Latest / Identity at the Center / #370 - RSM & IDAC Present - The Intersection of Cloud Security and IAM

Transcript

#370 - RSM & IDAC Present - The Intersection of Cloud Security and IAM · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. I'm feeling well.
0:18
Last episode you actually gave the banter a topic which was the
0:25
1,000,000 downloads. I think that was great news.
0:28
But back to me and this time, if you don't mind, I'm going to put
0:31
you on the spot. So topic we didn't prepare for,
0:35
but they give me just some thought.
0:37
And I think everybody as part of their maturity of, you know,
0:41
learning the space and communicating what we do to
0:46
executives and people that really aren't in identity is
0:50
taking this thing that we understand and explaining it in
0:54
business speak. And I'm wondering kind of what
0:57
tips do you have for our listeners?
1:00
What do you do? What has your journey been like
1:03
to take these complex topics and turn them into business speaks
1:07
that other people can understand?
1:09
Well, I mean, there's so many topics to cover there.
1:12
I think I have to break it down simply so I can understand it,
1:15
first of all. So I think that helps, you know,
1:20
I don't know, I think without an example, that would probably be
1:23
helpful for me to kind of say, OK, how would I approach that?
1:26
I think the most important thing is knowing your audience.
1:28
Who are you talking to? Are they a technical group?
1:30
Are they not a technical group? Is it, you know, executive
1:33
speak, which is a more polished version of baby talk just for
1:37
for some folks, right? Stuff like that.
1:39
It's just use simple language and I think try to use analogies
1:43
or examples. That'll be probably my, you
1:46
know, tip, I guess without really having a topic to
1:50
explain. I think analogies and examples
1:53
are great, but sometimes I abuse that.
1:55
Sometimes I start trying to come up with an analogy on the fly
2:00
and then it doesn't work. And sometimes it can even be
2:03
embarrassing. Couple of the tips that I use is
2:08
talking about outcomes, talking about objectives, Just trying to
2:12
kind of boil it down to like, all right, give me the headline,
2:15
give me the story in, you know, something I can relate to and
2:20
something that just gives me the the answer doesn't walk me
2:24
through all the the details because I think as identity
2:29
people, we understand all the details.
2:32
And that can be a little bit dangerous, right?
2:35
If we dive into details because that's our comfort level, then
2:38
we're going to lose people who really don't care about those
2:41
details like we do. There's a time for details.
2:44
There's a time not for details, and you need to be able to
2:47
answer the So what question? So what if I don't do this thing
2:51
or So what if we do do this thing, right?
2:53
Whatever that is. What is the So what?
2:55
That is part of that message. Absolutely.
2:58
And I think, you know, final thing that I'll say is that I
3:02
think practicing over and over and you know, practice with the
3:06
people that are in your life, practice with your Co workers.
3:10
Another great thing is like if you go to conferences and you
3:13
talk to people who are in the industry who maybe do understand
3:17
the details, practice with them. Start talking about things in
3:21
terms of what is the overall story?
3:24
What are you trying to get at? What are the objectives or the
3:27
outcomes that you're driving for the business?
3:29
If you can do it in that environment, you should be able
3:32
to do it anywhere. Yeah, that's a good tip.
3:34
I think there's a lot of practice that takes place behind
3:36
the scenes. Know your know your content.
3:38
If you know your content, you can confidently answer
3:41
questions. Yeah, that's probably the
3:43
biggest thing. I think everyone has their own
3:45
speaking and communication style.
3:46
You'll you'll kind of figure that out eventually.
3:48
But know your know your stuff and it's going to be a long way.
3:51
Rather than kind of, you know, fake it till you make it.
3:53
It's a lot harder to to get a, you know, have a good decent
3:57
conversation if you're constantly scrambling or
3:59
Googling behind the scenes. Right.
4:00
Like, what does that mean? Right.
4:02
That kind of thing. Well, in terms of like
4:05
summarizing stories and talking about conferences, one thing
4:08
that we normally do is go through the laundry list of all
4:11
the discount codes. But I think we're entering the
4:14
peak season for conferences and rather than spending 20 minutes
4:19
just going through all the codes, what should people do?
4:22
Yeah. We have way too many conferences
4:24
that you and I are going to be at in some, some way, shape or
4:26
form. So we're going to talk about
4:29
just at a high level, but go to the website, idacpodcast.com,
4:32
Scroll down. I've got all of our discounts
4:35
there. More coming soon, but we are in
4:38
the thick of it. There is 2 official
4:41
cybersecurity summits that I'm going to be at.
4:43
I'm going to be in Chicago, going to be in Philadelphia.
4:46
Then we've got the authenticate conference that is coming up.
4:49
That's going to be in October. So we've got some fun things
4:51
we're going to do. I am happy to say that Fido Feud
4:55
is coming back to authenticate. So I have been cleared to to say
4:59
that I am working on the questions and Jim will be a team
5:02
captain. Megan is going to be the
5:04
returning champion from Fido Lions.
5:05
She's going to take Jim on again with a whole new team.
5:08
So I'm looking forward to that. Bigger, badder, better than we
5:11
did last year. But that's very exciting.
5:13
Fido Feud was a lot of fun, the most fun had at the conference.
5:17
Let's see then we've got Infosec World, that's a new one that we
5:20
just signed up for within the last week or so.
5:22
So that's coming up also in October.
5:24
We've got Ideniverse in Washington DC, that's in
5:27
November. And then to kind of cap things
5:28
off the end of the year at Gartner, I am and we're going to
5:31
be doing a new game show there tentatively called Majority
5:34
Rules. But a lot of audience
5:36
participation, people playing their phones.
5:39
Jim, you'll be up there on a stage with me and probably
5:41
Rebecca from Gartner and kind of doing our thing.
5:43
But yeah, we're kind of doing like this whole, you know, game
5:46
show stick at different conferences and people seem to
5:48
enjoy it quite a bit. Yeah, it totally gets old.
5:51
Why not keep going with it? I mean, people seem to enjoy it.
5:55
We have fun doing it, and hopefully it continues to draw a
5:59
crowd. I think we'll keep doing it as
6:00
long as people keep wanting it. Yeah, it's a little counter
6:04
probing I think to some of the conferences where you, you know,
6:07
it's like, OK, I am or security talk all day long and say, all
6:09
right, let's have some fun and, you know, kind of get the pulse
6:12
of people. So I like doing weird and
6:14
interesting things and you know that that scratches that itch
6:17
for me. Let's just put it that way.
6:18
Yeah, You know, I, I love what we're doing with this episode
6:22
today. Kind of something we started in
6:24
the beginning of the year, which was they're trying to take other
6:28
areas of cyber and talk about how they intersect with
6:32
identity. And we're continuing that
6:34
conversation today with two of our colleagues from RSM.
6:40
Yeah, We're going to cover the intersection of cloud security
6:43
and identity and access management.
6:44
This is, I think, Part 5 in a series.
6:46
We started early off in 2025, started off the year with Ghazi
6:50
in January. We recorded that one at last
6:53
year's Gartner. And you can go back and look at
6:55
Jim and his cowboy hat and cowboy attire.
6:57
So that's, you know, the hook for that one.
6:59
But yeah, you and I work with some just really smart, good
7:02
people, which is one of the strengths, I think of our
7:04
organization. And so let me go ahead and take
7:06
a second here to introduce Justin Devine.
7:08
He's a cloud transformation director.
7:10
Welcome, Justin. Thanks, Jeff.
7:13
Appreciate it. Yeah, I'm glad to have you here.
7:15
And then one of our colleagues in the digital identity practice
7:18
here at RSM, we've got Vishnavi Vadi, Nathan, she's a Digital
7:21
Identity Director alongside Jim and myself.
7:23
Welcome Vishnavi. Thank you, Jeff.
7:25
Hello, Jen. All right, so we have tradition
7:27
around here. First time anyone joins us, we
7:30
talk about their backgrounds, you know, how they got into
7:32
identity, in this case, maybe how we got into infosec kind of
7:35
at large. Vishnabi, I'm going to start
7:37
with you. How did you get into the
7:40
wonderful world of identity and access management?
7:44
Yeah, at 10 years ago, I began my journey in the identity world
7:48
with the basic authentication and authorization.
7:50
At that time, most of the organization relied on custom
7:54
built solutions or tightly coupled identity modules with
7:58
the legacy applications. My work centred on building the
8:02
login workflows, directory services, moving towards the
8:08
governance identity and governance world where
8:11
automating from the manual account creation to the
8:14
automated provisioning, road based access controls, audit
8:18
compliance. That's how my journey began 18
8:21
years back and gradually I progressed towards the
8:24
privileged access management with governance under waiters
8:27
spotlight gradually shifted those days from to the high risk
8:31
accounts, administrators, privileged accounts.
8:34
So I evolved my focus into the area and automated password
8:39
rotation. That's where I sharpened my
8:42
skills from the authentication authorization or access
8:45
management gradually to identity governance, then to the
8:48
privileged access management. And also I have seen the journey
8:52
of identity world from custom and legacy to the next Gen.
8:57
identity solutions, heavily customized identity world ID and
9:02
systems, on premise systems and directory services, hardcoded
9:08
role, role models to the next Gen.
9:10
SAS, first identity platforms, pretty much all the key players
9:14
in the market. I have been part of the
9:17
evolution and the journey adaptive authentication,
9:20
password less. That's how my journey has been
9:23
for the 18 years. That's a lot of stuff to cover.
9:26
Do you have a favorite? I am technology or you know, I
9:30
am vertical? Like is it IGA, is it Pam, is it
9:33
authentication? Like, what's your favorite part
9:35
of identity? Access management is something
9:39
that always excites me because it gives the flavour of login,
9:45
password layers, biometric the I've seen how access management
9:50
has evolved 18 years back where we had everything custom
9:55
developed login modules, we and it was all the traditional
9:59
directory services. Many most of those ages we had
10:03
everything as an L dab directories.
10:05
Now things have evolved a lot. I come from a generation where
10:11
I've seen everything in the passwords.
10:13
We used to make sure that protection, everything is taken
10:17
care of as part of customization.
10:20
Now everything just happens with the click or a small
10:23
configuration. So that really excites me.
10:26
And consumer access management is also something that I always
10:29
enjoy working coming from a financial organization
10:34
background in the past where that B2C part of the world plays
10:38
a very important role and that's where most of the business lies
10:42
for the financial organization or healthcare organization or be
10:46
it retail organizations. So I really enjoy that side of
10:50
the world and all the tools that are in the market really excites
10:54
me. And I have had wonderful
10:56
experience in this 18 years working with almost all the top
11:00
leading products in the Gartner quadrants.
11:03
So does that bug you as much as it bugs me?
11:06
When you go to like as a consumer, you go to a website
11:09
and they just have a terrible identity experience and they're
11:12
like, Oh my gosh, come on, like fix this thing.
11:15
Just want to reach through like, all right, why does my, you
11:17
know, the, the password is probably the most classic
11:19
example, right? OK, my password's not working
11:22
and let me go to reset it. New password can't be the same
11:25
as old password. What what is going on here?
11:28
Like, it drives me crazy. Does it drive you similarly
11:30
crazy, or are you a little more cooler and calm with it?
11:33
No, no, I would say sometimes it's both.
11:36
As a consumer, sometimes it is really frustrating when I'm
11:41
asked to reset my password or do certain things, but when I view
11:45
my identity hack it saves me. No, this is right.
11:48
You have to do this. You have to configure your MFA,
11:51
you have to make sure it's secured and you reset, or you
11:56
change your password frequently, or go with the biometric, or go
12:00
with the certificate based authentic.
12:04
It just, it just prompts me to keep up with the standards.
12:11
Well, I'm glad that you know it. It similarly drives you crazy,
12:14
but it seems like you got a little bit cooler approach to
12:17
it, which I could appreciate. All right, Justin, let's hear
12:19
about your background. How did you get into information
12:22
security? And do you consider yourself an
12:24
identity and access management person?
12:25
Are we going to have to, like, award you an honorary title here
12:28
as part of this conversation? Yeah, I think, I think you could
12:30
deputize me. I, I, I guess I would say that
12:34
the first time I touched identities is probably the, the
12:37
local user accounts on the computers I used to take apart
12:40
and put back together as a, as a kid to my parents dismay.
12:45
And then that moved on to a lot of Active Directory as I
12:47
supported a lot of application implementations.
12:50
And then as I got into cloud, when cloud was being born, it
12:54
was about Active Directory migrations into the cloud, into
12:57
other identity providers. And that now that I'm mostly
13:01
involved in cloud transformations and cloud
13:02
security transformations, I, I generally run into an interface
13:06
with identity as a prerequisite or a dependency that we need to
13:13
solve before we can transform some things in the cloud, before
13:16
we can do migrations, things such as, such as that.
13:20
So I'm not a, I'm not a dyed in the wool identity pro the way
13:24
Vishnavi was. There's no way I can follow
13:26
that. But I have written that e-mail
13:29
about a website that doesn't work right and then sat in shame
13:33
about writing that e-mail because I know it just goes to
13:35
some some poor person who is is not going to not going to be
13:39
able to do much with it. But it feels good to vent a
13:42
little bit, right? Like, all right, fix your
13:44
process like this is not a good user experience.
13:46
And look, the, the identity space is a, a warm, inviting
13:51
place, you know, come on in. It's great.
13:54
You know, Jim, and I've been doing this for a long time,
13:55
Vishnavi as well. So, you know, I'm going to, we
13:58
can start the, you know, the one of us chant if we want to do
14:00
that. This is why I team up with the
14:02
three of you though. It's because I know that in
14:06
order to make cloud migrations and transformations go well and
14:09
to keep things in the cloud secure, I need folks like
14:13
yourselves who are pros to, to help me get into all the gory
14:18
details that you were talking about.
14:19
And at the beginning of this call, right when you were
14:22
talking about how you translate for, for business users.
14:25
I know I need AI need a a diagonal wool identity pro like
14:29
yourselves to to work with to make it go well.
14:33
So there shall be, you know, one of the things that Jeff and I
14:37
talked about when we decided to come up with an episode to
14:41
connect cloud security and identity is, you know, what is
14:45
the the right approach? Is it to have your identity
14:49
strategy or cloud strategy or do the both of those at the same
14:54
time to make sure? The cordon seems like it's the
14:56
latter, but it seems also like a lot of times those pieces kind
15:02
of run separately until there's a problem more until something
15:07
needs to be done about it. And then it's like, OK, well, we
15:11
need to fix this. What is the approach that you
15:14
recommend? Great question, Jim.
15:18
Cloud and IAM are inseparable in today's enterprise because cloud
15:22
amplifies both opportunity and risk and IMS the control plane
15:27
for governing that risk while enabling business agility.
15:31
That's how I look at it in simple terms, if you want me to
15:33
explain it, what I can explain like why I, why cloud and IM
15:38
must be considered together. Cloud expands widely and the
15:44
traditional IM was focused on primarily on employees accessing
15:48
internal system. Whereas cloud introduced SaaS,
15:52
Paas, IAS, each with their own identity layer without central
15:57
IAM identity sprawls, policies, fragment, attackers exploit
16:03
weakest links. All this actually brings in or
16:07
in or gets embedded into the cloud migration.
16:11
So according to me we have to we should consider both cloud and
16:14
IAM together. I would call it like identity
16:18
becomes the new perimeter in because in cloud there is no
16:22
firewall around everything. The perimeter is what identity
16:25
is. So when we think about cloud
16:27
migration, we should also think about IM together.
16:32
Cloud agility definitely requires IM agility to when our
16:36
developers pins up workloads or SAS tool at speed just and can
16:41
definitely add on top of this, IM must automate the
16:45
provisioning governance federation, MFA and how to
16:50
handle the privileged accounts like administrators and
16:55
everything. And also with cloud and IM
16:58
getting together, compliance and zero trust plays a very
17:02
important role that can be definitely achieved.
17:05
When we think or bring in IM flavours with the cloud beat, we
17:09
talk about GDPR, HIPAA, PCIDSSCC, P/E, everything that
17:15
could be cannot go separate. It has to bring together with
17:20
cloud migration, but we have to bring in IM as well.
17:25
That's all I think about. It yeah, I know that's very
17:27
thoughtful. And Justin, I think the same
17:30
question to you. I mean, you probably, but by the
17:35
time folks are already talking to you, they're like, all right,
17:38
we need to do some kind of migration to the cloud.
17:40
We need to get the cloud right. Is there kind of an education
17:44
process or some kind of readiness evaluation that you go
17:49
through from an identity perspective?
17:52
Absolutely. So generally when I've, I've LED
17:58
cloud migrations and, and transformations, we have kind of
18:01
readiness checklist and identities always a big part of
18:04
it. Because I, I have seen multiple
18:08
instances where a client, for example, wants to migrate an
18:11
application and then as they dig into it, it turns out, oh, it's
18:15
using an authentication method that we haven't extended to the
18:19
cloud yet. So it's definitely something you
18:21
have to knock out early, right, to make sure that you have all
18:26
of the capabilities you need where you're going, not just
18:30
where you are. And then that often influences
18:36
migration, sequencing, grouping, things like that.
18:38
So one thing that Vishnavi said that I, I keyed up that I, I
18:42
really, it really resonated with me was about the opportunity and
18:46
the risk, right? And I always tell clients you're
18:48
not going to be able to keep up at the speed and scale of cloud
18:52
without automation. And identities are really great
18:57
example of that because every time you're spinning something
18:59
up in the cloud, you're creating identities, sometimes privileged
19:02
ones. And you you really need to get
19:04
that under control early or it will get out of control and
19:09
you'll have a a very bad, very bad time in cloud.
19:13
So let's stay with that speed question real quick, because I
19:16
think that is something that is so prevalent among cloud
19:18
services. You're talking about services
19:20
that spin up and down sometimes with a milliseconds, right?
19:23
Or even shorter nanoseconds. What are some tips that people
19:26
might out there to think about? And I don't, we're not going to
19:28
solve all the problems now, right?
19:29
Because it's too much. But speed is the problem.
19:32
How do we How do we, you know, contemplate or think about?
19:36
That my the, the the most straightforward answer I can
19:41
give you is leveraging automation and standardization,
19:44
right? Because you can't keep up with
19:47
that speed as a human. You can't, you can't have an
19:50
army of humans doing access reviews on or entitlement
19:55
reviews on every identity in your cloud.
19:57
But as you said, Jeff has things, identities are created,
20:01
destroyed, left, left and right or every last thing you spin up
20:05
has an identity right, it has an identity.
20:08
And that identity has privileges sometimes across your, your
20:12
cloud. So that's probably the number
20:15
one thing I would say is the quicker you can get a system in
20:19
place that doesn't rely on humans double checking
20:23
everything. The happier you'll be and the
20:26
less of a mess you'll end up in, and you know, the more secure
20:30
you'll be overall. So this sounds an awful lot to
20:35
me like orchestration and being able to say, hey, let's pull
20:38
together some sort of identity infrastructure.
20:41
Vishnavi, I guess this is an area that you're probably have a
20:44
lot of, you know, experience with.
20:46
Is this kind of idea of how do we, how do we address the speed,
20:50
right? We need automation.
20:51
Like to Justin's point, humans there, it's it's we're too slow.
20:54
Unfortunately, even if we're the Usain Bolt of identity and
20:58
access management, it would still be too slow.
21:00
So how do we look at things like orchestration and especially in
21:04
this type of area where we're in like hybrid modes, right?
21:06
So we've got on Prem AD and then Entra and then Octas and pings
21:11
and all kinds of stuff like that.
21:12
How do you address that? Yeah, I can start with giving an
21:16
example Jeff, since it is very. This answer would also add
21:22
flavors to the previous question which me and Justin tried to
21:25
answer. I was part of one of the major
21:30
migration, cloud migration which involved IAM concepts or IAM
21:36
components as well. It was for a financial
21:39
organization where they decided to lift and shift some of the
21:42
critical applications into Azure and AWS.
21:45
It was the conscious choice they made for both.
21:49
They they left the access management to the cloud native
21:53
IAM without integrating it with the corporate IAM.
21:56
So it was like leave it as it is, take it, adapt a new.
22:01
At some point we saw a user had a bitter experiences
22:08
specifically with duplicate across accounts, across
22:11
environments, orphaned accounts getting piled up.
22:14
Auditors started flagging certain violation when it comes
22:17
to least privileges just to speeding up the process.
22:21
The decision was taken light, just leave it and shift it, lift
22:25
and shift and leave things behind.
22:28
We had to take a pause there, make a right decision like let's
22:34
consolidate IAM for the organization.
22:37
Be it you have cloud, you have partially on Prem if it is 5050%
22:42
or 8020% or 3070% whatever percentage it could be, but
22:47
bring it as a centralised IAM. We Federated their on Prem with
22:52
cloud platforms. There are now we have lot of
22:56
orchestration products available in the market or skin is very
23:02
commonly seen in the market. We used it for SSO, automating,
23:06
automated provisioning, deprovisioning, enforced MFA
23:09
across all cloud services. To give you a quick statistics
23:14
that reduced 80 percentage of the issues we faced immediately
23:19
after the migration, just take a pause and unify the IAM for both
23:25
since we started about this. Definitely for organizations,
23:31
orchestration plays a very important role when or when they
23:35
are caught up as part of the transformation, we will have
23:37
legacy and modern cloud. We definitely need a connective
23:41
tissue to unify them without breaking the business
23:44
operations. Yes, it becomes very difficult
23:47
for the business and also the technology team be the cloud
23:50
team and our IM team or the so-called service desk feed will
23:54
be piled with tickets. So identity orchestration is the
23:57
integration layer that connects the IEM system.
24:01
It has an ability to talk to the legacy directories, home grown
24:04
provisioning engines, cloud IEM platforms, SAS apps, privileged
24:09
access tools in and act like a cohesive identity fabric.
24:14
I usually name it like bridging old and new models, automating
24:18
identity workflows, abstracting complexity away from the end
24:21
users. This is exactly what the
24:24
middleware or the orchestration layer does.
24:26
And there are now we have N number of orchestration layers
24:30
or the tools that are available readily available for us to pick
24:34
up and embed it into the system for as part of the migration.
24:39
So what I'm hearing is that it's not a technology problem per SE,
24:43
right? There's plenty of tools out
24:44
there that can kind of do the thing.
24:46
So now I'm thinking maybe this is a governance thing.
24:48
And Justin, I kind of want you to weigh in on this is if I'm
24:50
looking at things from the cloud perspective, I am pulling at a
24:53
whole bunch of new services, right?
24:55
That could be AWS, Azure, GCP, you name it.
24:59
And those are just the platform providers, but I probably have a
25:01
whole bunch of other SAS solutions, right, that I'm using
25:04
from that. I imagine governance has to be
25:06
part of this as well. Say, OK, what are the rules of
25:08
the road that we're going to follow here?
25:10
Are we going to agree on, yes, everything should be single
25:12
signed on through, you know, whatever, right?
25:15
Talk to me a little bit about the governance approach because
25:18
what I got from Vishnavi, and feel free to contradict if you
25:21
want or or or emphasize it is that the technology isn't the
25:24
problem. There are plenty of tools that
25:26
will do this. It's the people in the process
25:28
that needs to come along with this as well.
25:31
I mean, I think it depends on where you start, right?
25:33
I've been a part of a couple cloud transformations and a
25:37
couple cloud security transformations where the
25:41
clients had significant legacy identity entrenched providers.
25:50
I was with one client that I think had eight or 10
25:53
authentication methods that they had let their apps use.
25:56
And they kind of had to do an approach where they sequenced
26:00
what they were moving very, very much back to one of the earlier
26:04
questions with how do you consider these things?
26:06
They had to sequence things out to say, OK, we're going to get
26:10
down from 8 authentication methods to 4, right?
26:13
That's the big plan. But we can't do that all at
26:15
once, right, 'cause we have apps using them, we have to move them
26:17
off. We have to update those apps.
26:20
And some of them were just, we're just, we can't update.
26:22
We just got to live with keeping, you know, one or two
26:25
methods open because they're crown jewel apps.
26:27
But they actually took the identity road map and the cloud
26:30
road map and, and I, I helped them sequence them right so that
26:36
they could move the apps that use the authentication methods
26:40
that would be available early on.
26:43
And then as they deprecated some and modernized some, they could
26:47
move, move those. So I do think sometimes
26:50
technology can be the problem, but I think that's more often
26:53
true when you're trying to rationalize an existing kind of
26:59
untangle a knot right, where you might have hundreds of apps,
27:02
then sometimes the tech can be an issue and you have to figure
27:05
out your path forward, right? I think if you're fortunate
27:09
enough to be in a Greenfield, then then that's less true
27:13
because you the tools are available, right?
27:15
You just pick them up and and use them and start from a a nice
27:20
cleanish slate right from the beginning.
27:22
I think it depends. Where I think it depends where
27:24
you're starting is a typical consultant answer it it depends.
27:29
You know, I'm glad you called me out on that one because I, I
27:31
certainly hadn't, you know, I meant to talk about, you know,
27:35
difference between Greenfield and legacy.
27:37
And I think that definitely is a part where, you know, legacy
27:40
technology is, is a pain. It may not be worth doing
27:44
anything with it because it is such a pain.
27:46
So I think we have to know when to say, you know, sayonara, see
27:49
you later. We're not going to do that.
27:51
And that might be either getting rid of it or it might mean
27:54
that's just something we don't want to tackle and doesn't make
27:56
sense to like incorporate as part of the plan.
27:59
That's always going to be an exception or a one off or
28:01
something like that. This idea of saying goodbye and
28:05
knowing when to move things around and you know, when to,
28:09
you know, take what you've got. Everyone would love to have the
28:11
Greenfield, but that's not the real world, right?
28:13
For the most part is you're dealing with legacy decisions
28:16
that were, you know, I'll be generous and say they were
28:18
probably a good decision five years ago, 10 years ago, we
28:21
hope, right? But things change.
28:23
And so we need to get better. How do you have a conversation,
28:26
Justin, with those people that need to make that decision?
28:29
Because sometimes things aren't broken or they don't appear to
28:33
be broken. So why fix it?
28:35
Like, how do you have a conversation behind the scenes
28:37
to say, hey, we do need to change this and here's why?
28:43
Well, I I can kind of pull on that.
28:45
The same example I was mentioning before, a lot of it
28:47
came down to supportability, right?
28:51
If you're supporting 10 legacy things, it is an enormous drag
28:55
on your IT and cloud and you know your innovation, right?
29:00
You're just not going to be able to innovate.
29:03
A lot of your bandwidth, your velocity is going to be tied up
29:06
with supporting 10 legacy things.
29:08
So I, I mean, I guess I kind of jumped right into how I, how
29:13
I've encouraged clients to, to do this, but generally that's
29:17
the driver, right? It's your, you're not going to
29:20
be able to really take off and go at cloud speed like you want
29:25
to while these 10 things are hanging around your neck, right?
29:28
It's it's tough for it's tough for your team to support you.
29:32
You, you have people on your staff that they're on your staff
29:35
just 'cause they know this, this one thing, for example, right?
29:39
Or, and, and they could be repurposed to do, do better
29:42
things. So maybe you get down from 2:50,
29:45
right? Maybe you can't get down A11 IDP
29:48
or authentication method to rule them all, right, because that
29:51
may be too ambitious for a, a very large enterprise.
29:57
But you try to show them how getting down to a couple could
30:01
really free up a lot of resources and unlock a lot of
30:04
innovation and velocity elsewhere.
30:06
Yeah, that's a that's a really great point.
30:10
There's a whole area in the identity space called identity
30:14
orchestration. A big part of that is making
30:17
these different generations of identity technologies kind of
30:22
work together. One of the things that I find,
30:26
and I'm going to take it back to Vishnabi here to get her take on
30:29
this, is that the practitioners who are, you know, experiencing
30:34
this rapid movement from the traditional on Prem data center
30:41
kind of approach to the cloud is they've got identity tools that
30:47
were built for the traditional approach, OK?
30:50
And now they're trying to stretch the functionality to do
30:54
this thing to treat the cloud a lot like traditional, one,
30:57
because that's what they know, But two, it's also how the tools
31:01
were designed. Is that the right approach?
31:04
How far can you get with that approach Vishnavi?
31:07
As part of when we talk about identity and cloud
31:09
transformation and legacy and the new modern tools, definitely
31:16
that's where the identity modernization also plays a very
31:19
important role, Jim. So when we speak about identity
31:24
modernization, identity as cloud moves fast, identities with the
31:30
modern IEM model, who gets in and how, when, with what
31:34
privileges, the cloud adaption becomes more easy to handle.
31:39
The shadow ID or orphaned accounts and complaint risk
31:43
cloud requires modern IEM capabilities.
31:46
So we should definitely think about IEM modernisation.
31:49
Having legacy tools can be accommodated using orchestration
31:55
layer or whatever. But definitely IM modernization
31:59
is required. When an organization starts
32:01
thinking about cloud transformation, it is OK to hold
32:06
on to legacy IAM as a directory specifically, that is something
32:09
we cannot within over a very short frame.
32:13
We cannot come out of Active Directory or any anything as
32:17
such moving away from the legacy directory structures or the
32:24
Federated mode SSO models or it could be even and header based
32:29
or cookie based applications. It is very difficult to just get
32:34
away with it, but identity modernization is required.
32:38
We have to think about solutions that will serve both dear cloud
32:43
as well as hybrid or an on Prem environment effectively keeping
32:49
the focus that the organization has taken the cloud journey and
32:53
they are going to adapt the cloud to 100% in at least in the
32:58
next 5 years. So I would say take start the
33:02
identity modernization. Yeah.
33:04
Justin, I, I kind of wanted to pull you into the same kind of
33:07
topic here because one I wanted to clarify, right, I'm not
33:13
talking about old vendors versus new vendors.
33:16
It's not really about the vendor, it's about the
33:18
technology, but also the approach.
33:22
Can the approach be the same for managing the cloud as you took
33:26
with the on Prem? And I think identity kind of
33:30
follows technology, so clouds the advancement.
33:34
And does identity need to change to support that advancement?
33:39
I, I think it does, you know, fortunately there are a lot of
33:46
tools out there now to help manage the complexity that gets
33:49
introduced via cloud. But one thing that I heard from
33:53
Vishnavi that resonated with me and I wanted to point out is I
33:57
think the more sophisticated, the more leading edge your cloud
34:01
implementation, the more important your identity becomes
34:05
to have solid beforehand, right? So I, I was thinking about this
34:11
while I was listening to her. And for example, if you're just
34:13
lifting and shifting some VMS, well, the identity universe
34:17
isn't that complicated. If you're in a all Terraform,
34:21
all infrastructure is code land, automated landing zone
34:26
subscription or account isolation where developers have
34:31
to interact with CICD pipelines and the pipelines touch assets
34:35
and do deployments. I mean, just from how long I
34:39
spoke, think, think about everything in that sentence
34:41
having an identity, right? So what I've seen really be
34:45
really important is getting your RBAC rolls down in cloud is one
34:49
thing that's super important, especially when you have this
34:54
multi persona cloud program, right, where you have end users
34:59
who mostly just interface through whatever endpoint the
35:01
app has, like a web page, which is the most the most common,
35:05
right? And then you have architects,
35:08
engineers, developers, and they're all interacting with
35:13
potentially pipelines and cloud infrastructure directly.
35:17
Well, things just got a lot more complicated, right, because you
35:19
need you, you need those developers to have the roles
35:22
they need to do their work. And you want to try to make that
35:25
as frictionless as possible with some kind of self-service.
35:28
Well, now you've got something you need to set up and manage.
35:31
And hopefully the way you do that is make it as easy as them
35:35
for as easy for them as possible without introducing risk to the
35:40
organization, right? So you they can move at at cloud
35:44
speed. Yeah.
35:45
I think a lot of that resonates with me because I think every
35:49
organization does some element of kind of lift and shift and
35:54
then it really becomes a matter of, OK, I am as middleware is
35:59
very infrastructure sensitive. But if you update the IP
36:03
addresses and things like that, the firewall rules, generally
36:07
you can get things working in that model.
36:09
But when you talk about kind of re engineering the way you
36:13
manage that infrastructure, which is what I think you're
36:15
getting at. And that's where and almost
36:18
every organization ends up there, right?
36:20
Because it's like you're not getting the true value of the
36:23
cloud. You're just paying one bill
36:25
instead of the other if you're just lifting is shifting, right?
36:30
But it's when you can like optimize that infrastructure,
36:33
when you can do infrastructure as code is, you know, I know
36:36
that's kind of a buzzer, but it gets to the point of we're
36:40
dynamic and we're not doing things the way we did them in
36:44
the old days. You'd need different IAM tools,
36:48
right? Because all that nothing happens
36:50
without identity and access. I mean, I agree very, very
36:57
enthusiastically with what you said about lifting and shifting.
37:00
I call it, you know, data center C like you just moved into a new
37:03
data center. You're not getting the value of
37:05
cloud. But if you want to introduce
37:08
those more sophisticated engineering approaches, you are
37:12
taking on a, a burden of managing them.
37:15
And identity's a huge, a huge part of that.
37:18
And you need to be, you need to have a fulsome understanding of
37:22
what you're taking on, especially from the identity
37:25
perspective to, to really get the ROI from that, I think.
37:29
One thing that I'm not sure how familiar you are with this
37:33
identity security. So it's not just that all of a
37:37
sudden we're calling ourselves identity security.
37:40
To me, it implies something which is that kind of this
37:44
merger of cybersecurity and identity.
37:47
And really it's the incorporation of identity into a
37:53
lot of cybersecurity tools. At least that's how I see it
37:56
manifesting. And these tools are very data
38:02
hungry. They're very data dependent,
38:04
including logging dependent. I mean, primarily logging
38:08
dependent and having logs that support what they need from an
38:14
identity perspective so they can start to correlate.
38:17
OK, Justin Devine is in the system and he's doing all these
38:21
things and that doesn't match with his normal access patterns.
38:25
And maybe we've, you know, maybe the Socs should look at this.
38:29
And I think the next generation is going to be maybe we need to
38:33
shut off the Justin's access for a little bit because his account
38:37
may have been compromised. I guess what I'm, I'm getting at
38:41
with that question is, you know, I, I, I kind of feel like on the
38:46
cloud side, it's kind of more easy to set up monitoring.
38:50
But on the other hand, it's like the amount of monitoring that
38:54
you can do and you should do is starting to explode.
38:57
I'm wondering kind of what those implications are that, you know
39:03
you're seeing today and like how are you advising people in terms
39:08
of setting up their monitoring to kind of support everything I
39:11
talked about? Well, I do think that there's a
39:13
lot of truth to something that was said earlier, you know, on
39:17
the on the pod, which is that identity is kind of becoming the
39:20
new perimeter, right? If you look at all the big hacks
39:23
that take place, it's a lot easier to get in by getting a
39:26
password than, you know, going super hacker and hacking the
39:30
firmware on a firewall, right? It's a, it's a lot easier to
39:34
just convince someone to give you their password 'cause they
39:37
think you're from the help desk, right?
39:40
And I also think that the next generation of identity tools, it
39:43
is going to incorporate a lot of AI.
39:49
And we're working on something like that right now using AI to
39:53
analyze one of our clients authentication data and provide
39:57
the kind of thing you were talking about where oh, this
39:59
doesn't look right, this doesn't match the user's previous
40:03
pattern. I would say in the cloud, one
40:05
thing that's good is if you're using one of the major CSPS, the
40:10
ability to do certain things is. Easier sometimes because they
40:16
have those capabilities you just flip them on right you say, OK,
40:19
I've decided doing this is worth it right like automated access
40:22
reviews. I'm, I'm just thinking of some
40:24
of the, the features in Entra or you know, I am right, for Azure
40:29
and AWS respectively. So it makes it easier to kind of
40:32
get started, which is a good thing.
40:36
The complexity comes when you go multi cloud and add other
40:42
platforms in, right? That's when you probably, you
40:45
often end up going back to some of the more third party
40:48
solutions that can cut across a layer across multiple platforms
40:52
and clouds. But I do think it's a good thing
40:54
that the set of capabilities that are available to people
40:58
running in the cloud from an identity security perspective
41:02
grows all the time, right? Every couple of months,
41:05
Microsoft and AWS are adding some, some secure identity
41:09
security features to their stack, right?
41:11
So I think, I think overall that's a positive thing that
41:14
they're within reach and and sometimes fairly easy to enable.
41:20
Now, the CSPS can't help with the complexity of your
41:22
situation, your enterprise, but at least they're there and and I
41:28
think that's very useful and probably a good thing for
41:32
identity security overall. I feel like in the beginning of
41:36
our conversation, we're kind of at the point where we're
41:40
recommending, yeah, you should have this identity strategy and
41:46
you should really put together your identity tooling and
41:49
processes in advance of going to the cloud, right?
41:52
So that when you go to the cloud IT you can take advantage of
41:57
these great things. I'm sure there's practitioners
42:01
listening to the podcast right now like, yeah, wouldn't that be
42:04
nice? Because probably the voice on
42:06
high says we're going to move everything to the cloud in 12
42:10
months, so get her done. And so I think it's kind of the
42:16
classic dilemma. I guess my question.
42:19
Let me start with Vishnavi. So is that, is it realistic to
42:25
do these things in parallel or given that reality of the
42:29
situation they just laid out? And, and feel free to disagree,
42:33
but in that scenario, you know, what should the practitioner do?
42:37
Is it? Take these things on, be
42:40
pragmatic and try to do both. Yes, when an organization
42:47
decides that they have to start their cloud journey, they should
42:50
start thinking about identity access management as well.
42:55
So make a decision. I would look at it or I would
42:58
recommend. This is how I have been
43:00
recommending my customers when I didn't.
43:03
Cloud transformation has to happen.
43:05
Think about identity transformation.
43:07
Start the identity transformation little earlier.
43:11
Decide on how your identity fabric has to be, how your data,
43:15
where your identity data sets, how it is going to be in future.
43:20
How is your application landscape?
43:22
How are the application currently secured?
43:25
Be it authentication or authorization, they will be
43:29
definitely having a fine grain authorization or a coarse grain
43:32
authorization. It could be a custom
43:34
authorization. However it is think about all
43:37
this. How is the privileged access
43:40
then start the journey? I would call it more like a
43:43
foundational cloud IAM approach. When we start with the cloud
43:48
journey, the foundational cloud IAM also should dig in, date,
43:53
federation, MFA, RBAC. I'm not talking about ABAC at
43:58
this time. Just think about the RBAC and
44:01
least privileges, segregation of duties, life cycle, automation.
44:05
These are like the are the foundational cloud IAM that will
44:10
make the cloud journey more successful.
44:12
Then we can talk about advanced cloud IAM approach like just in
44:17
time, conditional access policies, service accounts and
44:23
API key management. Because many times we do not
44:27
speak about API key management, but just in would agree to this.
44:32
When we speak about cloud, API plays a very important role.
44:37
API key management has to be taken care of.
44:40
So with advanced cloud IMAPI key management is very important
44:44
service accounts, then most importantly continuous
44:49
monitoring and analytics. The next level I would say is
44:55
cloud governance and compliance layer.
44:57
This is adding on top of what Justin also spoke about.
45:00
That's why I wanted to bring this.
45:01
This is how the three stages of transformation cloud when it,
45:06
when we speak about cloud governance and compliance layer,
45:09
that's where our access reviews, certifications, compliance
45:12
mapping and the commonly heard term now is CIEN cloud
45:16
entitlement management that comes in as part of the cloud
45:20
governance and compliance layer. When we are able to achieve all
45:24
this, our design is zero trust. So cloud and IAM can be called
45:31
or encapsulated under the perfect zero trust model.
45:35
This is how I recommend. So just I kind of feel like
45:39
sometimes people feel like I am consultants or consultants in
45:44
general living in their ivory towers and cannot get pragmatic.
45:49
I don't buy that. I think we are very pragmatic.
45:52
The practitioners who listen to this podcast are the ultimate
45:56
pragmatist because they're living these unrealistic
46:00
expectations for identity and for cloud.
46:03
So kind of same question to you. You get through in this
46:06
situation like all right, we've got we've been under invested in
46:10
identity, but we need to get to the cloud in 12 months.
46:14
Can you do both? So I mean, I have, I have real
46:19
world experience in, in this situation, right, where the CIO
46:23
is saying we got to get this app to cloud by, you know, 2026,
46:28
right? And oh, but it, it requires an
46:31
identity update. So I would say I think everyone
46:35
in IT has had this situation before where someone's asking
46:39
you to do something. And the truth of the matter is,
46:42
is, is you're going to create tech that if you do it the way
46:46
you'll need to do it to meet the timeline, right?
46:50
To me, there's two ways to handle this.
46:51
The first is be upfront about the tech debt.
46:55
Don't bury it. Make sure that the people asking
47:00
you to get things done by a certain date are aware of what
47:04
they're going detect that they're going to incur and the
47:07
costs, you know, and the challenges that that's going to
47:11
create. You know that that's that's
47:14
number one, right, Because sometimes when the boss says you
47:17
got to get up there by 2026 because the data center is
47:20
shutting down, sometimes you got to do it.
47:22
Sometimes you can't make everything perfect before you
47:25
move everything. That's that's just the reality.
47:27
And I've seen trying to make everything perfect and perfectly
47:31
clean before moving to the cloud, like completely stall and
47:36
cause failed cloud cloud transformations.
47:39
The other piece of advice I I would have is don't make your
47:42
life hard. Don't pick the app that needs
47:46
for authentication providers to MFA providers and a bunch of
47:52
other IM words that I I can't pull off the top of my head, but
47:55
Vishnavi and you 2 could. Don't pick that app early you
47:59
you're just setting yourself up for pain.
48:02
You know, set pick, pick apps early in your cloud journey
48:06
where the authentication and the I, I and the IM support you need
48:11
is already in the cloud and you can just flip on those those
48:14
switches. And then like Vishnavi said,
48:17
hopefully if you started thinking about I am early, you
48:19
have two product Rd. maps running in parallel and one's
48:23
ahead of the other, right. And you're, you're adding this
48:25
feature and then you say, OK, we edit that feature.
48:27
That means we can move apps 712 and 13, which we couldn't before
48:32
we added that, that capability. But, but my, so you know, it
48:37
really comes down to tell the truth about tech debt and don't
48:41
make your life hard. Pick good pilots and pick, pick
48:44
good sequencing in your cloud journey to make your life easy
48:49
and learn as you, as you go. Don't don't take on the you know
48:54
your your crown jewel app that you know will bring down the
48:58
enterprise if something goes wrong as your first as your
49:02
first cloud migration. Well, you're taking all the fun
49:05
out of this, Justin. I mean, come on.
49:07
Whereas, you know, no guts, no glory.
49:09
What if the crown jewel app is the one that has to move?
49:12
I have been told that, right? If you got to get done, you just
49:16
kind of deal with it, right? All right, last question for
49:20
both of you. And Justin, I'm going to stay
49:21
with you and I'm going to give Vishnabi the final world after
49:23
you're done. But let's make this actionable
49:26
for people who are out there. What can people be doing over
49:31
the next 6090 days, let's say the next quarter, whatever that
49:35
looks like, where they can actually improve either their
49:38
cloud security or their identity and access management or ideally
49:42
both? So Justin, I'll start with you
49:44
and then Bishnabi will let you have the final word.
49:47
So the number one thing you need to be doing in cloud that we
49:51
don't always see is you have to be running automated scanning on
49:58
your cloud and you need to have people looking at that dashboard
50:02
and responding to misconfigurations just like you
50:06
do in a sock for anything on premise.
50:09
If, if you're not doing that, if you're not running, that's the
50:12
the basics, right? Even before you have a big plan
50:15
for cloud security, flip on your CSP Ms. and start burning down
50:20
risk. It may not be the most elegant
50:23
solution, but whenever I talk to a client and they're not doing
50:26
that, I, I say, leave the room and go flip on the CSPM and
50:31
start addressing the top things on the list from a risk
50:35
perspective. And then we'll figure out the
50:37
long term plan. Because if, if you're, if you're
50:40
not doing that, you really are leaving yourself exposed.
50:42
And it's it's sometimes surprising that those features
50:45
aren't turned on when we when we go to all our all our clients.
50:50
So just so we don't lose people, you said CSPM, cloud security,
50:53
posture management. For people who aren't familiar
50:55
with what that is, give me the 32nd definition of what CSPM is.
51:01
It it it. It depends on whose definition
51:04
you'd like to use, but generally there's two capabilities.
51:07
The first is a tool that scans your cloud configuration,
51:10
meaning how it is configured right now, it generally pulls
51:12
that, you know, via APIs, it comes over in Jason or, or
51:16
something like that, and it scans them and compares them to
51:18
known good states, right? It often compares them also to
51:21
compliance frameworks like CISPCI, things like that.
51:26
And it's often a layer that when people are early in the cloud,
51:30
they don't think about the configuration of their cloud
51:33
infrastructure, right? Some people also include what's
51:37
called preventative scanning, or static code analysis on
51:41
infrastructure's code, where you can actually scan the code
51:44
before anything ever exists in the cloud and pick up potential
51:48
vulnerabilities that way. Sometimes the definition include
51:52
one includes one, sometimes both, depending on whose website
51:55
you're reading. That's fair.
51:58
All right, finish. Now the final word for we get to
52:01
some wider note conversation here.
52:03
What's something that people could be doing over the next
52:05
quarter to improve their identity security?
52:09
Yeah, from identity and access management, I would take
52:12
considering three key towers we have from access management, I
52:17
would say start with password hygiene.
52:19
If you're still using password, look out for the next two auto
52:24
guidelines and make sure we have you have the right password
52:27
hygiene. Next, enforce MFA that is very
52:31
important and go to fishing resistant if possible at least
52:34
for the admins taking to the privileged access management
52:40
start enforcing least privileges just in time is readily
52:44
available with most of the tools that everyone are using as of
52:47
today. Try to leverage that and the
52:51
last that the identity governance start enforcing
52:56
access reviews. If they are not doing it at
52:59
least for their business critical applications, that is
53:04
easily doable in the 1st 60 to 90 days.
53:07
MFA, all the things and then make sure people have the
53:10
appropriate access. You know, 0 standing privilege
53:14
is probably great. You know, you want to get there,
53:15
but to get to there you have to start to whittle things down,
53:18
right? Things like that.
53:19
Yeah. OK, so let's go to lighter note
53:22
time. I'm going to ask you guys to
53:25
bury your your music souls here. And Justin, you've had a little
53:30
bit more time to think about this.
53:31
So as you're kind of thinking here, what is the last song that
53:36
you added to a playlist to your music library, whether that be
53:41
Spotify or Apple or whatever it may be?
53:44
What's the last song you added? Well, as you might have noticed,
53:50
all the things behind me are are music based.
53:52
So I'm kind of a a music junkie. So I'm always adding stuff.
53:56
I think the last thing I added was the new album from the
54:01
National. If you're familiar with that
54:03
band, they're one of my favorite bands.
54:06
And I think right before that I added the new Tyler, The Creator
54:09
album. So as you can tell, my tastes
54:11
are extremely diverse. So I'm, I'm always, I'm always
54:16
adding things, but those are two of the more recent things I can,
54:19
I can remember adding. Oh, and then the new Chance the
54:22
Rapper came out recently and I I think I added that too.
54:26
OK, all right, that's a that's that's a pretty, pretty healthy
54:29
mix there. Vishnavi, how about yourself?
54:32
What's the last song or album that you added in?
54:36
I just took the latest 2025 and I I added the top 25 list was
54:42
there. That is what I started just
54:45
recently a few weeks back I added and espresso is something
54:50
that I I liked it and I think one of the girls is something
54:55
that I've been constantly hearing it.
54:59
OK, so I'm not familiar with either of those, either of those
55:01
artists. What's the style of music that
55:03
that is? I think both are kind of.
55:11
It's a mixed feel. I get it.
55:13
It's not a particular genre at least I could relate it to.
55:18
It's more of a a very happy kind of it.
55:23
OK, kind of like a pop type music type.
55:26
Uplifting. Feel good.
55:28
Yes, and I'm more of an instrument person, so I like to
55:33
I I go with a lot of classical genres.
55:37
I try to hear instruments because I feel instruments.
55:42
I relate more with instruments rather than the words.
55:45
OK, that's interesting. So I'm, I'm, I'm similar, except
55:48
more on the electronic music side of things.
55:50
I, I prefer electronic music. Jim, how about you?
55:54
What's the last song or artist or album that you added to a
55:58
playlist or your library? So I wouldn't have mentioned 2,
56:01
so I'll give you the last one. And little back story is, a
56:06
couple years ago I thought, OK, now I'm in my library.
56:09
I have every song I like. The only time I'll add songs
56:13
from here on out are new songs that come out that I like, but I
56:17
still like. You'll be at Applebee's or
56:20
Chili's or something like that. And hero songs like, Oh my God,
56:24
I haven't heard that song in so long.
56:26
And this one was still the one by Orleans, so I added it.
56:32
All right, but here's one for you, Jeff, because I know that
56:36
you're a grunge guy. Yellow Ledbetter by Pearl Jam.
56:40
How is that not already there? Man, Come on, that's sacrilege.
56:44
Well, no, I'm thinking it probably was, but maybe.
56:47
You know, a lot of times there's like 10 versions on Apple Music.
56:51
I am an Apple guy. But here, I want you to do this,
56:55
Jeff. I want you to listen to that
56:56
song in your car cranked up, and I want you to put the words on
57:01
your phone. So you're like looking at the
57:04
words and you're thinking to yourself how the Eddie Vedder
57:08
look at these words and come up with this way to sing them.
57:13
Like he's some kind of musical genius that I just could never
57:18
think like that. I mean, he is obviously blessed
57:22
with that voice, but he's also a musical genius to take those
57:26
lyrics and like, figure out how to sing them that way.
57:29
Like it's off the charts. That's like saying what rhymes
57:32
with orange and then Eminem goes off and names like 8 different
57:35
words that he would do with that.
57:36
So definitely a skill and a talent.
57:39
I think. I mean all right, so let me do
57:43
my I'm going to do 3 just because you know, I'm I'm the
57:46
one who called the shot. So Go by The Chemical Brothers
57:50
have been on a Chemical Brothers kick recently.
57:52
They've been around for a long time, but go has been a good
57:54
one. I'm looking at my my Spotify
57:56
right now. Nobody's real by power man 5000.
57:59
So now we're, you know, stretching genres a little bit.
58:02
And then a cover that I discovered recently that I
58:05
enjoyed of like a prayer by a band called dogma.
58:09
So it's kind of like a rock goth version of like a prayer from
58:14
Madonna. You might actually like that,
58:16
Jim. So that's those are my. 3.
58:19
Yeah, OK, so this has been just a, a, an action-packed, chock
58:25
full episode of information. I want to thank Vishnavi and
58:27
Justin. Thank you both for being part of
58:29
this. I would say, you know, we'll
58:31
talk to you later, but it's probably Mike, I'll see you
58:33
online on teams or meetings and stuff like that.
58:37
So we'll leave it there for this week.
58:39
I'm going to have a bunch of links in our show notes for
58:40
people to check out. So both Justin and Vishnavi's
58:43
LinkedIn profile. So spruce those up, go out, feel
58:46
free to connect, either share stories on identity or cloud or,
58:50
you know, be polite around musical tastes, right?
58:53
Things like that, suggestions, etcetera.
58:56
And you can always connect with Jim and I and LinkedIn.
58:58
And yeah, I think that's it. So don't forget the website has
59:01
all discount codes, all kinds of stuff.
59:03
I'm constantly updating it. There's just too many to list
59:05
right now. But idacpodcast.com like and
59:08
subscribe and do all that fun stuff to help us great get get
59:11
great guests as it's easy for me to say like Justin and Vishnavi.
59:15
And we'll go ahead and leave it there for this week.
59:17
Thanks everyone for watching and or listening and we'll talk with
59:20
you all in the next one. You've been listening to
59:25
Identity at the Center. We hope you've enjoyed the show.
59:29
Make sure to like, rate and review, and we'll be back soon.
59:33
But in the meantime, hit the website at
59:35
identity@thecenter.com. See you next time on Identity at
59:42
the Center.