Latest / Identity at the Center / #307 - Creating an IAM Program

Transcript

#307 - Creating an IAM Program · Identity at the Center

• 0:00
  It's like me playing Grand Theft Auto.
• 0:02
  They're sure there's a main story and a main quest or
• 0:04
  whatever you want to call it, but I just happen to just
• 0:06
  randomly drive around and find random things to work on.
• 0:09
  So I need like something that's a little more on rail sometimes.
• 0:13
  Right. And it's like if we achieve the
• 0:16
  scope of getting $35,000, we can get a better car in the game.
• 0:22
  That's really what I think. It's the difference between the
• 0:25
  word objectives and goals. I agree with you, they probably
• 0:29
  mean about the same thing. I think objectives implies that
• 0:34
  there's some kind of metric driving like we want to get 10%
• 0:39
  more efficient or we want to improve our security platform by
• 0:44
  some metric and that ought to be the objective.
• 0:48
  So you see, the objective is like the measurable result of a
• 0:51
  goal. I think.
• 0:52
  So OK, I mean I can argue it both ways, but I don't, I don't
• 0:56
  want to argue. This is identity at the center
• 1:05
  if it has anything to do with IAM.
• 1:09
  This is the go to podcast now your hosts Jim McDonald and Jeff
• 1:15
  Stedman. Welcome to the Identity at the
• 1:23
  Center podcast. I'm Jeff, and that's Jim.
• 1:25
  Hey, Jim. Hey, Jeff, how are you?
• 1:29
  Oh, not so bad yourself. I think we're having the
• 1:32
  Internet as you're saying, we are best on this episode, but
• 1:37
  we'll just. It's very laggy, that's for
• 1:39
  sure. I feel like there's like a
• 1:39
  delay, like I'm saying something and then the gears are turning
• 1:43
  in your brain like, oh, processing, processing.
• 1:46
  OK, now we put out voice. I'm responding as soon as I hear
• 1:51
  your question mend. That's all I can tell you.
• 1:53
  But minimally tell, we're doing our best to stay on track of
• 1:58
  recording an episode and publishing one every Monday.
• 2:02
  That's our commitment to our loyal listeners.
• 2:05
  And hey, sometimes it's going to be a shit show.
• 2:12
  Yes, very well, maybe. So I'll do my best at this and
• 2:15
  make it sound natural, but if there are unnatural delays in
• 2:18
  between things that I just can't do cleanly or make it sound at
• 2:22
  least somewhat normal, I might just leave them in and just,
• 2:24
  yeah, deal with it. Hopefully the conversation and
• 2:27
  the topic makes up for it. And yes, this is the the joy of
• 2:31
  being an identity consultant and living in out of hotels.
• 2:33
  This time you're in the hotel and I'm actually at home.
• 2:35
  So that's a little bit of a role reversal there.
• 2:38
  Big time and well anyways I had meetings in Austin, TX very cool
• 2:44
  city, great food and and what I learned was that I dated
• 2:51
  Concentric stickers are in fact currency.
• 2:54
  You can use them for people who are die hard this years.
• 2:58
  We had a few at company called towels.
• 3:01
  They do B to BCIAN and as they're in my role as a
• 3:07
  consultant for RSM, that's my day job.
• 3:11
  We partner with them. It's a good relationship.
• 3:15
  I was there with Chad and Fletcher from our team.
• 3:19
  And again, they talk about the podcast like they just love it.
• 3:24
  And it's amazing, Jeff, because people keep asking like, why
• 3:28
  didn't you guys start doing this podcast?
• 3:30
  You know, five years ago, podcasts weren't even a big
• 3:32
  deal. And it's pretty cool.
• 3:36
  Just, I mean, the story's pretty, pretty lame.
• 3:39
  It's like, yeah, Jeff asked me to probably just start the
• 3:42
  podcast and like, yeah, I guess so.
• 3:44
  Like what else are we doing? Yeah, all you have to do is just
• 3:48
  speak into a microphone, right? It's that easy.
• 3:51
  Which one of these? I mean, you know.
• 3:56
  Well, except, except when we're dealing with weird Marriott
• 3:59
  Internet foibles. You know, that's the one thing
• 4:02
  that I think hotels have really missed the boat on is just black
• 4:06
  luster Wi-Fi all over the place. It's just not good.
• 4:10
  Yeah, totally. And even enhanced Internet is
• 4:13
  enhanced of a what over horrible Internet that operates at the
• 4:18
  speed of like flip phones? I don't know.
• 4:21
  Well, you're tethered to your phone, so we'll give it a shot.
• 4:23
  Why don't we get into a couple of the conferences that we want
• 4:26
  to make sure people are aware of.
• 4:28
  We can talk about Identity Week in Asia.
• 4:29
  We were just at the DC conference, which was a lot of
• 4:31
  fun about Asia still taking place October 22nd and 23rd.
• 4:35
  And if you use the code IDAC 30, that gets you 30% off.
• 4:39
  We'll have a link in our show notes for people to check that
• 4:41
  out. But before that, we've got the
• 4:43
  authenticate conference that you and I are going to be at October
• 4:46
  14th through the 16th in Carlsbad, CA IDAC 15 gets you
• 4:51
  15% off of your registration and I am very much looking forward
• 4:55
  to that conference. We've got some exciting plans
• 4:58
  for what we're going to be doing there.
• 5:00
  As part of sort of the official agenda, if you received an
• 5:04
  e-mail asking you to fill out a survey with a bunch of identity
• 5:07
  questions, please do so because that's for us.
• 5:11
  And it's something that Jim and I are working on and we need as
• 5:14
  much participation as possible from people listening.
• 5:17
  So if you're attending the final conference, whether it's remote
• 5:20
  or in person, hopefully you have an e-mail.
• 5:23
  If not, check your spam folders and look for that survey so that
• 5:28
  we can collect some information from folks and turn into what we
• 5:31
  hope will be a really fun session at the conference
• 5:34
  itself. That will be in person, and I
• 5:36
  believe it's going to be streamed too.
• 5:37
  So it'll be a lot of fun, but we need your help.
• 5:39
  So that's my tweet. Everyone has register register
• 5:42
  using our code. Yeah, of course.
• 5:44
  So you save money, we get a, we get a little bit of of credit as
• 5:47
  far as like, hey, you know what, we want to partner with you guys
• 5:49
  again because we were able to drive some some folks to attend.
• 5:53
  So that's how that works. Yeah.
• 5:55
  So conferences and I think today's is kind of be about
• 6:00
  conversations that you and I have both been having and sort
• 6:04
  of our real jobs around IM programs.
• 6:07
  I'm kind of like thinking about this like, all right, so you
• 6:09
  want to start an IM program, Cool.
• 6:12
  Now what, what do you do 1st and maybe kind of take a high level
• 6:17
  approach here from a, from a strategic perspective, say, OK,
• 6:20
  here's how we want to go about building out an identity and
• 6:23
  access management program. And I think this applies to
• 6:26
  really any organization. If you have an IM program,
• 6:30
  great. Take a look at it and let's see,
• 6:33
  you know, if there's anything that we mentioned here that you
• 6:35
  might want to incorporate. If you haven't started 1A,
• 6:38
  better time than now to start thinking about, OK, how do we
• 6:40
  want to get things kicked off? So why don't we start there?
• 6:44
  And I think the first thing that you probably want to start to
• 6:47
  think about is what is your IM program want to be when it grows
• 6:51
  up? What are its goals, its hopes,
• 6:54
  its dreams? What is the scope?
• 6:57
  You know, what is it your program is meant to address?
• 7:00
  Is it internal enterprise workforce, you know, employees,
• 7:04
  is it customer, is it both? Should you mix both into the
• 7:09
  same program? You know, I think there's,
• 7:11
  there's different options there's but what do you think
• 7:13
  about starting there? Jim is like, hey, let's, let's
• 7:16
  figure out what we want to be before we start to design this
• 7:19
  thing. Yeah, I think golds and scope
• 7:21
  are obvious two things that you need to define.
• 7:25
  I think sometimes you have to work backwards into that.
• 7:29
  In other words, what are the drivers?
• 7:31
  What are the outcomes that you're trying to achieve?
• 7:35
  When I think about these drivers and the outcomes, a lot of times
• 7:40
  it's it boils down to improved efficiency, reduced cost and
• 7:47
  improved security and a rich reduced risk, improved
• 7:52
  compliance results. So if you have those objectives
• 7:56
  in mind, that helps and certainly helps you drive your
• 8:01
  scope because if all these things require that you're doing
• 8:05
  a workforce saying customer I am, that may be the scope of
• 8:09
  your project. You may know those things are
• 8:12
  scope of your program, you may know those things going in.
• 8:16
  But either way, I think it's important to define what are the
• 8:20
  drivers, what are the outcomes that you're looking to achieve
• 8:23
  within your program? I feel like we're saying the
• 8:25
  same thing. We're setting goals, we're
• 8:27
  saying outcomes. So I think we're on the same
• 8:29
  page and I think those goals and outcomes are very different
• 8:32
  based on your scope. So if your, if your remit within
• 8:35
  the organization is you're in charge of employees, that's
• 8:38
  going to be a very different, you know, set of outcomes that
• 8:42
  you're trying to put in place if it, you know, compared to
• 8:45
  customers, right, true customers.
• 8:47
  And maybe maybe organization is more in the middle where it's
• 8:49
  like B to B is more like partners and other vendors and
• 8:52
  things like that. Think of like like a dealer
• 8:53
  network, right? Or insurances like that too,
• 8:56
  right? We have a lot of different kind
• 8:57
  of B to B partners that are, are doing things.
• 8:59
  So certainly figuring out those initial things starts to take
• 9:05
  the, the, the universe, right, and make it a little bit
• 9:07
  smaller. And I think that's, that's
• 9:09
  helpful because if you have a tighter scope and a tighter
• 9:12
  vision of what's of what you're trying to do, that helps narrow
• 9:17
  the focus and say, OK, here's the path you want to follow.
• 9:20
  Because otherwise, you know, it's like a, it's like me
• 9:22
  playing Grand Theft Auto. They're sure there's a main
• 9:25
  story and a main quest or whatever you want to call it,
• 9:27
  but I just happen to just randomly drive around and find
• 9:30
  random things to work on. So I need like something that's
• 9:33
  a little more on rail sometimes. Right.
• 9:36
  Maybe it's like if we achieve the scope of getting $35,000, we
• 9:41
  can get a better car in the game.
• 9:44
  That's really what I think. It's the difference between the
• 9:47
  word objectives and goals. I agree with you, they probably
• 9:52
  mean about the same thing. I think objectives implies that
• 9:56
  there's some kind of metric driving like we want to get 10%
• 10:01
  more efficient or we want to improve our security platform by
• 10:06
  some metric and that ought to be the objective.
• 10:11
  So you see, the objective is like the measurable result of a
• 10:13
  goal. I think.
• 10:14
  So OK, I mean I can argue it both ways, but I don't, I don't
• 10:18
  want to argue. Yeah, no, not.
• 10:20
  Let's just call it that for now, yeah.
• 10:22
  That's how it feels, obviously that's how it feels at the
• 10:25
  moment. OK, so we've got our objectives,
• 10:28
  we've got our goals and scope. What do you think is the next
• 10:32
  step that we that we want to start to think about?
• 10:35
  Well, normally what we do and we engage in this process with the
• 10:39
  client is we start with an assessment.
• 10:41
  And so it's very helpful to have people who have perspective.
• 10:47
  So either maybe people on your team have a good deal of
• 10:51
  experience of working at different organizations within
• 10:56
  your industry and have some background in how I am is being
• 11:01
  done at different places. Or you engage with the third
• 11:06
  party and which I've experienced with seeing what works well,
• 11:11
  what doesn't work well from an identity perspective.
• 11:16
  And then designing, well, really performing an assessment of
• 11:20
  where you sent, how mature are your current processes compared
• 11:25
  to other organizations in your industry and a world at large.
• 11:31
  Yeah, I think about it as, all right, I want to build this Lego
• 11:35
  car, spaceship, boat, whatever it may be.
• 11:38
  What Legos do I have that will help me get to that end state of
• 11:43
  whatever it is I'm trying to building?
• 11:44
  And more importantly, what Legos am I missing?
• 11:47
  Do I need, Do I have the right people?
• 11:49
  Do I have the right processes, the right technologies?
• 11:51
  So I think about it from an inventory perspective to say,
• 11:53
  OK, here's what we've got, here's where we're trying to go,
• 11:57
  what's working, what's not working?
• 11:58
  What are the parts that are missing?
• 12:00
  What are other people doing to solve for maybe some of these
• 12:03
  gaps? Maybe there's a unique Lego
• 12:05
  shape and there's only three of them in the world and you're not
• 12:07
  going to have access to it, so you've got to come up with an
• 12:09
  alternative. So I think working through that
• 12:12
  process of assessing and saying, OK, these, these are the things
• 12:17
  we have to play with. What does our toolbox look like?
• 12:19
  Are the tools we have good enough or do we need to buy new
• 12:22
  tools or upgrade our current tools or train our current tools
• 12:28
  right? Or maybe learn to use our tools
• 12:31
  in a different way through a business process or something
• 12:34
  that makes things more efficient?
• 12:35
  So I'm totally with you right there is like, OK, goals, let's
• 12:39
  set them up. Let's set our objectives now
• 12:41
  let's assess and see what we've got to play with and where we
• 12:43
  want and how are we going to get there with the tools we've got.
• 12:45
  Does that make sense? Yeah.
• 12:47
  And it it makes you think of an example.
• 12:50
  So one of the areas that we talked about in this one of
• 12:53
  these Lego boxes is what is the system of record for your
• 12:57
  identities? Normally companies do a very
• 13:00
  good job of having all their employees in a single HR system.
• 13:04
  They have a good search system of record for who works.
• 13:08
  Sierra Star's employees, contractors, It's really hit or
• 13:13
  miss. Some, many organizations have
• 13:16
  spreadsheets or databases of contractors without having the
• 13:21
  perspective of what is best practice, what are other
• 13:24
  organizations doing Startsheet good enough databases could not.
• 13:30
  I mean, generally the answer is going to be no.
• 13:33
  But how would you know such things?
• 13:35
  So I think having some experiences because trying to
• 13:39
  think about the identity management, it's experience
• 13:42
  based and you know from a consulting standpoint it's
• 13:46
  experience based. It's not like you go into each
• 13:50
  client organization and come up with the Whizbank solution,
• 13:53
  coming up with the solution based on what you've seen work
• 13:57
  in other places and what you've seen where it's caused major
• 14:01
  problems. You want to avoid major
• 14:03
  problems. So that example I just used, a
• 14:06
  major problem is an organization where we've got a spreadsheet
• 14:09
  for every country and they may or may not have the contractors
• 14:14
  in that spreadsheet. We may or may not have all the
• 14:17
  identity identities in the system of record.
• 14:21
  That is not going to be a good starting point for an IGA
• 14:24
  implementation. Yeah, if you're trying to go
• 14:26
  down the IGA route, you definitely are.
• 14:28
  The goal is to become more data-driven in that aspect is
• 14:31
  you want good timely quality data sources to drive that
• 14:35
  automation. But let me take the alternative
• 14:37
  here. If contractors are only 1% of
• 14:41
  your total users, is it worth saying, OK, well, we haven't won
• 14:48
  the battle yet to put him in our work day or whatever, you know,
• 14:52
  ADP, whatever the identity source of truth is for for
• 14:55
  employees. Can we get away with.
• 14:59
  Yeah, you know what, that's going to have to be a
• 15:00
  spreadsheet for now. And maybe it's a little bit of a
• 15:02
  Field of Dreams approach where we say, well, we're going to
• 15:05
  build it and we're going to hope there comes the employees will
• 15:08
  be taken care of and people are going to start to wonder why
• 15:10
  contractors don't have the same experience and they are more of
• 15:15
  a hassle. Well, here's why, because we've
• 15:18
  we've got the tools, we've got the business processes in place
• 15:20
  to manage our employees. But for whatever reason, non
• 15:24
  employees have, you know, don't have feature parity, right when
• 15:27
  it comes to those business processes.
• 15:29
  And so that's an option, you know, I guess.
• 15:31
  So I'm just. One example, but I think it's
• 15:34
  good that you bring up the devil's abdicated approach
• 15:36
  because I think the scenario you brought in was a very edge use
• 15:42
  case where the company has, let's say thousands of employees
• 15:47
  and only 1% of those employees are, I should say a thousands in
• 15:52
  the workforce and only 1% of those are non employees.
• 15:56
  That's I, I almost goes as far as to say I've seen that very
• 16:03
  rarely or maybe never. It's almost always a greater
• 16:06
  percentage, always almost always dealing with hundreds or even
• 16:10
  thousands of contractors. In those cases, you need to have
• 16:14
  a system record. When you're talking about a
• 16:16
  couple dozen individuals, you may be able to come up with a a
• 16:22
  more simplified way to manage to choose.
• 16:25
  Ultimately, you do need to come up with a solution.
• 16:28
  That's just one example of many identity use cases.
• 16:32
  Yeah, I mean, I agree with you. I, I, you know, there's there's
• 16:34
  no magic number, right? 1% of 1,000,000 is a lot of
• 16:37
  people. So I think it really is kind of
• 16:40
  let's take into context and say, OK, well how big of a problem is
• 16:43
  this? And do we, do we stop progress
• 16:47
  because 1% of our population is not going to be addressed and
• 16:50
  addressed very well? I'd argue no, unless that 1% is
• 16:55
  like critical to the business and causes a outsized amount of
• 16:59
  risk that you're unwilling to take, then OK, let's figure it
• 17:01
  out. Ideally you've got everyone
• 17:03
  covered, but I think in the real world, you have to make
• 17:06
  sacrifices sometimes. And that might be a battle that
• 17:10
  you, you know, push down the road a little bit rather than
• 17:13
  just waiting for everything to be perfect before you start,
• 17:16
  because that's it's, it's never going to happen.
• 17:17
  You got to start somewhere. But I'm with you on that because
• 17:19
  a lot of times these programs we start to think about this is
• 17:22
  like, hey, this, this advice you're, you're saying Jim and
• 17:25
  Jeff sounds, you know, pretty, you know, common sense like duh.
• 17:30
  Well, some of it is, yes, but people aren't doing it.
• 17:34
  It's like, OK, well, why aren't you doing it?
• 17:36
  Why aren't you setting a structure around this?
• 17:38
  You know, who owns identity and access management, right?
• 17:40
  Things like basic questions like that.
• 17:42
  And so sometimes it doesn't sound so innovative until you
• 17:46
  get further down the road and say, oh, yeah, we needed to
• 17:49
  like, build the base, you know, before we started to add in all
• 17:52
  the fancy stuff that that we really were thinking about
• 17:55
  getting to. But if you had tried to do, you
• 17:57
  know, let's put AI on top of it right now, terrible time.
• 18:01
  You're, you're, you're not going to enjoy it.
• 18:02
  The data will be suspect and you'll wonder why you ever did
• 18:05
  this in the 1st place. So I, I'm a firm believer in and
• 18:08
  thinking about that firm foundation.
• 18:10
  And that's where that assessment part comes in.
• 18:11
  It's like, OK, what do we have to play with?
• 18:13
  What's realistic? I see.
• 18:15
  The other thing about an assessment is that you're going
• 18:19
  to find where are your big gaps, Where is it that you really need
• 18:23
  to have a mature, stable process and you're underwhelming.
• 18:28
  And I think probably most practitioners intuitively know
• 18:34
  where those gaps are. But putting together a bar chart
• 18:39
  of like we're here in terms of maturity, we need to get there
• 18:43
  or where we are, where we are heading, I think that's an
• 18:48
  important exercise. I think it's important.
• 18:51
  I don't place as much. I mean, it's a bar chart and you
• 18:54
  know, 50% of all stats are made-up.
• 18:57
  So you know, it's kind of like, OK, maybe that's what you need
• 19:00
  to get executive buy in because ultimately you're going to need
• 19:04
  executive buy in to get this thing going.
• 19:06
  And so maybe, you know, your executives are very big on
• 19:10
  charts and you need to quantify everything or as much as you
• 19:12
  possibly can, but sometimes those metrics might be a little
• 19:15
  bit subjective and you have to kind of explain.
• 19:17
  OK, well, you know, the Active Directory team is doing a great
• 19:19
  job, but AWS stinks. So how do you try to combine
• 19:23
  things into like 1 bar chart might be a little bit
• 19:25
  challenging. So I think you have to kind of
• 19:27
  understand as part of that assessment process to say, OK,
• 19:31
  here's what we're doing. Well, here's where we need
• 19:33
  improvement and let's figure out how to get this together because
• 19:37
  unless you've got executive buy in, you're going nowhere where
• 19:39
  you're going to have a very difficult time.
• 19:40
  This is not a grassroots campaign that you can typically
• 19:44
  stand up and all of a sudden you've got, you know, whatever
• 19:47
  investment people or technology that you need to get things
• 19:50
  started and certainly not you don't have the support to do
• 19:53
  business change, which is really, really hard.
• 19:55
  That's probably the hardest thing of us, if it's the change
• 19:58
  and you need the executives to be part of that, that process.
• 20:00
  Yeah, I think that's one of the reasons I love interviewing
• 20:05
  chief information security officers on the podcast is that
• 20:09
  they speak the executive speak, but understand cybersecurity.
• 20:15
  So they're able to put investments and return on
• 20:20
  investors in terms that executives get.
• 20:24
  Why would I spend money to reduce risk?
• 20:28
  I could spend that money to improve my business in other
• 20:33
  ways. So it's important to make that
• 20:37
  that business case, that return on investment case for investing
• 20:42
  in identity and access management, investing in an
• 20:46
  improved user experience or improved security posture.
• 20:51
  Yeah. And so you need the people who
• 20:54
  get that, who understand that and are good at making that case
• 20:58
  or you're going to be running around and doing IM on, you
• 21:03
  know, pocket change. That is no fun.
• 21:06
  Not only is it no fun, but it's hard to be effective and you're
• 21:10
  going to constantly be chasing your tail.
• 21:13
  Yeah, I think one thing that I've seen a a big improvement
• 21:16
  over the years in talking with CSO's and others at the
• 21:19
  executive level is their ability to articulate why something
• 21:24
  needs to be done. Because a lot of times the pain
• 21:27
  and suffering is hidden because there are heroic IM people
• 21:31
  running around doing things that are beyond the scope of their
• 21:36
  role or going above and beyond to fix things just out of the
• 21:39
  they know what's the right thing to do.
• 21:41
  And a lot of times that stuff gets hidden and covered up.
• 21:43
  Well, nothing's broken. Why do we need to fix it?
• 21:45
  Well, let's open up the the covers and look at this, you
• 21:50
  know, engine that is like a bunch of popsicle sticks and a
• 21:52
  hamster. Like that's not, you know,
• 21:54
  that's that's not where you want to be and it's it's a risk,
• 21:58
  right? If one of those popsicles has a
• 22:00
  break, the whole thing kind of falls down.
• 22:01
  Or if the really important hamster leaves, who's going to
• 22:05
  drive this engine? So I think, I think that a lot
• 22:08
  of the executives that you and I both talked to have gotten
• 22:11
  better and articulating that of here's why the investment is
• 22:15
  important. Now ultimately the business is
• 22:17
  going to decide. And I think it's the CSO's job
• 22:19
  or whoever's in charge of making that, that case really needs to
• 22:23
  understand the risk component for it and be able to articulate
• 22:26
  that out to others to secure the other buying.
• 22:28
  Because it's not like CSO's can do this all on their own either.
• 22:32
  Typically they have to go out and get support from their peers
• 22:34
  and other executives right within the organization.
• 22:37
  So it's important that that executive buy in is in place,
• 22:41
  not just in information security or wherever the IM program is
• 22:45
  going to live, but across, because you're going to need
• 22:47
  people across the organization to make this thing happen.
• 22:50
  You're going to need a cross functional team, which is really
• 22:53
  where you start to say, OK, we've got our our goals.
• 22:56
  We've started to think about what we have in place.
• 22:58
  We've got executives saying, yes, you know, proceed, let's
• 23:01
  start to figure out what's next, and let's put together A-Team
• 23:04
  because you talked about those conversations that you have with
• 23:06
  a whole bunch of other people as well.
• 23:08
  It's not just information security as part of an IM
• 23:10
  program, it's infrastructure, it's the help desk, it's the
• 23:15
  business themselves. So you really want to make sure
• 23:17
  that you pull enough people together, but not too many
• 23:19
  people to be able to have insight and windows into the
• 23:24
  different parts of the organization so that whatever it
• 23:27
  is you're designing works for as many people as possible.
• 23:30
  Yeah. And suddenly pulling that
• 23:33
  information in Billy Evangelist in the cross functional area.
• 23:38
  So HR and other parts of IT or other departments, they can go
• 23:44
  out and talk to their teams about how I am is coming with
• 23:50
  the strategy, how it's important to align with the strategy,
• 23:53
  adopt the shared services. I always like to talk about the
• 23:59
  360° view of IM conference. And we worked with a guy named
• 24:06
  Ben and he's like, oh, gag. Like 360.
• 24:09
  Like that's so cliche. And I don't think it's about
• 24:13
  7/27/20 is like make your head spin on.
• 24:18
  But I think about the 360 is like looking at bulb on and
• 24:23
  communicating what the IM program is contributing to the
• 24:27
  company and getting feedback about what the business is doing
• 24:31
  and how the IM team can support that.
• 24:34
  It's, you know, working down with the IM implementation
• 24:40
  teams, with the operation teams, the project management office
• 24:45
  and understanding how things are going with the DJ on the ground.
• 24:51
  It's also working laterally with the business and with other
• 24:56
  technology teams to make sure that the services you're
• 25:00
  creating as an IM team are effective, that business can use
• 25:05
  them, that the business understands them, and that from
• 25:08
  a technology perspective, they're fitting in with what the
• 25:12
  needs are. If you're doing all those
• 25:14
  things, you're going to build evangelists and the people are
• 25:17
  going to say, hey, the sign in program is not so bad.
• 25:21
  And you're getting results out of it and things are happening.
• 25:23
  And it's not just, you know, a committee for committee sake,
• 25:27
  that kind of thing. Here's why I don't like the 360
• 25:30
  term. I get where your, your head is
• 25:33
  at makes sense. But to me, 360 is 2 dimensional.
• 25:37
  And it's, it's more like it needs to be like a sphere or a
• 25:40
  globe And to be able to say, oh, we are, you know, we're, we're
• 25:43
  communicating at in all directions.
• 25:46
  I don't know if 360 gets that three-dimensional aspect to it.
• 25:50
  Does that make sense? Well, definitely, I mean in
• 25:55
  terms of the mathematics of the 360 is definitely 2 dimensional,
• 26:00
  so I get that. I don't know what the sphere
• 26:02
  would include that the 362 D view doesn't when what are you
• 26:08
  thinking there? Let's.
• 26:09
  Let's just go with it. Yeah.
• 26:11
  I mean, let's let's go with it because I think, I think the
• 26:13
  concept makes sense and I don't want to, I don't want to get
• 26:15
  into a geometric discussion, but I do want to ask you what's at
• 26:20
  the core of that 360 at the center?
• 26:23
  Would that be the I am program manager?
• 26:25
  So I always think of the I am steering committee as kind of
• 26:30
  the core body that pulls all together.
• 26:33
  But if you go even more central to the core, yeah, like now
• 26:38
  you're in that little ball and center of the earth.
• 26:41
  This is the I am program manager.
• 26:44
  I don't think it's just one single role.
• 26:45
  I think that person holds it together that the IAM architect,
• 26:50
  they become a team. It's like the business person
• 26:53
  and technology person and really the IAM program manager running
• 26:57
  around who doesn't get the tech is going to have a problem being
• 27:02
  effective. The person who gets the tech but
• 27:05
  doesn't understand the business is going to have a hard time
• 27:08
  getting around. So usually it's two different
• 27:11
  people. I guess there could be one
• 27:12
  person who really guess both aspects of it, but it's both
• 27:17
  sides ahead. And then the third leg of the
• 27:20
  stool, there is one is the executive who's kind of saying,
• 27:24
  all right, this is what the business needs to buy in.
• 27:27
  So it's not Even so much conversations upward because
• 27:32
  they're so hard to have. You don't get that much time
• 27:35
  from executive teams, so if you have somebody who's from that
• 27:40
  that world who is part of your core, they can tell you like
• 27:43
  this what the business is expecting from the program.
• 27:49
  And they might be part of the steering committee or something
• 27:51
  like that. But I'm with you.
• 27:53
  I think there's like this, this core I am team that kind of sits
• 27:56
  in the middle. And there will be other
• 27:58
  resources that kind of spin in almost like planets orbiting or
• 28:02
  moons orbiting a planet, right? That kind of situation, you
• 28:04
  know, maybe HR is really important for this first phase
• 28:06
  because you mentioned IGA, we need HR to be there because
• 28:09
  we're going to be using their data to drive automation.
• 28:13
  Once that's done, maybe they spin out into a further orbit
• 28:16
  where they're, you know, not as I want relevance, not the right
• 28:19
  word, but they're not the focus. You know, maybe now we're
• 28:22
  pulling in IT infrastructure team because we're doing
• 28:25
  privileged access management. They become much more in focus
• 28:28
  and then OK, we fix that and they kind of slowly drift into a
• 28:31
  further orbit and then, you know, you've got these other
• 28:33
  components that are coming in. But I think I'm with you in that
• 28:36
  like you've got a program manager.
• 28:37
  I'm going to tell you, a good program manager is really hard
• 28:39
  to find someone that can communicate and understands the
• 28:42
  technology are exceedingly rare. If you are one of those people,
• 28:48
  be sure you're taking advantage of that, of those skills and
• 28:51
  really driving your organization.
• 28:52
  If you're, and if you're a, if you're a techie and you're
• 28:54
  really not great at communicating, work on it.
• 28:56
  I mean, start to work on the communication and if you're a
• 28:59
  good communicator, but you understand the tech, you know,
• 29:01
  watch videos, get more involved with that stuff and kind of
• 29:04
  learn it. Because I do see that that
• 29:07
  Unicorn of a single program manager that understands the
• 29:11
  vision of the program can communicate why that's important
• 29:15
  and what people are going to get out of that in layman's terms,
• 29:18
  terms that everyone's going to be able to understand, but also
• 29:21
  understands the technology. They don't need to be a
• 29:23
  developer. They don't need to be, you know,
• 29:25
  in the guts of the applications configuring things, but they
• 29:29
  need to understand the capabilities that are there and
• 29:32
  have the resources at their disposal to enact those things.
• 29:36
  Engineers, analysts, you know, whatever that looks like for the
• 29:38
  tools. Yeah, I mean, let's try the most
• 29:41
  important role in the program overall.
• 29:43
  You brought the cross functional team line is thinking about
• 29:46
  that. You know everything we just
• 29:48
  described would work as well for a workforce IM program or
• 29:54
  customer IM program. Oh, you think about that
• 29:57
  important role of the program manager.
• 30:00
  How often have we talked to folks who've made their way
• 30:03
  through I to become the identity program manager, You know,
• 30:08
  essentially the the chief practitioner of IAM for their
• 30:13
  organization and how many different paths people can take
• 30:17
  to get there. I usually find that it's people
• 30:21
  who understand the business, know how to make the case for
• 30:26
  return on investment, and have enough technology understanding
• 30:30
  that they know what the parts of pieces are or more.
• 30:34
  You know, I don't think that just because you're not
• 30:37
  technical, you should use as an excuse to say I don't need to
• 30:42
  learn that or I don't want to learn that.
• 30:44
  I think be a sponge. I think if you're technical,
• 30:48
  learn as much as you can about business.
• 30:51
  They can only help you in whatever position you take.
• 30:54
  Yeah, I totally agree. I think once you've got that
• 30:57
  team in place, now you start to think about the tools you're
• 31:00
  going to do battle with, right? What are the capabilities you
• 31:04
  want to bring in? Do you need an IGA tool?
• 31:06
  Do you need privilege access? Do you have single sign on and
• 31:08
  MFA? Have you got all that, you know,
• 31:11
  figured out already and now you need to do something with ITDR
• 31:15
  or some other analytics? Or maybe you're on the customer
• 31:18
  side. You're like, hey, we don't
• 31:18
  really have a good way for our customers to manage their
• 31:21
  profiles or maybe their their data consents, especially if
• 31:24
  you're in Europe or other places where you have, you know, laws
• 31:27
  like GDPR, for example. So I think really understanding
• 31:30
  what the technology fits are is important because these are
• 31:34
  typically long term decisions that you're making, right?
• 31:37
  You don't buy Octa and say, OK, well, we'll get rid of it in a
• 31:40
  year. These things are generally too
• 31:42
  expensive to like turn over that quickly.
• 31:43
  They're not disposable in that way.
• 31:46
  And that can be really challenging because there's a
• 31:47
  lot of really good products out there, products that are like in
• 31:51
  your face and everyone knows about and ones that just for
• 31:54
  whatever reason struggle with awareness and, you know,
• 31:58
  presence in the market. And they're new or upcoming or,
• 32:01
  or maybe they're big in Europe, but they're not big in the US or
• 32:04
  vice versa, right? Things like that.
• 32:06
  So I think understanding the technology landscape is very
• 32:09
  helpful because it almost always comes down, in my experience, to
• 32:13
  the details. You're going to buy an IJ tool.
• 32:16
  Guess what? They can all do provisioning.
• 32:18
  They can all create an Active Directory account, you know,
• 32:20
  remove it, add permissions and run an access review.
• 32:23
  It's all the details around it that are typically the
• 32:25
  differentiators at this point for a, for a, for a technology
• 32:29
  that's that mature, you know, up and coming things maybe like an
• 32:31
  ITDR or some sort of, you know, AI enhancements as we're seeing
• 32:34
  now, maybe there is a little bit something there.
• 32:37
  It's like, OK, you know, there is a little more maybe meat on
• 32:40
  the bone that we need to kind of chew on.
• 32:42
  But I think the, the right technology is, is really key
• 32:46
  because you're going to be stuck with that for probably, well, at
• 32:49
  least three years if it's SAS, cause three-year subscription's
• 32:52
  basically right, but probably longer because people are going
• 32:56
  to ask you, well, why did we spend all this money
• 32:58
  implementing this tool only to RIP it out three years later?
• 33:01
  That's a really tough pill to swallow.
• 33:04
  Yeah. Well, I mean, that's the
• 33:07
  question is like what should be the horizon that folks should
• 33:11
  look me at? It almost seems like to say 10
• 33:14
  years is like a little bit polyamic or unrealistic.
• 33:21
  At least five years I kind of feel like is the minimum where
• 33:28
  you start to really get your money's worth.
• 33:31
  You're ripping it out at five years and having to rebuild.
• 33:35
  That's a major reinvestment. There's a tough decision.
• 33:40
  I think one thing is just saying this company is the leader now
• 33:46
  and assuming they're going to be the leader in five years.
• 33:49
  Well, if history is any teacher, that's not always the case.
• 33:54
  In fact, it's rarely the case. I don't know if history is the
• 33:59
  right teacher for this. I mean, you look back on this
• 34:04
  industry 15 years ago, you have said you choose Oracle or CA or
• 34:09
  IBM. None of those companies are
• 34:12
  really relevant in this space anymore.
• 34:14
  Maybe IBM, but CA and Oracle are not relevant in their identity
• 34:20
  space anymore. They owned the identity space.
• 34:24
  They were the only choices really.
• 34:26
  And now you look around and the other incumbents, will they be
• 34:32
  around 5-10 years down the road? I think they it feels like they
• 34:38
  will. It's choosing the right
• 34:42
  technology is is not easy. No, because there's so many good
• 34:45
  choices. And the truth is you could
• 34:47
  probably be successful with almost any of them if you're
• 34:49
  willing to adopt their business process that they bring to the
• 34:53
  table. That's sometimes a challenge for
• 34:55
  organizations. You know, you bring up this this
• 34:57
  idea of like, will the company be around in five, 1015 years?
• 35:01
  I think that's real important. You know, IBM and you know, the
• 35:05
  CAS and the Oracles, they've been around for a long time.
• 35:07
  And yeah, they kind of had their heyday in the IM space, but they
• 35:10
  were around for a long time. I mean, it wasn't like they were
• 35:12
  only an IM for like 5, you know, 5 minutes, five years, whatever
• 35:15
  that is. It was decades, you know, that
• 35:18
  they were kind of the the only real players in that enterprise
• 35:21
  market now. They let, you know, upstarts
• 35:24
  like Sale Point and others, you know, come up and kind of steal
• 35:28
  the market away from them. But there will be other vendors
• 35:31
  that come up. But when do you make the
• 35:34
  investment in a small player versus an established player is
• 35:37
  always interesting 'cause I think a lot of that has to do
• 35:40
  with the risk appetite of the organization.
• 35:43
  If you're a small organization, maybe a little bit more nibble
• 35:45
  in your choices. Maybe you are willing to go
• 35:46
  with, you know, somebody who's new where it doesn't have the
• 35:48
  track record, Maybe they don't have, you know, that's the fancy
• 35:51
  training portals and kind of all that stuff.
• 35:53
  But you feel good about their technology and you've gotten
• 35:56
  maybe some insurances from leadership over there, right,
• 35:59
  The CEO or people who are maybe more hands on maybe than than
• 36:02
  another organization. Or maybe your organization is a
• 36:05
  little more adverse to that type of risk and wants to have an
• 36:08
  established partner. And those are the types of
• 36:10
  organizations that will say, well, give me the Gartner Magic
• 36:12
  Quadrant. Let me just look at the upper
• 36:13
  right. I don't.
• 36:15
  Think there's anything wrong with that?
• 36:18
  I it might be, but maybe that's just the profile of the
• 36:20
  organization. They're not willing to look at a
• 36:23
  smaller company until they've grown and gotten through that,
• 36:26
  that hump of hey, we're in the market, We've been around now
• 36:30
  for 5-10 years and we have a bunch of customers and there's
• 36:34
  less of a concern that they might die overnight, for
• 36:37
  example. I can get that.
• 36:38
  I get the risk. I understand it.
• 36:39
  I don't agree with just saying look at upper right of Gartner
• 36:42
  and even Gartner will tell you don't look at just Gartner upper
• 36:44
  right. That doesn't mean as much.
• 36:46
  But there are organizations that do not want to play with the
• 36:51
  smaller fish. They're looking for the more
• 36:53
  established fish in that case, and I get it.
• 36:56
  I think that's just something that you have to think about.
• 37:00
  You have to think about it. So you know, as you've been
• 37:03
  talking, I was thinking I just talked about Oracle CA and IBM.
• 37:08
  People are saying I think you probably, yeah, that ancient
• 37:12
  history in terms of identity. They were replaced by Octa
• 37:18
  paying for Jack. No, they were replaced by Gigya
• 37:23
  and January. Those companies basically don't
• 37:28
  exist. They're bought by Akamai and SAP
• 37:32
  and they pulled back those capabilities so much that I mean
• 37:36
  when was the last time they've either seen SAP or Akamai and an
• 37:40
  identity conference. So these things run in cycles.
• 37:44
  There's acquisitions that can take place and then companies
• 37:48
  can deemphasize the portfolio. Can you take that and like glean
• 37:55
  me the operation from it? No, I just think it means that
• 37:58
  you're saying the right technology is even harder than
• 38:01
  you think. Yeah, I agree.
• 38:04
  OK, So we've got our program, we are, we've got our goals, our
• 38:08
  scope, we've done our assessments, we've got our buy
• 38:11
  in from the executives. We've got a team kind of put
• 38:13
  together. We've, we've muddied through the
• 38:16
  process of, OK, we figured out the technology we're going to
• 38:19
  use. Now how do we get it
• 38:21
  implemented? And typically you'd probably
• 38:23
  want to do this in a phased approach versus a Big Bang.
• 38:26
  Because Jim, I'm going to go off and build this thing.
• 38:29
  I want you to give me $3,000,000 and I'll see you in three years.
• 38:32
  Are you going to give me that money?
• 38:36
  No, I might give you a loan to the first phase.
• 38:41
  Right, so I need to show wins right along the way.
• 38:47
  You didn't need to show wins. I think my feeling on
• 38:51
  implementation has been maturing.
• 38:54
  So I'm going to tell you where it's at.
• 38:56
  Today I came up as a wonderful guy.
• 39:00
  I have a PMP and I learned that PMBOK and it's waterfall based
• 39:06
  project management. It's create phases.
• 39:09
  You start a project, get into project.
• 39:12
  At the end of the project, you have a bunch of functionality
• 39:16
  that you defined and built requirements for and designed in
• 39:19
  the beginning of the project. Today things are shifting more
• 39:24
  towards agile project methodologies where you do
• 39:27
  sprints and they're very short. They're almost like many
• 39:30
  projects where you do requirements design,
• 39:34
  implementation or I'm sorry, development, testing and then
• 39:39
  implementation all within a two week time period or something
• 39:43
  very short. That's the way I think the
• 39:46
  industry is going. I don't think that approach
• 39:50
  works well for initial deployments.
• 39:54
  MVP deployments are called them where you say, OK, today we have
• 39:58
  some legacy technology that's barely supported anymore and
• 40:02
  it's doing automated provisioning or it's doing some
• 40:06
  basic capability within the identity space.
• 40:10
  I still think that. You know, defining a project and
• 40:13
  saying we're going to RIP and replace, that's the way to do
• 40:16
  that. But then when it comes to
• 40:19
  integrating more applications into your environment, when it
• 40:22
  comes to enhancing functionality or rolling out new
• 40:25
  functionality, I think that agile approach works really
• 40:29
  well. I think 1 is a little bit more
• 40:32
  difficult is taking that approach and communicating it to
• 40:37
  the executives because ultimately they want to know
• 40:41
  what they're going to get for their money.
• 40:43
  And you can't say, well, every two weeks we're going to decide
• 40:46
  what we're going to work on. So I'm still kind of struggling
• 40:51
  with that. And it's not like I learned
• 40:52
  about Agile last week. I've been struggling with this
• 40:55
  for a decade, you know, since I've really kind of like brought
• 40:59
  my head around it. I think that in a way you're
• 41:04
  kind of like layering phases and layering non pure agile on top
• 41:10
  of agile to say, all right, we're going to do 8 sprints.
• 41:14
  At the end of the 8 sprints we're going to deliver this set
• 41:18
  of features and functionality. But within those sprints you
• 41:22
  decide what to work on when. So that's kind of how I feel
• 41:27
  like, you know, the approach to the implementation plan,
• 41:32
  realistic reality being thought. Right now, I feel like to some
• 41:35
  degree you're almost bound by whatever your organization tends
• 41:39
  to do for projects. Some organizations are
• 41:43
  waterfall, some are agile, and some are somewhere in between.
• 41:48
  But I think a lot of times, especially if you're in a big
• 41:50
  organization, you know, large enterprise, they probably have a
• 41:53
  program management office or project management office, and
• 41:57
  they have a defined set of criteria that every project goes
• 42:00
  through. And sometimes it's not a great
• 42:03
  match, but you still have to do it anyway because that's just
• 42:06
  the way the organization works. I do think the phase approach
• 42:10
  generally makes sense. I think if you're implementing a
• 42:13
  technology, almost always the first phase looks alike no
• 42:18
  matter what technology vendor you pick in a certain area.
• 42:21
  So I'll pick on IGA again. If you're going to deploy IGA,
• 42:25
  you're probably going to connect it to identity source of truth,
• 42:28
  right? Your, your HR platform, you're
• 42:30
  probably going to connect it to Active Directory and or your
• 42:34
  Intra directory or Azure Active Directory.
• 42:36
  And maybe you're going to connect it to service now or
• 42:39
  some other ITSM tool, your ticketing system, that might
• 42:43
  look like phase one for any IGA platform because they generally
• 42:47
  all will kind of start in the same area.
• 42:51
  Then from there, it might iterate based on, well, we are a
• 42:54
  financial organization, so we have socks and other things that
• 42:56
  we need to be aware of. So maybe financial apps come
• 43:00
  next because you need to do that, right?
• 43:02
  Or maybe they're included as part of phase one.
• 43:04
  But guess what? The real phase one is still
• 43:07
  probably AD first, then the other financial apps, right?
• 43:10
  And maybe that's the same for you.
• 43:12
  If you're doing an authentication, you're putting
• 43:14
  it into IDP, what you got to connect it to is probably going
• 43:17
  to be whatever your new directory is.
• 43:19
  Your first step is hopefully going to be enabling MFA and
• 43:23
  then you're going to talk about, OK, what are the applications
• 43:25
  that we want to connect to that? And so I think a lot of times
• 43:29
  these, even though it's like the same pattern, it's really the
• 43:32
  technologies are really going to start in the same spot.
• 43:34
  What what the variation ends up being is what are the objectives
• 43:38
  that you've already defined to say, OK, well, we're doing this
• 43:40
  because we need to be compliant because we failed our socks on
• 43:43
  it. OK, well, let's start planning.
• 43:45
  So this time next year, we have those applications under
• 43:49
  management in our new platform. They're going through a new
• 43:51
  access review process and we'll feel more confident that we'll
• 43:55
  be in a better position to be more compliant.
• 43:57
  Or maybe it's our cyber insurance is going to be due for
• 44:01
  renewal and they charge us an arm and a leg because we didn't
• 44:03
  have MFA or we couldn't get insurance because they didn't
• 44:05
  have MFA or because they're starting to ask questions around
• 44:08
  privilege access management. And we don't have good answers
• 44:10
  to that yet. Let's not be in that position
• 44:12
  next year. Let's start with the phased
• 44:15
  approach to get there. And let's start with the
• 44:18
  priorities to say, OK, what do we need to get cyber insurance
• 44:21
  MFA mandatory? OK, now we know what our first
• 44:24
  phase is for an IDP. And I think you can take that
• 44:27
  same logic and apply it to any technology that you're looking
• 44:29
  to deploy, especially in a core identity solution or identity
• 44:34
  situation, Your authentication, your life cycle management and
• 44:39
  your privileged access, like those three things are generally
• 44:42
  going to kind of start in the same ballpark.
• 44:43
  And then Spira from there based on your business use cases or
• 44:47
  things that you want to address. Does that make sense?
• 44:49
  Yeah, I, I'm wondering if you're from running to folks in the
• 44:54
  business who say, all right, you're, you're building a plan
• 44:58
  for the company that we are we're planning to triple in size
• 45:02
  over the next five years. You know, really that plan to
• 45:07
  me, I mean, my, the initial log that comes to my head is crawl,
• 45:13
  walk, run. In other words, you can't go,
• 45:15
  you're crawling today. You're doing things in a certain
• 45:19
  way that you're saying we just, we want to run, teach us how to
• 45:24
  run. Like feel like we need to teach
• 45:28
  you how to walk first? Right.
• 45:29
  You ever, you ever been sitting on your foot and your leg falls
• 45:32
  asleep and then you try to get up and run, you're going to fall
• 45:34
  over and look like a dummy. Yeah, you know, and sometimes
• 45:38
  after you know, that's what needs to happen is like, hey,
• 45:40
  you know what if if you could run, wouldn't you be doing it
• 45:43
  already? But you're not because there's
• 45:46
  problems. You've got to solve some of
• 45:47
  those root issues first. I don't know any organization
• 45:50
  that's like, hey, we're going to plan, we're going to be smaller
• 45:52
  in five years. No, no, no company does that.
• 45:55
  Every company is looking to get bigger.
• 45:57
  There's nothing unique about that.
• 45:59
  Every company is the goal is to make more money, grow larger,
• 46:03
  blah, blah, blah. Right.
• 46:04
  So yes, you want to design your program to meet the future, but
• 46:09
  every program has foundational building blocks.
• 46:12
  No matter how big or small you want to be, if you don't have
• 46:15
  those foundations in place, you're going to struggle.
• 46:17
  You're going to have, you know, dead leg and you're going to
• 46:20
  fall over and look like a fool. That's, that's my $0.02 on it.
• 46:24
  I love it. All right, so we've got our
• 46:26
  phased plan, we'll call it, or at least you're starting to
• 46:29
  figure out like what chunks that you want to do from an
• 46:31
  implementation standpoint for technology.
• 46:34
  I don't think you didn't want to ignore the user experience
• 46:36
  because you can have the best technology in the world, but if
• 46:38
  nobody can use it, guess what? Nobody's going to use it and
• 46:41
  you'll use your ROI and you got unhappy campers literally all
• 46:45
  over the place. So when you're designing the
• 46:48
  implementation of these tools and you're evaluating which
• 46:51
  tools you want to use, you should be looking at what is the
• 46:55
  end user experience. Does this make sense?
• 46:58
  Does it look like a program that was designed in the last 10
• 47:01
  years even, right. I mean, I think you and I have
• 47:03
  seen a lot of products where it's like, well, that was a
• 47:06
  great interface for the year 2000.
• 47:07
  You know, here we are in tier 2024 and nothing has changed and
• 47:11
  it still looks like that. Does that give me confidence
• 47:13
  that the user experience is going to be good maybe for a
• 47:17
  certain part of our workforce that understands that, but maybe
• 47:21
  that part of the workforce is aging out and moving on in our
• 47:25
  in our newer workforce totally doesn't get it and they think
• 47:28
  it's a terrible user experience. So I think you've got to focus
• 47:31
  on your constituents, right? Who are the scope of your of
• 47:34
  your programs, whether it's employees, partners, customers,
• 47:38
  whatever may be, really pay attention to that user
• 47:41
  experience. Nail it because that's going to
• 47:44
  be the first impression that your IM program makes for a lot
• 47:46
  of people. The first time you have to go in
• 47:48
  and reset your own password if it's a total hassle.
• 47:51
  This thing stinks. What do you mean I have to call
• 47:54
  somebody? Can I just do this on my own
• 47:57
  right? A lot more self-service, a lot
• 47:59
  more agency. Where the where the Amazon
• 48:02
  points of things where it's self-service.
• 48:04
  I want to go to a portal, buy the thing that I need or request
• 48:08
  it and never talk to a person and just have it magically
• 48:11
  appear on my doorstep in two days or even better yet, same
• 48:14
  day. If I live next to a Prime, you
• 48:16
  know, warehouse or something like that.
• 48:18
  That's the sort of mentality I think is if you treat I am like
• 48:21
  a product for your organization, think about that.
• 48:23
  User experience is such an important part that I feel is
• 48:26
  getting better. I feel like a lot of people I'm
• 48:28
  talking to recently are thinking about that user experience, but
• 48:32
  it hasn't always been that way. And I think it's something that
• 48:33
  we should always be vigilant for as identity people is take a
• 48:37
  step back, you and I get identity.
• 48:40
  Maybe there's somebody out there that's like, yeah, I I'm an
• 48:42
  Azure expert. I totally get it.
• 48:45
  But we sometimes get lost in this, you know, self delusional
• 48:49
  spot where it's like, yeah, I get it.
• 48:51
  What do you mean you don't understand why my SAML
• 48:53
  connection isn't working? And I gave you an error message
• 48:55
  saying open ID connect not configured.
• 48:57
  No, normal humans going to be under be able to understand
• 49:00
  that. So you've got to think about
• 49:02
  that from, you know, Jim's dad's perspective.
• 49:05
  Can Jim's dad use it? All right, now we're on to
• 49:08
  something. What do you think?
• 49:09
  Yeah. Well, I, we had an interesting
• 49:12
  conversation about this today and I'm going to answer this
• 49:17
  question off of you. So I think customer identity and
• 49:21
  workforce identity, this topic needs to be treated differently.
• 49:28
  But I want to ask this first question is from an executive
• 49:32
  owner perspective, workforce identity and customer identity
• 49:37
  generally owned by different executives CX OS within the
• 49:43
  organization. What?
• 49:45
  What have you seen mostly? I think typically they are, they
• 49:49
  may have some shared teams. I think historically marketing
• 49:53
  or some other customer kind of facing department might have
• 49:57
  been in charge of it, e-commerce, whatever that looks
• 50:00
  like for whatever position. I think it's two different
• 50:04
  mindsets. And I think now you get into,
• 50:06
  you're trying to find an IM program manager that knows how
• 50:09
  to do talking and talk tech. And now you want them to talk
• 50:13
  both on the enterprise workforce side as well as the customer
• 50:16
  side. Yeah, that Unicorn just became a
• 50:19
  lot harder to find. So maybe it does make sense to
• 50:22
  have a couple of people. Maybe my focus is enterprise and
• 50:26
  your focus is customer or vice versa, right?
• 50:28
  Whatever it may be. I, I guess it's, it's the
• 50:32
  consulting answer of depends, which I kind of hate to say, but
• 50:35
  I think it's difficult to find one person who really
• 50:39
  understands everything about both sides and can talk all that
• 50:44
  technology and be that good. And I'm sure there are people
• 50:47
  out there who are like, yeah, I can do that no problem.
• 50:49
  Great, cool. I think it's a unique skill set
• 50:51
  and it becomes more unique the more requirements you pile on
• 50:55
  that role. And that's just another set of
• 50:57
  requirements. So I can certainly see
• 50:59
  information security, for example, owning the enterprise
• 51:01
  workshop or the enterprise IM program, but I can also see the
• 51:06
  the information security team telling or advising some other
• 51:11
  group to say, hey, we know you're working on customer
• 51:14
  identity. Here are some services that we
• 51:16
  have that you might be able to use.
• 51:17
  But more importantly, here are the guidelines or the governance
• 51:20
  or the policies that you need to make sure are in place so that
• 51:23
  the risk is at the level that our organization is willing to
• 51:27
  tolerate. I don't have to own it, just
• 51:29
  make sure you put MFA on every account, right?
• 51:31
  Or something along those lines. I think everything you said
• 51:35
  there was spot on. So I think what you normally see
• 51:39
  is that the C so is responsible for workforce I am and then the
• 51:45
  question or then this statement doesn't become prioritized user
• 51:49
  experience. In other words, it's more
• 51:51
  important than security. It's don't forget the user
• 51:54
  experience. So in other words, like 10 years
• 51:57
  ago, or maybe it was longer, but it was like the user experience
• 52:03
  for workforce I am doesn't matter.
• 52:06
  These people work here. I don't do what we tell them to
• 52:09
  do. I think companies and that was a
• 52:12
  terrible mindset, but they, I think it was the predominant
• 52:16
  mindset, at least where I worked at once, right?
• 52:19
  I was, you know, going back before I got into consulting.
• 52:23
  I think the industry's matured. Companies have matured to say
• 52:28
  not only is cybersecurity important, but giving our
• 52:32
  employees a good experience with their IT is important so they
• 52:37
  can be productive and so they don't hate working here.
• 52:42
  On the customer identity side, I think it's kind of important.
• 52:48
  I think on the customer identity side, you're right.
• 52:50
  It's often times the chief marketing officer or some
• 52:54
  business executive, VP, let's say, who owns the customer
• 53:00
  portal, let's call it. It could be whatever, but it's
• 53:03
  customer I am and I've heard things like and I'm not kidding
• 53:08
  about this Jeff, like we need to have 8 character passwords,
• 53:13
  preferably would be 6 and ain't no way we're rolling out MFA.
• 53:18
  When I hear that I tell whoever I'm talking to they are wrong
• 53:24
  and you can tell them that Jim McDonald told them they're
• 53:26
  wrong. That is just terrible.
• 53:30
  I'm I understand that the user experiences paramount when it
• 53:35
  comes to customer IM. And if you're going to put 6
• 53:40
  chart capacitors, 8 chart capacitors, you're basically
• 53:43
  putting their data at risk and it's your fault.
• 53:48
  It's not their fault if those accounts get breached.
• 53:53
  And so for them, I'm not going to say prioritize the user
• 53:58
  experience. They already are prioritizing
• 54:00
  user experience. It's almost like don't forget
• 54:03
  about security or don't de prioritize security.
• 54:08
  I think you know at least SMSOTP is ubiquitous.
• 54:13
  So if you have a low insurance use case, at least do SMSOTP.
• 54:21
  Don't rely on 6 and 8 character passwords and if you start
• 54:24
  getting longer, there's a passwords or password change
• 54:27
  frequency. I mean you're making that user
• 54:32
  experience worse. Start using multi factor
• 54:35
  authentication. Move to, you know, unfishable
• 54:39
  multi factor authentication. I'm not saying you should mail
• 54:43
  Ubikeys to all of your customers but have no authenticator apps.
• 54:49
  I mean, it's these things aren't that far out anymore.
• 54:53
  I feel like yes, you, you kind of said something there about
• 54:56
  like they're, they're focused on the user experience versus
• 54:58
  security. I'd argue they're not focused on
• 55:00
  the user experience because they're not doing a good job of
• 55:03
  helping the user protect themselves from themselves.
• 55:07
  And I think this is a spot where, again, you know, maybe
• 55:09
  it's a program manager, maybe it's executives.
• 55:11
  They really need to articulate why that's a bad idea to not
• 55:14
  have MFA in place. OK, you don't want MFA in place.
• 55:17
  Well, what if I told you there was easier?
• 55:18
  What if we just didn't have passwords at all and we went
• 55:21
  passwordless? Tell me more.
• 55:23
  Right. I think this is where if you're
• 55:24
  staying current with the market and identity space, hey,
• 55:29
  passkeys might be a solution here that everybody wins.
• 55:32
  So I think there's options there.
• 55:33
  But I think sometimes you're totally right, not sometimes
• 55:37
  you're totally right, but sometimes you do have to draw a
• 55:40
  line in the sand. Like look, that's just not
• 55:42
  acceptable. And I'll flat and I'm with you.
• 55:44
  If you do not have MFA on your IDP today, you are asking for it
• 55:50
  and I want it in writing that I told you this was a bad idea.
• 55:54
  And when you get breached, it's not going to be me that's going
• 55:57
  to, you know, be rolling out the door.
• 55:58
  It's going to be the, you know, someone else.
• 56:01
  Sometimes it's CYAI hate to say it, but there are politics in
• 56:04
  every organization and you're not going to win every battle.
• 56:06
  The best you can do, especially sometimes if you are not at the
• 56:09
  level where you've got the juice right to be able to kind of
• 56:12
  direct policy is look here. This is This is why this is
• 56:18
  important. I want you to real understand
• 56:20
  the risk that you're taking if you do not follow this advice.
• 56:25
  But I think you also have to be able to work with your business
• 56:28
  partners. OK, I get it.
• 56:31
  We don't want to have 16 character totally randomized,
• 56:35
  you know, can't use the same, you know, character more than
• 56:39
  once, right? Some of these, you know, we've
• 56:40
  all been in the end of that password policy.
• 56:42
  It just is like impossible. Like how am I supposed to go
• 56:44
  with the password for this? Like it just doesn't work.
• 56:46
  Come up with alternatives. Look at modern authentication
• 56:49
  ideas, you know, use web auth, then use pass keys.
• 56:53
  I think there are enough options out there now that hopefully
• 56:57
  this trend starts to lessen because it's almost like you
• 57:02
  kind of talk there about the employee experience is like,
• 57:05
  well, they work for us. We can tell them what to do and
• 57:07
  it doesn't matter. I think the products have gotten
• 57:10
  better in that space also. So it's not just that we're
• 57:14
  getting better. The products are getting better
• 57:15
  because we've been asking them to get better.
• 57:17
  Hey, I want a better user experience, even though I'm just
• 57:20
  an employee in quotation marks, right?
• 57:23
  I'm still a customer of the services that my organization's
• 57:26
  providing. And it it can and it should be
• 57:29
  better products have caught up. But yeah, when I I'm with you, I
• 57:33
  will, you know, tell them, tell them Jim and Jeff said you're
• 57:36
  wrong. I'll add my name to that
• 57:38
  petition as part of that process.
• 57:40
  Oh, your slot language? Yeah.
• 57:45
  All right, let's keep it moving. I want to combine this idea of
• 57:49
  like governance and policies and like metrics and measurement
• 57:53
  because I feel like they kind of go together.
• 57:56
  But I think that's what the other part of this program is to
• 57:59
  think about, OK, what are our policies?
• 58:02
  What are our standards? Are they realistic?
• 58:04
  Do you even understand what a policy is versus a standard
• 58:07
  versus a procedure? Maybe it's time to rethink how
• 58:10
  you, you know, define what those things are.
• 58:13
  My mind a policy is, hey, you should have multiple forms of
• 58:16
  authentication. Great.
• 58:20
  How I do that might be an IT standard or a corporate standard
• 58:24
  or a security standard that says, OK, The policy says we
• 58:27
  have to have multiple forms of authentication based on our risk
• 58:30
  tolerance as an organization. And we've talked to the
• 58:32
  executive about it. We've kind of established this
• 58:34
  is the minimum bar that you need to be at.
• 58:37
  We're going to allow SMS, we're going to allow push
• 58:40
  notification, and we're going to allow you the key.
• 58:42
  And maybe that changes on a row. But those are the three we're
• 58:44
  going to do for now. Now you've got your standard,
• 58:47
  here's our standard process for that, or sorry, our standard for
• 58:50
  the implementation or application of that policy.
• 58:54
  And then the procedure is how you do those types of things.
• 58:56
  I think sometimes I see a lot of policies that are like trying to
• 59:00
  jam standards into it. And depending on the
• 59:02
  organization, maybe you can change policies really easy,
• 59:06
  maybe you can't. Maybe it requires a board
• 59:09
  approval or something that doesn't happen very often and
• 59:12
  you get stuck kind of behind the times and you're not able to
• 59:15
  really kind of push, yeah, the security of a certain policy or
• 59:20
  a certain standard that you want to put in place.
• 59:22
  So I feel like the governance, the policies that go around
• 59:26
  that, the standards, but then also the monitoring, the measure
• 59:29
  goes with that as well as OK, well, OK, we got this.
• 59:31
  I am program. How do we know if it's
• 59:33
  successful? What are some of the metrics?
• 59:36
  You know, can you just stick your head out the window and
• 59:38
  say, well, it feels a little bit warmer today.
• 59:40
  So I think we're doing good, you know, yeah, customer
• 59:44
  satisfaction surveys will certainly be important.
• 59:46
  It's like, hey, our people, you know, they think this is a good
• 59:49
  experience, but there should be hard metrics as well, right,
• 59:52
  Jim? It's like how many automations
• 59:54
  did we are we able to do for onboarding, for off boarding?
• 59:57
  How many, you know, bad sessions were we able to block from
• 1:00:02
  authenticating entire environment, right.
• 1:00:04
  There should be some ability to drive some metrics that makes
• 1:00:08
  sense to your organization to kind of demonstrate it because
• 1:00:10
  at the end of the day you need to show value and a lot of
• 1:00:12
  times. Especially in the IM world, that
• 1:00:14
  value is almost invisible because it's like, well, I just
• 1:00:17
  typed my ID and password or I did a prompt on my phone and I
• 1:00:20
  was in like, what's security? You're right.
• 1:00:23
  OK, Well you know, I've said this before, like look in your
• 1:00:25
  Microsoft account and go and look at your access history and
• 1:00:28
  I'm sure you will see tons and tons of things where people were
• 1:00:32
  trying to get into your Microsoft account and Microsoft
• 1:00:35
  to their credit, blocked it. They're giving you a log and
• 1:00:37
  say, hey, these roads again, but they didn't service it to me
• 1:00:40
  because it never rose to the level where they felt confident
• 1:00:43
  it was me logging in, right? You need to be able to
• 1:00:45
  demonstrate those sorts of wins and publicize those wins, make
• 1:00:49
  people aware of it. Continuing about what the value
• 1:00:52
  is that you're bringing to your organization, whether it's
• 1:00:54
  efficiency, risk reduction, you know, hey, we saved X percent on
• 1:00:58
  our premium this year because we had our strong privilege access
• 1:01:01
  management, you know, platform in place.
• 1:01:04
  Hooray win. You know, maybe it paid for the
• 1:01:06
  privilege access management, investment always be looking for
• 1:01:09
  those things to to promote the wins and to measure the success
• 1:01:11
  of the organization. What do you think?
• 1:01:14
  I think you you know that there were a few points I wanted to
• 1:01:18
  add on to. I think when you have Carl's you
• 1:01:21
  framework and you say you shall have every access shall require
• 1:01:29
  multi factor authentication. It's Cuba simple.
• 1:01:33
  What are you doing to monitor that?
• 1:01:35
  So let's say you have 700 entry points and 500 of them are
• 1:01:42
  connected into your IDP that has multi factor authentication.
• 1:01:49
  Maybe you're doing adaptive, so that's green check box for those
• 1:01:53
  500. What about the other 200?
• 1:01:55
  Are you? Are you keeping track of whether
• 1:01:58
  or not they have met all the policies?
• 1:02:01
  If not, you don't know whether or not you're complying with
• 1:02:05
  your own policies as an organization.
• 1:02:09
  And so I think that's very important.
• 1:02:11
  I think also having a very formal exception process because
• 1:02:16
  you'll have legacy applications that say our application is like
• 1:02:21
  dumb tube, you know, in other words, it's a telnet section and
• 1:02:29
  MFA is not possible. OK, maybe it is, maybe it isn't,
• 1:02:34
  but let's just say it isn't and they have a a technical reason
• 1:02:37
  why it won't work. Whatever software they're
• 1:02:40
  running won't integrate with whatever solutions you can come
• 1:02:45
  up with. That's fine.
• 1:02:46
  You have to file a formal exception and somebody in the
• 1:02:50
  business, some business person, even if it's an IT executive has
• 1:02:56
  to own that risk. That's to me.
• 1:03:00
  And, and by the way, this has nothing to do with identity.
• 1:03:03
  This is how you run a good cybersecurity department is
• 1:03:08
  yeah, policies the organization has to policies and standards
• 1:03:12
  they are. They're not optional.
• 1:03:14
  It must be complied with by everyone.
• 1:03:16
  And if they can't be complied with, a formal exception needs
• 1:03:21
  to be applied for and approved. And in order for that to happen,
• 1:03:27
  a senior executive needs to sign off on it.
• 1:03:30
  And usually it's an ink signature, but you know, a
• 1:03:33
  workload tool would probably be fine as well.
• 1:03:36
  But what I'm getting at is that, you know, that's a risk
• 1:03:40
  management exercise that's above and beyond identity.
• 1:03:44
  I should include really all of your cybersecurity policies and
• 1:03:48
  standards. So I think that's important.
• 1:03:52
  We also talked about, you know, clear roles and responsibilities
• 1:03:59
  for your program. I, I, I think you may be into
• 1:04:02
  that, that I think that, you know, identifying those up front
• 1:04:07
  is going to be very important, evolving those overtime who's
• 1:04:11
  responsible for what decisions within your program, spending
• 1:04:15
  money or changing policies, things like that.
• 1:04:20
  Who, who's got that responsibility within your
• 1:04:23
  program? Yeah.
• 1:04:26
  So I think those things are very important.
• 1:04:28
  I think that the basis of your IM program is your policies,
• 1:04:33
  your shared services should be called your easy button to
• 1:04:36
  comply with those policies. So, you know, teams that are,
• 1:04:41
  you know, maybe have some autonomy over their application
• 1:04:46
  or they're saying, hey, our application is too important to
• 1:04:50
  rely on your creaky IM system, so we're just going to do our
• 1:04:54
  own IM. That's fine, whatever you know,
• 1:04:57
  maybe executives have said just leave them alone, that's fine.
• 1:05:01
  They still need to comply with the policies or if they're not
• 1:05:04
  going to apply someone you're saying the race as to see.
• 1:05:08
  So that's the personality. Yeah, I agree with that.
• 1:05:11
  I think that idea of, you know, basically conducting a
• 1:05:15
  certification campaign right against things that are not
• 1:05:19
  within compliance of whatever policies you set out makes
• 1:05:21
  sense. Maybe it's OK, Yeah, telnet
• 1:05:25
  example for example, that you mentioned.
• 1:05:26
  OK, yeah, they, they can't comply.
• 1:05:28
  All right, let's check back again in a year and see if
• 1:05:30
  things changed or six months or whatever the right time frame
• 1:05:32
  is. Yeah, maybe it's time to move on
• 1:05:34
  from a technology that doesn't meet modern standards.
• 1:05:37
  You know, maybe there's a company out there, and I think
• 1:05:39
  we've mentioned this in prior episodes, like there's this
• 1:05:41
  website, right, SSO tax or SSO dot tax or something like that,
• 1:05:45
  where companies charge for basic security things like enabling
• 1:05:49
  SSO. Maybe they're not the right
• 1:05:51
  choice if they're going to charge for basic security
• 1:05:54
  concepts like that. Yeah, maybe they're a good
• 1:05:56
  product and you know, maybe, you know, they, they, there are no
• 1:06:00
  other choices, but I think that's part of that same, same
• 1:06:02
  ideas like, hey, what are we doing to get better?
• 1:06:05
  Track what you've got, measure it.
• 1:06:07
  And yeah, some things are going to be a compliance, especially
• 1:06:10
  when you're just starting out. Nobody is 100% compliant 100% of
• 1:06:14
  the time. There are always accepted risk
• 1:06:17
  somewhere that someone of the appropriate authority level or,
• 1:06:22
  you know, signing authority has said, OK, I'm willing to accept
• 1:06:25
  that risk. If something happens, then we'll
• 1:06:27
  deal with it. That exists.
• 1:06:30
  Plan for it and you won't be surprised.
• 1:06:33
  You also mentioned one of the thing that I've got to cover
• 1:06:36
  which was around monitoring or measuring user experience and
• 1:06:46
  how much of your ROI they committed to you're achieving.
• 1:06:51
  So you're asking the company to invest in identity.
• 1:06:56
  I think the thing you should do with being a program is really
• 1:06:59
  have a well thought out plan of what are the dials that you're
• 1:07:03
  going to improve. Snap a line, where does those
• 1:07:07
  dials exist today? Whether it's in terms of things
• 1:07:11
  that are easily measured within the tools that you have, you
• 1:07:16
  know, longer password resets, things like that, or things that
• 1:07:20
  you have to go out to the business to measure with survey
• 1:07:23
  data, for example, like user experience.
• 1:07:26
  But either way, you need to be able to show improvement over
• 1:07:29
  time. Six months, a year, year and a
• 1:07:32
  half, two years to show, hey, remember I asked you for
• 1:07:36
  $1,000,000. I said I could do all these
• 1:07:39
  great things. I did all these great things.
• 1:07:41
  User experience improved by 50%. That's huge.
• 1:07:47
  This shows you're a good bet, right?
• 1:07:48
  And if you can deliver on that, you're guess what?
• 1:07:51
  You're probably going to be more apt to find funding for future
• 1:07:53
  projects that you want to work on as well or to keep things
• 1:07:56
  going. And I think This is why it's so
• 1:07:58
  important to be communicating. You know, throughout this entire
• 1:08:00
  process. I don't think you can
• 1:08:02
  communicate enough. I do think you need to give some
• 1:08:05
  thought into the communications that you are doing.
• 1:08:07
  Know your audience. Who are you talking to?
• 1:08:10
  What is relevant to them and what do they care about?
• 1:08:13
  Try to think about it from their perspective and tailor that
• 1:08:16
  communication to them, but always be thinking about, OK,
• 1:08:20
  how do I explain this? I get stuck in an elevator, you
• 1:08:22
  know, with somebody. Can I explain what my IM program
• 1:08:26
  is doing on the 15 second write up?
• 1:08:28
  Or can I, hey, you know what? We just rolled this thing out
• 1:08:31
  and you should check it out, you know, and and and and have that
• 1:08:34
  dialogue going with people, both part of your program, but also
• 1:08:39
  to your customers of your IM program, whether it's workforce
• 1:08:43
  or, you know, customers in AB to C type scenario.
• 1:08:46
  So the communication is super important throughout any time
• 1:08:49
  you get to celebrate a win, celebrate the win.
• 1:08:52
  Draw attention to it, highlight it.
• 1:08:54
  If there are issues, address them as well.
• 1:08:56
  Hey, this is not working and let's not be afraid to go back
• 1:09:00
  and rethink how this is implemented or the business
• 1:09:05
  process is designed or whatever it may be.
• 1:09:07
  It's OK to be wrong. And I think sometimes we
• 1:09:09
  struggle with what we have to be perfect every single time.
• 1:09:12
  It's just not realistic, right? We're humans, we're going to
• 1:09:13
  make mistakes, but be willing to admit the mistakes and think
• 1:09:18
  about it and maybe you think it's great, but your customers
• 1:09:21
  hate it. Hey, I'm sorry, as much as I
• 1:09:24
  love it, I'm going to have to redo that and and come at it
• 1:09:26
  from a different angle. And that's fine.
• 1:09:28
  It's OK to get smarter. And I think sometimes we lose
• 1:09:30
  that as well. I think lastly, the most
• 1:09:33
  important thing I think is to stay current.
• 1:09:35
  A lot of times we see investments in, hey, we're going
• 1:09:39
  to stand up on IM programs could be awesome.
• 1:09:41
  We gave it like 2-3 years and we were really kicking butt.
• 1:09:44
  And then it just kind of like died on the vine and just kind
• 1:09:47
  of coasted and didn't keep up with the world and the
• 1:09:50
  environment. And now here you are four years
• 1:09:55
  later, five years later, six years later, and it's like, wow,
• 1:09:57
  what happened? Like we used to have a really
• 1:09:59
  kick butt IM program and services, but we didn't keep up
• 1:10:03
  with things. We didn't stay current.
• 1:10:04
  And I think it's really important, you know, we had, I
• 1:10:07
  kind of had this conversation earlier today was there's peaks
• 1:10:10
  and valleys in an IM program. If you're not doing it right,
• 1:10:14
  you want to smooth those peaks and valleys out as much as
• 1:10:16
  possible. If you're behind, you're going
• 1:10:19
  to have to invest to catch up. And invest means money, people,
• 1:10:23
  time, whatever that is. But there's going to be a spike
• 1:10:26
  to get up to a certain level and then you're going to have to
• 1:10:30
  keep a certain level of investment going to maintain and
• 1:10:34
  to keep current with things. What typically happens is if you
• 1:10:36
  look at, you know, a budget for an IM program over 10 years, if
• 1:10:40
  you're not doing it right, is you'll see a spike in year 1 and
• 1:10:44
  then it drips down to like, you know, year three-year 4 and then
• 1:10:47
  another spike and it kind of drips down.
• 1:10:50
  If you had just kept current, it would have been a lot cheaper
• 1:10:53
  and you would have been a lot better positioned from a risk
• 1:10:55
  and a usability standpoint, most likely, if you had just
• 1:10:57
  maintained and kept current with where the market is.
• 1:11:00
  And I think that's really important for people who's like,
• 1:11:03
  great you put in technology and what's next?
• 1:11:05
  What should I be thinking about? What did I see at a conference?
• 1:11:08
  What did I hear on the world famous Identity at the Center
• 1:11:11
  podcast, right? What are the things that I need
• 1:11:13
  to be thinking about for, you know, skating to the puck and
• 1:11:17
  hockey. You don't skate to where the
• 1:11:18
  puck is, you skate to where it's going.
• 1:11:20
  The business is like that. Your IM program should be like
• 1:11:22
  that. And if you're not doing it,
• 1:11:25
  guess what? The puck is still going, you're
• 1:11:27
  just going to be further and further behind.
• 1:11:29
  So you want to make maintain your cadence and your ability to
• 1:11:32
  keep up with the world from an IM perspective as well as the
• 1:11:35
  business side of things. Yeah, I think, I think
• 1:11:39
  organization can fall back, fall behind for a few reasons.
• 1:11:43
  One is they have to shake up people and maybe the people who
• 1:11:49
  were responsible for the IM road map moved into all through
• 1:11:54
  things. Priority shifted and that role
• 1:11:57
  never got back filled. So it just became continue to
• 1:12:01
  operate. And that's something that we say
• 1:12:03
  I am. It's not a project that's
• 1:12:05
  program. So you take your eye off the
• 1:12:08
  road. We just you have the things the
• 1:12:11
  car keeps moving, but you're not paying it to to the road and bad
• 1:12:16
  things can happen. I think the other thing is I've
• 1:12:20
  seen this happen for a few clients over the years.
• 1:12:24
  They get signed up in the MSSP doing indemnity as a service,
• 1:12:30
  but they build that MSSP around what we do today.
• 1:12:37
  They have to take into account that they're going to want this
• 1:12:40
  system enhanced, but I think probably the best way is to set
• 1:12:45
  some money aside or have some flexibility to be able to
• 1:12:49
  perform enhancements in the system themselves, one or the
• 1:12:53
  other. Usually they don't have any
• 1:12:55
  staff left, right? They outsource the management of
• 1:12:58
  their IM. They need to put some money
• 1:13:00
  aside for enhancements because what you have today is not going
• 1:13:04
  to serve you three years on the rig.
• 1:13:07
  I don't care who you are, I can almost guarantee three years on
• 1:13:11
  the rig. You're going to require
• 1:13:12
  enhancements along the way because if it's going to change,
• 1:13:16
  you're going to have new applications, a new HR system,
• 1:13:20
  say it's there. So you need to take that into
• 1:13:24
  account. Even if you're outsourcing the
• 1:13:26
  maintenance of your IM system, which may make total sense to
• 1:13:30
  your organization, may make total sense for you.
• 1:13:33
  Just remember to put some money aside or build it into your
• 1:13:38
  budget, build it into your bill to get that system to have
• 1:13:43
  tickets or whatever their process is for enhancing that
• 1:13:47
  system. Yeah, I think that's a really
• 1:13:49
  good tip. I think the other thing I'll add
• 1:13:50
  to that is there's a lot of vendors out there and fewer
• 1:13:54
  partners. If you are working with, you
• 1:13:58
  know, an MSSP or or something on those lines, whatever managed
• 1:14:01
  service, look for a partner, look for somebody who's you
• 1:14:04
  know, got your, is interested in helping you involve in helping
• 1:14:08
  you get the most out of things and has a plan to say, hey, you
• 1:14:12
  know, this thing is what it looks like right now.
• 1:14:13
  It's going to change and that's OK, that's fine.
• 1:14:15
  That's natural. Here's how we're going to keep
• 1:14:17
  up with that, right? And maybe it's as simple as,
• 1:14:20
  hey, there's going to be a version upgrade because we're a
• 1:14:22
  partner with so and so company and we're using our technology.
• 1:14:25
  We know this is coming. This is something you want to
• 1:14:27
  plan for or hey, I saw this neat thing called pass Keys at a
• 1:14:31
  conference last year. Have you guys thought about
• 1:14:33
  that? If you have a good partner, it
• 1:14:36
  makes a world of difference for your experience with any type of
• 1:14:40
  managed service. And I think a lot of times, you
• 1:14:43
  know, it's unfortunate, but money rules sometimes.
• 1:14:46
  And those partners tend to be a little bit more expensive
• 1:14:51
  upfront, but maybe they pay off in the long run because you're
• 1:14:54
  in a much better position and, you know, maybe you've developed
• 1:14:56
  a better relationship with those partners.
• 1:14:58
  So I think it's also something to think about as, you know, if
• 1:15:01
  you're going to outsource, really consider who you're
• 1:15:03
  working with and make sure that you had a really good
• 1:15:06
  comfortable feeling with it. People are going to change,
• 1:15:08
  right? I mean, you and I might go from
• 1:15:11
  one company to another like we have, and those relationships,
• 1:15:14
  you know, will probably carry along from there.
• 1:15:16
  But you really want to make sure you understand the company that
• 1:15:19
  you're getting, you know, to partner with and making sure
• 1:15:22
  that they're the right fit for you strategically.
• 1:15:24
  Because hopefully you hope that. It's a long term relationship.
• 1:15:28
  Thank goodness it any better believe you they're I keep
• 1:15:32
  hearing the same company names also working.
• 1:15:34
  I'm not not going to repeat them on the podcast, but you know,
• 1:15:39
  they leave a Trail of Tears that they go in off at the lowest
• 1:15:44
  price and then change order you to death.
• 1:15:48
  And and to avoid all the change order issues, basically sit pad
• 1:15:54
  and have a system that gets older and older.
• 1:15:58
  It's not a good situation. Yeah.
• 1:16:02
  OK. I think this might be a record
• 1:16:04
  for our longest episode ever, so why don't we leave it there?
• 1:16:06
  I'll just kind of recap real quickly.
• 1:16:08
  I just realized we have 10 steps here.
• 1:16:11
  One, define your goals in the scope. 2, conduct an assessment.
• 1:16:15
  3, get that executive buy in. Four, put together your your IM
• 1:16:20
  team and it should be a cross functional kind of core team.
• 1:16:23
  Not everybody a core team. Make sure you're picking the
• 1:16:27
  right technologies. Number six, think about what
• 1:16:31
  your deployment is going to look like, whether it's phased, some
• 1:16:34
  sort of implementation plan. How are you going to make this
• 1:16:37
  thing digestible for the organization?
• 1:16:40
  Don't forget about the user experience.
• 1:16:42
  Make sure that that's a priority.
• 1:16:43
  Think about your governance and your policies and your standards
• 1:16:47
  and your measurements and how you're going to monitor all that
• 1:16:51
  and then stay current and communicate this sort of like
• 1:16:54
  weaved kind of threw out there. So but it's 10 if we don't count
• 1:16:57
  communicate because you should be doing that the whole time.
• 1:16:59
  So that's the kind of sum it up. You know, I didn't really think
• 1:17:04
  of a lighter note question. You got any ideas?
• 1:17:07
  Have you done? Anything.
• 1:17:08
  What was your last trip? My last work trip was DC.
• 1:17:13
  You were there. I mean, we were in DCI think
• 1:17:17
  before that. Or was I?
• 1:17:19
  You know, someone said to me the other day, it was like, you
• 1:17:22
  know, you travel a lot, but you don't remember where you've
• 1:17:24
  been. And I feel like that's where I'm
• 1:17:25
  at. I guess my last personal trip
• 1:17:27
  was that trip I took to Texas for my friend's 50th surprise
• 1:17:31
  birthday party, which was a lot of fun.
• 1:17:33
  And that was good times. You know, that was it was a
• 1:17:36
  great time to reconnect with some folks I hadn't seen in a
• 1:17:39
  long time. And it was great to just kind
• 1:17:41
  of, you know, do a nice thing for somebody who, you know, as a
• 1:17:44
  friend of mine and, and kind of bring joy to their life.
• 1:17:47
  And I think more people should do that.
• 1:17:49
  What about you? What's the last personal trip
• 1:17:51
  you've taken? Personal trip I've I'm in
• 1:17:57
  Austin, TX right now. One thing I've noticed is like
• 1:18:01
  everybody I talk to is like it's great here.
• 1:18:05
  They love living here. It's too hot.
• 1:18:07
  I mean, it, it's mid-september and it went up to 100° today.
• 1:18:13
  So I'm assuming that's too high. I can't do that, way too high.
• 1:18:18
  But everybody seems to love it. But everybody complaints about
• 1:18:22
  how expensive it is to live here.
• 1:18:24
  And I think that's the thing. It's like if some place becomes
• 1:18:27
  awesome to live, other people find out about it and everybody
• 1:18:32
  wants to live there. They jacked up the real estate
• 1:18:35
  cost and then you can't afford to live here anymore.
• 1:18:39
  So I don't think many people who live here, like living here, are
• 1:18:45
  planning to sell their homes and move to a new house anytime
• 1:18:49
  soon. They're they're kind of stuck
• 1:18:51
  until 20 forever. Well, that's a real positive
• 1:18:56
  story, so thanks for that. Well, no, I mean it's supposed
• 1:18:59
  to be lighter. Come on man.
• 1:19:00
  It's a cool city, people. Love, it's a cool.
• 1:19:02
  City and the only downside is the cost of rules leader thing
• 1:19:07
  and the heat. Yeah, well, I just read the
• 1:19:09
  other day, you know, I'm in the Asheville, NC area and we're no
• 1:19:13
  longer the most expensive place to rent in for the state.
• 1:19:16
  That honor now goes to Charlotte.
• 1:19:18
  So Asheville has typically been one of the more expensive places
• 1:19:21
  because it's a very desirable location, very touristy and the
• 1:19:24
  weather is great pretty much year round.
• 1:19:26
  But now we're #2 and that's, I think that's a good thing.
• 1:19:30
  So I'm I'm happy about that. Yeah, that's really good sign.
• 1:19:33
  All right, Jeff, we do against the hours to be like a 15 minute
• 1:19:38
  episode, but no advice. Yeah, we try, We try, but we
• 1:19:42
  just talk and talk and talk and we have so many Nuggets of
• 1:19:45
  wisdom that we want to share with people.
• 1:19:47
  So hopefully people get it and understand it and they're able
• 1:19:49
  to put up with our our weird delays with, you know, cell
• 1:19:53
  phone connections and and bad hotel Wi-Fi.
• 1:19:56
  But I think it was good episodes.
• 1:19:58
  I've got a challenge. Yeah.
• 1:20:00
  We've been recording this long. If anybody is still listening,
• 1:20:04
  comment on Jeff's YouTube or I'm sorry, LinkedIn post about this
• 1:20:09
  episode and say where you were on your last trip.
• 1:20:14
  That'll be interesting. That way we'll know where our
• 1:20:17
  last five minute Drew is. Yeah, on LinkedIn or on the
• 1:20:20
  YouTube video, either one's fine.
• 1:20:22
  Yeah, give us a like and subscribe wherever you're
• 1:20:23
  listening. idacpodcast.com is our website, idacpodcast.tv.
• 1:20:29
  We'll take you to our YouTube channel and yeah, connect us to
• 1:20:32
  LinkedIn. If you were listening this long,
• 1:20:34
  thank you very much. Tell us your last personal
• 1:20:37
  place, personal travel, not business travel that you went
• 1:20:40
  on. And yeah, we'll keep the
• 1:20:42
  conversation going. So with that, we'll leave it for
• 1:20:45
  this week. Thanks everyone for watching or
• 1:20:47
  listening and we'll talk with you all in the next one.
• 1:20:51
  You've been listening to Identity at the Center.
• 1:20:54
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:20:59
  review, and we'll be back soon. But in the meantime, hit the
• 1:21:02
  website at identity@thecenter.com.
• 1:21:06
  See you next time on Identity at the Center.