Latest / Identity at the Center / #295 - Security Scientist Joseph Carson on AI and Digital Identity

Transcript

#295 - Security Scientist Joseph Carson on AI and Digital Identity · Identity at the Center

0:00
It's like you're sitting in a lake and what we're doing is
0:03
we're we're, we're, we're trying to force the attackers to create
0:06
ripples in the water so we can see potentially where the threat
0:09
is. It's forcing them to use
0:12
techniques which are noisy, that they make it more difficult for
0:16
them. And ultimately they deter them
0:19
to going looking for another victim who doesn't have these
0:21
types of technology controls in place.
0:28
This is identity at the center if it has anything to do with
0:33
IAM. This is the go to podcast now
0:38
your hosts Jim McDonald and Jeff Stedman.
0:48
Welcome to the Identity at the Center podcast.
0:50
I'm Jeff, and that's Jim. Hey, Jim.
0:52
Hey, Jeff, how are you? Not so bad yourself.
0:55
Good. So I, I had an interesting thing
0:57
happen earlier today where I had a, a video call with somebody
1:02
who I've been interacting with at work for quite a while.
1:06
And he said, Jim, you win the award, you look nothing like
1:09
your headshot. And so I, I didn't take it as a
1:14
compliment or an insult, but it just made me think I need to
1:18
update my headshot. So next conference that we go
1:21
to, I'm carving out the time to get a new headshot.
1:25
Well, you just missed Identiverse had them.
1:26
I mean that's the issue where I get mine done.
1:28
You're that or Gartner. Get Gartner later this year
1:30
maybe. I felt like I was busy the
1:32
entire time at Identiverse so I didn't get it done, but maybe
1:36
you can, like in post production, put a little picture
1:40
of my headshot so folks can see how different it is and see if
1:43
they agree. Why a lot of pictures of you and
1:46
only some of them look like you? Your LinkedIn picture is like a
1:51
a a super AI enhanced version. Is that your ideal state?
1:55
Is that what you're trying to manifest?
1:56
Yeah, like my jaw is like 20% bigger.
2:00
I've got way more hair. I mean, like, yeah, better skin.
2:03
So why not? Why not use technology for good?
2:07
Until until you get sold the product that is not on the tin.
2:11
Yeah, exactly. Well, you know, the other thing
2:14
I love about conferences is the swag.
2:16
And I'm holding a piece of swag today, which is football or
2:21
soccer themed, and it's a stress ball.
2:25
And when I got it, they're like, oh, you want two of them?
2:27
I said, oh, you can take three if you want.
2:30
I was like, well, I only have two hands on it.
2:32
So I didn't want to stretch it in their bag and take it home.
2:35
Yeah, that's pretty much what it came down to.
2:36
And I was like, I don't have three stress balls worth of
2:39
stress. I'm I'm trying to keep it much
2:41
more chill than that. Well, somebody out there is
2:43
probably like, give me that damn stress ball.
2:45
I like I I, I don't have enough stress balls.
2:48
Yeah, exactly. Exactly.
2:50
Well, let's see what else. Speaking of conferences, before
2:52
we get to our main topic and guess, we've got Identity Week
2:55
coming up. That is September 11th and 12th.
2:59
We've got the America's Conference in Washington DC.
3:02
You and I are going to both be at that doing podcasting things
3:05
and I think I'm hosting a panel or something.
3:07
We'll figure it out. Yeah, IDAC 30 gets you 30% off
3:13
of your registration for that. And that code is also good for
3:16
the Asia conference in Singapore.
3:17
So if you're going to that on October 22nd or 23rd, you can
3:20
use the same code for both. Maybe you can be like Thanos and
3:24
have like your identity conference, you know, Gauntlet
3:26
and go to like all of them. If you went to Europe earlier
3:28
this year, same code work for that.
3:30
So they've been great partners for us.
3:33
Also, if somebody works in government, they should just
3:36
reach out to us because we might be able to help them get in for
3:39
free. If they're allowed, yes,
3:41
sometimes there's rules and stuff like that.
3:43
But yes, if you are needy of a pass and you qualify as a, you
3:49
know, governments basically it's like what I like a customer, a
3:53
real person, not a vendor in this space.
3:56
Reach out, let me know and we'll see what we can do for you.
3:59
But for all the other peons out there like you and me,
4:02
Conference code Ida C30 for identity week.
4:06
Let's see what else we got authenticate after that.
4:08
That is October 14th, the 16th in Carlsbad, CA, just north of
4:13
San Diego, which is a suite location.
4:15
What a terrible place to go. Yeah, I know.
4:18
I love Southern California weather.
4:19
I think it's like the best on earth, but that's just me.
4:23
We've got a conference code for that one as well.
4:24
IDAC 15, you get IDID AC15, you get 15% off of your registration
4:31
for that one. So we're.
4:32
Excited. We've been guaranteed you will
4:33
not find a better code than that Guaranteed.
4:36
If you get out there while it's still early bird pricing, get
4:39
the 15% off and the better pricing, because when the
4:43
pricing goes up, the 15% off, well, I guess it goes up in
4:48
terms of dollars, but not in terms of percent.
4:51
So here's the problem with discount codes, right?
4:53
Is to get the maximum value, you have to wait till the very end
4:57
when it's most expensive, which is really dumb, right, if you
4:59
think about it. But yes, it stacks with
5:01
whatever. So if you want to save even more
5:02
money, right, register early, register often, that sort of
5:05
thing. Jimmy and I will be there doing
5:07
podcast again, podcasty things and I'm not sure for, I'm not
5:10
sure where we'll fit into the schedule, but I know we've been
5:11
having some discussions with the team about that.
5:13
And so as we get more information, we will keep you
5:15
updated. We've got some good ideas.
5:17
I think it's going to be. I have an idea that I've been I
5:20
have a couple ideas that I've been trying to pull off for
5:24
literally years now and we just haven't figured out a way to do
5:27
it. One of them we've done once in a
5:29
very long time ago when we first started the podcasts.
5:33
The other one, I've been thinking about a way to try and
5:35
do it in a way that doesn't injure people.
5:38
Let's just put it that way. But I think we'd make for a fun
5:41
episode if we can figure out how to do it.
5:43
So both of those. People would not be a good idea,
5:46
right? And I don't want to get injured
5:47
doing this. This is supposed to be a safe
5:48
place for identity, and I don't want to feel bad for that.
5:53
OK, so those are our conferences.
5:54
Anything else you want to mention before we get going?
5:57
No, let's get into it. We have a great guest today.
5:59
Yeah, we've got Joseph Carson. He's a chief security scientist
6:03
and advisory. See so at Delinia.
6:04
Welcome to the show, Joseph. Many thanks Jeff and Jim.
6:08
It's a pleasure to be here and really excited to to have a a
6:11
intriguing and insightful discussion with you today.
6:14
Well, I'm glad you were able to set aside the time.
6:16
I'm, I already know that you're a pros pro 'cause you have your
6:19
own podcast doing, you know, talking about cybersecurity.
6:22
And we're gonna get into that a little bit.
6:24
But let's just set the table here.
6:26
How did you get into the world of identity and access
6:28
management? Let's find out what your origin
6:29
story looks like. Is it something that you chose
6:31
or did it choose you? Absolutely.
6:33
It's a really great question. And for me, you know, my journey
6:37
in this entire industry, my, my career has been close to 30
6:39
years now and that's how long I've been in the industry.
6:42
And you know, I started off my career in the early 90s working
6:46
in system administration. So keeping systems up and
6:48
running mainframes, you know, doing OS migrations.
6:51
I was a COBOL programmer if anyone can remember COBOL so.
6:55
That's bringing a lot more money doing that now.
6:58
True, true. So that's really kind of where
7:01
my career started. Late 90s, early 2000s, I
7:04
switched into focusing around cybersecurity.
7:07
I originally, kind of, I'm originally from Belfast,
7:10
Northern Ireland. That's where I originally, I've
7:12
travelled around the world, I've lived in Australia, America,
7:14
Canada, and it was about 20 years, just over 20 years ago
7:19
where I made a move to Estonia. And it was my kind of expertise
7:23
in cybersecurity in in coming to Estonia, where that was my
7:27
convergence of both the security and identity.
7:30
When I moved to Estonia in the early 2000s, they just started
7:33
their journey in digital identity and it was something
7:36
that became very foundation to their entire society.
7:40
They started the journey in the 90s focusing on paperless
7:42
society, but it was the early 2000s when they really seen that
7:46
in order to be successful, digital identity was key to
7:49
making that something to grow the society, to have interrupt
7:53
ability to be able to accelerate and do things much more online.
7:57
So early 2000s was, you know, what they referred to back then
8:00
was Extro and that was a system that basically had several key
8:03
ingredients, which was digital signature, digital signing and
8:07
also a non repudiation, which was basically built around
8:10
blockchain. And they implemented that across
8:13
all of their information systems, all of their government
8:16
services. And that was where, you know,
8:19
using my skills and working with the government back then, that
8:22
allowed me to see, you know, the convergence of the importance of
8:25
security and also how important it was to protect identities and
8:29
what security controls and what risks they had.
8:32
And it's been, you know, it's been up and down.
8:33
You know, it hasn't been plain sailing.
8:35
They've had great positives. You know, they've been able to
8:37
do voting online. So not just electronic voting,
8:40
but Internet voting, online banking, online tax returns and
8:45
that systems progressed, but we also had a massive cyber attack
8:48
back in 2007 that showed weaknesses in the system and,
8:51
and the importance of resiliency is as well to make sure that
8:54
systems continue operating and there's continuum improvements
8:58
over that. And even to the point where, you
8:59
know, they saw that, you know, they needed to be decentralized
9:03
even further, not just having decentralized identity, but also
9:06
decentralized in the government systems to the point where they
9:09
actually created the idea of a data embassy was the ability to,
9:12
you know, decentralize the government outside of the
9:14
country in other locations. So that was really kind of, you
9:17
know, working with the historian government and getting very
9:19
closely tied. That's where my cybersecurity
9:22
skills became very kind of overlapping in the identity
9:25
world. And then it was around 2015
9:27
where I decided that not just focusing on cybersecurity for
9:32
things like endpoints and and applications and systems, I then
9:36
moved my career to purely focusing on identity security.
9:39
So the last 10 years I've been really heavily kind of focusing
9:43
my cybersecurity kind of expertise on protecting
9:46
identities. There's a lot there that I want
9:49
to unpack and I think I want to start with Delineia itself.
9:52
So you work for Delineia and I guess for, for people who aren't
9:55
familiar, Delineia is a, is not a new company, right?
9:59
It's a combination of a couple, but we can, I'll let you explain
10:02
that you're better than I can. So I want to ask you about what
10:04
is Delineia, what you know, what would you say you do?
10:07
And then tell me about your role as a chief security scientists.
10:11
What does that even mean in the real world?
10:13
Tell me about your day-to-day. So, so that's a great question.
10:15
So just to kind of for the audience with a bit of
10:17
background, you know, Delineia is, is a new kind of name or
10:21
brand in the industry, but it's not a new vendor.
10:24
It was the consolidation or convergence of both Psychotic,
10:27
which provided, you know, vaulting capabilities and
10:30
Centrify, which provided basically, you know, privileged
10:33
elevation capabilities as those two companies joining together,
10:36
which then, you know, coming up with the name was it was one of
10:39
the most difficult things you have can do in this industry is
10:42
what they call it a company. And delineate comes from the
10:45
term delineate, which is the defining the boundaries of the
10:48
space. So so that's where the company
10:49
came from. My role in the company is as a
10:53
security scientist is primarily it's it's a security researcher.
10:56
I use my skills to really kind of look at all of the threats
10:59
that's out there in the world that really focus on
11:02
compromising and, you know, stealing and breaching and
11:06
getting access to digital identities and using my
11:09
understanding kind of how attackers, what techniques
11:11
they're using, how they're being successful.
11:14
So I do a lot of research. I spent a lot of time basically
11:16
in my lab. I'm basically uncovering,
11:19
recreating, looking at the events, looking at indicators of
11:22
compromise, looking how attackers are abusing those
11:25
controls that we've got in place to bypass them.
11:27
And then I ultimately then create content from that,
11:30
whether it being in the form of books.
11:32
I've wrote six books to date already.
11:35
I write, I write tons of white papers throughout the year,
11:39
blogs, do webinars, speak at conferences.
11:43
So if you look at the role, it's, you know, part of the, the
11:46
role is, is, is the research side.
11:49
The second part is creating educational content to help
11:51
people learn about these threats and what's the best practices to
11:55
mitigate them. And then the third part of my
11:57
role is really, you know, educating the industry and
12:00
community. So I spend a large force of my
12:02
time yearly is going to conferences, going to events,
12:04
doing workshops, going to organizations.
12:07
They invite me in and, you know, asking me to provide my
12:11
expertise into helping them redefine their identity strategy
12:15
to make sure that they have security and resiliency in
12:18
place. So that would be my kind of
12:20
day-to-day. It's not always in that equal
12:23
percentage of terms, but that's what a lot of my time is spent
12:26
on as as well as doing the podcast as well.
12:29
Yeah, when I asked about that before I get to the podcast, I
12:32
feel like that, no offense, but that's like the thing that I'm
12:34
interested in as a podcaster as well.
12:36
But tell me about Cupid Cybersecurity Conference.
12:39
I know you have an affiliation with those guys as well, right?
12:41
Absolutely. So so Cupid I get.
12:43
Basically I was invited as a speaker like 10 plus years ago.
12:47
Maybe it was actually 11 or 12 years ago.
12:50
And one of the things I found about the conference is Cuba's a
12:52
very small conference. It's a very niche conference.
12:54
It's based in Prague, but they also hold conferences elsewhere.
12:56
They have sometimes events in New York.
12:59
They've got events in Bratislava and others.
13:02
But I was invited to be a speaker and I loved the
13:05
conference. I loved the event.
13:06
It was so niche, but the quality and the conversations that you
13:09
have with the community was so intriguing.
13:12
I learned so much, I met so many amazing people, even my other
13:16
older ego, which is sometimes, you know, myself and Dave Lewis
13:20
look very much alike. So sometimes they confuse us.
13:23
And I actually met Dave Lewis at the conference for the first
13:25
time there as well. We were speaking together.
13:27
So basically over the years, I, I enjoyed it so much that my
13:31
participation now is part of the speaking Bureau, which I, I
13:35
really enjoy. So it's the ability to look for
13:37
getting, you know, the next great speakers in the industry,
13:40
those who's coming up with some new idea or new, you know, kind
13:45
of research. And I get to review all of the,
13:47
the, the call for papers for the events and then helping select
13:51
the ones that ultimately get to speak at the conference.
13:54
So my kind of role there is really kind of helping make sure
13:56
that, you know, my expertise as a speaker previously is helping
14:00
me, you know, let's say mentor and bring in the next generation
14:04
of speakers And they tend to start there and then move into
14:07
other bigger conferences or what they will.
14:10
And your experience as a entertainer, dare I say it,
14:12
right, as a podcaster, right? It's kind of like what we're
14:14
doing here. So 401 Access denied.
14:17
Tell me about that podcast. Absolutely.
14:20
So, so many, many, many years ago, you know, and around the
14:23
late, you know, 2019 or so I was being, I was being a guest on
14:26
many podcasts and I really enjoy it.
14:28
I enjoy coming on podcasts and I enjoy, you know, speaking with,
14:31
you know, amazing people like yourselves 'cause I, I learn a
14:33
lot as the conversation's always enlightening.
14:36
I was, I like to, to be, you know, learn things.
14:39
That's my goal as as I'm a continuous student and one
14:43
basically COVID had happened and you find, you know, you weren't
14:47
travelling anywhere. I wasn't going to advance.
14:49
And I thought at the time, you know, what better way to stay
14:52
connected with my peers was to start a podcast.
14:55
So started the podcast almost four years ago now.
15:00
I said we'd be maybe 3 1/2 four years and it was a way for me
15:05
just to stay connected with my peers and having conversations
15:09
and, and every you know, it was a it's a bi weekly podcast and
15:12
it was thought leaders in the start of shady space.
15:14
So it was the opportunity for me just to spend an hour every
15:17
couple of weeks talking with friends and we turned into a
15:20
podcast and said now a few years later, we're over 110 plus, you
15:26
know, 115 podcast episodes, just under 400,000 listens across the
15:30
episodes. And we do both audio and video
15:33
across all the most common platforms.
15:35
But we have so many amazing guests.
15:36
I've had the likes of Jeff White, who is an amazing
15:39
journalist who basically was the author of Lazarus Heist and
15:43
Rince. I've had the head of NATO cyber
15:47
defence on talking about how NATO are protecting, you know,
15:51
countries from security attacks. I've had the head of Europol on
15:55
talking about how they're, you know, helping bring cyber
15:58
criminals to justice who use digital means.
16:01
So it's, it's for me, it's, it's, it's just an opportunity
16:04
to, to have fun conversations and, and learn.
16:09
So yeah, so the podcast for me is, is it's, it's become, you
16:12
know, it's, it's become a passion of mine and to, to
16:17
really continue. So it's absolutely we we've got
16:19
a lot of similarities in, in, in areas that we can share notes
16:22
later. But yeah, the podcast is, it's a
16:24
fun, it's a fun podcast similar to this for a open discussion,
16:29
talking about industry topics, trends, what's happening, what
16:33
techniques are used, and sometimes even just a fun
16:36
discussion to, to give the audience something, you know, of
16:39
a, of a learning and lightning. And so they can be, you know, a
16:42
family on the wall kind of observing and, and listening.
16:45
And, and at the end, they, they have something that they can
16:47
take back to their, their personal career or the company
16:51
as well. Yeah, that's also a great name
16:54
for the podcast. You know, Jeff and I, we love
16:56
podcasting so much and we have, you know, behind the scenes.
17:01
He and I will talk about a lot of things and we're like, yeah,
17:03
if we had a talked about that on the podcast, we probably would
17:06
get cancelled. So we had thought about, OK,
17:09
well, maybe we'd have a podcast where we'd have avatars and our
17:13
faces would be potatoes. We call it call it Potato Head
17:16
chat, but I think maybe what we could call it would be four O 4
17:21
not found. You know, that could be our
17:25
podcast, but you said a lot, Joseph, that interested me and
17:30
one of them was just the very fact that First off, I think
17:33
you're our first guest from Estonia.
17:35
So bravo for that. It's an honor.
17:39
Thank you. It's an honor for.
17:40
Us no pressure. You're only representing the
17:42
everybody. You're only representing the
17:44
entire country. Yeah, but it's, I kind of feel
17:47
like a scenario has been put up on a pedestal in terms of we all
17:52
see what's happening from what, you know, the art of the
17:55
possible, if you will. You're actually doing some of
17:58
those things around decentralized identity and
18:00
things like that. But I if there's some things
18:04
that really people aren't aware of, I'd love for you to point
18:07
those out. But also, I think, you know,
18:10
we've heard about different people's opinions on the
18:12
challenges of why what Estonia is doing hasn't really been
18:17
replicated in other places. And I'd love to hear your
18:20
thoughts on that. Absolutely.
18:22
So, so one of the things is, you know, Estonia started this
18:25
journey back in the early 90s when the first became, you know,
18:28
it was the re independence from the Soviet Union.
18:31
And just, I was, I think it's important to start with the
18:33
background is why they went on this journey because that's so
18:35
fun. It's so critical is back in the
18:38
early 90s, one of the major challenges when they became re
18:41
independence from, from the Soviet Union was land ownership.
18:44
And that was basically, you know, when you have a occupying
18:47
country, who decides what your education is and decides what
18:52
history is? They can change history to be
18:54
whatever they want it to be. They can teach in schools their
18:57
version of history or their, you know, alternate facts and, and
19:01
their perspective of things. And, and it really means that,
19:03
you know, history can be forgotten and lost over time if
19:06
that is something that continues.
19:08
So in the early 90s when, you know, they, they had this kind
19:12
of reforming of government and they went into the Land
19:16
Registry. And of course, the Land Registry
19:17
was all kind of modified. So one of the biggest problems
19:20
they had was finding out who owned really what land.
19:23
And, you know, people coming, who'd left the country from
19:26
Canada. They were coming back from UK
19:29
from US all back to Estonia to look at, you know, the families,
19:32
birthplaces and you know, where graves and and visit.
19:36
And they find all of a sudden this land and manners and houses
19:39
built on it and they started reclaiming that.
19:42
So made a massive issue. And as I still me was kind of it
19:46
was also, you know, the early 90s was the birth of CERN.
19:48
It was the, you know, digital computing, decentralized
19:50
computing, where desktops were going into everyone's homes.
19:53
And so at that time, they said, let's find a way to make sure
19:57
that our history can never be erased again.
19:59
That was the fundamental that I mean, that was the basis.
20:02
Let's make sure that no matter what occupying country that they
20:04
cannot erase history. And through the 90s they did all
20:08
this research. It was late kind of 9697 when
20:11
the few and, and, and Estonia was, was prime at that time
20:15
because it was the kind of in the Soviet Union, it was where
20:18
all the cryptographers were. It's where all the
20:20
mathematicians were, you know, computer scientists.
20:24
So that was the right mix of knowledge and education and
20:27
bringing those people together. And they said find a solution.
20:30
And in the 9697 they came up with basically time stamping was
20:34
one of the fundamental capabilities.
20:36
And that that research is what turned into the birth of their
20:39
digital identity because they said is in a physical world.
20:42
We want to make sure that in an online digital world also that
20:46
we cannot change history as well.
20:48
And that whole research spent that, you know, digital identity
20:52
became one of the finding pieces.
20:54
It was actually digital identity was originally tried in Finland
20:57
and field, but it was actually in Estonia where they were able
21:01
to make it successful because what they showed was what was
21:04
the critical thing that Estonia was successful was showing the
21:07
value. That's what all the countries,
21:09
other countries who have tried this have put it as an
21:11
enforcement as you know, it's, it's you had to do it because it
21:15
you know what'll make us better. But what what they weren't doing
21:18
was showing the value. That was the that was and that
21:20
was also education. That was years of education
21:23
before had to show the citizens what's coming.
21:25
And the value was that you can go fill in your tax form and
21:29
spend half a day standing in queue, parking your car, filling
21:32
in forms. Or you can go and use this new
21:34
online system with a digital identity that you can do it in
21:37
15 to 20 minutes. And people are like, you know,
21:40
there's there's no like if I even want to save half of my day
21:44
wasted time, I can do it online and get it done with.
21:47
And not only can I do it online with the tax office, but I can
21:50
now do my banking online, I can do my population register
21:54
online, I can do my vehicle license online, everything.
21:57
It just started that snowball fact is that when people started
22:00
seeing the value and how much time it was saving them, they
22:05
basically quickly migrated to using the digital online
22:08
services that came with that digital identity.
22:10
And of course, with that comes all the security, you know,
22:12
capabilities. And one of the things that some
22:15
of the government was like, well, you know, we want to make
22:17
sure that people have trust in the system because trust is one
22:20
of the fundamentals. And one of the ways that the
22:22
government tried to get around is that so that they're not seen
22:25
as the ability to change history was that they use blockchain.
22:30
So 2002, 2003 was implemented blockchain, the bases.
22:34
And of course, we know blockchain and cryptocurrencies
22:36
and audit, you know, one repeat all of those things.
22:39
But the fundamental piece there was to make sure that they go
22:42
through the concatenation, they get the root hash.
22:45
And then what they actually do is they take that root hash and
22:48
they print it in the Financial Times newspaper.
22:50
So that means that even the government themselves cannot
22:53
change history after that event has occurred.
22:56
And that's what builds trust. It's builds trust in the
22:58
society. Societies start trusting because
23:00
they can self audit the government and they can also
23:03
check the audit logs and everything else to see, you
23:05
know, has anything been changed. So that's where, you know,
23:09
Estonia's been really kind of cycle.
23:10
The problem is that when other countries have looked at this
23:13
and tried to replicate it, they started thinking, well,
23:17
Estonia's a small country, it's got 1.31 point, 4 million
23:20
people. That's why they were successful.
23:22
Oh, they started with a clean slate.
23:23
They don't have the legacy systems.
23:25
That's why they were successful. It's a very well connected on,
23:29
you know, society technically wise from mobile data and
23:33
online. That's why they're successful.
23:35
Yes, those are all reasons why they're successful.
23:38
But what they've been able to do is being able to look and
23:40
understand education in the society, doing the services,
23:44
showing the value, showing the trust, building auditability
23:49
from the citizens to the government, showing it's a front
23:51
door, that this is a way. And one of the things that's
23:53
over time built is that the citizens, you know, the last
23:57
time a citizen visit has visited a government office, it's
24:00
probably in in years, you know, even for voting and for renewing
24:04
licenses and registration and changing your address.
24:07
It's been years since they've had the visit office.
24:10
And that's one of the things is that, you know, the government
24:12
has got the point where that that with the value of the
24:15
citizens is two things is that they don't have to talk to a
24:17
government official. And, and at the same time,
24:21
they're reducing waste of time. And the calculation of that, if
24:23
you get into, you know, even the value of, of saving of time is
24:27
that they calculate it in basically GDP, they say per year
24:33
and there are about five to six days GDP, say per year.
24:36
And that calculates into about 2 1/2 billion EUR.
24:38
So you show, you know, the value of the value of the value and
24:42
that's what's critical. So over time, Estonia society is
24:45
really kind of that's become, it's actually ingrained in the
24:48
culture now. And it means that also when
24:51
things like COVID happen, people could still work safely.
24:54
They could work from home very easily.
24:57
It was actually interesting because typically Estonians, if
25:00
you see a bus stop that will stand as far apart as possible
25:03
from each other. And they said when when they
25:05
removed that restrictions of two meters, they were unhappy
25:10
because now they could, they could go back to further
25:13
distance away. So it really gets into, you
25:16
know, that now it's become so ingrained that even, you know,
25:20
voting majority this year and last year when the voting in the
25:23
elections is more people voted online than in person.
25:28
And that shows that, you know, it become it's now that
25:31
generation changed as well, where the the next generation
25:34
are starting to become those digital nomads, natives.
25:38
And, and they're continuing that evolution as well as in in
25:41
recent years, they've also added artificial intelligence into
25:45
that mix as well. And with artificial
25:48
intelligence, you know, to the point where things have done
25:51
really well as things like the medical records and E
25:54
prescriptions and E voting and all of those things have done
25:57
fantastic. But for me, this what was
26:00
artificial intelligence agent, which is known as CRAT.
26:04
Now, interestingly, I had a big conversation with the CIO at the
26:06
time seems secret. So and he's the CIO and he was
26:14
talking about this crat, crat, Crat.
26:16
And and if you understand kind of Estonian, you know,
26:19
methodological history, Crat is a little creature.
26:22
So it's it's a story, story fairy tale.
26:25
And it's this creature that at night time, it comes into your
26:28
room when you're sleeping and it steals your, your kind of your
26:33
thoughts and your memories for its master.
26:36
And I'm going, how is the government going to sell this to
26:39
the citizens? How, how are they going to take
26:42
crap that's going to be a government technology that's
26:46
going to come and steal your memories when you're sleeping?
26:48
How, how are citizens going to accept this?
26:51
And it wasn't until later when I started seeing the
26:53
implementation of it was that it's really about
26:56
interoperability. So Sony has done a really great
26:59
job in dropping, but across multiple systems, I can
27:01
authenticate in one area. I can laterally move across
27:05
depending on what let's say trust or or risk level that you
27:09
come in under at the beginning. That will determine how you can
27:12
laterally move across systems without having to re
27:13
authenticate again. And you know, the idea is that
27:17
when you fill in like let's say you do a process one time, such
27:22
as, you know, let's say a postal package comes, you have to do a
27:24
declaration about what that package is.
27:27
You might have to pay import tax.
27:29
Then you have to go and pay to the bank and do the exchange.
27:32
And then you have to tell the post office where to send that
27:35
package. And you do that one time, the
27:37
crap bot remembers the what you did.
27:41
And the next time that same activity comes again, you can
27:44
say repeat the same process that I did last time.
27:47
So it's really the automation. It becomes the citizen's
27:50
assistant to remembering all the things I've done in the past.
27:53
So when I realized, you know, the crap bot, it's, it's not
27:57
stealing the memories, what it's saying, it's remembering my
27:59
preferences and choices so that the next time things come, so
28:03
I'm not wasting my time, I can just simply ask my the crap or
28:07
the AI assistant to do it for me.
28:09
I still have to authenticate myself, yes.
28:13
And I still have to authorize the action of the bot to do the
28:17
action or the task that I want to do still is those actions.
28:21
But there's no typing. There's no, you know, decision
28:24
making. I just say do what I did before.
28:26
So that's really about making the user experience more simple.
28:32
I can tell for one thing from, you know, that answer to that
28:35
one question, the reason why Martin Cooper recommended you
28:40
for the podcast, he's like, you've got to get this guy on
28:42
the podcast. Very insightful, knows
28:45
everything about every or a lot about everything.
28:49
You surround myself with smart people.
28:51
Surround yourself with smart people.
28:52
That's that's a smart thing to do.
28:55
But as you're going, I'm, I'm sitting here like I've got to
28:58
pick your brain on a topic that's specific to the identity
29:02
space and one that I'm hot on, but I want to see where you
29:06
fall. So this idea of ITDR, really,
29:09
it's like identity intelligent monitoring in my book.
29:14
And then there's the response part.
29:17
Let's set that aside because I think that's just an automation
29:19
piece and etcetera. And maybe there's way more to it
29:22
than that, but it's really about identity intelligent monitoring,
29:27
at least for me. I want to know what you think of
29:30
ITDR and where do you see it five years down the road?
29:34
I think that's the real question.
29:36
That's a, that's a fantastic question and it really gets into
29:38
a lot of the things I've been doing research wise into looking
29:43
at. A lot of the activities I do is
29:45
I get sometimes called into these, you know, massive data
29:48
breaches or incidents. So I'm used as a subject matter
29:51
expert. So I'm sometimes allowed to go
29:53
in and help organizations to become victims to recover.
29:56
It could be, you know, data extortion attack.
29:58
It could be from a identity theft, an insider, or it could
30:00
be from a data breach right through to ransomware victims.
30:04
So one of my expertise is going in and you know, let's take, you
30:08
know, one of the skills that I have is going through all of the
30:10
event logs, all of the scene logs, all of the activities to
30:13
identify, you know, the attack path that the attackers came in
30:17
and how they moved around, how they gained access, how they
30:21
elevated privileges. So that's a lot of the research
30:23
that I do. And the great thing is that when
30:25
we look at new kind of areas, technologies and and advancement
30:29
such as text response, IDTR is that they're taking the skill
30:34
set that I have and automating my knowledge to be able to do it
30:37
repeatable faster. And be able to make sure that
30:41
either in a pre beat breach that you'll be able to identify
30:44
potential attackers much earlier or that in a post breach, to be
30:47
able to accelerate and find out potentially how they moved
30:50
around, how they gain access and therefore being able to mitigate
30:53
and lock them out. And because typically, you know,
30:55
in those scenarios, the attackers typically are still
30:57
high persistence, they're still on your network and you want to
30:59
find it as quickly as possible. So it's a really great way to be
31:03
able to look at all of the different methods or techniques
31:06
that attackers currently use and look across your identity fabric
31:09
or identity framework or identity event logs and
31:13
information to be able to quickly determine is there any
31:16
indicators of an attack happening on your network
31:19
immediately. And then you get into that
31:21
response pieces that let's take remediation.
31:23
Let's maybe, you know, stop that person from having an access,
31:27
let's change the password, potentially enforce a re
31:30
authentication. Let's level up their security
31:33
controls and require multi factor authentication.
31:35
Let's monitor that session. Let's turn it into a, let's say
31:39
a, a, a non recorded session to recorded session.
31:42
And then start looking at the, the activities and context of
31:45
what that person's been doing. Let's prevent them having access
31:49
to more sensitive data, maybe customer data or financial
31:52
information. So it's really taking the action
31:54
and limiting the attack surface that that, you know, identity
31:58
has on the, on the infrastructure, whether on
32:01
premise where it would be in the edge or in the cloud or, you
32:03
know, in your data. So for me that, you know, that
32:06
ITDR is a massive array of, of, of really value to organizations
32:10
because it can help you. One is to cover discover attacks
32:15
and threats much earlier and prevent them leading into
32:17
something of very big catastrophe or in a post breach.
32:20
It can help you identify quickly the attack path and then make
32:24
sure you're able to shut the door and put better security
32:27
controls that would, you know, allow that attacker to move
32:29
around. Now it's kind of where it's
32:31
going is we're having this big kind of, let's say, acceleration
32:36
into, you know, we've had the identity access management space
32:39
for a long time. You know, we've had basically
32:42
SSOMSAID, PS:, all of that IDAS side of things.
32:48
And what we're seeing is that converging, it's really turning
32:50
into an authentication experience end to end.
32:53
So the authentication is really about, you know, me kind of
32:56
proving I'm really me. That's all to me, what we're
32:59
saying. And and I've talked to, you
33:00
know, my kind of vision in this space is that it's an evolution
33:04
of basically where we've had bring your own device, you know,
33:07
I'd say 15 years ago to where, you know, the last five years
33:10
has been bring your own office, working remotely, people
33:14
bringing their own printers and their own devices.
33:16
And it's moving into where you start seeing this conversions of
33:19
the consumer identity, where it's bring your own identity.
33:23
And I really do see that in that authentication space, there will
33:26
be an IDP that's, you know, you're bringing on Zente, but
33:29
organizations may want to add more security controls and, and,
33:31
and you know, verification to that to trusted ID.
33:34
PS So there'll be different levels of, you know,
33:37
authentication. So that's where you're starting
33:39
to see that whole IM direction. And then the other side of it is
33:42
basically where you've had things like Palm and IDDR and
33:46
you've had chem and auth, your authentication, even multi
33:50
factor authentication falls into that area.
33:52
And they're all convergence as well.
33:53
They're all moving into an authorization experience.
33:56
It's all about now, OK, Joe's come in and I've proven who I am
34:00
from authentication role. Now what am I allowed to do
34:04
after I've proven who I am? What things can I do?
34:07
You know, can I access the server?
34:09
Can I log into this application? Can I view this data?
34:11
Can I make these changes? And that's really the
34:13
authorization experience. And then sitting across that's a
34:16
whole governance layer about, you know, what has Joe been
34:19
doing across the network? And that's where you can take
34:22
all of those pieces and put it into IDDR and determine about,
34:25
you know, should I be, you know, logging in at that time?
34:28
Should I be accessing that system and have I ever done it
34:31
before? And then determining, you know,
34:33
OK, if that's a baseline, let's make sure that we put a risk
34:37
score against that so that the IDDR can say this is something
34:40
of an anomaly that we should actually either send to a seam
34:44
out of additional security controls or just going to be a
34:47
bit more cautious with this particular session activity.
34:50
So this really getting into and, and it's moving, you know,
34:52
there's two major areas. I've been talking to a lot of
34:55
analysts over the last year, and this is turning into an identity
34:58
security posture management, which is then combining with
35:03
data security posture management.
35:04
We're starting to see more identity controls moving away
35:06
from the the me and those identity controls moving to the
35:10
data. And the data will then in, in,
35:12
in a dynamic way, determine whether I'm allowed the access
35:15
real time. So it's going to be an
35:17
interesting space. But the one thing that's going
35:19
to change to, to, to Jim, your question is that a lot of these
35:23
ALAI algorithms will be self learning.
35:26
And, and my role in the future might be just training the
35:29
algorithm. It'll be taking the new threats
35:32
and indicators of compromise and showing the algorithm how to
35:35
detect and then applying that across, you know, entire
35:39
platforms and entire data sets to be able to quickly identify
35:43
potentially areas of, of threats.
35:46
Ultimately what we're doing here is, you know, we're really
35:48
accelerating the ability to, to, you know, I, I will say it's
35:52
like, it's like you're sitting in a lake and what we're doing
35:55
is we're, we're, we're, we're trying to force the attackers to
35:59
create ripples in the water so we can see potentially where the
36:02
threat is. It's forcing them to use
36:05
techniques which are noisy, that they make it more difficult for
36:09
them and ultimately they deter them to going looking for
36:13
another victim. He doesn't have these types of
36:14
technology controls in place. I love that analogy of the lake,
36:19
you know, you, you, you, we, we, we get into the space of
36:23
identity and access management and digital identity.
36:26
And we've done a show on this that's been one of our more
36:29
popular ones. We went out and we asked a whole
36:31
bunch of people what is the difference between digital
36:34
identity and identity and access management?
36:37
And we've gotten a different answer every time.
36:41
So I'm going to ask you, Joseph, what is the difference between
36:44
digital identity and identity and access management?
36:46
It is a great question. And sometimes they've been used
36:49
inter exchangeable, but a digital identity is what
36:52
associates me to basically authentication or an online
36:58
system. It's it's, it's the person.
36:59
It's tying it back to me as the human.
37:02
A digital identity, when you look at IMIM, sits across
37:05
multiple types of identities, not just human, but machines,
37:07
but keys, code, systems. So identity access management
37:12
is, you know, more about the authentication and the access
37:15
control side. A digital entity identity is
37:18
just a static object that, you know, associates to me.
37:22
So you think about, you know, I always go back to it.
37:26
It's how this industry's progressed over time.
37:28
We have to look back at where we started off and sometimes it was
37:31
basically, you know, in this space, we used to call it
37:33
account management. You know, it used to be account
37:36
management because we only had one or maybe 2 and it kind of
37:40
goes back to the object and it was so, so tied back to me and
37:45
it was the association. So when I look at, you know,
37:47
even how you know, it's tied back in Estonia today is the
37:50
digital gently is association as me and it's the attributes to me
37:56
as the human. And it's my digital DNA for
37:59
online activity. And I might have multiple
38:03
identities, digital identities that associates back to me.
38:07
So it's, it's, you know, I'm the connection between them.
38:10
When you look at IMIM is the policies that'll determines what
38:14
I can do with each of those individual identities to target
38:18
systems, to applications, to code, to resources.
38:21
So it's the IM pieces, the tie to my, of my digital identity to
38:26
a target system. So it's, it's, it's, it's almost
38:30
like a, an object of, of an extension, but a digital
38:34
identity is ultimately, you know, association with me as the
38:37
human. May I go back and forth on do
38:41
things have identities? And I generally come down on no,
38:45
they don't. And I think folks in our
38:49
industry, the majority say yes to you.
38:53
Devices have identities and things have identities.
38:58
So, you know, I've got a thermometer or thermostat on my
39:03
wall and it can connect and it's got an IP address.
39:08
I don't think it has an identity.
39:11
I think it's a device that belongs to me.
39:13
I'm the identity. I mean, let's say you so.
39:18
It's a great question and great point.
39:21
I, I do can, I mean calling it a digital identity because I'm all
39:24
association digital identities back to the human side.
39:27
It can have, you know, the machine identity side of things.
39:30
You know, it really evolved from how to manage asset management.
39:34
That's ultimately kind of where it started from when we think
39:36
about even it has its foundations going back to
39:39
license management. License management is really
39:41
where all of this started was, you know, we look back to even
39:44
Microsoft licenses. It was, you know, five pieces of
39:46
hardware that was used to basically create a a GUID that
39:50
would then tie back that this machine's using that.
39:53
So it was a really to kind of do asset management and tagging in
39:56
some regards. But what we started seeing is,
39:59
you know, and not necessarily, you know, I.
40:02
We might not have devices that have owners as well associated
40:05
back to humans. Those devices might be doing
40:07
workloads, they might be just doing processing.
40:09
It might be a workload needing having access to a specific
40:14
piece of data or computational power.
40:17
But you know, calling it an identity.
40:19
I agree that, you know, maybe the term is not right, but it
40:22
does have some type of asset tagging, which which, you know,
40:27
it just means that you have to be able to somewhat understand
40:30
that it's this piece of code that's doing the the, you know,
40:34
the access or is this, you know, specific machine that the access
40:38
is coming from. So you do have to have some sort
40:41
of tagging and asset identification.
40:44
And I think that's just, you know, some, some people has just
40:46
made it simpler. I used to call it non human
40:48
identities, people called machine identities, asset
40:52
identities, asset tags. There's lots of different names
40:55
we can call it, but ultimate, it's ultimate to to to source of
41:01
origin of what, you know, what the specific resource is doing
41:04
and why does it need to have access.
41:06
And I think one of the biggest things is as we moved to cloud,
41:08
it was a it was a lot more as we moved to just just in time
41:11
access. We need to have some ways and
41:14
that that gets into the challenge of doing digital
41:16
forensics and cloud and and that's why we need to have some
41:19
sort of at least asset association or tagging so.
41:23
I think we could get to the point.
41:24
I think it's easier to just call it an identity.
41:26
I think we could get to the point of with robotics and
41:29
artificial intelligence, where it's so indiscernible that the
41:35
AI is doing so many human activities that it actually
41:39
becomes an identity. I agree.
41:43
So I mean AI agents you know do have an identity associated to
41:47
them. It's simply just an account that
41:50
it gives it some type of access or, you know, authorization into
41:54
performing a specific task. And that could be basically a
41:56
persistent, you know, authorization or could be just
42:00
in time authorization or just in time access.
42:03
But absolutely right is that, you know, I, I, I don't see them
42:05
as, you know, becoming sentient, you know, that they become
42:09
operating in their own, making their own decisions.
42:12
There's two things that I refer to as when we look at AI agents
42:15
or even I look at the AI bot that it's only created with the
42:19
Kraft bot. It's an, it's an assistant to
42:22
humans. It's not to replace humans, It's
42:25
just to augment the decisions we make.
42:28
And it's either two things. It's either basically assisted
42:31
technology, meaning that it's going to provide, let's say
42:35
augmented intelligence to helping me make decisions, which
42:38
is, you know, I'm going to decide the action that that AI
42:42
agent will take. It will show me options and I
42:45
will decide which one to take. Then once we'll get to a certain
42:48
point is we'll make, let's say autonomous actions, meaning that
42:52
I will allow that agent to operate on my behalf.
42:55
But I want to be able to audit, you know, you know, explain
42:59
ability into how that will actually, you know, that that
43:02
result will happen. And of course, they will be
43:05
potentially less, you know, harmful or, or damaging types of
43:08
actions, but things you might just say, you know, file my tax
43:11
returns on my behalf. And, you know, I, I don't need
43:14
to, you know, just show me the results.
43:16
I don't want to have to deal with it.
43:17
I've done it the same way for the last five years in a row.
43:20
Why would they do the same? Or even voting, you know, I
43:23
voted the same way the last few years, unless I'm going to
43:26
change my decision. Maybe, you know, you're going,
43:29
you know, intervene with the algorithm and say I I'm having
43:32
questions or, you know, you might put, you know, responses
43:34
in. But a lot of times, you know,
43:36
what we're going to be able to do is that they will be, you
43:39
know, extensions. It's, it's not going to be
43:42
identities by themselves. It'll be an extension tour
43:44
identity as identity assistants. I, I think that's what they
43:48
originally were, were trying to do many years ago when we had
43:50
these virtual assistants and we had Clippy and other types of,
43:53
you know, assistants for us. But ultimately it's it's really
43:58
there to to make our wall. I'm waiting for Clippy to come
44:00
back with you. Know now one. 100% more AI and
44:03
it's like writing your paper for you and it's like, no, you get
44:06
the paper clip. I have to ignore it, but that's,
44:09
I mean, it becomes an assistant to us that that's what it's
44:12
truly there. So, so I do like, you know, you
44:14
know, the things that copilot's doing is is pretty impressive
44:19
and other, you know, degenerative AI capabilities.
44:21
It's really there to extend my kind of where I can then focus
44:27
on the things that I really enjoy doing and and and automate
44:30
the things that are just mundane and repetitive that's are not
44:33
interesting that you know. That's where it's at now, but it
44:35
could be in the future where it's much more evolved.
44:38
And you can say, all right, AII want you to build a whole
44:42
business of AI robots, right? And you could do that for the
44:46
purposes of, hey, I want to start, start a law firm.
44:50
So start creating and training all of these lawyers in
44:53
different areas. Not even lawyers.
44:56
Lawyer bots. Lawyer bot things, right?
44:58
I mean, this is the worst it will ever be.
45:01
Like it's right, No? It it can, it can get, it can
45:03
get a lot worse than we can take.
45:05
A lot worse for the same. Abilities like you.
45:07
Set them off for evil? Yeah, no.
45:10
Because because the. Capability right now, yeah.
45:12
Because the worst it'll ever be, it will get more capable over
45:15
time. Absolutely.
45:16
I mean, what, what basically attackers are simply just taking
45:18
the same basically, you know, algorithms and they're taking
45:20
the card grills off so you can get, you can get, you know, the
45:24
safe one and you can get the unsafe 1.
45:26
So, so we're, we're in this situation where that, you know,
45:29
we're trying to do it for good, but attackers can simply take
45:32
the same thing and take the protection off it.
45:34
Guaranteed that that the adversary is going to take AI
45:39
and try to teach you how to steal.
45:42
I mean it. It's only it's 100% certain,
45:46
right? Go target this crypto exchange
45:48
and steal all this big, you know, Bitcoin right and just
45:51
give it, you know, the instructions about what you want
45:53
to say. So absolutely, you know, there's
45:55
going to be these separations of, you know, technology can
45:57
always be used for good or bad, but we can't we're in a
46:00
situation right now where we can't change that.
46:02
We're, we're, we're, we're committed, we're going forward,
46:04
it's going to happen, but we just have to become very aware.
46:07
I, I really think the explained ability is, is very important
46:11
out there and and there's will be areas that will become
46:14
heavily regulated as well. It's only a matter of time, you
46:17
know, so, but I mean, the good thing is right now is attackers
46:20
are not using it that much. They're using it to analyze data
46:24
dumps. So when they exfiltrate and they
46:26
steal data from an organization, they might say, hey, hey, you
46:29
know, AI go on determine how much I can, I can, I can try to
46:34
get ransomware from this organization.
46:36
How well is their finances? So, and it will tell you, you
46:39
know, here's the ransomware, here's what their insurance is
46:41
covering, here's what you can request.
46:43
And therefore, you know, it's so the intelligence and data
46:45
analysis is happening. Definitely they've been using it
46:49
for improved fish fishing capabilities.
46:50
So one thing is in Estonia, the language has been protecting the
46:54
country and society for many years because the language is
46:57
very difficult. And what attackers have been
47:00
able to do is that the real to do campaigns using generative AI
47:04
to do automatic translations. And those translations are so
47:08
good. They're, you know, to the point
47:10
now the language is no longer protecting society.
47:12
And it just means that, you know, citizens now have to
47:14
become better aware of phishing campaigns, social engineering
47:18
that are trying to steal their their passwords and credentials
47:21
and access to do damaging things.
47:23
So it just means that generative AI is it's lowering the bar and
47:27
it's making them better quality. So lowering the bar, meaning
47:30
more people can, you know, be online criminals with just a
47:34
computer and Internet connection and improving the quality.
47:37
Meaning that we're, you know, the, you know, the e-mail coming
47:40
from Africa from your long lost cousin, you know, that has
47:43
inherited billions to now where it's basically very
47:47
sophisticated. Very, you know, hard to tell the
47:49
difference between real communications, real messages,
47:52
and those who are abusive. I mean, Can you imagine having
47:56
an AI go off and say hey go take a look at Shodan, find
47:59
everything that's usually a default password and then try to
48:01
breach it? That's exactly lowering the bar
48:07
and giving you better, better quality capabilities.
48:10
Those are the things that, you know, it's what I'm worried
48:13
about more is it's the battle of algorithms right now that we're
48:16
moving into. So I'm worried about that right
48:19
now. The the, the reason why
48:20
attackers are not using AI is because the basics work today,
48:23
you know, going in and stealing a password, you know, buying the
48:25
credentials online, you've got access brokerage who just
48:27
specialize in that. All day long that when everybody
48:29
uses the same password anyway. Exactly so and and and
48:33
ultimately, you know, you, you get cyber fatigue from things
48:35
like, you know, MFA fatigue. Bombard them with Tom sons of
48:39
MFA request and he's simply just like, OK, I'll just get away
48:43
with it and I don't want to see them just accept it.
48:46
So really the the techniques just work today.
48:48
So that's why they haven't moved.
48:49
But when we get those basics right, when organizations really
48:52
start getting the foundations and they start getting MFA in
48:56
place, not just at the front door, but at lateral moves, when
48:59
they start looking at, you know, auditing, context based access
49:02
controls, dynamic based access controls, they're looking at
49:05
policy based. So it becomes very not just
49:07
static controls that's always been in the past to much more
49:10
adaptive controls of the future, meaning that it's starting to
49:13
look and analyze all the different things that I'm
49:15
looking to do and therefore deciding what card rails that
49:18
put in place and making it difficult for attackers to be
49:21
successful. The more those get, the more we
49:23
get better with the basics, the more we'll be pushing the
49:26
attackers to move, moving to using AI much more.
49:30
And my worry is then what happens is you start having the
49:33
algorithms, having a battle, whoever designs the algorithms
49:37
the best is going to be the winner.
49:38
So and that means attacker is going to be moving to things
49:41
like real time campaigns, real time campaigns where it used to
49:44
be, they'll just create one campaign which might last for
49:46
six months to a year and it'll be successful because they're is
49:49
using the same vulnerability over and again.
49:51
They're using the same credentials and passwords over
49:53
again, the same techniques has just created a campaign playbook
49:56
that reruns that over and over again.
49:58
They put AI into the mix. That playbook will be self
50:01
progressing, self learning and will augment itself.
50:04
So at field on XYZ targets, what can you learn from that?
50:09
Let's kind of re evaluate, let's redesign our tech playbook and
50:15
attack pass and then, you know, look to bypass those much more
50:18
in the future. So we're in this battle of
50:21
algorithms and it means that you know what we put in place from
50:24
AI capabilities today. We need to keep progressing that
50:28
that that needs to be a a continuous improvement over time
50:32
in order to to make sure we we stay a little bit ahead of
50:35
criminals. All right, so I'm sufficially
50:38
terrified. Thank you very much for that,
50:39
Joseph. There's no hope for us in the
50:41
future, so. We're AI at the center.
50:44
Right, yeah, Gonna have to go and create a new podcast for
50:46
that one. You know, we've, we've talked
50:50
about so many different things here and I feel like we could
50:52
talk for hours and hours and hours and hopefully you'll come
50:53
back and have another conversation with this.
50:55
But I do want to be respectful of time.
50:57
You do a lot of public speaking, right?
51:00
That's kind of one of the things you do.
51:01
You got your podcast, etcetera. I am always curious about what
51:05
happens behind the scenes. Like, you know, what are the fun
51:08
stories where it's like, oh, people only saw this part,
51:12
right? This was the public facing
51:13
presentation. But behind the scenes, oh boy,
51:16
if only you could see, you know, like, do you have any good
51:18
stories that are like behind the scenes of either speaking or
51:21
broadcasting or whatever it might be?
51:23
Yeah, so absolutely so so I mean just kind of give you an idea.
51:26
You can see, I don't know, the audience can see all of the the
51:29
badges in the background. So that's my speaking badges
51:32
over the years I've done. A lot of badges.
51:34
I've done somewhere. It's probably close to about
51:37
1000, I think, speaking in my career of different conferences
51:41
and events. And you know, for me it's, it's
51:44
always a, it's an almost pleasure to be able to go and
51:47
share my experience with the audience.
51:49
I always hope they just somebody you find some value of my
51:52
experience and, and, and they take that away and there's been
51:55
interesting things over the years.
51:58
I just even I've had people, you know, speakers here basically
52:03
kept their headset landed on and went to the bathroom.
52:06
So you've got a room full of 500 plus people and all of a sudden
52:09
you're, you know, you're. Flashing.
52:12
A little tickling and the flushing going and everyone's
52:15
just going what is going on? And you know, this is the person
52:18
had a, a hot mic, you know, forgot the Lander was on and
52:21
went in the bathroom. I've had situations where, I
52:25
mean, I, I've mentored speakers over the years and I had one
52:28
time there was a girl kind of, I was mentoring speaking and you
52:33
know, she got up on, on stage and she was fantastic.
52:36
It was like really great speaking.
52:38
But she got into this thing where she was walking around and
52:41
ultimately she stepped backwards and she stepped literally off
52:45
the stage and the stage was like a good like meter high.
52:50
She disappeared behind the curtains.
52:51
I was just like, Oh my God, Oh my goodness.
52:53
Like for any, you know, obviously any speaker to recover
52:56
from, that is always hard when you, when you're in that
52:57
situation, you're just like you can get frightened.
53:00
All of a sudden she just jumped back onto the stage again and
53:03
literally just continued. And actually even once she was
53:06
off the stage, she was still, she was still speaking, she was
53:08
still continuing her talk. She jumped back on and she
53:13
continued on. And I was, for me, that was
53:15
spectacular. A couple of incidents happened
53:18
with me Now I was, I, I mean, I do, it's usually about 30, can
53:23
be upwards of 50 speaking sessions in a year.
53:27
And I'm always, when you get to my experience, you can always
53:30
double checking everything you have backups and backups and
53:32
backups. And I've got multiple laptops
53:34
that I carry, which is always a pain.
53:36
I've got all the kind of dongles and I've got my own clickers
53:39
that I, I don't use anyone else's clicker because I use my
53:41
own, because I know it's going to work.
53:43
And last year was a, a session I was speaking, I'd just finished
53:46
two talks and it was the 3rd and final one.
53:49
And it about probably about close to 400 people in the room
53:53
and there's about 2000 people online watching my talk.
53:56
And, and if you ever see me speaking, I'm one that's always,
53:59
kind of, I always take the high risk.
54:01
So I'll always do, if I, if possible, I'll do a live demo.
54:04
I'll always, I'll get up there and I'll keep my virtual
54:06
machines running and I'll take you through because you know I
54:09
can, I can change my demo as I need to and go into different.
54:12
Things for trouble, Joseph. It's just asking for trouble.
54:15
So, so I'm up there on a stage, I've got my virtual machines
54:17
running, I've got my hard drive plugged in, I've plugged in and
54:20
bringing it to the podium and I'm about maybe 25 minutes into
54:23
the session, you know, and there's one person kept putting
54:26
their hand up. I'm going, as I said, I'll take
54:29
questions. At the end, it's his hand up
54:31
again. I'm going, OK, you have a
54:33
question. It looks like it's really
54:35
important. He says, I hope you realize that
54:37
your battery is only 5%. I looked down at the screen and
54:41
I just the shock and the fright, I just saw my batteries like it
54:44
was like a countdown 5% for because I'm running tons of
54:48
virtual machines. That thing was just eating the
54:49
power under plan. It was just ticking down.
54:52
I just were like, Oh my goodness.
54:53
And when I realized that even I plugged into the podium, but
54:56
there's no power to the podium. So I just said I said the
54:59
podium. So I was like just one second,
55:00
you gotta solve it. I ran, I jumped off the stage
55:04
like almost 400 people in the room, ran over to my bike,
55:07
pulled out APD power plug, ran back to the stage, took out the
55:11
plug, plugged it into the the the podium pack and it just kept
55:14
it going, kept it at that four or 5%.
55:17
So while that was happening, so I continued on, the technician
55:21
got a massive cable onto the back of the room, started
55:23
plugging Power Pack, Power Pack. And then eventually after like I
55:27
felt this tap in my ankle saying there was a power supply to
55:30
fruit. So I felt this this little
55:32
tapping. She was like, OK, I looked down
55:35
and I was like, OK, so change the plug from the pudding that
55:38
and this kept going. So there's those moments.
55:40
It just was so close. But the big fail, I was
55:46
presenting not long ago this year and there was a massive,
55:49
there was a couple 100 people in the room and I was presenting
55:53
and all of a sudden boom, electricity completely went out.
55:58
Somebody outside was preparing for the lunch, the catering.
56:02
They'd plugged in a massive like toaster and took the entire par
56:06
out of the entire conference room, this thing.
56:09
And it was like it was a it was like a bang and everything, all
56:14
audio screens, everything went down.
56:16
I'm just down there going, what can you do?
56:20
So, so I just present cause 'cause one of the things is when
56:23
you're doing this so long, you know what you're presenting, you
56:26
don't need to look at the slides.
56:27
So I just kept presenting as let's.
56:29
Go to the theatre of the mind, right?
56:30
Imagine, if you will, right? I I think this is what was on
56:34
the next slide, so I'm going to present that.
56:35
So, so I had to be very articulative.
56:38
Is that what you're not seeing here?
56:39
But what you would have been saying is this and to explain
56:43
through what's. Worth it?
56:47
Not, not so much. It wasn't definitely worth that
56:52
toaster. The other thing was like for
56:54
bagels or something, or like this bagel toasters thing.
56:57
But yeah, I had the complete power go off, no mics, no and
57:00
all things. So I just had to, I just had to
57:02
amplify my voice so everyone in the room could hear.
57:05
And I had to just so they had. To do back in the day, right?
57:08
I mean, back in the day, they didn't have AB equipment.
57:10
The politicians like Abraham Lincoln would have to just speak
57:15
very loudly. Loudspeaker.
57:17
Yeah, they get one of those big megaphone type things that.
57:19
Yeah, so so say next you know as as I need to add that to my
57:23
backup now. So, so you see a guy in the
57:25
airport carrying in like this giant paper.
57:29
They can't have batteries, right?
57:30
We don't want to run out of power.
57:31
Just giant paper, you know, megaphone.
57:34
That's probably plan. C or Plan D.
57:37
So, so over the years, interesting things have
57:39
happened. Absolutely.
57:41
I mean, I've from ad hoc. I mean, I've had, you know,
57:43
organizations or conferences had speakers not turn up and he's
57:46
like, Joe, what can you speak about?
57:48
It's. Surprising how often that
57:49
happens, isn't it? Like I, I think that's one thing
57:51
that I've noticed as I've done sort of more of these is how
57:54
many times people get asked to pinch hit because someone
57:58
couldn't make it. Or, you know, now it's like, OK,
58:00
well, someone tested positive for COVID and they weren't able
58:03
to travel right. Or, and they're doing the right
58:04
thing or whatever it might be. So like things like that.
58:07
I I'm I'm almost astonished at how many times it happens at
58:10
conferences. And I think sometimes that's why
58:12
they've got to start, you know, accepting my talks because I
58:15
usually submit several call for papers and they're like, you
58:18
know, we'll just accept one. So we know these got like 5
58:21
more. That's a great pro tip actually,
58:24
right? If you can kind of make a name
58:25
for yourself of being able to, you know, pinch hit as needed,
58:29
that might be something that might be a tiebreaker, right,
58:31
where somebody gets accept or not, or you know, maybe just
58:34
kind of nominated as like, hey, you know, you're not officially
58:37
on it, but if you can have something ready, that would be
58:39
great. Yeah, I've, I've been, you know,
58:41
I've been brought in, you know, for, you know, lots of
58:43
conferences, even like first conference as well as as a
58:45
backup speaker. They just say we, we, we're not
58:49
going to have you as the main speaker right now, but we know
58:51
if you've cut tons of talks, we'll just have you as a backup.
58:54
So one thing and and it has happened where I've had to, you
58:57
know, step in as a backup and, and take a major speaking
59:01
session, which sometimes was a keynote.
59:04
Yeah, right. Flights get delayed.
59:06
You know, people, something happens.
59:08
You know, personal events happen.
59:10
And you know, if you're organizing conferences and
59:12
events, you, you're bound to have, have these, you know,
59:15
terror. I even, I used to host the
59:17
cybersecurity conference in Tallinn many years ago.
59:20
And I had to have, you know, even the point where you know
59:22
you, you know you got when you're choosing speakers, you
59:25
want speakers, you can deliver multiple sightings.
59:28
Hey, we're going to throw an impromptu panel together.
59:30
Come on back, guy folks. I've done that as well for P
59:34
Pals. So so it's absolutely you just
59:37
become, you know, it's just like in the security industry, you
59:39
just become resilient. You learn a lot from what
59:42
happens, what kind of happened. And there's always the unknowns.
59:44
There's always things that, you know, there's new things like,
59:46
you know, for me, the toaster blowing the electricity, you
59:49
know, there's things that you just can't prepare for, but you,
59:52
you know, if, if they do happen, you just be resilient.
59:55
That's, that's what we're here to do.
59:56
I realize that my, my, my job is historically cybersecurity, but
1:00:00
I realize that that's actually not my job anymore.
1:00:02
My skill set is, that's my skills, but what my kind of job
1:00:06
is, is how to, to help organizations become resilient
1:00:10
and, and when bad things do happen, that they can quickly
1:00:12
just move on. And that's what, that's the
1:00:14
skill set you learn. And that's, you know, whether
1:00:16
being with conferences and speaking or, you know, doing
1:00:18
podcasts and things happen sometimes, you know?
1:00:21
You just find ways that we, we become so experienced and so
1:00:24
knowledgeable that we find ways around them.
1:00:27
We find ways to, to keep it going and you know, it's, it's
1:00:31
ultimate. And that's with experience.
1:00:33
And that's what we, what we try to then do is, is, is put that
1:00:35
into automation so that next time you know it, it fixes
1:00:39
itself. Yeah, I'm a fan of Littlefinger.
1:00:43
From where? From Game of Thrones, right?
1:00:45
Fight every battle, everywhere all the time, and you'll never
1:00:47
be surprised unless you got Aria somewhere out there ready to
1:00:51
stick it with a knife. I think that's a great place to
1:00:53
wrap up. I don't know how we can actually
1:00:55
top that. It's been such a fascinating
1:00:56
discussion, Joseph. I hope you'll come back and I
1:00:59
feel like this again. We can just pick something and
1:01:02
just go on for our. Absolutely.
1:01:04
So hopefully you'll come back, we'll have a link in our show
1:01:08
notes for people to reach out to you if they've got questions or
1:01:10
anything like that. Have a link to Delinea so people
1:01:12
can find out information about that.
1:01:14
If you're not already aware, definitely one of the major
1:01:16
players in the identity management space, the Cubit
1:01:19
conference, so people can find out more about that.
1:01:22
The 401 Access Denied podcast, so you can find that.
1:01:25
So I have a link to that as well.
1:01:27
And then I actually found a link to the Estonia Kratt AI bot, so.
1:01:31
Fantastic. You know, it's the, the, the
1:01:34
link will be there for people to find it.
1:01:36
I think it's such a cool idea and maybe we'll figure out how
1:01:39
to do one for our own website. Do the IDAC bot people wanna ask
1:01:43
questions or stuff like that? See what else for a wrap up, our
1:01:48
YouTube channel. We are starting to grow it.
1:01:50
We've just started doing video just within the last like couple
1:01:52
months. So if you go to idacpodcast.tv,
1:01:55
that'll take you right to our YouTube channel, or you can find
1:01:58
us on the web, IDAC Podcast, Twitter X, whatever it's called
1:02:01
when this hits your face or ears at IDAC Podcast and then
1:02:05
Mastodon at IDAC Podcast at infosec dot exchange.
1:02:10
Jim, did I miss anything LinkedIn?
1:02:15
Yeah, that's how we get great guests like this.
1:02:17
So if you got ideas, suggestions, introductions,
1:02:20
we're always happy to have conversations just like we have
1:02:22
with this. Joseph, any final thoughts
1:02:24
before we wrap it up? Absolutely, it's, it's always a
1:02:27
pleasure. I mean, it's been a long time
1:02:28
since we got the chat, so it's always a pleasure.
1:02:31
And can I, you know, to, to get your insights and, and you know,
1:02:34
the, the questions you're asking me really can I, it's for me, I,
1:02:37
I enjoy sharing the knowledge as much as I can.
1:02:40
And absolutely, you know, next time you want me on, I'm, I'm
1:02:44
here and available for you, for the audience and to to really
1:02:47
kind of, you know, help educate and bring the community
1:02:49
together. Perfect.
1:02:51
Yeah. Thank you so much.
1:02:52
So yeah, that's it for this week.
1:02:54
We'll wrap it up here. Thanks everyone for watching and
1:02:57
or listening and we'll talk with you all in the next one.
1:03:01
You've been listening to Identity at the Center.
1:03:05
We hope you've enjoyed the show. Make sure to like, rate and
1:03:09
review, and we'll be back soon. But in the meantime, hit the
1:03:12
website at identity@thecenter.com.
1:03:16
See you next time on Identity at the Center.