Latest / Identity at the Center / #415 - Identity Management Day 2026 with Jeff Reich

Transcript

#415 - Identity Management Day 2026 with Jeff Reich · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. I'm doing great, man.
0:18
Today's been kind of the day of focusing on conferences and the
0:26
show and I've been doing the scheduling.
0:28
I think that's the behind the scenes part that people
0:32
understand. I think you get it or you know,
0:34
how much work goes into the scheduling aspect of things and
0:39
it's inevitable you're going to have reschedules and things like
0:42
that. I don't know how it equates to
0:46
the the kind of the work that you do with the editing and all
0:51
the social media. But I will tell you it's it's
0:54
pretty time consuming. Yeah, I mean, it is what it is.
0:58
It is the hobby, the job, the 5:00 to 9:00 as you like to put
1:02
it, but it's more like 5 to 5:00 AM, the opposite of what our day
1:07
jobs are normally are. But look, I like doing it.
1:11
I think this is a fun and hopefully helpful resource for
1:14
people. Conferences are a lot of work,
1:15
but those are also fun and helpful resources.
1:18
You know, today we're going to talk about Identity Management
1:20
Day in a in a minute here. But like stuff like that is, is
1:22
cool and it brings community together.
1:23
So I enjoy it. And you know, let us say today's
1:27
April 1st. So I'm on the lookout for any
1:31
hijinks that might be going on. We have a April first episode
1:35
that was released earlier today. By the time people hear this
1:38
one, which I think will be April 13th, if I, if I recall, will be
1:42
a couple weeks past that some hopefully people will have
1:45
appreciated it. None in you know, not falling
1:48
for any hijinks, but I'm I have not seen too many, but have also
1:52
not been like on the news yet, especially like the tech sphere
1:55
to see like what things people have put out today for April
1:58
1st. Yeah, yeah.
2:00
But you know, as we're kind of working on getting ready for
2:03
these conference ISM I what's occurring to me is like how many
2:08
great organizations support the podcast 390 pro being the
2:12
official podcast ID pro Cooper recall with having us and you
2:18
know, kind of hosting us are really taking good care of us in
2:20
terms of getting ready for EIC as well as the cybersecurity
2:27
alliance, getting ready for Identiverse and what we're going
2:30
to be doing at Identiverse. And I think those details are
2:33
going to unfold, but we're going to, you know, make sure that we
2:37
have a good presence. And I'm of course, we'll do a
2:39
game show. And then our guest today, the
2:44
IDSA has been a partner with us for it's having more than five
2:50
years, right? We've had our guests on five
2:52
times as of today. Then we have Julie.
2:55
I think at one point Julie was the all time, you know, most
3:01
frequent guests. So I think that exceeded 5I
3:04
mean, obviously the podcast hasn't been around for 10 years,
3:06
but we definitely have gotten a lot of support from the IDSA as
3:12
well. Yeah, it's a, it's a, it's a
3:14
great organization. Very fortunate to be able to
3:16
have, you know, these types of things available to us as an
3:19
industry. So Yep, we got Identity
3:22
Management Day. It is tomorrow for people who
3:24
are listening to this for the first time on April 13th.
3:26
Identity Management Day is the 14th of April.
3:29
We're going to talk with Jeff Rich in a second.
3:30
I want to go back to the clouds to, to the EIC conference
3:34
because we have discount codes for that.
3:35
You'll find them on our website, our website.
3:37
I can't talk what's going on here.
3:39
We've got the Identiverse conference, which is a Cyber
3:42
Risk Alliance. Shout out to Shirley, she's
3:43
awesome to work with over on that side.
3:45
We actually have an improved discount, so it is now up to 30%
3:49
off early bird, I think might still be available by the time
3:53
people listen to this. You know, your early bird
3:55
chances may or may not have different levels, but we do have
3:58
a 30% discount now on Ideniverse.
4:01
So definitely hope to see people there like Jim mentioned will be
4:04
doing, you know, some sort of game show type thing as we seem
4:08
to be prone to do, as well as recording episodes live from the
4:11
Expo whole floor and, you know, taking in the the sights and
4:14
sounds of Vegas, which I know everyone just loves putting
4:17
myself. Yeah, I do love it.
4:19
I'm not saying I'm talking cheek.
4:20
I love it, but I know that that's maybe polarizing.
4:23
It's not. It's polarizing, but I did want
4:26
to give a shout out. You gave a shout out to Shirley,
4:28
who I totally agree completely. Awesome.
4:31
Totally supports us. But also Marina Kordash over at
4:37
Kardashian Control. What's that?
4:40
I'm probably saying it wrong. Yeah.
4:42
Marina's awesome. Yeah, my German is a little, you
4:46
know, a little little. So yeah, awesome person
4:50
supporting us as well. Yeah.
4:53
All right, Why don't we get in today's kind of focus, which is
4:56
Identity management day. Jim, you and I are going to be
4:58
doing some stuff around that, but we'll save that for a little
5:00
bit later. Let me introduce Jeff Rich.
5:02
He is the Executive Director of the Identity Define Security
5:06
Alliance, IDSA alliance.org. It's his fifth time on the show
5:10
with us. So Jim, you owe him a jacket as
5:13
well. We have to start printing
5:14
jackets pretty soon because we have a lot of folks who need
5:17
jackets. But welcome to the show, Jeff.
5:19
Thank you very much. Thank you.
5:21
And I'm waiting for that jacket. It's so thank you.
5:24
I'm looking forward to it. It's great to be back.
5:26
You know, you mentioned here's all the organizations that
5:29
support you and and you're obviously grateful for all that.
5:32
There's a reason that every organization in its industry
5:36
supports you. It's because one, you're great
5:39
guys to to just be with, you're just if you're just fun to hang
5:43
around with. Let's start with that.
5:44
But you really provide a a good service, a great service with
5:49
the podcast that focuses on everything that's going around
5:52
identity, everything around you because you're at the center
5:55
right. Great name too.
5:58
That was a smart choice and you do it in a real supportive way.
6:02
So everyone wants to find a way to pay you back.
6:05
So don't underestimate why that happens.
6:07
It happens for a reason. Well, that is flattery will get
6:10
you everywhere in this show, as I've said before.
6:12
Thank you so much for that. I was very kind.
6:13
Look, we do the show that we want to do and that we think we
6:18
enjoy doing, and we hope others do.
6:20
And, you know, we try to take yourself seriously too much.
6:24
You know, obviously identity's a serious conversation.
6:26
But yeah, we like to have fun and try to be approachable
6:29
because they think there's plenty of places to go to like
6:31
technical information and like, you know, read a spec, for
6:34
example. But a lot of identity happens
6:37
outside of specs. And so we try to be as
6:40
well-rounded as possible, even even sometimes straying into
6:43
like information security at large because some of that stuff
6:46
also effects how we do identity. And so, yeah, I appreciate that.
6:50
It's like I said, this is a great community.
6:52
It's fun to engage with. I would encourage anybody who
6:55
sees any of us at conferences or on the street or at the airport,
7:01
you know, come up, say hello. We're always happy to meet folks
7:04
that you know that are that are out there and and learn from
7:06
them. You know, I, I'm, I want to riff
7:10
off one thing you just said before we get into any further,
7:13
I guess I'm going to take us there.
7:15
The, you mentioned, you know, people and how it's always
7:19
people that are making it. We just recently did one of our
7:22
webinars which was an Identity Management day preview.
7:25
And you know, identity Management Day is broken up into
7:28
three regions, Oceana, Asia, Europe, Middle East and Africa
7:32
and the Americas and, and we follow the sun basically, which
7:36
is why it's a 21 hour event. It's 21 hours of identity.
7:40
Goodness is a term that we use. And I had representatives from
7:44
each of the three Co chairs, Identity XP in Melbourne,
7:48
Australia, Amada in, in Copenhagen, Denmark, and saving
7:52
it here on the West Coast and in the US, the three Co chairs for
7:57
the three regions. And we talked about what makes a
8:00
good conference and what to look for in each one.
8:02
And, and I'd, I'd like to have an opportunity to talk about
8:04
what some of the highlights coming out of each region, I
8:07
think this year. And then I asked at the end, I
8:09
got them all together and I said, so what's the one thing
8:11
you really need to focus on maybe for the next 5 years?
8:14
That's the most important component of, of identity and
8:17
making it work going forward. And all three had a slightly
8:20
different version of saying people, even though AI and non
8:25
human identities and agentic identity is there.
8:28
You know, I was at of the RSA Conference last week, a couple
8:32
weeks ago when you're seeing this and I challenge people to
8:35
find a booth that didn't have AI on the banner or agentic on the
8:40
banner and no one could find one.
8:42
So we're there. This is where we are now.
8:45
That's good. We have to, we recognize that
8:47
even with all that, everyone that knows how to make it works
8:50
is the most important part of what we need to do going forward
8:53
as people. So, and you help make that
8:55
really I'm, I'm not going to try to, you know, butter you up
8:58
anymore, but that really is the key.
9:00
You know, butter away my friend, I'm slather it on.
9:04
Look, you know, we get lost sometimes in technology.
9:08
So but we forget the actual word is identity.
9:12
Identity is, you know, it has been human for a very long time
9:16
and it's now extending into other areas.
9:18
But yeah, it's, you know, it's people, it's process, it's
9:20
technology, it's a whole bunch of different things.
9:22
And you know, we we definitely should probably like just jump
9:25
right into, you know, what is identity management day?
9:28
You've got some themes that kind of set up before we do that
9:31
though, because people might not be familiar with IDs Alliance,
9:35
maybe just to give us like a quick 32nd on kind of what it is
9:39
and and why you put on this thing.
9:41
I'm happy to so IDSA identity to find security alliance has been
9:44
around for seven years or so to answer your Julie question
9:48
earlier. And our our mission is to we're
9:53
a non profit and we focus on raising the level of security
9:56
and identity security awareness around identity.
10:00
That's it. That means may seem like a
10:02
simple mission, but it has tentacles that reach everywhere.
10:06
As you already said, it's security, it's people, it's
10:08
process, it's software. Everything that happens now,
10:12
whether it's from a machine or not, has an identity associated
10:15
with it. So we either have research
10:18
papers, working groups, educational webinars on how
10:22
we're going to deal with this, and about 90% of what we do is
10:26
available free to the public. You guys do a lot, but I'd say
10:30
the identity management day is kind of your Hallmark event.
10:35
Give us an overview. You talked about the different
10:37
regions, but give us the 411 of what's going to be happening
10:42
during Identity Management Day. It's a good question and thank
10:46
you. That is that in our annual
10:48
research paper which we published in September.
10:50
Those are our two big events and with Identity Management Day,
10:55
you know, it started off as an 8 hour event focused mainly on the
10:58
Americas and we have expanded that into the three regions
11:03
because there were people interested and they said, hey,
11:06
can we have an identity management day too?
11:08
And the answer really should have been no, we don't need
11:10
multiple ones, we need one huge 1.
11:13
So that's what we're left with. So Identity XP in Melbourne,
11:16
Australia approached us first and said we want to do this with
11:19
you. So what you're going to be
11:21
seeing there And they, by the way, I have a hybrid event.
11:24
They're the only hybrid component of what we're doing.
11:26
They have an in person event in Melbourne where they have
11:29
speakers and some sponsors and we stream all of that as part of
11:33
the online 21 hour online event. So some of the speakers you're
11:38
going to get there are from and Australia ends up being a a
11:41
different animal for a whole bunch of reasons.
11:44
You know, they're a large area, they're not necessarily densely
11:47
populated and as a result when there's an identity issue there,
11:51
it affects almost everyone. You know, the IT scale has a
11:56
different meaning. Their scale hits everyone pretty
11:58
quickly. So they take a slightly
11:59
different approach. It's a good healthy approach to
12:02
what they do, but they work a lot.
12:04
A lot of the vendors work more closely with each other there I
12:07
think then I seen in other regions, although it does happen
12:10
everywhere else too because of that.
12:13
And there is a certain amount of geographical isolation that's
12:16
there too. I mean, certainly the Internet
12:18
makes everyone available, but there's a component to you're in
12:22
Australia or you're in the rest of the world world.
12:24
So I, I like the approach they take it.
12:27
And what you're going to see coming out of that I think
12:30
really focuses on what some of the regulations are going to be
12:33
there. And you're also going to talk a
12:34
bit about the rest of Asia as well, what the impact of issues
12:38
are and what the most recent breaches are.
12:41
They specifically still talk about what's the latest breach
12:45
we've had. If you compare that to the
12:47
Americas, for instance, it that's not as big a deal for us
12:51
anymore. And it's sad because it's, it's
12:53
just accepted, Yeah, which one happened today.
12:56
But they're they're a little more rare, but they have a
12:58
larger impact. So I think you're going to see
13:00
that focus there along with a lot of nice young people working
13:05
their way up into the industry. And I'm going to talk even more
13:08
about that in just a minute. So that's what we have going on
13:10
in Oceana Asia as we move to AMIA with AMADA hosting that out
13:16
of Copenhagen thinking. I really love the fact, by the
13:19
way, on that webinar they talked about we had someone from each
13:21
of the three regions. We had four unique dialects on
13:24
that webinar. And that made me giddy.
13:27
I'm, I haven't quite figured out why, but it made me feel like we
13:30
have people from all over the world here and they're all
13:33
interested in the same thing. It's fantastic.
13:36
So what you're going to get to see out of them, out of Amia is
13:40
some great headliners. You mentioned Kubaker, Cole,
13:44
Martin. Kubanker's going to be there.
13:47
Simon Moffett's going to be there speaking.
13:50
Paul Walker's going to be there from Amada.
13:53
Mr. NHI Lolit Choda is going to be there and Paul's going to be.
13:57
Not only do they have sessions, Paul's going to be leading a
13:59
panel with those other three. That is going to be a powerhouse
14:03
panel when you think about those 4 individuals.
14:06
So, so Jeff, let me just interrupt.
14:08
When you say they're going to be there, you mean they're going to
14:11
be on site in Denmark or virtually They're going to be
14:14
there. They're going to be online.
14:16
The only on site component we have is in Australia.
14:18
So everything else is online. They're going to be just like we
14:21
are here now and I count this as here, so or there depending on
14:26
on your perspective. I was going to say, if you need
14:29
somebody to go to Denmark, Jeff and I would volunteer for that.
14:33
Just keep that in mind for such an awesome city.
14:37
Such an awesome city. It's because you get so much of
14:41
the old, you know, old and it's still intact old world beauty,
14:49
charm, architecture, everything else.
14:51
And then you go 2 blocks away and you have a brand new
14:53
shopping strip center with really nice shops, but they all
14:57
blend there. There is, you know, it's not the
14:59
one versus the other and, and Tivoli Gardens every it's a
15:02
beautiful place. I, I love Copenhagen, in case
15:04
you couldn't gather that. So, and it sounds like you do as
15:08
well. Again, open invite if you want
15:12
to have Jeff and I travel to Copenhagen next year or to
15:16
Australia. We love the people and we'd love
15:21
to come and spend time with them in person.
15:24
Hold on a second. I haven't been to either and so
15:26
I don't know if I love the people yet or not.
15:29
Let's say I like the people. Let's just say that you're
15:32
willing to try. You're that's fair.
15:36
You're open to it. Yeah, I'd love to go.
15:39
You've never been to either place, and I'll go to, I'll go
15:41
to anywhere at least once. But yeah, for sure.
15:44
I made, I just made a note that I'll keep that in mind.
15:48
So I, I talked about the powerhouse we're going to have
15:50
into Mia, You know, you plus we have other good speakers too.
15:54
I'm not trying to diminish anyone else, but those are three
15:56
or four names that if you're in the identity industry and you've
15:59
been in it for, you know, a couple years more, you know,
16:02
those names, you've encountered them before one way or another,
16:05
even what they write or presentation or online things.
16:08
And then we move to the Americas and we have some great speakers
16:12
here as well. Without question, some of them
16:15
we have. Enrique Teixeira is going to be
16:19
there, another one of those big names that if you've been doing
16:22
this, you know, you know who they are.
16:23
We have other great speakers. There's one I'm going to point
16:26
out in particular, though. We have an 11th grader that's
16:30
going to speak. This is the first time we dip
16:32
down into another age group, really, although I guess you
16:35
could say with me starting anyone else is a different age
16:38
group that's in this industry. But we were approached by an
16:43
11th grader who wrote a paper on cybersecurity and neuroscience
16:50
and how one really feeds the other.
16:53
And we read it. And, you know, so I've, I've, I
16:56
was director of operation for a Research Center at University of
17:00
Texas San Antonio for a while and, and got engaged with, you
17:04
know, students and post docs and, you know, dealing with
17:08
this, I judge science fairs. It's one of my favorite hobbies.
17:13
And I saw this paper and said, wow, this is it makes me feel
17:17
good. I hadn't even met her yet.
17:20
Because wow, Assuming we leave enough of the earth to to
17:24
survive, it's going to be in good hands.
17:27
Because there there are people like this that are in in 11th
17:30
grade. And at least you didn't just
17:32
start now that are not only brilliant, but can apply it and
17:36
say, here's what the real world means.
17:38
As opposed to either I did research or I used, you know,
17:42
ChatGPT to write a paper, you know, or whatever else is going
17:45
on right now. I know that we're, there are
17:47
people that are capable of, of a continuing the earth in a really
17:51
good way. So I'm, I'm to me, as much as
17:54
all the other figures are going to be fantastic.
17:56
That's the highlight I'm looking for.
17:58
Yeah. Let me follow up on that because
18:01
another organization that I forgot to mention that we
18:04
partner with that heavily partner with is Die AF and they
18:09
sponsor young folks who are in their education process or right
18:14
out of school get into the identity industry through the
18:18
conference exposure. And I mean, Jeff and I have met
18:22
several of the people that they've chosen and they've
18:26
played a role in these conferences and super brave
18:29
people. I guess I've kind of come with
18:31
the same optimistic perspective that you just mentioned, Jeff.
18:39
Yeah, it it makes me happy. It makes me feel good because
18:43
whatever I've done and time will be the judge of whether it's
18:48
even noticed. I'd like to think I've done
18:51
something positive. All of us want to feel that way.
18:53
But what makes me feel even better is whatever state we
18:56
leave it in, it's going to get better.
18:58
So it's, it's a wonderful feeling.
19:01
Yeah, and I think you're you're doing a big thing with this
19:03
identity management Day. And like I've seen the
19:06
progression of it. You talked about those people
19:09
who are participating. You know, maybe this becomes an
19:12
official holiday one day because that's kind of the way I look at
19:15
is like identity management Day. Like I'm an identity management,
19:19
I'm practitioner. This is a day to celebrate me
19:21
and my ilk, so that's for sure. Hey, one thing that we talked
19:26
about, you know, in preparing for the show is that you have
19:30
the theme for this year. And can you talk to us a little
19:34
bit about that theme? Happy to talk about the theme
19:37
first of all on the holiday. I like the idea, but because I
19:40
run Identity Management Day, I'm not going to get the day off so
19:46
well once I come up with a way to do that.
19:47
But in any. Case Santa Claus of Identity
19:51
Management Day. Santa works on Christmas Eve and
19:55
into Christmas morning. Yeah.
19:57
That's the deal with the Jeff. And if I get the rest of the
19:59
year off, then I'll take it. OK, that sounds good.
20:02
The theme for Identity Management Day this year is
20:05
Finding Identity, The Search for You, Me and the Machines.
20:11
And allow me to expound on that a bit.
20:13
If you think about it, especially with everything we've
20:15
already talked about so far today, you can see how it makes
20:19
sense because identity has been human based since the, the dawn
20:23
of, of humans, right? And that's good carbon based
20:25
identity, pretty easy to understand.
20:28
Whether you have to go down to DNA or not, you still know what
20:30
it means. But now there's you and me,
20:33
which means now we have interaction between identities,
20:36
which brings up seems like authentication and
20:40
authorization. How do I know that you are Jeff
20:43
and Jim, other than the fact that I know the two of you?
20:45
And I'm still convinced AI is not yet good enough to to
20:50
replicate both of you at once. There aren't enough computers to
20:53
do that effectively. So authentication, validation of
20:58
who someone is, that's a big challenge.
21:00
Now it's bigger than before because of scale in the
21:03
Internet. You know, me dealing with
21:05
someone in Copenhagen, authentication wasn't an issue a
21:08
long time ago because I could use a third party source.
21:11
A lot of time elapsed between the beginning and the end of the
21:14
transaction. Now they're instantaneous.
21:17
So it is big deal. And then the machines come in
21:21
because of what's going now with agentic identity and non human
21:25
identities and machine identities.
21:28
And I actually treat all three slightly differently, even
21:30
though they're all closely related.
21:33
It's an identity that may or may not be associated with a person.
21:39
It may be directly associated with a person and it may pretend
21:44
to be associated with a person, but really isn't.
21:45
I'll use deepfake as an example there that we were already
21:49
referred to once I happened to, I was at a the Deepfake summit
21:53
about a month ago in Houston and a lot of experts getting
21:57
together and talking about deep fakes and how do we deal with
21:59
this problem? Is it a problem?
22:00
Have we solved it? What's going to happen next?
22:03
And even with all the best minds around this in one room, when
22:08
the questions asked, what are we going to do from here, most
22:11
people still stared into their group and like, I really don't
22:14
know yet. So, so tie all that together.
22:19
We need to find identities, not only our own, but what every
22:23
identity we deal with and find a way to get a level of trust and
22:28
authentication with it so we can do things that we have
22:32
confidence in. And I, I don't if you, I don't
22:35
know if you heard this, I'm going to paraphrase it.
22:37
Recently Fed Chair Powell in the US at his at a press conference,
22:43
which would now would be a few weeks ago, made a statement
22:48
about confidence, consumer confidence and the definition to
22:51
use. And I like I'm paraphrasing, so
22:53
don't, I'm not quoting him, but confidence is a feeling you get
22:56
right before reality hits. And I think that works.
23:03
And if that may be, what if you remember for more than anything
23:06
else, we lack confidence in the identity industry.
23:11
And that's our theme for this year.
23:14
Not to be like confidence, but we need to get around it.
23:17
Let's talk about AIA little bit because I, you know, it's kind
23:20
of permeates everything and I, you know, I get it.
23:23
Like we've been talking about AI for a long time, especially on
23:24
this show. We joke about it being AI at the
23:26
center sometimes, but it really has permeated like every single
23:30
discussion. Even in my day job, like, you
23:33
know, as a consultant in identity, every single client
23:36
that I'm talking to is asking me about AI and permissions and
23:40
access and how are we going to secure these things, You know,
23:44
just from a valid use perspective, let alone we start
23:47
thinking about things like deep fakes and, you know, nefarious
23:50
ways to get identity into a situation that we don't want it
23:54
to be in. I'm curious, like, are you,
23:56
where do you fall right now from a optimist, pessimist, somewhere
24:02
in the middle? Like, how do you currently feel
24:05
about the way AI is impacting identity?
24:12
So where I fall is right on the ground, but because gravity
24:17
works. But so I'm going to answer with
24:21
what we're doing at IDSA around that because although I don't, I
24:26
don't create all the work that comes out of our working groups
24:30
as an example, but I do offer some guidance and sometimes they
24:33
take them, sometimes they don't. But it's still, it's IDSA
24:37
output. And we have two working groups,
24:39
one that's AI and identity, pretty straightforward one would
24:43
think. And we have another one that's
24:46
machine and agentic identities, which on its own seems pretty
24:51
straightforward as well. We have two groups working on a
24:54
framework, what they want to publish and what it's going to
24:56
mean. And we discovered they aren't
24:58
first of all, they're not silos, but they're not even close to
25:01
being silos. There is a lot of overlap.
25:03
We're not merging the groups. There is enough work to do
25:05
uniquely create deliverables out of each, but AI ends up being
25:11
across the board. So if for an example, should we
25:16
focus on AI for IAM or should we focus on IAM for AI that there's
25:24
one simple question that I can drop with those groups that's
25:28
six months work? I don't think we can ignore
25:32
either though. No, no.
25:33
And I'm not suggesting we do. It's six months worth to really
25:36
get into yeah, you can find, oh, here's a tool that can do IAM
25:39
for AI today and then there's going to be a new AI function
25:43
that comes out next month and it won't work for that.
25:46
That's why it's going to be a six month effort.
25:49
And we need to be at the higher framework level rather than at
25:52
the tool level. And it's something that as much
25:55
as most of our members are identity vendors and I love
25:58
them, do most of them focus on because they have a business to
26:03
run getting it a product out that can do that.
26:07
I look at most of what's out there today as bridge solutions
26:11
for that reasons. We're, we're no, we're done.
26:13
We're just really into as much as we think we're fully into AI
26:16
and what's happening every day, we're still just dipping maybe
26:19
our first two toes in it. We are not into it yet.
26:22
So I think what we haven't done a good job of is really take a
26:27
step back and say what is the overall architecture and
26:32
structure and framework without having to get technical about
26:34
it. How do we want to make it work
26:37
for ourselves? And that ends up resulting in
26:39
many cases and guardrails. And I would offer, and you may
26:42
find this, Jeff, and in your consulting that when I talk to
26:47
any organization about what do your guardrails look like for
26:51
your AI, Those are the people who say, how do I manage this?
26:56
Well, there's the beginning of your answer without guardrails
26:59
and doesn't have to be technical guardrails, but just saying,
27:01
here's what I want AI to be able to do.
27:04
And you by definition, I don't ever wanted to do anything else
27:08
or I want to do these three things and explore in this area
27:11
and which can be very advantageous.
27:14
When you set that up as your ground rules, then you have to
27:17
find those tools and implementations that can help
27:20
you accomplish that. When you can't do that, what
27:23
you're doing is saying, well, I'm just going to use AI because
27:26
I'm going to save money, because it's faster, because it's cool.
27:30
All those reasons are there, but it will grow teeth, get right
27:33
behind you and bite you. Well, I think we we know what
27:37
happens when an AI runs amok. Just see our April first episode
27:42
and opens. Having some issues with that,
27:45
you know. Yeah, it's, it's it's a tough
27:48
question to answer right now because I don't think people
27:52
really know what the answer is. I think we're trying to apply
27:55
principles that we've learned across the decades of identity
27:58
management and security in general to say, hey, here's how
28:01
we think it should work, but we just don't know yet.
28:03
This is still link so quickly. I'm curious if you've heard
28:07
anything like are there themes that you're picking up from the
28:11
conversations you're having with either vendors or other members
28:14
of IDs Alliance or even working groups and things like that to
28:17
say, hey, we know we don't have the full answer yet, but you
28:22
mentioned guardrails is right as an example, like other other
28:25
things like that that are starting to sort of surface,
28:28
maybe that might be options in how we secure identities like
28:33
that. Yeah, there's a few things I've
28:36
seen come out and, and the one that stands out to me, even
28:40
though it, you may not think of it as standing privilege.
28:43
Standing privileges is a, is a principle that this industry's
28:47
been using for a very long time saying here's either an
28:49
individual or a process that always needs to get exemplary
28:54
things done and they always need to be able to get that done.
28:57
Well, standing privilege to me is beginning to crumble because
29:02
the processes that are going to be used, that need that
29:04
authority can be ephemeral. You could have a Kubernetes
29:07
container that's going to perform something that needs
29:11
full admin authority and it'll only last 1 1/2 seconds and then
29:15
it's gone. It as in it just no longer
29:18
exists, that all the resources have been allocated to something
29:21
else and it's now maybe in history or maybe not.
29:24
Did you log it? Do you have any?
29:26
Do you have any control over what it was going to do and do
29:30
you have any observability of what it did?
29:32
So I'd say that's the first principle that I'm seeing coming
29:35
out of this is what do you do with standing privilege?
29:38
That leads to my the second observation, and this one's a
29:41
personal one, not what I'm getting from members.
29:44
I believe Pam or privilege access management as we have
29:48
been using it is obsolete. It may not feel that way
29:53
everywhere yet, but the reason I feel that way is everyone and
29:57
everything is now privileged, even if it's for a very narrow
30:01
focus. Typically a privileged account
30:04
was, you know, you had sys admin you could do anything to for
30:07
every. First of all, you can't even get
30:09
your arms drawn everything right now and that environment is
30:12
fluid. You know of the the containers
30:14
is an example. It changes all the time.
30:17
So privileged access now has to mean who can do the things that
30:22
can really 'cause damage. That's how I define privilege.
30:26
That becomes virtually everyone. So I'm not saying don't manage
30:30
privilege of access. I'm saying treat everyone as if
30:33
they have privilege and manage the access that way.
30:37
So that's a personal observation of mine.
30:39
Jeff, it looks like you have something to say about that.
30:41
Yeah, so interesting. I think the Standing privilege 1
30:44
is definitely one that, you know, we've talked about for a
30:46
while and that the Holy Grail destination would be something
30:50
along the lines of a 0 standing privileges environment.
30:53
It makes sense, right? Don't give access unless it's
30:56
needed at the time you need it and then take it away.
30:58
But the realists in me is like, look, I've worked for large
31:02
organizations. I work for a large organization.
31:04
To do that is just not going to happen because companies are not
31:10
built, they're not automated enough from an identity
31:14
infrastructure standpoint and from a business engagement and
31:18
logic standpoint to say, OK, well, what do you mean?
31:22
And won't have the access. Well, trust me, you're going to
31:25
have it because we're going to grant it automatically because
31:27
we've been vested in all these tools to make that automation
31:30
happen. A lot of companies haven't.
31:33
They are still, you know, they may not have invested in an
31:37
identity governance tool, right where they're still doing like
31:39
manual joiner mover Weaver functions or maybe they did, but
31:43
they only took it to like Active Directory and that's it.
31:46
They haven't connected like the 500 other applications that they
31:49
need. And so while I I like the idea
31:52
of it, I just don't know if it's a realistic destination for most
31:57
organizations. I'm a fan.
32:01
You should be trying to get there.
32:02
I just don't know if you can if it if it's realistic as a goal
32:04
for most people when it comes to that.
32:07
Well, that I think I was going to pick up a little bit where
32:10
Jeff finished off there because I was thinking the same thing,
32:13
which is and I think you were trying to come out strong about
32:19
privileged access management because if you truly have 0
32:23
standard privileges, right, then traditional approaches to Pam
32:28
probably don't add a whole lot on top of that.
32:32
I just saw this video the other day.
32:34
I don't know if you guys remember the the cheating
32:38
scandal on a website called Ultimate Badge.
32:41
So this is like in the early 2000s, they had for the System
32:46
Administrator something called God Mode.
32:48
And the God Mode was like you could sit at a table and see the
32:52
cards that everybody had. Well, one of the founders of
32:55
this website, this betting site had access to the God Mode
33:01
application. Now you start thinking like, OK,
33:04
well, I can think of 15 different ways that we could
33:08
have put the stop to that, right?
33:09
We could have been logging how often the account was used.
33:13
We could have done check in, check out a password for it,
33:17
which is like traditional privilege access management type
33:21
things. So I was just thinking like, all
33:25
right, well, if you can't get to 0 standing, I, I kind of have
33:31
the overall philosophy. Don't let perfection get in the
33:34
way of getting better. And I kind of feel like at least
33:39
I I agree with you, the journey ought to be towards your
33:42
standing privileges. But I think kind of traditional
33:46
Pam gets you better than you are today.
33:50
And just staying a step ahead of everyone else is usually like,
33:55
you know, if you look at any of these safari videos in Africa,
33:59
right, it's the lions always go after the slowest Buffalo.
34:05
Don't be the slowest Buffalo. So that's all I was thinking as
34:09
you were talking about this thing.
34:11
So you, you both think valid points and I don't want you to
34:14
think that. I was suggesting that by June
34:17
1st, we need to have no standing privilege.
34:19
I'm not suggesting that at all. But I do think it needs to be
34:22
the vision and the goal in the same way.
34:24
And I'm going to use a similar example.
34:27
And we're not there yet. I've been doing this for close
34:29
to 50 years. All right.
34:31
And about my second year in, I remember saying we need to kill
34:34
passwords. I think passwords are finally
34:36
dead. I've been hearing that for over
34:38
40 years and it has been a goal, it's been aspirational.
34:45
We are actually starting to get there.
34:47
It may still be an asymptotic approach and we may be, we may
34:51
be just be cutting the distance between US and no password by
34:54
half, but there's always still another half we can, we could
34:57
cut, but the only way we're getting there now is through the
35:02
persistence of division that passwords alone don't give you
35:07
good security. And, and we've all known that,
35:11
but we never had a better solution.
35:12
Now between pass keys and tokens and you know, hardware keys and
35:19
server to server authentication and other tools that we have, we
35:23
can start saying you don't necessarily need to know a
35:26
password. And that's a good thing.
35:29
You know, the next thing we need to get rid of maybe our SMS
35:31
authentications, but that's another, maybe another, another
35:34
podcast, another show. So by staying aspirational on
35:41
killing the password, I think we can be aspirational on killing
35:44
standing privilege. And I think we'll reach it
35:47
faster than the journey it took us to get rid of passwords.
35:50
And we're not done with it yet, but I think we are.
35:53
And actually, I don't think they're ever going to complete
35:55
the go away, but I think they'll become negligible.
35:59
Well, in an effort to become even more opinionated than I
36:01
already am, I feel like this is another situation where we have
36:07
a lot of great concepts in identity.
36:09
So 0 standing privilege, privilege, access management,
36:12
identity governance, continuous identity, you know, zero trust.
36:16
And now we've got, you know, AI and stuff like that.
36:19
If I'm a, if I'm a real organization, I'm barely keeping
36:23
up with any of these things. And so pass keys are, are, are a
36:27
great example of that. Nobody likes passwords.
36:29
They just nobody likes them, right, Because they're, they're
36:32
not a great solution. It's just what we have.
36:35
And so it's OK, great. We've got this thing called
36:36
passkey. Let's get it start getting
36:38
rolled out. You know, Fido Alliance has done
36:40
a great job of like pulling, you know, major industry players
36:42
together to get a standard in place and get adoption
36:46
capability in place. That took years to get it done.
36:49
And it's still, you know, further out for a lot of other
36:52
folks that just are now starting to think about it because
36:55
they've been working on, you know, let's call it, you know,
36:59
user life cycle things for the last decade because that's what
37:02
they were told a decade ago they need to start working on.
37:05
And so it, it will never move as quickly as any of us want it to.
37:09
And that's why I have to. I, I, I tend to be more
37:12
conservative when it comes to timelines.
37:14
It's like, OK, is this the year the password dies?
37:17
Yeah, we've been saying that, you know, like you said, Jeff,
37:18
for like the last 10 years, it seems like.
37:20
Right. And every year it's like, OK,
37:21
this is the year that's going to finally die.
37:23
No, it's not. Test is going to be around for a
37:25
while because we're going to, there's going to be people who
37:26
can't use pass keys, there's going to be other authentication
37:28
methods, whatever. But we are making progress and
37:32
sometimes that progress gets lost when we look at it from
37:37
like the day-to-day view. So if you look at it every year,
37:40
every two years, every three years, like are we better at MFA
37:43
than we were five years ago? Heck yeah.
37:45
Because we had to be because of COVID.
37:47
COVID pushed a lot of companies into the MFA world because they
37:52
had to be secure because all their workers were all of a
37:55
suddenly doing remotely, you know, remote work.
37:59
There wasn't that, you know, punch in the face.
38:02
That was like, hey, you've got to get out there and do this
38:03
right now, except for that. And so there will be other
38:09
triggering events like that, but I feel like we'll drive adoption
38:13
and, you know, maybe it's AI. We're seeing a lot of effort put
38:17
into this to say, OK, well, how are we going to secure this
38:19
things? Because we've also been
38:21
designing identity systems and identity, you know, programs
38:25
around human scale. And that means speed of humans.
38:30
AI doesn't work at human speed, right?
38:31
So what it used to be is like days, weeks, months, years.
38:34
Now it needs to be nanoseconds, milliseconds, seconds is like
38:38
the greatest, you know, scale, you're doing things.
38:40
So I think there's, I think there is this idea of like,
38:44
well, there's so many shiny things.
38:45
What do I grab onto? Like is it, I've been hearing 0
38:47
standing privileges now for a while.
38:49
I'll do that. And then now someone tells me I
38:50
have to do there's other things. Oh, you know, it's almost like
38:53
I'm a kid in a candy store and I can't pick which one.
38:56
Yeah, I want to go after. Well, Jeff, you know on that if
39:00
you're in a candy store, you're a kid in a candy store and
39:02
you're told you can pick a candy, that doesn't solve
39:07
anything except you get some candy right now.
39:09
And isn't that wonderful? I'm getting my Snickers bar man,
39:11
that's what I'm picking and that's I'll be happy with that.
39:14
You're in a candy store and you go for Snickers.
39:17
Snickers is the best candy in the world.
39:18
And I will come at me and in the DMS on LinkedIn.
39:21
I'm I'm. They're open and.
39:22
You're the nougat peanut chocolate guy, right?
39:24
OK, that's fine. I, I'm not judging.
39:30
Well, maybe I was a little, but I don't want anyone to think
39:35
that I'm a purist on this. I'm not.
39:37
I, I know what it takes to be able to.
39:40
I like to think I've seen at least what it takes to be able
39:43
to make a, a seismic shift like this, and that's exactly what it
39:47
is. But the only way we're going to
39:49
get there is to just push, you know, a millimeter a week and
39:54
maybe that's all it's going to take.
39:56
But we will never make the progress unless we do that push.
40:00
So everything we do, I think needs to at least be leaning
40:02
that way. Now to your question about a
40:05
small organization that starting off, they're going to be a
40:08
software shop. How do I, they're not going to
40:10
be able to get all of this. They can't be that leading edge
40:13
on everything because you're not an identity shop.
40:15
It's not what they do. So rather than buying 8
40:19
different pieces of software, they're going to conflict with
40:22
each other and not give them the result they really need what
40:26
they need to do. And this goes back to the
40:28
fundamentals of, you know, I was a programmer before you were a
40:31
developer. You were called a programmer.
40:33
I was a programmer a long time ago.
40:36
And what we had to do at the very beginning was completely do
40:40
before you even do pseudo code something else that's a foreign
40:42
word. Now you had to come up with a
40:45
flow of what needed to happen and it had to include what needs
40:49
to be included in that and what things need to be excluded.
40:52
And that may be the world needs to be excluded except for what
40:55
I'm working on. We don't do that very well
40:57
anymore. And faster computers and AI have
41:01
gotten us there. And I don't want to single back.
41:03
I'm not that. Oh, back in the day, we get it
41:05
better. No, no, no, we didn't.
41:07
Because I used to have when I, when I broke code, I had one and
41:11
it was on cards, OK. And I had one test run a week,
41:16
and if I had a JCL error that just caused it to fail at the
41:19
beginning, I had to wait another week before I could test the
41:22
program again. Can you imagine a developer
41:24
having to deal with that today? No, that would be stupid.
41:28
You can. You can run it and then run
41:29
again and you find a new area and keep finding whoever is.
41:31
That's great. But we are still skipping the
41:33
fundamental how do we structure it?
41:35
What does it need to do? What's the regression testing?
41:38
And boy, we really got off the track from identity here, didn't
41:41
we? Yeah.
41:42
But I wanted to weigh in before we completely move on.
41:44
So Jeff talking about something that is totally legitimate, the
41:50
zero sending privileges, because Jeff and I are pragmatic by
41:55
nature, we work with clients. We never identify clients
41:59
obviously during our podcast, but we do a podcast and we work
42:03
with some cutting edge clients that are doing continuous
42:06
authentication that are doing shared signals framework that
42:10
are doing 0 sending privileges, right?
42:13
They're the ones who have budget.
42:15
We also work with clients where you talk to them and you find
42:19
out, Oh my God, they have the passwords in an Excel
42:22
spreadsheet, but the Excel spreadsheet is, is password
42:26
protected. It's like, Oh my good Lord, what
42:30
are we going to do? You have to be able to, as a
42:34
practitioner, you have to be able to adjust to this scenario.
42:39
But you can't say, well, the world is we're dealing with the
42:42
spreadsheet or the world is that we're dealing with just the
42:47
cutting edge. It depends on the, where the
42:51
client is, you know, the, the, I keep bringing it up and I, I
42:55
wish I knew who to attribute it to.
42:56
But he talked about the, the information security poverty
43:00
line. And there are organizations that
43:02
are below the poverty line. And I see organizations like
43:06
that. And I've worked with some in the
43:08
past. And essentially, like if
43:10
Microsoft offers it as part of ENTRA, as far as their ENTRA
43:14
license, it's like now we have something we can implement,
43:18
we'll do that. And I see other organizations
43:21
who are, you know, like, hey, we'll take a chance on some of
43:25
this stuff because this might be the next big thing.
43:28
And not only that, but we have a real world use case now that
43:33
can't wait. And we're going to, you know,
43:36
take a risk that this company might not be around in the year.
43:41
Here's my Here's my thought on this.
43:42
I think we all want to be there, right?
43:45
And, and hopefully that's, that's, that's coming across as
43:48
like, yeah, like these are all great ideas and we definitely
43:51
want to get there. My problem that I have with this
43:54
is that it's easy to get distracted.
43:58
It's the new shiny thing. Oh, I've got to do that.
44:01
And I didn't do any of the basics to get there.
44:04
I'm still doing faxes for onboarding.
44:07
Like what? And yet you want to do like this
44:09
other crazy, you know, advanced thing over here.
44:12
Get the basics done first and then start looking at the other
44:16
stuff because those shiny features assume that you've
44:22
already tackled the basics. Like 0 standard privilege is
44:25
actually a great example of this.
44:26
It's like, OK, the only way to get 0 standard privilege is
44:28
through automation. Full blown comprehensive
44:32
automation across all of your systems and it's rock solid and
44:36
it works all the time. If you can't, if you're not
44:39
doing that today, good luck with standing privilege.
44:42
I mean, 0 standing privilege, like that's just not going to
44:44
work for you. And so that's kind of like where
44:45
I, I see a lot of organizations struggle.
44:47
It's like, yeah, like these are all great concepts.
44:49
You should be moving towards that, but get the basics done
44:53
1st and then start to think about how you're going to extend
44:58
past that. Because we get the basics done,
45:00
chances are you're going to be pretty compliant with whatever
45:02
you need to be client with as long as you're doing the basics.
45:04
That's going to get you 80% of the way there at least.
45:07
I completely agree with you. And it still goes back to figure
45:10
out what you want to do and stop focusing on things you that
45:15
aren't core to what you're trying to do but seem sexy.
45:18
And maybe it may look great, but it's going to take you away from
45:21
your core and now you're going to be doing two things poorly.
45:25
I can tell you we moved away from Identity Management Day,
45:27
but this is a great conversation.
45:28
I think these are the types of conversations that I think
45:31
people around the world are having in their own little, you
45:33
know, in their own rooms, your own conferences and things like
45:36
that. So it wouldn't surprise me that
45:38
we hear some of this on Identity Management Day.
45:41
Is that fair, Jeff? Oh, I, I think you can expect
45:44
it. I can guarantee it, because
45:47
you're not just going to see, hey, here's the greatest new
45:49
identity tool. You're going to see some of
45:51
that. But Jim, to your point, we live
45:54
in Gray. We live in the Gray area there.
45:57
There are, if you're at the extreme, you're actually missing
46:01
out on a lot. So you have to live in the Gray
46:04
area. Speaking of Gray area, what a
46:06
transition Gray area makes me think of quantum computing and
46:11
cryptography and quantum computing.
46:14
So we've already gone pretty long on this show, but I did not
46:19
want to not ask you this question because you have some
46:23
great thoughts on this that you want to share.
46:27
My big thing is like the quantum fears are making people start
46:32
worrying about whether or not Bitcoin is going to be broken at
46:36
some point, right? Is Shaw 256?
46:40
We know it's not going to, you know, be the the king of the
46:44
Hill forever, right? And we're going to use something
46:48
quantum. What resistant or quantum proof?
46:53
The term I would use would be quantum resilient, because in it
46:58
would be, it's becoming somewhat cliche, but you can't, you can't
47:01
stop it. You can't stop what's going to
47:03
happen. It's no different.
47:05
It's an arms race, all right? If you have a weapon and your
47:09
opponent has the same weapon, you're going to want one that's
47:12
a little better and they'll want one that's a little better than
47:14
yours. So that's really what's
47:16
happening here, although it doesn't have to be based in
47:18
evil, although in some cases it is.
47:21
So I go back to, I think at one point, and you and I may have
47:25
talked about this, I remember when Triple Des was the
47:28
encryption standard that came out and around, I think it was
47:32
part of the Orange Book series, the Color of Rainbow series.
47:35
It was the Orange Book and triple Des was how we needed
47:38
secure thing with most secure thing we had and before the ink
47:41
was dry it was broken. So, and, and now we have better
47:47
computers to break, to break it. Once Quantum is truly focused on
47:52
encryption in particular. And I'll talk about other
47:55
components, I think. And because any cryptocurrency
47:59
is based on encryption, the Ledger has to have faith, has to
48:03
demonstrate faith that there is a unique transaction entry in
48:07
there. It's, it's the only one there
48:10
and it was never compromised. That's done through a form of
48:12
encryption. Quantum computers, when you have
48:16
enough computing power, cooling and money to make it work, will
48:22
break that. It's, it's, it's, it's software.
48:25
It will break it. So you can count on that.
48:28
I'm not certain it'll be in my lifetime.
48:30
It may be, it may more likely going to be in yours.
48:34
And what we need to do is not war is not fear it and not say
48:38
what's going to happen. What we shouldn't do was just
48:41
save, sell everything and get gold and stuff it under your
48:43
mattress. You know, I've also, I know
48:45
someone that's done that. I I I actually know someone that
48:49
did that. They made money this year, then
48:53
last year they made money. They they would have made money
48:57
if they sold it. But if you keep the gold, you
49:02
may or may not migrate. That's the whole point of a
49:03
commodity, right? That what we're not going to do
49:06
is get into the psychology of, of buying and selling
49:08
commodities. Yeah, forget.
49:09
Gold. We should be investing in RAM
49:11
sticks. That's where the real money is
49:12
right now. But when you look at things like
49:17
where I think quantum is going to really help identity and
49:19
security is if you have a connection, whether it's audio
49:24
or with server to server or just data to data.
49:27
When you can create with quantum, quantum computing, a
49:30
quantum entanglement, if you've heard this term, that means you
49:33
essentially have two components that are mirror images of each
49:37
other. They're not the same.
49:38
They're mirror images. And when something happens to 1,
49:41
essentially universe action happens to the other.
49:46
When you have a quantum entanglement, the act of simply
49:49
viewing it, observing it breaks that entanglement because both
49:54
sides now change. Now that's it's a big concept
49:58
that more and more people are going to start seeing soon
50:01
because quantum entanglement, I think it's going to provide the
50:04
next big level of security for us and it's going to come from
50:08
quantum computing. But the downside of quantum
50:11
computing is everything you're counting on today will become
50:15
somewhat paper thin once quantum computing becomes a bit more
50:19
democratized and available. I think, you know, I've heard
50:25
different estimates for when quantum computing would become
50:30
available. And I think what I heard was
50:33
that the biggest risk is really, you know, we're doing all this
50:37
cryptographic exchange of messages.
50:40
Someone could be wire sharking and saving those messages off so
50:45
that by the point that they're able to use a quantum computer,
50:48
they could break them. I don't even know if that's
50:50
true. I don't really understand it
50:53
well enough to say, OK, that's a realistic concern or not.
50:57
Jeff, do you have any tips? Like, what should people be
51:01
doing right now? Is it just keeping an ear on the
51:04
news and having the curiosity to kind of figure out what is out
51:11
there or what do you tell people when people ask you?
51:15
I'm asking you right now, what do you advise?
51:19
Oh, good. I count you as a person.
51:20
So that's a valid when people ask.
51:22
Thank you. So some of that's going to be
51:26
out of my area of expertise, but especially when you focus on
51:30
identity and when you deal with the identity associated with a
51:33
crypto wallet, for instance, In fact, cryptos wallets contain
51:37
identities very often. It's not simply cryptocurrency.
51:42
You know, a digital wallet can now contain a driver's license
51:46
in many states in the USA. Passport in the EU is going to
51:50
be in a digital wallet. That's all a form of crypto
51:56
right now and encryption that we're depending on for our for
52:00
our identities. They're the things I often
52:03
recommend are first of all, make sure you have a backup of what
52:06
you do different for a cryptocurrency, you can't
52:08
necessarily back that up. There are ways to get it done,
52:12
but when you're not actually making a transaction, get it on
52:16
something removable and get it in a lead line safe.
52:19
That may sound a bit overreactive, but I have one in
52:23
my house and it's I feel very comfortable that I have
52:30
availability of the things that are important.
52:33
Should there be enough fire at the home or something else
52:36
happens and it's in a location that's not easily found.
52:40
I'm not even going to come close to saying right now where where
52:42
it is. So if we take a certain amount
52:45
of torture for that to happen. But the advice I give is back up
52:48
what you can first of all, and to your point, see what's going
52:52
on in the world. Watch the news stories about
52:55
where a compromise occurred and find out why right now, many of
53:00
those compromises occur through social engineering rather than
53:04
hacking per SE. That's where our biggest
53:06
exposure is. Hey, we just got back to people
53:09
again, didn't we? Because social engineering
53:11
focuses entirely on how could I convince you that you need to
53:15
give me something? Thank you very much.
53:16
Now I'm going to compromise. Whatever it is you had or
53:19
whatever you, it gives you control for someone else.
53:21
So be a situational awareness. Be aware what's going.
53:25
Whenever you're asked for any information, don't believe it.
53:28
It doesn't matter who did, maybe your your spouse or partner.
53:32
There's a certain level of trust that probably needs to be there.
53:36
But beyond that, when you're asked for something, don't
53:38
believe it. Find a way to validate it.
53:41
Phishing. Phishing still works.
53:43
The reason it works is people say this looks like a valid
53:46
e-mail. I'll just click this link.
53:48
Boom, you're done. It doesn't matter what you
53:50
enter, you're already done. So when you get something like
53:52
that, always go back to what the source should be and confirm.
53:56
Did you just send this to me? It may seem like extra work.
53:59
It it won't seem like extra work when you do it and someone else
54:03
didn't and they lost whatever it is, they had a value.
54:05
So back up what you have. Be aware what's going on and
54:09
where you can put in a control. Do that.
54:11
If you can add another factor of authentication when you with it,
54:15
when you log into something, do it.
54:17
I, I know it may seem like a pain and people don't like
54:20
brushing their teeth either, but it's better than having your
54:22
teeth pulled out, right? So brush your teeth, find a way
54:27
to do another method of authentication, especially for
54:29
the things that are value, not everything.
54:31
If you're going to go look at sports scores, you don't need
54:34
multiple ways to authenticate yourself.
54:36
But if you're going to look at your polymarket account for your
54:39
betting on those sports scores, then you might want to have a
54:42
couple different methods of making sure you it's you that's
54:45
getting into no one else. How's that for for a current
54:48
example? I love it.
54:50
I mean, I think it's like the first time we mentioned
54:52
Polymarket on this show, but it's an interesting, you know,
54:58
look at how we actually have to manage all this stuff.
55:00
So I'm with you on this. I feel like we could torture you
55:04
for a little bit longer and maybe get the location of that
55:06
safe by making you stick around and talk with us for several
55:09
more hours. But let's start to wrap things
55:11
up and take it to the identity Management Day is like a finale.
55:15
And we asked this question last week, but we're going to do it
55:18
again because we've got you here.
55:21
Let's talk about theme songs for Identity Management Day.
55:25
I gave a couple last week. People can go back and listen to
55:27
those, listen to that last five minutes of our episode.
55:30
I'm curious, Jeff, if you could pick like one or two theme songs
55:34
to celebrate Identity Management Day 2026, what would you pick?
55:39
Well, I'd start with the theme, which is Finding identity.
55:43
It kind of leads right into the Finding Nemo theme.
55:46
Now, that's not be your favorite song, but it it it it actually,
55:51
we were coming up with a theme. That's the first thing.
55:53
Well, it sounds like Finding Nemo.
55:55
Well, then we need to have a tagline after it.
55:57
But Finding Nemo, I think it's going to be the first one that
55:59
that fits into there. Go ahead and judge all you want.
56:03
I'm not necessarily a Finding Nemo fan, but it kind of fits.
56:07
I think any song by the Searchers works because you're
56:11
searching for You, Me and the machines, and that can actually
56:16
title almost any song from the 50s or 60s.
56:18
I'm old, what can I say? But any song by The Searchers
56:22
certainly fits in with the theme.
56:24
And what's a good one that's dealing with the machine?
56:27
I mean, you could go Rage Against the Machine.
56:30
Rage Against the Machine. Yeah.
56:31
Tom Burrell. Yeah.
56:32
Why? Why not, right?
56:35
Yeah, take take your anger out on on some of these things.
56:37
So you haven't heard that the the episode we talked about it
56:40
yet, but you know, I mentioned I Will Survive And when the bodies
56:46
hit the floor as like two options, you know, kind of
56:49
tongue in cheek as as things are out there, you know, a couple
56:53
other ones they have like Master of Puppets and you know, from an
56:56
identity standpoint, trying to, you know, juggle all that.
56:59
And then Daft Punk, harder, best, harder, better, faster,
57:02
stronger. Something along those lines
57:04
where, you know, again, I'm thinking more of like a playful
57:07
nature of what identity management day might look like.
57:11
OK, well, so there's going to be a Talking Heads song in there
57:15
somewhere. Once in a lifetime.
57:19
I think once in a lifetime, yeah.
57:21
What could that could work? Just every year.
57:26
Pardon. Well, not the theme.
57:28
The theme changes every year. Last year, if you remember, it
57:31
was the mouthful existential identity.
57:35
That sounds like AI. That was that was actually the
57:39
driving force behind that name last year.
57:41
Yeah. You know, just like you talked
57:44
about the back office effort for getting the podcast out, there's
57:48
a lot of work around a 21 hour event.
57:50
I'm not lying here, but sometimes the toughest thing is
57:54
coming up with we need a theme that can stick and that is not
57:58
easy. Yeah, so 21 hours.
58:01
Why not 24 hours? Because we came up with a number
58:05
of hours each region was willing to give us.
58:07
OK. So we need each region to donate
58:10
another hour next year and then we'll get to 24.
58:13
I'm going to hit them up for that and I, I hate you now.
58:17
I you really you want me to? You want me to do this for?
58:20
I want to know where that goes. I'm going to keep signing you up
58:22
for things you didn't ask for until I know where that crypto
58:24
is, man. What crypto?
58:27
Yeah, good answer. Yeah, hey, I used to do work
58:31
where I had to answer things like that.
58:32
So yeah, I'm, I'm practiced at it.
58:36
All right, let's go ahead and leave it there for this week.
58:38
I think it's good on the side. Yeah, Jim, I forgot you you you
58:42
didn't chime in there. I.
58:43
Had like the perfect dancer lined up I.
58:45
Think. Hit me.
58:46
Let's do it. So how do you feel about Beastie
58:48
Boys first? I mean, you got to fight for
58:51
your right. OK, so and again Jeff, Jeff
58:57
Rish, you led right into my answer, right, because 21 hours
59:01
you say it for the whole thing, right.
59:04
So you have to be awake for at least 21 hours.
59:08
Hopefully you're taking a shower before it starts.
59:11
So you're up for probably 24 hours and it ends in the Western
59:18
Hemisphere time, right? the US and South America anyway,
59:23
which includes Brooklyn. No sleep till Brooklyn, baby.
59:27
All right, there you go. Well, Brooklyn's on the East
59:30
Coast, but yeah, I see where you're going with it.
59:33
I'm just glad you didn't pick Sabotage because like, oh boy.
59:36
Yeah, it's dark. No sleep till Brooklyn.
59:40
Yeah, so if you want to do West Coast hotel, California actually
59:43
fits. You can check in anytime you
59:45
want, but you can never leave. That's, I mean, that's identity
59:48
for you. There you go.
59:49
I don't know how we topped that one.
59:50
That's a good one. All right, let's wrap it up.
59:52
Happy Identity Management Day Jeff and to folks around the
59:56
world and Jim as well look forward to I don't.
1:00:00
Count as part of folks around the world.
1:00:02
Well, you do count as a person, as Jeff has indicated.
1:00:05
So we will include you as that. But yes, there's a lot of stuff
1:00:09
going on. Check out the website.
1:00:11
We will have links in our show notes for people to check out.
1:00:14
We will be part of the festivities US Eastern Time.
1:00:18
We'll have a live episode that we're doing kind of that.
1:00:20
So I'm looking forward to that, Jim, to be transparent for
1:00:23
people who are listening this the day before we do it.
1:00:26
We still don't know what we're going to do, but we are doing
1:00:28
something. So you'll have to tune in and
1:00:31
see what our episode is for Identity Management Day.
1:00:34
And thanks to Jeff for inviting us to do that.
1:00:36
So thank you so much for that. Great to have you there.
1:00:39
Yeah, so I will have links in our show notes.
1:00:41
People check out all kinds of stuff, connect with Jeff around
1:00:44
music choices, theme choices, thoughts on quantum AI and
1:00:48
everything in between. You can find us on the web, IDC
1:00:51
podcast.com. That's also where we have all of
1:00:52
our latest discount codes. So don't forget to use those.
1:00:55
Those support for the show, whether you're going to EIC or
1:00:58
Identiverse or conferences that are coming up later this year
1:01:01
that we'll have to stop codes for as well.
1:01:03
So like subscribe to all that fun stuff and we'll leave it
1:01:06
there. Thanks everyone for watching and
1:01:08
are listening and we'll talk with you all in the next one.
1:01:13
You've been listening to Identity at the Center.
1:01:16
We hope you've enjoyed the show. Make sure to like, rate and
1:01:20
review, and we'll be back soon. But in the meantime, hit the
1:01:24
website at identity@thecenter.com.
1:01:28
See you next time on Identity at the Center.