - PAM & IGA with Paul Mezzera · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with
• 0:10
  IAM, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Stedman. Welcome to the Identity at the
• 0:23
  Center podcast. I'm Jeff and that's Jim.
• 0:25
  Hey, Jim. Hey, Jeff, how are you?
• 0:27
  Oh, that's a bad yourself. Good, good.
• 0:28
  I spent an hour on the phone this morning with an old friend
• 0:32
  of ours, Episode 100. Do you remember who our guest
• 0:36
  was for episode 100? Was that our friend Victor?
• 0:41
  It was our friend Victor Barris, Co founder of identropy, hired
• 0:46
  the two of us into this identity consulting space.
• 0:51
  It's. His fault that this that this
• 0:53
  has happened, but that way. It's all his fault.
• 0:56
  He's a contributing factor. But I also feel like he probably
• 1:00
  won't hear this, because I what I realized was that he hasn't
• 1:03
  been following, downloading every episode and listening.
• 1:06
  But yeah, I told him, you know how much the podcast has grown?
• 1:11
  How many people are listening worldwide that were getting
• 1:14
  voicemails or getting messages from folks?
• 1:17
  It's been truly like rewarding for both of us I think and also
• 1:24
  I mentioned about how we're doing these sponsor Spotlight
• 1:27
  podcasts and certainly we're not getting rich from it.
• 1:30
  But the idea that you know we're able to bring in, bring in folks
• 1:36
  from companies, they sponsor the episode and we're able to you
• 1:41
  know talk to them about their solution.
• 1:44
  And I think what's great about that, it's kind of like an
• 1:47
  initial sales call. You get to kind of like if
• 1:51
  you're a listener, you get to figure out like, OK, this is
• 1:54
  either something I want to learn more about or something that's
• 1:57
  not a fit for me. And I got enough information I
• 1:59
  can move on. Either way, I think you get
• 2:02
  value. Yeah, I think I was saying about
• 2:05
  this the other day and I think I think you and I were talking is
• 2:06
  like we need to have like a like a like a standard like first
• 2:10
  three questions or something like that like OK who are you,
• 2:13
  what do you do and what do you want?
• 2:15
  It's something like that that kind of like you know help Dr.
• 2:18
  awareness. Obviously you know all of our
• 2:19
  sponsors are looking for different things out of it, but
• 2:21
  for the most part it's just awareness.
• 2:23
  I think there's so many tools in this space it's very difficult
• 2:26
  to keep up and being able to you know have folks on and actually
• 2:29
  get into a technology. It is kind of like having that
• 2:31
  first demo call or or something like that right where you know
• 2:35
  maybe we take the brunt of it. Operation Human Shield, they
• 2:38
  don't, you don't you don't have to give up an e-mail address
• 2:40
  right away. They can kind of hear about the
• 2:41
  product and then get into it later if they if they like it.
• 2:44
  And we've been really fortunate. I think we've had some really
• 2:46
  cool, some really cool you know vendors come on and kind of talk
• 2:49
  about their solutions but we've got some you know some ones in
• 2:52
  the pipeline that that are very cool as well.
• 2:54
  So it's good to. You know, I kind of feel like
• 2:58
  part of my day job is anyway like learning about products.
• 3:01
  So when we do have a sponsor spotlight where you know, that
• 3:05
  solution is, I mean that's like every time it's like something
• 3:10
  that I learn from it, like I learn about their solution and
• 3:13
  it becomes part of, you know, our bag to walk around with.
• 3:17
  Yeah, I mean, I like it. I we'll keep you longer and fine
• 3:20
  as well. As people find value, I think
• 3:22
  the feedback has been overwhelmingly positive from the
• 3:25
  handful of people that I've actually pulled in real life.
• 3:27
  I say, hey, did you listen to that?
• 3:27
  What'd you think? What could we do better?
• 3:29
  Right. Gotten some ideas like that.
• 3:31
  So if I've asked you for feedback and you've answered, I
• 3:33
  do appreciate it. If you have feedback out there,
• 3:36
  hit us up on LinkedIn. So just send a note to Jim or I
• 3:38
  and let us know what you like or don't like or or use our
• 3:40
  whatsoever. We but we the whole point of it,
• 3:42
  right, is for it to be 1 valuable and two, not really a
• 3:48
  commercial kind of environment, right?
• 3:49
  It's a conversation, but we're able to get in a little more
• 3:51
  detail around stuff like that and hopefully it's entertaining
• 3:54
  enough that people don't turn it off.
• 3:56
  Yeah, you know, I think the other way that I wind up doing
• 3:59
  my research about solutions that are out there is YouTube.
• 4:04
  I've been also watching a lot of YouTube's from conferences,
• 4:08
  YouTube's about products and you know, now I've got YouTube
• 4:12
  Premium, so I don't have to watch any ads.
• 4:15
  It's fantastic. I love it.
• 4:17
  But it's it's not cheap as I think it's like 19 bucks a
• 4:20
  month. I mean, but it's, I mean shirts
• 4:24
  are what the value you get out of it.
• 4:25
  I feel like it's the best streaming service.
• 4:28
  I mean, I know you get YouTube for free, but yeah, no ads.
• 4:31
  It's great. And the music is just kind of a
• 4:34
  bonus on top of it. I already have like 8 different
• 4:35
  music surfaces. I don't need another one, but I
• 4:38
  watch YouTube enough where that's the one that's like, Oh
• 4:41
  yeah, that's like a Nova Raider. Definitely going to keep that
• 4:44
  one. Definitely worth it.
• 4:47
  You know, I I kind of had some fear of missing out on the
• 4:51
  Gartner conference in London this week, and watching the
• 4:55
  updates that I've been seeing on LinkedIn definitely missed out.
• 4:59
  But we're not going to be missing out on many of the US
• 5:02
  conferences. No, we got a a bunch coming up
• 5:04
  and fortunately we have partnered with several of them.
• 5:08
  So we've got discount codes. So we've got things like
• 5:10
  Identiverse coming up that's May 20. 8th to 31st.
• 5:14
  That's at the Aria Resort and Casino in Las Vegas.
• 5:17
  It was there last year. It's an awesome location.
• 5:19
  We've got discount code and if you use the code IDV 2 four dash
• 5:24
  IDAC 25, I know totally rolls right off the tongue, gets you
• 5:28
  25% off of your registration. It's stacked with early bird, so
• 5:32
  the sooner you use it the better.
• 5:35
  Again, IDV 24, DASH IDAC 25. You don't need to remember it.
• 5:40
  I mean, bonus points if you do, but it'll be in our show notes
• 5:43
  so you can take a look there. And I actually got to put a
• 5:45
  couple banners up on our website to to promote that too.
• 5:47
  I haven't done that yet. Maybe.
• 5:48
  Maybe I'll get around to that this weekend, but that's one of
• 5:51
  them. So we've got identiverse, May
• 5:53
  28th, 31st. Make sure you register, use the
• 5:56
  code. Let's see what else you get.
• 5:58
  CPE credits. Book your room, too.
• 6:00
  Book your room. Yeah, you don't want to be that
• 6:02
  guy who has to like walk 2 miles in in Vegas to like get to where
• 6:07
  you're near me. You always stay at the hotel of
• 6:10
  the conference. That's the pro tip.
• 6:12
  Vegas is enough walking that you don't need to be, you know,
• 6:14
  walking extra. You're going to be walking a
• 6:16
  plenty just going from your room in the area and all the way to
• 6:19
  the back corner. Yeah, that was always funny with
• 6:23
  with Caesar's. You could stay in Caesar's but
• 6:25
  you'd have to walk 2 miles. Fortunately it was all indoors,
• 6:29
  but I mean to get to the different rooms, it was not a
• 6:34
  not to be taken for granted. You couldn't leave your room and
• 6:36
  be in a a session in 2 minutes. That's that's just not going to
• 6:40
  happen. No, that's not happening.
• 6:43
  Not happening at all. That's Vegas for you, though.
• 6:45
  I like Vegas. I'm looking forward to it.
• 6:47
  We have another conference we're gonna hit later this year.
• 6:50
  Identity Week, America, actually the whole Identity Week series,
• 6:53
  whether you're going to Europe, which is in Amsterdam, June 11th
• 6:56
  and 12th, the one in America and Washington DC that's the one Jim
• 6:59
  and I, you know I'll be at, that's September 11th and 12th
• 7:02
  or the one in Asia which is in Singapore, October 22nd, 23rd.
• 7:06
  The code IDAC 30 gets you 30% off, a lot easier to remember.
• 7:11
  So that's kind of cool. But again, we'll have a link in
• 7:13
  our show notes for people to check out as well.
• 7:15
  But I was at that one last year, I hosted a panel.
• 7:18
  We had actually kind of an All Star panel that we docked things
• 7:21
  and I think we're looking to do the same thing again this year.
• 7:23
  So I'll be hosting some sort of panel to be determined and then
• 7:28
  we'll also be doing podcasty things and of course you know
• 7:30
  both conferences will be doing podcasty things, but hopefully
• 7:33
  people take advantage of the of the discount codes and yeah,
• 7:36
  book those hotel rooms early and often.
• 7:41
  And our our guest for today is somebody that I think we met at
• 7:45
  conference through the conference circuit a while back
• 7:48
  and very glad to have him here with us tonight.
• 7:53
  Yeah. And by the way it is tonight.
• 7:55
  We're recording Friday at at this point, it's 7:38 PM on the
• 8:00
  East Coast. So love of the game, right?
• 8:03
  Love of the game. I'm in a hotel in New York City,
• 8:06
  relatively close to Times Square, so it's kind of scene
• 8:09
  setting for you. I'm in a hotel room.
• 8:10
  I'm about 10 floors up. I don't know if how peaceful
• 8:14
  this is going to sound for me on a recording standpoint because
• 8:17
  it seems like there is a awful lot of activity with Times
• 8:19
  Square guests outside the window.
• 8:21
  Sirens, people, noise, whatever, AB, I'll do my best to clean up.
• 8:25
  But hey, just think of it as like, hey, you know, you're on
• 8:27
  location and the exciting world of consulting, travel and, you
• 8:32
  know, recording a podcast in your room on a Friday night in
• 8:34
  the hotel. Sounds exciting.
• 8:36
  Sounds thrilling, right? That's what everyone looks
• 8:38
  forward to. All right, why don't we get to
• 8:39
  our guests? He's been patiently waiting in
• 8:42
  the wings. He's been with us before.
• 8:43
  His name is Paul Mazzara. Identity enthusiast at large.
• 8:47
  Welcome back to the show, Paul. I'm really glad to be back guys.
• 8:50
  Very nice to be here. Well, thanks for taking the
• 8:52
  time. I know it's a Friday night here
• 8:54
  for us in the East Coast. I think you're on the West
• 8:56
  Coast. It's a little bit earlier for
• 8:57
  you. So we'll try to get you out so
• 8:59
  you can enjoy your weekends. The last time you were here with
• 9:02
  us was Episode 190 and that was November of 2022.
• 9:07
  So roughly about a year and three months ago for us, we
• 9:10
  talked about identity, governance, not going to ask you
• 9:13
  to tell a story, the story. If people want to find that out,
• 9:15
  go back, listen Episode 190, we'll be right here when they
• 9:19
  come and then come back and pick it up from here.
• 9:21
  I guess what's new, What's been happening in the last, you know
• 9:23
  year and and plus a few months? Yeah, definitely.
• 9:27
  Yeah. So I'll save people maybe from
• 9:29
  having to listen my whole sob story from before.
• 9:31
  But yeah, I mean, originally, you know, I've been doing IAM
• 9:35
  for many, many years. And then had a great time at
• 9:38
  Gartner and then I was at last time when we recorded I was at
• 9:41
  Savient doing product and market strategy.
• 9:44
  And since then I left Savient and started doing a bit of
• 9:49
  consulting with the company called Lionfish Advisors.
• 9:53
  And basically that's was around you know having consulting and
• 9:59
  helping tech, tech companies. So it was basically, you know,
• 10:04
  providing some thought leadership and an advisory to
• 10:07
  them. But then shortly after I decided
• 10:10
  I gotta go back to something a little more full time and I
• 10:14
  joined University of California, Davis.
• 10:17
  And so I've been leading and I didn't access management and
• 10:20
  actually I was leading a collaboration and messaging
• 10:23
  team. So all the electronic mail
• 10:26
  storage, Google box, all the great stuff that everyone needs
• 10:30
  to do to their job. So head several teams there that
• 10:35
  that you know running a team of about 20 people.
• 10:38
  So you probably have seen some of the posts of looking for
• 10:40
  some, some supervisors as well. So you know, so a lot of
• 10:45
  management kind of responsibilities, but kind of an
• 10:47
  exciting time over there as we're kind of modernizing our
• 10:50
  IAM platform there. So then we'll get to chat about
• 10:53
  that a little later. Yeah, the the higher Ed space is
• 10:56
  so fascinating and definitely want to dive into that with you.
• 11:01
  As Jeff mentioned, we talked the identity, governance and
• 11:04
  administration last time you're on.
• 11:08
  But really what I wanted to hopefully pick your brain on a
• 11:11
  bit today is Privileged access management keeps coming up my
• 11:15
  day job. It feels like it's kind of where
• 11:19
  the industry at large is starting to say OK we we're in a
• 11:23
  pretty decent position from single sign on and MFA
• 11:28
  perspective. You know we've got our arms
• 11:31
  around and maybe we're mid deployment of governance, but
• 11:36
  Privileged Access Management, we we need to have a strategy and
• 11:40
  The thing is like it's not like you can just easily go online
• 11:44
  and say all right, I got it all figured out.
• 11:46
  So generally you need to bring in some some expertise, some
• 11:50
  people who've worked with Privileged Access Management.
• 11:54
  But I think the that you know the underlying to all that is
• 11:58
  that the space is rapidly evolving and I'm wondering if
• 12:03
  you can kind of share what do you think is driving this
• 12:07
  change, this evolution that's happening so quickly?
• 12:10
  Yeah, definitely. I mean I think back to kind of
• 12:13
  the beginning days of privileged access, you know maybe in the
• 12:15
  early 2000 or so we're dealing with a lot of on Prem
• 12:18
  infrastructure, right. So and really trying to protect
• 12:22
  those crown jewels, which in most cases when there's any kind
• 12:25
  of a compromise, you know that's really the end game is to get a
• 12:28
  privileged account, right. So these these are definitely
• 12:31
  the crown jewels of the organization and and through
• 12:34
  that and through you know a lot of different breaches and such.
• 12:39
  Now Csos are top of mind. I mean we need a privilege
• 12:42
  access management strategy and solution in place and or maybe
• 12:46
  even in some cases can't even get cyber insurance unless you
• 12:49
  have privilege access management.
• 12:51
  So definitely the game is, is got as the game is a higher game
• 12:55
  to play. Now with Pam it's more critical,
• 12:59
  but I'd say what's changing it is you know this move to the
• 13:02
  cloud, right. So when I was at Gartner, we
• 13:04
  talked about CIAM, which is the cloud infrastructure entitlement
• 13:07
  management and that was about, you know, how do you manage the
• 13:12
  thousands and maybe millions of entitlements that say AWS, you
• 13:16
  know, exposes through in their services and there's just no
• 13:20
  humanly way possible to manage those.
• 13:22
  So back in the day at the beginning, it privilege access,
• 13:25
  maybe you had a, you know, jump server, you had a Windows
• 13:27
  Server, a Unix server, you know, you had probably a manageable
• 13:30
  number of entitlements and people that you can manage is
• 13:33
  probably something you can, you know, point and click and assign
• 13:36
  people and do that. But it's just I think it's not
• 13:40
  possible any longer to do that. So we need some new solutions
• 13:43
  that'll that'll automate a lot of that.
• 13:46
  And I think that's where the Kim kind of comes in at least to to
• 13:50
  at least give you a visibility of what entitlements should or
• 13:53
  shouldn't be there. Of course I don't.
• 13:54
  I don't see that as Pam, but it's, it is privileged access to
• 13:58
  management to some extent because all those entitlements
• 14:00
  are privileged, right? You're kind of sneaking into my
• 14:04
  next question with that last part.
• 14:06
  But First off, I had that issue. So it's Kim or Keem, and on what
• 14:11
  authority do you make that distinction?
• 14:14
  I had this debate with Enrique Teixeira and he wanted to call
• 14:18
  it Paige. And we said, well, that sounds
• 14:20
  too much like some famous person.
• 14:22
  And so we said, well, Kim is the cloud infrastructure and talent
• 14:26
  management. Yeah, we kind of dubbed it Kim,
• 14:28
  you know, even though it's not kind of spelled that way.
• 14:31
  But that's how I've always, you know, pronounced it.
• 14:35
  But. I think either way you go,
• 14:37
  you're going, you're going to sound like some famous person.
• 14:39
  So, OK, so I kind of started off with this, like, dialogue about
• 14:45
  how Privileged Access management is expanding, and I wanted to
• 14:50
  bounce a few different tools that are, you know, probably all
• 14:54
  worthy of their own space. But I'm going to phrase the
• 14:59
  question like this. If you were as a practitioner,
• 15:03
  which you are, we're putting together a Pam strategy with
• 15:10
  these things be in your Pam strategy, are they, you know,
• 15:14
  and I'm only going to give you an option of yes or no, OK.
• 15:19
  So the first one is that's going to be tough because.
• 15:22
  I always like to say it's depends, right?
• 15:23
  But OK, I'll try. You I'll try my you can go into
• 15:26
  your you can try and soften it but I want a black and white to
• 15:29
  start itdr. So this part of your Pam
• 15:34
  strategy, right, right. I would say yes to some extent.
• 15:38
  Yeah, I'll explain. I'll explain why, but I'd say
• 15:40
  yes. OK, go ahead, explain.
• 15:43
  Oh, OK. Didn't know if you're going to
• 15:45
  just give me the. Yeah, no, no.
• 15:46
  You can say yes or no and then you can go right into it.
• 15:48
  That's cool. Yeah, because I was thinking of
• 15:51
  ITDR. And actually the beginnings of
• 15:53
  ITDR is really about attacking the identity infrastructure,
• 15:57
  right? That's really what ITDR was born
• 16:00
  out of that. It's like you know,
• 16:01
  unfortunately I don't want to name specific vendors, but where
• 16:04
  they were attacked and they were able to mint SAML tokens and
• 16:07
  Oauth tokens and basically you're attacking the identity
• 16:10
  infrastructure, right. So that's the identity threat
• 16:13
  detection at a response and to me privileged access management
• 16:17
  tools have always done some element of this in terms of
• 16:21
  recognizing when either tokens, you know where you have a a
• 16:25
  golden ticket created in your Active Directory, things like
• 16:28
  that. So I would think any kind of a
• 16:31
  Pam privilege access strategy should include some sort of
• 16:34
  threat detection and response. So maybe not a ITDR separate
• 16:38
  tool, but some element of threat detection and response.
• 16:42
  Jeff, do you want to weigh in on this?
• 16:43
  I mean, did Paul get it right? Oh, he gave the the classic
• 16:48
  depends answer. So, you know, as a consultant
• 16:50
  I'm, I'm sitting here cheering like, yeah, it depends.
• 16:52
  Yeah, I mean, sure, right. I think why wouldn't your
• 16:57
  strategy include as many tools and options as as you possibly
• 17:01
  could? Well the answer is probably
• 17:02
  money. It's probably with the reason
• 17:04
  why it's not there. But I feel like ITDR is
• 17:07
  definitely having a moment in Sun for the last couple years
• 17:09
  Now I've I've, I've talked about this before and and Paul I don't
• 17:13
  know if you and I have talked about this but I feel like ITDR
• 17:15
  is sort of the the evolution of what UBA and what UEBA was maybe
• 17:20
  a decade ago. It was this whole idea of
• 17:22
  collecting signals and then doing behavior analysis and cool
• 17:26
  identity things. But I feel like UBA of 10 years
• 17:30
  ago was a little bit ahead of its time because there weren't
• 17:33
  automation things in place yet for a lot of organizations.
• 17:35
  People were still discovering IGA, people were still
• 17:37
  discovering the basics of Pam, like things like that.
• 17:40
  Now I feel like we're, you know, about 10 years later, a lot of
• 17:45
  organizations have kind of cracked that.
• 17:46
  And now they actually have the tools to take advantage of that
• 17:49
  ITDR functionality to say, oh, OK, if you detect this, signal,
• 17:52
  this threat, you know, go do something about it rather than
• 17:55
  just tell somebody about it. Exactly.
• 17:59
  I kind of feel like that's the promise of ITDR and the ability
• 18:05
  to execute what's really going to come down to I think there's
• 18:09
  it's having a stay in the sun and that day in the sun will
• 18:12
  continue as long as that reality gets met and it becomes more
• 18:17
  platforms that are included and gets better at detecting those
• 18:22
  things that are happening at that layer 7 rather than layer
• 18:26
  three of the OSI model. So I I'm very hot on it right
• 18:31
  now. And in terms of whether or not
• 18:34
  as part of a privilege access management strategy, I think
• 18:36
  absolutely, if you're able to detect a breach while it's
• 18:40
  happening and take a, you know, make a response, in other words,
• 18:46
  disable an account or do something that will thwart that
• 18:50
  event, I mean, what better tool can you have?
• 18:54
  So definitely I think too. Yeah, I think too in terms of
• 18:58
  I'll just say nothing about IT and R which which is cool is it
• 19:01
  just it's putting identity at the forefront there, right,
• 19:04
  where UEBA maybe wasn't so much, I mean it was very much joined
• 19:09
  at the hip with your SIM tool, right.
• 19:11
  And kind of general you know kind of information event
• 19:17
  management and and it was meant really to cut the noise of all
• 19:20
  the different alerts you get in your in your SIM tool.
• 19:23
  That's really what the value prop was.
• 19:25
  And so I think it's great that the, you know, the identity
• 19:28
  piece has been kind of you know, highlighted because identity is
• 19:32
  actually as we've been hearing is you know key to security,
• 19:36
  good security posture, right. So, so definitely I think ITDR
• 19:40
  is an important thing. You know, whether it's going, it
• 19:44
  remained kind of a its own thing or it be part of a a larger, you
• 19:48
  know, ecosystem of components, who knows?
• 19:53
  OK, so I'm going to change the format of the question because
• 19:57
  now I want to shift because I I really didn't want you to say no
• 20:00
  to ITDRI, right? That was my motivation.
• 20:04
  But now I want you to tell me whether or not you think these
• 20:07
  things are Privileged Access Management or they are something
• 20:11
  completely different. And I'm going to go to that
• 20:14
  example of Kim that you brought up earlier, cloud infrastructure
• 20:18
  entitlement management, Pam or not Pam?
• 20:21
  I think it is Pam because most of those infrastructure, cloud
• 20:26
  infrastructure entitlements are privilege entitlements.
• 20:29
  So I think fundamentally that is Pam.
• 20:32
  But actually when we've named this, we said entitlement
• 20:35
  management. So it sounds like IGA, right.
• 20:37
  So so it it's it's, you know, you can go either way on this.
• 20:43
  But given this privileged, I think it's important that you
• 20:47
  know with privileged access it's all about identifying the
• 20:49
  privileged accounts, you know, making sure that the right
• 20:52
  people have access to those accounts or not and be able to
• 20:56
  identify if those accounts are being, you know, used properly
• 20:59
  or compromised, right. So, you know, I think Kim
• 21:02
  addresses some of those things. So I I look at it like I'm
• 21:05
  taking a test. Cloud infrastructure entitlement
• 21:08
  management, cloud infrastructure entitlements, who's going to
• 21:12
  have cloud infrastructure entitlements, probably an admin
• 21:15
  of some sort. So I'm in the Pam camp as well.
• 21:18
  Cloud infrastructure entitlement leads me to believe that you're
• 21:20
  talking to, you know, Azure admin, AWS admins, GCP admins,
• 21:24
  you know, X cloud, whatever we're calling it and you know
• 21:26
  admins. So that's the way I look at it.
• 21:28
  So I'm looking at it like from a test taking perspective as the
• 21:31
  nerd I am, it's it's cloud infrastructure and the
• 21:34
  entitlements that go with that Pam final answer.
• 21:38
  Yeah no I'm I'm I'm good with that answer as well.
• 21:42
  Let's move to the next one DevOps secrets fault.
• 21:46
  And bonus question to this or you know, 1A is OK DevOps
• 21:52
  secrets fault and is there differentiation between
• 21:56
  different secrets vaults or is whatever suite you're running
• 22:00
  you just use that? Yeah, I mean a secrets vault.
• 22:04
  I mean secrets are really privileged, yeah, they're
• 22:07
  they're almost the same as privileged accounts, right.
• 22:09
  They're just kind of the kind of the cloud version, right.
• 22:13
  Or the, you know, probably more in the context of your
• 22:17
  Kubernetes and different cloud native technologies that use
• 22:22
  secrets, right. So I I definitely think that's
• 22:26
  part of Pam. You know, although you know Pam
• 22:29
  tools had not traditionally done a good job managing those
• 22:32
  secrets, but I think they've come a long way now, you know to
• 22:35
  to being able to do that. So yeah, those are privileged
• 22:38
  accounts and so therefore those must be protected, just like
• 22:42
  your other, you know, passwords and credentials in your password
• 22:46
  vault, so to speak. OK.
• 22:51
  Endpoint privilege management, which I guess that's kind of
• 22:54
  built into the name, but what we're talking about here is
• 22:57
  managing administrative access to your laptops and desktops.
• 23:03
  I mean is that is that Pam or is that desktop management or
• 23:08
  something else? Yeah.
• 23:09
  And again I think you you think about it either from the people
• 23:12
  process part of it, you may not have your Pam person or group
• 23:17
  managing your desktop, you know the privileges.
• 23:19
  But I do still think that it is privilege access because in many
• 23:23
  cases you have your built in administrator account and your
• 23:28
  you know your your laptop and so and employ privilege management
• 23:32
  tools. What they do is they you know
• 23:34
  manage those credentials, they allow you to kind of just in
• 23:37
  time you know elevate your your non privileged account to a
• 23:42
  privileged account so you could do something on your machine.
• 23:45
  So definitely those and actually my experience has been that this
• 23:49
  is a real hot item for compliance for Csos and those
• 23:54
  who are worried about breaches because words where does
• 23:59
  breaches start, you know at the end point and a privileged
• 24:02
  account on an end point could easily be traverse and you know
• 24:06
  assume the privileges of other you know possibly server level
• 24:11
  accounts so. Yeah, it's definitely an
• 24:14
  expensive problem to solve. What do you think, Jeff?
• 24:16
  Well, I mean, it's admin privileges again, we're talking
• 24:18
  about it, I guess. Why wouldn't get me?
• 24:20
  I mean, we're talking about ransomware.
• 24:22
  And you know, if you've got admin privileges on your
• 24:24
  machine, guess what? Install whatever you want and
• 24:28
  cause that problems. Most organizations probably want
• 24:30
  to shut that down. So yeah, you want admins to
• 24:33
  control that sort of thing. So again, Pam, final answer.
• 24:36
  OK. So it seems like Jeff, your
• 24:40
  dividing line is admin, it's Pam, not admin.
• 24:45
  We'll see. And when I say we'll see, brings
• 24:48
  me right to my my last one, social media account management.
• 24:54
  So in other words, you are a big sports league or a big, I don't
• 24:59
  know, media company or something like that.
• 25:02
  You've got Twitter accounts, you got Facebook accounts, Instagram
• 25:05
  accounts, yadda, yadda yadda. How do you manage those?
• 25:08
  How do you make it so that those don't fall in?
• 25:12
  I mean, you could probably do just as much damage to a a
• 25:15
  company like that with their Twitter account as you could if
• 25:19
  you got certain types of admin accounts.
• 25:23
  So social media account management, Pam or not Pam?
• 25:27
  I think it's Pam. I I think so.
• 25:31
  I mean now I'm thinking of it in the general term, right.
• 25:33
  So whether it's be part of a Pam tool or I mean that's the whole
• 25:37
  other debate, right. It's who's you know, maybe
• 25:39
  they're specialized tools to that that are more business
• 25:42
  friendly for for to safeguard those accounts or maybe that
• 25:46
  could be on a you know, platform by platform basis, you know,
• 25:49
  maybe Twitter might have a a certain kind of cool admin way
• 25:53
  to protect those. But yeah, I agree.
• 25:55
  I think those accounts in the wrong hands can what, damage the
• 25:59
  company's reputation, right? So those are privileged accounts
• 26:01
  in my opinion. Jeff.
• 26:03
  Yeah, I mean, yeah, absolutely. I've been, I've been thinking
• 26:06
  Tam has applied for social media accounts for, for years now.
• 26:10
  I'm not hesitant to say that. I feel like, you know, I've been
• 26:13
  saying this for about 5 years now talking with companies that
• 26:16
  we work with and say, hey, what are you doing about your social
• 26:18
  media accounts? I wouldn't even qualify it for,
• 26:21
  you know, if your company is public facing and sports leagues
• 26:25
  and things like that. Any company, if you have an
• 26:27
  online presence and you're and you have people that have access
• 26:30
  to your social media accounts that can do damage to your brand
• 26:35
  that is privileged access. You might you might not be an
• 26:39
  administrator in the truest, not truest in the traditional sense
• 26:43
  of like infrastructure, but you're probably an administrator
• 26:47
  of your social media service, LinkedIn, Facebook, Twitter, X,
• 26:51
  whatever it's called now, by the time you listen to the most
• 26:53
  right things like that is you're still an administrator.
• 26:56
  And I feel like brand reputation damage should absolutely be at
• 27:02
  the thought, at the forethought of of people thinking about
• 27:04
  this. And I feel like this is an area
• 27:06
  where Pam vendors have absolutely failed.
• 27:09
  I don't know one out there that has actually thought about
• 27:13
  social media accounts and how we're going to protect them as
• 27:16
  part of their overall solution. They might have a partnership or
• 27:20
  something like that. But you know, I'll call out, you
• 27:22
  know, a cyberarch, A delineia, a Beyond Trust.
• 27:25
  Where are their Privileged Access Management capabilities
• 27:27
  for social media accounts? I don't think they exist.
• 27:30
  I'm happy to be wronged. If I haven't tell me, but I
• 27:33
  haven't seen it yet. I feel like that's an untapped
• 27:35
  area that really needs a lot of exploring and figuring out,
• 27:39
  especially as we move organizations, move more into
• 27:41
  the cloud and take advantage of things like that to promote
• 27:44
  their brand or even provide services.
• 27:46
  I mean, you can go to the Delta app and use chat message, right,
• 27:50
  to get help, you know how? How good the help is a totally
• 27:53
  different story. But there's lots of ways to
• 27:57
  communicate with, you know, companies online.
• 28:00
  And I feel like social media is just, you know, it's like the
• 28:03
  Mariana Trench, it hasn't been explored yet.
• 28:05
  Yeah, I mean that's actually the point that I was going to make.
• 28:08
  I do think that, you know, and I do think it's somewhat dependent
• 28:13
  on the type of company. Like if you're a chemical
• 28:16
  company or something like that, a smaller company that you know,
• 28:20
  not every company, the brand is important.
• 28:23
  But if your social media account got hacked, it might not even
• 28:27
  make the nightly news. Like nobody might even care that
• 28:30
  someone put out some stupid tweet about like some chemical
• 28:34
  company. I use that as an example.
• 28:37
  Not to disparage chemical companies, but it's a lot
• 28:39
  different than if you're the New York Times or you're the
• 28:42
  National Hockey League or something like that, right?
• 28:46
  Those ones where you know people really keep their eye on, you're
• 28:51
  shaking your head. No, you don't agree.
• 28:53
  I disagree. I totally disagree.
• 28:55
  I mean, I think those are important too, but I think
• 28:58
  there's actually more damage the smaller the company compared to
• 29:01
  the larger what's the what are, what do people do?
• 29:05
  You go on Google Maps and you're looking for a tuition, a plumber
• 29:08
  or restaurant. If someone messes up your small
• 29:11
  business profile there because somebody posted something
• 29:15
  stupid, you're you have such a small pool of available
• 29:18
  customers and such. Small.
• 29:20
  Reach. I think the damage there is
• 29:22
  outsize compared to a large organization that has tons of
• 29:25
  media contacts, tons of money to kind of thwart the problem to
• 29:29
  fix their PR. You know, if you're a small
• 29:31
  restaurant and somebody writes, I don't know, we, you know, we
• 29:34
  cook, I don't know some endangered animal and serve that
• 29:38
  as meat, people are going to latch onto that.
• 29:41
  And yeah, I mean, I think, I think it's outside stripped the
• 29:46
  other way. Like I would.
• 29:48
  I would be a lot more focused if I was a smaller organization
• 29:52
  that is much more dependent on brand loyalty, brand recognition
• 29:58
  and positive images that way because I feel like you can
• 30:00
  solve a lot of things of money. The bigger the company the more
• 30:03
  money they can throw in the problem.
• 30:05
  Hey, you know we talked about Comcast.
• 30:07
  Comcast stocked forever. What did they do?
• 30:09
  Oh, it just changed our name to Xfinity.
• 30:11
  It's still the same service. They just did a rebranding.
• 30:15
  You know small organizations, smaller companies, small
• 30:17
  business, they don't have those kinds of resources to do that.
• 30:19
  So I I'm shaking my head here like, no, no, I feel.
• 30:21
  I feel the opposite, but that's my.
• 30:24
  So everyone's got both sides of the argument now.
• 30:26
  I What I was getting at though is I I definitely think there
• 30:29
  should be a policy. But there's still that
• 30:33
  technological hurdle, right? You're not going to have a
• 30:36
  privilege access management, traditional privilege access
• 30:39
  management tool, cyber architect Elenia Beyond Trust do social
• 30:43
  media, account management. If anybody out there disagrees
• 30:46
  with me, we've got a voicemail channel.
• 30:48
  We've got a way to contact us by e-mail.
• 30:51
  Feel free to hit us up on LinkedIn.
• 30:53
  But as far as I'm concerned, it's an area that I don't think
• 30:56
  anybody's solving in this privilege access management
• 31:00
  space per SE. I know like we've had folks on
• 31:03
  in the past talk about a social media platform tool, but I
• 31:07
  wouldn't say it was like a mainline privilege access
• 31:09
  management solution. OK, right.
• 31:12
  Moving on from that topic. Real quick go into to Jeff's
• 31:16
  point, yeah, probably a smaller business that would not be able
• 31:19
  to leverage you know like a full blown solution.
• 31:21
  So they're likely have to do something like making sure to
• 31:25
  secure all their accounts and multi factor authentication, you
• 31:27
  know other kind of protections to make sure that those accounts
• 31:31
  are are aren't easily compromised.
• 31:33
  Right. So and maybe even resort to if
• 31:36
  you have a shared account using you know a password vault.
• 31:39
  You know, yeah I mean for sure to say that, but you know I mean
• 31:44
  there's there's ways that small companies can can do, you know
• 31:47
  do to protect their their online accounts.
• 31:50
  Yeah. And chances they're probably
• 31:51
  even thinking about it, right, They're they're more
• 31:53
  concentrated on their product and their service and things
• 31:56
  like that. And yeah, I mean, you know, I'm
• 32:00
  not going to go to my local BBQ place and I'm pretty sure
• 32:02
  they're not running Cyber Ark or sales for any of this stuff,
• 32:06
  right. All they care about is like
• 32:07
  getting the rings out the door. Yeah, when they e-mail you, it
• 32:11
  will be a gmail.com account. All right, So I wanted to switch
• 32:16
  topics. Fall Mutual, friend of all of
• 32:20
  ours, friend of the show Ian Glazer recently posted something
• 32:25
  on the ID Pro Slack genre, which by the way, got tons of traffic.
• 32:30
  I mean, I think there were like 62 replies within a couple days.
• 32:35
  But basically the gist of it was just point to a blog post that
• 32:40
  he inked and we'll put a link in the show notes.
• 32:44
  But it was basically discussing 0.
• 32:46
  Sending privilege and least privilege and that, you know,
• 32:50
  I'm a direct quote of Ian's, is least privilege is a lie.
• 32:56
  And maybe that's what started the firestorm, right?
• 32:59
  Because it's like we've all been like, preaching least privilege
• 33:02
  for like, I don't know, I've been preaching it for 20 plus
• 33:05
  years. I didn't take offense to it
• 33:07
  personally because I think, like, you know, these kind of
• 33:10
  discussions are what make this industry interesting.
• 33:14
  How does that strike you? Yeah, I mean, yeah, Ian's a
• 33:17
  brilliant communicator and a writer, you know, so he, he's,
• 33:20
  he did all the right things on this article around, you know,
• 33:23
  putting a kind of little controversial, you know, put the
• 33:27
  statement there around, you know, I, you know that it's at
• 33:30
  least privilege is a lie. But, you know, looking at the
• 33:32
  article, I mean, yeah, he definitely says that that should
• 33:35
  not be our end goal. But obviously entitlement
• 33:38
  management is probably here to stay in many cases.
• 33:42
  And so it's a matter of maybe the new goal should be 0
• 33:45
  standing privilege and maybe that should be our ultimate goal
• 33:47
  that you know, why not you know eliminate as much standing
• 33:52
  privilege as possible, right. So you know we kind of look at
• 33:55
  it from a you know one extreme would be over privilege on one
• 33:59
  side and then zero standing privilege on the other.
• 34:03
  You know maybe at least privilege is somewhere in the
• 34:04
  middle and and so you know if zero if 0 standing privilege is
• 34:09
  just an approach to get you to reduce the number of
• 34:13
  entitlements that are your or accounts that are could
• 34:16
  potentially be exposed right. So if you could do it with 0
• 34:19
  standing privilege it's great. I just don't know if it's how
• 34:22
  practical that is for some of the like legacy systems that are
• 34:26
  out there that just require you know standing accounts to you
• 34:31
  know, I mean in the environment where I work it's all on Prem.
• 34:35
  You know we have Active Directory, we have servers Unix
• 34:38
  servers Linux servers Windows servers, Active Directory.
• 34:42
  Actually all my domain admins are, you know, I manage all that
• 34:46
  that group and you know obviously they we get reviews of
• 34:51
  you know do you need that domain account and you know what can
• 34:54
  you do. And and the challenge sometimes
• 34:57
  is that these legacy solutions don't give you that delegated
• 35:02
  administration. That's fine grained enough that
• 35:04
  you could say OK I got this you know department IT in the, you
• 35:11
  know School of Medicine or whatever in the in the
• 35:14
  university and they need certain things 'cause they got their own
• 35:17
  machines and basically I can't delegate to that fine level of
• 35:21
  of privilege. So I have to give them sometimes
• 35:25
  an account that's more privileged than than what they
• 35:27
  need, you know, So those things and obviously we do, you know, I
• 35:31
  have some guys that do a lot of programming to get around that,
• 35:34
  you know, but it's not inherent in a lot of these tools.
• 35:37
  You know, of course, like in Azure, they got PIM, so we use
• 35:40
  that and definitely you can, you know, do 0 standing privileges
• 35:45
  there. You can elevate an account for a
• 35:46
  set period of time. So yeah, definitely, I think,
• 35:50
  you know, probably as we evolve to more cloud solutions, we'll
• 35:53
  be able to do 0 standing privilege.
• 35:55
  But I just think that it's, you know, it's a lofty goal, but
• 35:58
  it's yeah, it's it's going to be a while before we all get there.
• 36:02
  I want to bounce this to Jeff because I want to.
• 36:06
  I want to throw it to. Jeff is is least privileged to
• 36:08
  lie. I don't think it's a lie.
• 36:10
  I think it's how do I describe this?
• 36:14
  Right. So it's the difference between a
• 36:17
  horse and buggy and a a car that you're driving down the street.
• 36:23
  Least privilege was what you could do with the available
• 36:28
  technology that you had at the time.
• 36:31
  Meaning we don't have automation.
• 36:33
  The only way you get to 0 standing privilege is if you
• 36:35
  have a supreme amount of automation in your environment.
• 36:39
  You're data-driven. You are attribute based, access
• 36:43
  control driven to say, hey, I need this specific entitlement
• 36:47
  at this specific time because I have this specific piece of data
• 36:51
  that tells me to do that. The vast majority of
• 36:54
  corporations and organizations out in the world do not have
• 36:56
  that level of maturity when it comes to identity.
• 37:00
  So what is your fall back line? Well, it's roles.
• 37:03
  Well, in case you need access. OK, so now we go back to the
• 37:06
  rules. OK, Well, the technology didn't
• 37:08
  exist. We didn't have the, you know,
• 37:10
  the combustion engine. So we all thrown horses right
• 37:13
  before that was we walked right. And then the wheel got invented,
• 37:16
  right and things like that. I think it's the same concept.
• 37:18
  So I don't think it's a lie. I think it's just, I think it's
• 37:21
  just a description of where you're at from a technology
• 37:24
  standpoint. That's how I see.
• 37:26
  It well, no, I think that's that's a good point.
• 37:30
  I also feel like if you're going to do 0 standing privileges, in
• 37:35
  other words just in time provisioning of access, you want
• 37:39
  to just in time provision the least privilege that's required
• 37:43
  to do the job. It's not like, oh, I need to go
• 37:46
  out and add a printer to the print server.
• 37:48
  I'd like to check out global admin.
• 37:50
  That's not necessary, right? And I know I'm, I'm creating
• 37:53
  like this totally outrageous example.
• 37:56
  But I think you want to add a printer and we should give you
• 38:02
  printer administrator rights or something, right?
• 38:05
  So and then the other thing I think is that you know, zero
• 38:10
  sending privileges philosophically speaking is the
• 38:16
  way to go. But you know from an
• 38:19
  implementation standpoint, you're not just going to flip a
• 38:21
  switch and take your thousands of entitlements and get it all
• 38:25
  to 0 standing. And you know, I think what is
• 38:28
  realistic is to pick out the high risk situation, high risk
• 38:33
  use cases and go after those. But you know, if anything that
• 38:37
  we're saying, Ian's out there listening is like like screaming
• 38:42
  at his at his cell phone or whatever he's listening on.
• 38:46
  Bring it back, Bring. Show we'd we'd love to have this
• 38:49
  conversation a little bit further.
• 38:51
  You know, I I sparked up a debate on ID Pro Slack one time
• 38:56
  too, where I brought up the whole topic of do you need to
• 39:00
  have secondary admin accounts? So specifically using the
• 39:04
  example of Active Directory, should people have
• 39:09
  administrative access using their everyday account or should
• 39:16
  they in all cases have a secondary admin account for
• 39:20
  doing? When I say all cases for doing
• 39:22
  administrative work, I feel like they should have a secondary
• 39:26
  account for doing all administrative work because I
• 39:29
  think the traditional argument has been well you don't you
• 39:33
  you're probably not going to get fished for your admin
• 39:36
  credentials. Like we all like to think
• 39:39
  phishing is for other people. Phishing is going to be the dumb
• 39:43
  person who can't see through these emails.
• 39:45
  But the reality is it's like we all have our our dumb moments.
• 39:50
  And so the the idea would be that if you're if you did get
• 39:54
  Phish on it or your everyday you would use your everyday everyday
• 39:59
  account credentials. So that's number one.
• 40:03
  I think #2 is that the. Admin accounts you can put in a
• 40:10
  separate OU and then isolate them from lower level users
• 40:14
  being able to change the credentials.
• 40:16
  So here's the scenario I'm talking about is say you had an
• 40:21
  administrative access on your everyday account and you were in
• 40:24
  the same OU as the help desk and the help desk could go in,
• 40:30
  change your password, eliminate your multi factor
• 40:33
  authentication, then go and reset your account or go and log
• 40:37
  in to your account. Now they're an administrator so
• 40:41
  they've gone from someone that you have.
• 40:44
  Give them this much trust to someone who now can run the
• 40:47
  entire domain and take over your organization.
• 40:50
  So if you're not thinking about those kind of like take over
• 40:54
  kind of paths, I think you're doing yourself a disservice.
• 40:58
  So to me, secondary accounts in a separate OU that people
• 41:03
  outside of that OU can't touch those accounts.
• 41:06
  What do you think, Paul? Yeah, I mean, I think the deep
• 41:08
  default is a secondary account. I mean, you look at even ISO
• 41:12
  27,001, I mean you look at all the frameworks and that's like a
• 41:15
  de facto, you know, policy that, you know, you can't have your
• 41:21
  daily use account to be an administrative account.
• 41:24
  So you know, I, I, I agree with you that it has to be a separate
• 41:28
  one and especially if depending on where you are on the maturity
• 41:32
  spectrum in Pam. I mean you could you know if
• 41:35
  you're able to elevate your account or use Pam tool which
• 41:39
  then that Pam tool hopefully does have the privileges to do
• 41:43
  whatever you want it to do, but you directly don't you know so
• 41:45
  that's the other way to to do it.
• 41:47
  So you really don't even need a second Dairy account that's
• 41:50
  called all managed by your Pam tool, right.
• 41:53
  So you know, there's a lot of, there's different ways around
• 41:56
  it, but I think you know it, you know, depends on the the, you
• 42:01
  know, IT environment you have is what you have to do.
• 42:04
  But definitely, yeah, you never want to just be doing your
• 42:06
  e-mail and your account as an administrative account.
• 42:09
  And that's going back to the privilege employee privilege
• 42:11
  management. Some folks are by default
• 42:16
  administrators of their Windows laptop, which is almost the same
• 42:19
  thing that you're talking about. It's you know that's you're
• 42:23
  really exposing yourself there. I.
• 42:25
  Disagree. I.
• 42:26
  Absolutely disagree because I I'm like a trainer.
• 42:29
  That's one. I think.
• 42:31
  So here's how we stop the the proliferation of privileged
• 42:35
  access management. Just give it to everybody.
• 42:37
  Everybody's a everybody's an admin now.
• 42:39
  You're not special anymore and you don't have to worry about
• 42:42
  it. There you go.
• 42:45
  Just legalize everything and everyone will stop.
• 42:47
  Exactly. Everybody's an admin if nobody's
• 42:50
  special. Yeah.
• 42:52
  So before we move on from this topic of Privileged Access
• 42:55
  Management, Paul, do you see anything in the future?
• 42:59
  I mean, you have a crystal ball, right?
• 43:01
  Yeah, kind of right here. What I see is that as we are
• 43:06
  using AI for a lot of things, right, we're able to automate a
• 43:10
  lot of a lot of tasks and we're able to even automate a lot of
• 43:13
  BI at some point, some IM functions.
• 43:17
  Yeah, I think privilege access is going to be even more
• 43:19
  important than than ever, you know, and that there's gonna be
• 43:22
  a lot more accounts probably that will become privileged.
• 43:25
  So I'd say the scope of privilege access is gonna
• 43:27
  expand. It's not just your, you know,
• 43:30
  your your server and admin geeks, you know, in the closet,
• 43:33
  you know, in the computer room, you know, doing their thing, you
• 43:35
  know, having potato chips and a coke or whatever.
• 43:38
  You know it's gonna be your you know maybe your chief marketing
• 43:40
  officer other folks you know that are that are doing
• 43:44
  privilege access and and also you know it's going to be more
• 43:49
  difficult to know if this is a real person or if this is an
• 43:52
  impersonation of somebody through AI you know through.
• 43:55
  So I think it's going to be really important that we kind of
• 43:59
  understand how do we authenticate or or prove
• 44:03
  authenticity of a person that that it is a person versus a
• 44:08
  machine, you know. So I think that's going to be a
• 44:10
  real big challenge I think going forward.
• 44:14
  And I don't know if it's really particularly in the context of
• 44:16
  Pam, but I think it's going to be a general problem around any
• 44:19
  kind of access, right? Yeah, not only how do you prove
• 44:23
  who you are, how do you prove who you're not.
• 44:26
  I think it's another area. I mean that's a whole other show
• 44:29
  I think we get into. I think I feel like we've we've
• 44:33
  beat up Pam pretty good at this point, which is a terrible thing
• 44:35
  to say and please don't isolate that and put that anywhere.
• 44:38
  But let's talk about IGA because last time we checked in with you
• 44:41
  we're kind of talking through that you you spent some time
• 44:43
  with saving it, you got you got a lot of experience really in
• 44:46
  this space. I guess where do you see kind of
• 44:49
  the current state of IGA right now from marker perspective
• 44:52
  because Gardner has called it done in my mind for a couple
• 44:57
  years now. I think 2019 was the last Magic
• 44:59
  Quadrant. You know, we asked Henrique and
• 45:02
  Becky on stage when we were at Gartner last year.
• 45:05
  You know who won what, You know what, what was the plan there.
• 45:08
  But I still see a lot of IGA vendors starting to come up
• 45:11
  again, you know, trying to be disruptive and we've had several
• 45:14
  of them on our show. Where do you what's what's the,
• 45:16
  what's the state of the IGA market from your perspective?
• 45:19
  Yeah, I mean I think you're you're going to have your you
• 45:22
  know your leaders always you know that that are that are that
• 45:25
  we have today that are continuing to innovate and add
• 45:28
  you know bells and whistles and functionality to their current
• 45:31
  platform. And then you're going to have
• 45:33
  these point solutions, you know these innovators that are going
• 45:35
  to approach things in a different way.
• 45:37
  I think you know the generative AI and maybe natural language
• 45:41
  type solutions where things that just because I still think IGA
• 45:45
  is very complicated. You know, for most people it's
• 45:48
  very complicated to implement very, you know, it's not
• 45:53
  necessarily IG as fault, but you know, because integrating with
• 45:56
  sources of truth and provisioning to systems, I mean
• 46:00
  it's not easy thing. But of course we want, we need
• 46:03
  to simplify it, that we need to streamline it and make the
• 46:07
  learning curve a little, you know, improve that learning
• 46:10
  curve, you know, no matter what solution you go with, right.
• 46:12
  So perhaps, you know, with AI and that, you know, we are able
• 46:17
  to make it easier for somebody to get up to speed on a
• 46:21
  particular solution and maybe even help.
• 46:24
  Given that all these platforms of SAS and you know they're
• 46:27
  they're seeing all the different entitlements and transactions
• 46:31
  occurring across all their tenants.
• 46:33
  That I'm sure there's some intelligence to be built there
• 46:36
  to help new customers with say higher Ed say where they got,
• 46:41
  you know, 5 universities on their platform.
• 46:43
  Well, the 6th one should be much easier for them because now
• 46:47
  they've said OK, well we see these other universities that do
• 46:50
  it this way and it's it. It's hopefully going to self
• 46:54
  streamline the onboarding and configuration of the IGA tools.
• 46:57
  I think automation is definitely going to be a big part of it.
• 47:02
  Is that the real innovation that that's taking place now?
• 47:05
  Is it just it's getting easier to deploy these things, it's
• 47:09
  getting easier to leverage the tools?
• 47:13
  Because I feel like that's that's still the innovation
• 47:16
  point we already saw. Oh yeah, you need to connect a
• 47:18
  whole bunch of stuff together, right?
• 47:19
  And then use some sort of voodoo magic to figure out, oh, this is
• 47:23
  Paul on this system and Paul on that other system.
• 47:26
  But it's historically been a complex process to get that
• 47:29
  integrated and set up and configured and work flows and
• 47:33
  write all the other stuff. Is the innovation point just
• 47:35
  making those things easier to do?
• 47:38
  I think it's definitely one of them you know and you know which
• 47:42
  as you said maybe not even 10 years ago we were still having
• 47:45
  to install these different servers and and IGA tools on
• 47:48
  Prem and the complexity of that was yeah and Pam solutions as
• 47:52
  well don't want to leave them out.
• 47:54
  And so at least with the SAS you know solutions now you don't
• 47:58
  have to worry about all that configuration.
• 48:00
  They basically spin up a tenant for you and you configure things
• 48:03
  with the you know point and click and it's much easier from
• 48:07
  that perspective. So I think that part at least
• 48:10
  that part of the complexity has been removed.
• 48:14
  But in terms of you know the possibly the way that that the
• 48:19
  user experience has been on some of these solutions to me seems
• 48:24
  still a little bit not streamlined for the the typical
• 48:27
  user. And as we know as I mentioned
• 48:29
  earlier, more and more people because the more you could
• 48:33
  delegate and push these business processes to your business the
• 48:37
  better, right. So you want your business, your
• 48:41
  business unit to manage all the entitlements for their people
• 48:44
  and none of them are technical usually.
• 48:46
  So easier to make it for them, you know, they're the best
• 48:49
  people to, to do that work, right.
• 48:51
  And I just think that maybe there'll be some, some
• 48:56
  innovation in the user experience that could be
• 48:59
  incorporated into these IGA tools because I'd say that would
• 49:02
  be that would be awesome because we could do that.
• 49:05
  Yeah, if that makes it easier. I think for everybody, it's
• 49:07
  always a great win. I want to pivot the conversation
• 49:10
  towards your higher Ed experience because I feel that's
• 49:15
  a underrated from a difficulty standpoint that unless you've
• 49:19
  been in the space and tried to manage identity and especially
• 49:24
  the more complex higher Ed scenarios that people may have a
• 49:28
  difficult time kind of understanding just how complex
• 49:30
  it could be. I guess.
• 49:32
  Can you talk a little bit about your experience in the higher Ed
• 49:34
  space? You know you've got a broad
• 49:36
  range of experience. How does higher Ed compare to
• 49:38
  some of those other roles that that you might have had?
• 49:41
  And is it about what you expected from AI guess a
• 49:45
  difficulty level, Is it easier or is it harder?
• 49:47
  Are there things that's like, oh, I never really kind of had
• 49:50
  to deal with that before and now you are in the higher Ed space?
• 49:54
  Yeah, I'd say it's definitely a lot harder and you know,
• 49:58
  obviously you know when I was in the financial industry and in
• 50:02
  the healthcare industry, you know, so this is not my first
• 50:05
  gig. So I've had all that experience
• 50:08
  to do to kind of you know as foundation.
• 50:11
  So I'm not totally surprised you know around you know IGA
• 50:16
  solutions and some of the typical problems and and be able
• 50:21
  to streamline onboarding and deprovisioning and things like
• 50:24
  that. But I think the biggest
• 50:25
  challenge for the higher Ed is all the different constituents
• 50:29
  that are out there. It's not just like an HR system
• 50:32
  or a vendor management system, but you have student information
• 50:34
  system, you have a, you know we have a common HR across all the
• 50:39
  UC system. We have affiliate system which
• 50:43
  is basically like a third party access, you know for non
• 50:45
  employees. We have applicants.
• 50:48
  So we have students that are in various stages, right.
• 50:51
  So their applicants will what what rights should they have as
• 50:54
  an applicant, right. Obviously you don't want to show
• 50:57
  them their application until it's ready to, you know, for
• 51:01
  them to know if they've made it in or not or maybe their grades,
• 51:03
  you know things like that. And then what about after the
• 51:06
  student leaves the university, now they're an alumni.
• 51:08
  Well, what access should they get then?
• 51:10
  And then we have staff like like myself and then we have faculty.
• 51:15
  So faculty, you know, they, they want to, you know, have access
• 51:19
  to everything that they need to be, you know, to cutting edge
• 51:23
  teacher. They want to be able to share
• 51:25
  all their information out on the Internet with no restrictions at
• 51:28
  all. So there's that kind of that
• 51:32
  balance between, OK, the university wants to share and
• 51:36
  kind of go at lightning speed, but then obviously, you know we
• 51:40
  we do have AC, so we have information team, security team
• 51:43
  that's also worried about, you know, the things that you
• 51:46
  typically worry about. So there's that tension, you
• 51:49
  know and there's so there's so many different constituents.
• 51:51
  There's also, you know, privacy for student privacy.
• 51:54
  So anything that we want to do for a student around their
• 51:59
  access, we have to talk with the registrar, the privacy officer,
• 52:04
  you know, so that just a lot of different constituents to
• 52:08
  manage. So I think it's not so much
• 52:11
  different from the other industries, but it's just more
• 52:15
  constituent management and and so I think that's why it's
• 52:18
  important to have an IM program and have a real focus on
• 52:23
  building those relationships so that you understand what their
• 52:27
  needs are, right. And Paul, I can, I can see a
• 52:30
  scenario where you mentioned like the professors just want to
• 52:34
  set something up without restrictions.
• 52:36
  And you know you probably hear from people who are new to
• 52:39
  higher Ed who maybe are teaching in class but come from business.
• 52:43
  And it's like, hey, you know the other place I work, I can just
• 52:47
  do this, that and the other Bing bada, Bing bada boom.
• 52:50
  And it it's like, yeah, if you don't understand all the
• 52:54
  complexity behind the scenes and why we can't do that, so totally
• 52:58
  resonates. The other thing like I've worked
• 53:02
  with a lot of universities over time helping them develop their
• 53:05
  identity strategy. And one of the things that I've
• 53:08
  seen with almost all the universities was like getting
• 53:12
  the ID card, you know, getting set up.
• 53:15
  You know, you had to go through some kind of identity
• 53:18
  verification process. And prior to COVID, it was a lot
• 53:22
  of times like you just show up, show your government issued ID,
• 53:27
  bada Bing bada, boom, you're verified and then you can get
• 53:31
  like a Level 2 type of an account.
• 53:34
  I think with COVID and some of the advancements that have taken
• 53:39
  place with in the space and in other words technology
• 53:44
  advancements. Plus even though even though I
• 53:47
  said a lot of people would show up on campus, there's always
• 53:50
  more complicated than that really big university of
• 53:52
  satellite campuses in other countries or you know, they
• 53:56
  might have researchers in other places.
• 53:59
  So it wasn't always easy. They always had to have
• 54:01
  something. But I guess what I'm going
• 54:03
  getting at is it seems like identity verification.
• 54:06
  It would be a really hot use case in universities and the
• 54:10
  ability to do kind of like a selfie match to a government ID
• 54:15
  seems like, oh that would be a perfect hit for higher Ed.
• 54:19
  What are your thoughts? Yeah, I think you're right.
• 54:21
  I mean, definitely with the, you know, global community
• 54:25
  constituency, like you said, professors, researchers all over
• 54:28
  the world, they need access, you know, the students.
• 54:32
  But again, it's all about, you know, what is it that does that
• 54:36
  impinge on someone's privacy? So you have to go through the
• 54:40
  questions of for each type of person, what is it that's
• 54:45
  acceptable to those constituents?
• 54:48
  You know, it has, you know, in terms of identity verification.
• 54:52
  But I do think, yeah, I mean at some point I, I would love to
• 54:55
  have something that's automated for onboarding even employees,
• 55:00
  right. And be able to, you know,
• 55:02
  instead of having them to come and show their driver's license
• 55:04
  and their passport or whatever, scan it in, fax it or whatever
• 55:08
  it might be. I'm not too familiar with that
• 55:10
  process but I know it's probably you know, pretty pretty
• 55:14
  outdated. So I I definitely think that
• 55:18
  would be a great use case at some point.
• 55:20
  I mean we're on a journey, we're just trying to to get past going
• 55:24
  to a commercial IGA solution at this point, you know from a
• 55:27
  custom 30 year old, you know, provisioning solution to
• 55:31
  something that's you know, much, much more modern allow us.
• 55:35
  To involve. That's when I discovered a while
• 55:39
  back learning work I working with.
• 55:41
  One of the higher ads was this thing called Grouper.
• 55:43
  I was like, what is that? Yeah, I used to love grouper
• 55:47
  sandwiches. But after my experience with
• 55:51
  Grouper's software, I was like, yeah, not so much.
• 55:54
  I never heard of the grouper sandwiches.
• 55:58
  Paul, you've been working on a lot of different things.
• 56:00
  I know we're we're hitting in an hour here.
• 56:02
  So, OK, kind of want to let you get out with your evening,
• 56:04
  right, I guess you do with. All the work.
• 56:07
  Yeah, well, you know, that's fine.
• 56:09
  What else am I going to do in New York City?
• 56:10
  You know, at at 8:30 APM? I'm sure there's nothing else
• 56:12
  going on. You're ready to hit the streets.
• 56:16
  In one, in one way or another perhaps, but you've got all
• 56:20
  these different you know things you've been working on I guess
• 56:22
  what's what are some upcoming projects or things that that you
• 56:25
  might be working on kind of next in your world?
• 56:28
  Yeah, I mean definitely, you know, I'm going to be, you know,
• 56:35
  I'm gonna be joining Gartner actually hopefully very soon.
• 56:39
  It's kind of hard this the timing of it, but yeah, that's
• 56:43
  that's kind of my next, you know my next venture is actually
• 56:46
  rejoining Gartner. I'll be at doing identity of
• 56:51
  course and working in the a little bit different team than
• 56:56
  the team that I was in. But I'm really looking forward
• 56:59
  to that. So I was really excited about,
• 57:03
  you know, being able to to stay in the vendor space, be in the,
• 57:06
  you know, the the kind of the, the space where you're looking
• 57:10
  at new technologies and such. And so I'm excited that that I'm
• 57:14
  going to be joining Gartner and I would love for folks that are
• 57:18
  listening to reach out, you know, on on LinkedIn and
• 57:22
  obviously that'll, you know, be able to post, you know, comments
• 57:27
  and things. I'd love to get your input.
• 57:29
  You know, in general, 'cause I know that in the past when I was
• 57:32
  a Gartner, input from folks from conference attendees or just
• 57:37
  people that I talked to was so valuable in in making your
• 57:40
  research and your presentations and all that better, right?
• 57:44
  So. So I'm looking forward to this,
• 57:46
  this audience that would be able to to hit to, you know, connect
• 57:50
  with me. Well, that's exciting.
• 57:51
  And now I guess that that's why we're recording this on a Friday
• 57:55
  night and getting it out on a fair and fair Friday the
• 57:57
  following week because, you know, once you go into the
• 58:00
  Gartner thing, right, we wouldn't be able to have you on
• 58:02
  the show basically, though, that's kind of why we're doing
• 58:06
  this special episode. So it kind of saved it till the
• 58:07
  very end. But it's very exciting.
• 58:09
  I think, you know, if you're not, if you're not following
• 58:12
  Paul, I've linked it already, one he should be, but there's a
• 58:15
  lot of good information that comes out from there.
• 58:17
  And you know, I'm looking forward to seeing the stuff that
• 58:19
  you produce and publish and, you know, bending your ear on things
• 58:23
  and and meeting up the conferences and things like
• 58:25
  that. So that's really exciting.
• 58:26
  I'm very happy for you. And you know it's another good
• 58:29
  gap for the Gartner team. So you know folks that can
• 58:31
  regain or there as those others. Yeah, congratulations, Paul.
• 58:35
  And don't forget the little people when you're at Gardner.
• 58:41
  Yeah, where, when, when can we expect the Magic Quadrant for
• 58:44
  Identity and Access Management podcasts and how far to the to
• 58:48
  the up and right would we be? Well, yeah, you would definitely
• 58:53
  be #1, I would think. Yeah, way up on the top, upper
• 58:57
  corner. Yeah.
• 58:58
  But then the caveat is we always say that, you know, don't always
• 59:02
  pick the ones on the upper right.
• 59:03
  You know, look at the other ones.
• 59:05
  Right. We also share the center.
• 59:08
  And we're called that day at the center.
• 59:09
  Like, should we be in the middle?
• 59:11
  Or, you know, maybe it's not a magic quadrant anymore.
• 59:14
  Maybe it's like some kind of a weird Venn diagram where you get
• 59:17
  Eve involved. She likes and Venn diagram.
• 59:19
  There you go, we can. Work with that.
• 59:21
  There you go. That's really exciting, Paul.
• 59:22
  So I'm I'm glad we're able to get this in and sort of an off
• 59:25
  cycle thing, but we're happy to do it and and get you back on
• 59:28
  you know before, before we couldn't.
• 59:31
  Yeah, no, I really appreciate it.
• 59:33
  I do. I really do.
• 59:34
  And you know, I I enjoy your podcast.
• 59:36
  I listen to probably every episode and get a lot out of it.
• 59:41
  Love the vendor reviews, love the conversations with folks.
• 59:44
  So keep, keep up and go to work guys you know?
• 59:46
  Definitely. We'll definitely appreciate that
• 59:48
  and you know how we close our shows.
• 59:50
  We end on a later note. We're gonna go completely off
• 59:54
  base here and talk about travel real quick.
• 59:57
  So here's the here's this week's question, or this episode's
• 59:59
  question, I guess I should say. What is the most interesting
• 1:00:02
  place that you've traveled to, and why did it leave such an
• 1:00:05
  impression on you? Yeah.
• 1:00:06
  I had the good fortune of recently going to Europe.
• 1:00:11
  So I flew into France got a chance to check out the the Mona
• 1:00:16
  Lisa and a couple of things and trained over to to Italy and
• 1:00:20
  went on a cruise. It was just like my kind of
• 1:00:23
  dream vacation. And I think the most I what I
• 1:00:26
  appreciate it the most is really the Rome and going to the to the
• 1:00:29
  Vatican and seeing all the history and the wonderful works
• 1:00:33
  of art and and just the the history that's there in Europe.
• 1:00:38
  It's not like you know the United States but I mean it just
• 1:00:40
  goes back thousands of years. So you just got you're blown
• 1:00:42
  away by by everything that you see, right?
• 1:00:47
  And so that, to me, was probably my my most favorite and exciting
• 1:00:52
  vacation that I've had. It does sound like a good time
• 1:00:56
  for sure, Jim. How about yourself?
• 1:00:57
  What's the most interesting place you've traveled to and why
• 1:01:01
  did it leave an impression? So I traveled to Seoul, South
• 1:01:06
  Korea. It was probably about 10 years
• 1:01:08
  ago and I was. I was there on business and the
• 1:01:12
  impression part. So First off, beautiful country,
• 1:01:16
  very modern, more modern than I was expecting and more modern in
• 1:01:22
  some ways than we have things in the United States.
• 1:01:26
  And I know we have listeners from all over the world, right?
• 1:01:29
  So I don't want this to be too US centric of an answer, but for
• 1:01:32
  me it was like you know, it was I think it was a 12 hour time
• 1:01:38
  difference from home. And so I was just like tired all
• 1:01:44
  during the day and I couldn't sleep at night and I think I was
• 1:01:47
  getting like 2-3 hours of sleep per night.
• 1:01:50
  So that starts to wear on you after a few days.
• 1:01:54
  And I was starting to feel, like, anxious.
• 1:01:56
  And this one memory that I have of sitting in a Starbucks and I
• 1:02:02
  remember somebody who I knew from, you know, part of my
• 1:02:05
  company. So they spoke very good English,
• 1:02:08
  was telling me, oh, yeah, about a year ago, the North Koreans
• 1:02:13
  were digging a tunnel towards Seoul.
• 1:02:16
  And I, I think Seoul is in northern South Korea, right.
• 1:02:20
  It's not that far from the DMZ, etcetera.
• 1:02:24
  But the North Koreans were building a tunnel into South
• 1:02:27
  Korea, and they were going to invade South Korea.
• 1:02:30
  And I was like, that's not what I needed to hear.
• 1:02:32
  So I was jacked up on caffeine. I was getting like 2 hours of
• 1:02:35
  sleep at night. I'm like, I'm like, OK now I'm a
• 1:02:38
  nervous. Wreck.
• 1:02:39
  That's I I can see why that would leave an impression on
• 1:02:42
  you, that's for sure. The thought of North Korea
• 1:02:45
  popping up into the butt of your hotel like a movie or something
• 1:02:48
  like that. Yeah, not a good movie.
• 1:02:51
  Not a good movie to be in. Fun fact is, we actually have at
• 1:02:54
  least one listener in North Korea from based on the tricks
• 1:02:58
  that I've seen. So hey, cool, you know, if
• 1:03:00
  you're listening there, maybe that was them.
• 1:03:01
  Maybe they're just trying to, you know, spread the gospel of
• 1:03:03
  identity. I don't know.
• 1:03:05
  Let's see if I need to. Meet Jim in person maybe?
• 1:03:09
  Yeah. Well, it could be the Paul
• 1:03:11
  Mazzara of North Korea. Let's see.
• 1:03:16
  For me, I think, you know, I've been fortunate to travel a
• 1:03:19
  little bit, not so much internationally, but I think
• 1:03:21
  probably my first big international trip going to
• 1:03:24
  India. I went to India for like 2 weeks
• 1:03:29
  to do some training for a team that was out there for identity
• 1:03:32
  operations and things like that. And it was my first time kind of
• 1:03:35
  really leaving the United States.
• 1:03:37
  And I was probably late 20s, early 30s, I guess in that area.
• 1:03:42
  And you know, I'd been to like Canada, stuff like that kind of
• 1:03:45
  didn't really count. But you know, this was, Oh my
• 1:03:47
  gosh, I'm getting on a flight and going literally around the
• 1:03:49
  world to another country and it was awesome.
• 1:03:53
  I enjoyed it. I was very fortunate to have
• 1:03:56
  like good hosts that were kind of making sure that, you know,
• 1:03:59
  one, I didn't, you know, disrespect anything from a
• 1:04:01
  culture standpoint, right. That was, you know, you know,
• 1:04:04
  stay on the up, up and up on that side.
• 1:04:06
  But just the the blitz on the senses there.
• 1:04:08
  The first time you kind of go to someplace like that and you've
• 1:04:11
  lived in the US the whole time, the food, the sights, the
• 1:04:14
  sounds, the traffic, the driving, all kinds of stuff.
• 1:04:19
  It was such a a fun trip. I'll never forget it.
• 1:04:23
  It's definitely one of the favorite things.
• 1:04:24
  But going to India and specifically I was in Chennai
• 1:04:27
  which is in the southern tip kind of on the east side of the
• 1:04:31
  Bay of Bengal over there. And you know, Jim, you know how
• 1:04:35
  much I, I love heat and humidity and this is like the worst that
• 1:04:39
  I've ever been in 120°, you know, and like 400% humidity.
• 1:04:45
  And it was just not my ideal scenario, but I had such a good
• 1:04:48
  time and people were so friendly and the culture was just
• 1:04:51
  amazing. So that's probably my was just,
• 1:04:54
  it was just the most impressionable kind of like, you
• 1:04:57
  know, you get out there and say, OK, yeah, there's there's more
• 1:04:58
  in the world than just kind of what we see here in the US And
• 1:05:01
  you know, your ranch dressing isn't the most important thing
• 1:05:03
  in the world. Did you get to fly business?
• 1:05:07
  Dead. That would.
• 1:05:08
  That definitely helps. Yeah.
• 1:05:09
  There's. I won't fly more than five or
• 1:05:12
  six hours without being. I just can't do it.
• 1:05:14
  I'm too old now at this point. Knack back issues.
• 1:05:17
  I can't sleep on planes anyway. But yeah, we got the, we got
• 1:05:20
  business class and we had a nice plane coming back, actually was
• 1:05:23
  Ana, which I think is a Japanese airline if I remember.
• 1:05:29
  And it was like super high tech. And yeah, why flat?
• 1:05:32
  We have like huge TV's. It was awesome.
• 1:05:35
  And of course I didn't pay for it, so that made it even better.
• 1:05:38
  Yeah, I didn't sleep. They like I just, I don't sleep
• 1:05:40
  on planes. Where they like the because we
• 1:05:42
  we I did I I just figured since I'm going I'm going to you know
• 1:05:46
  spend the money for for a nice business class myself and and
• 1:05:50
  yeah the United I'd never been on a business class since for a
• 1:05:54
  long time for you know business travel but how does it compare
• 1:05:57
  to the United seats the that particular airline I I kind of
• 1:06:01
  like these but they seemed a little on the narrow felt a
• 1:06:05
  little claustrophobic even though I could recline all the
• 1:06:07
  way down and got my own TV you know armrest and but it was
• 1:06:11
  still a little bit claustrophobic for me.
• 1:06:14
  It is. But look, it's still better than
• 1:06:15
  sitting back. And yeah, of course you're
• 1:06:17
  talking first world problems at this point.
• 1:06:19
  So I was actually on it was, it wasn't a United flight.
• 1:06:22
  It was, you know, it was like Star Alliance or whatever.
• 1:06:24
  It's like United and the NA and stuff like that.
• 1:06:26
  But I thought they were pretty much the same.
• 1:06:29
  But I remember the service was much better from like a service
• 1:06:34
  on a flight perspective and it was just a newer plane and, you
• 1:06:38
  know, kind of got lucky. I don't know if I got lucky or
• 1:06:40
  not but it seems like every flight that I fly in Delta these
• 1:06:43
  days is like some 40 year old plane that half the stuff
• 1:06:46
  doesn't work. It's it's not a premium product,
• 1:06:49
  I'm sorry to tell you. You know add over at Delta it
• 1:06:53
  is, you know it's just fine. It's average, nothing great.
• 1:06:56
  But I saw one thing I think International Airlines seem to
• 1:06:59
  have, at least the the mainstream ones seem to have
• 1:07:02
  better service, better planes and things like that.
• 1:07:05
  Do you guys ever watch like travel vloggers on YouTube?
• 1:07:10
  I mean you can see like all the different, oh that's one of my
• 1:07:14
  rabbit holes that I go down and like watch you know all the
• 1:07:17
  first class flights and all the first class train sleeper trains
• 1:07:22
  and things like that. But what made me think of all of
• 1:07:26
  this also was Jeff, you brought up Japan and like so many people
• 1:07:31
  go to Japan they say and they they have these pod hotels.
• 1:07:35
  So basically you don't get a hold of the hotel room, just get
• 1:07:38
  like a little like pod. I don't know how to describe
• 1:07:42
  except that. So it is like a little cubicle
• 1:07:43
  thing. Yeah, it's like a little cubicle
• 1:07:45
  thing with just the bed and there's somebody who has one
• 1:07:48
  right above you and the both sides of you and you know,
• 1:07:52
  everything is, but it's all like super modern.
• 1:07:56
  I just always think when I'm watching it, like Jeff would
• 1:07:59
  love this. I would love to go to Japan.
• 1:08:02
  Japan has bucket list for me. I've only been to, let's see,
• 1:08:06
  Takeda airport and a bus from Takeda to Hanada in the middle
• 1:08:10
  of the night because I missed my connection.
• 1:08:12
  Thanks United, That's flying out there.
• 1:08:15
  So I yeah, that's the story until before.
• 1:08:16
  But basically, you know, sleeping in the Hanada airport
• 1:08:18
  outside of the Hello Kitty store, blasting Hello Kitty
• 1:08:21
  music for like 8 hours waiting for my next flight.
• 1:08:24
  I would love to go to Japan. We need to find like some, some
• 1:08:27
  client or something that will take us out there because yeah,
• 1:08:30
  it's expensive to get out there. Or maybe, maybe Identity Week
• 1:08:34
  will be in Tokyo one year and there you go.
• 1:08:37
  Who knows, maybe we can do that. Use those discount codes you
• 1:08:41
  know, show support. There you go.
• 1:08:43
  Go to the conferences and show that we we can draw a crowd.
• 1:08:46
  Maybe we'll get out there someday.
• 1:08:47
  That'd be awesome. All right, We're at an hour 10.
• 1:08:50
  I think we're getting close to setting the record here.
• 1:08:52
  Paul, thank you so much for being part of this.
• 1:08:54
  I'm glad we were able to squeeze you in before the the warm
• 1:09:00
  embrace of Gartner gets around you.
• 1:09:03
  Thank you for sharing your knowledge with us.
• 1:09:05
  Definitely if you if you not following Paul on LinkedIn, you
• 1:09:09
  should be. We'll see hopefully you later
• 1:09:11
  this year at the Gartner IM conference as well.
• 1:09:13
  I think that one's gonna be in Grapevine, TX again.
• 1:09:15
  Like it's like the first we could just like, remember.
• 1:09:18
  Yep. So we'll we'll probably see you
• 1:09:20
  there and yeah, let's see what else use our discount codes.
• 1:09:24
  We have a bunch of links in our show notes for both the
• 1:09:26
  Identiverse as well as the Identity week America
• 1:09:28
  conferences. We're on the web,
• 1:09:31
  idacpodcast.com at IDAC Podcast on Twitter or X, whatever it's
• 1:09:37
  called. By the time you listen to this
• 1:09:39
  Mastodon at in IATIDAC podcast at info Psycho Exchange till
• 1:09:44
  it's a Friday night, I'm ready to go.
• 1:09:46
  And then we'll have links in our show notes, right.
• 1:09:47
  For for us on LinkedIn. For Paul.
• 1:09:48
  On LinkedIn. Yeah, that's it.
• 1:09:51
  So party time. New York City, here I come.
• 1:09:56
  No, I'm just kidding. Yeah, slice of pizza.
• 1:09:59
  Sorry I didn't, Michelle. That's, that's that's might have
• 1:10:01
  an exciting New York City trip, but yeah.
• 1:10:04
  Thanks everyone for listening. Paul, thanks again for joining
• 1:10:06
  us. Congratulations again.
• 1:10:07
  Don't be a stranger. Appreciate it.
• 1:10:08
  Thank you all. Right.
• 1:10:09
  Thanks, everybody. We'll talk to Y'all on the next
• 1:10:10
  one. You've been listening to
• 1:10:13
  Identity at the Center. We hope you've enjoyed the show.
• 1:10:18
  Make sure to like, rate and review and we'll be back soon.
• 1:10:22
  But in the meantime, hit the website at
• 1:10:24
  identity@thecenter.com and find us on Twitter at IDAC Podcast.
• 1:10:32
  See you next time on Identity at the Center.