Latest / Identity at the Center / #255 - CAEP and SSF 101 with Atul from SGNL and Sean from Disney

Transcript

#255 - CAEP and SSF 101 with Atul from SGNL and Sean from Disney · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:27
I'm actually usually I say not so bad, but I'm operating at
0:30
like a 60% clip right now because I've been sick all week
0:33
and my voice just sucks. How'd you like me getting you
0:36
sick last week? Yeah, I appreciate that.
0:37
It was either you or my wife. So you and I traveled all last
0:41
week for client work or real jobs, and you were sick,
0:45
coughing over the place. But stay away from me.
0:47
And while you were while we were out there, my wife was sick at
0:50
home. So by the time I got home
0:52
Saturday, I think by like by Sunday night Monday, I was like,
0:56
all right, what are you what are you?
0:58
Bastards gave me something. So.
1:01
Yeah. Well, I feel kind of
1:02
responsible, but then I also think that, you know, you
1:05
interacted with about 1000 people in the course of that
1:09
week also. So it could have been any one of
1:11
them. But anyway, usually I'm the one
1:14
who's sick and and grinding through it.
1:17
You don't get sick very often. I've dodged a lot of bullets.
1:21
It's. Good to see.
1:23
You and I were texting. I was like, I felt like, I feel
1:25
like the last couple months with all the travel I've been doing
1:29
102 flights last year. So a lot in the in the third
1:33
quarter or fourth quarter especially.
1:35
I was like Neo in the Matrix dodging like virus and plague
1:39
bullets coming my way and I have not been sick in a very long
1:42
time And then here it goes, it happens.
1:45
Fortunately I feel like I'm it's getting better already but and
1:48
my voice sucks. So there may be point parts
1:50
where I like point to you and say you take the next question
1:53
I. Can't do your best Yoda, but
1:57
yeah, I was. I mean, I've I've had my years
2:00
where I've done a lot of flights. 102 is a lot of
2:03
flights, but doesn't seem like every time now there's a delay.
2:09
Like on this last trip I was delayed in both directions.
2:14
Yeah, I was two. We got delayed our we actually
2:17
got stuck in Atlanta overnight. We had to stay in Atlanta and
2:21
then fly out the fine morning getting where we're going and
2:23
then you got delayed coming home.
2:25
I got delayed coming home the following day and then I was
2:27
actually supposed to have two flights this this week and I
2:32
missed the the first. The first flight was delayed and
2:36
I wasn't going to make my connection and I wasn't going to
2:38
be able to get to where I needed to go in time.
2:39
So I was like, I will just cancel that, which actually
2:41
worked out well because I was sick anyway at that point.
2:43
So it's like I'm not going to go, it's not worth it.
2:46
And then at that point it's just kind of like which is, which is
2:49
which will stay home this week and get free and clear.
2:51
Don't be that guy who gets on the plane.
2:52
It's like all over the place. Do something, do something, go
2:57
somewhere. Yeah.
2:59
So we're focused a lot on privilege access management last
3:04
week. And then the announcement came
3:06
out that Delinea acquired Authorize.
3:11
I thought that's really interesting.
3:13
I, I always thought pretty highly of of those guys and you
3:16
know Gal was on the podcast in our early days right before we
3:20
had good audio quality or any of that good stuff at you know,
3:24
episode 98 all the way back in June of 2021.
3:29
And by the way, you know how I found that?
3:32
I went to idacpodcast.com, click, listen to the show.
3:37
We've got a handy dandy search bar that you put out there.
3:41
And I'm telling you that search bar is like, it's better than
3:45
most search bars that are out there.
3:46
Like it really. It really works actually.
3:50
I spent literally minutes putting that together.
3:52
So I'm glad you appreciate that handiwork of a simple search.
3:55
But yeah, you're, you know, you're a natural promoter, you,
3:57
you know, promoting the website already.
3:59
This is great. Yeah.
4:00
Well, and in addition to that, on the website we've got the
4:04
leave us a voicemail button. And so as a special promotion
4:08
for the leave us a voicemail, we're doing a little, let's call
4:12
it a contest. I don't know if that's really a
4:14
contest, but if you leave us a voicemail and it's a question
4:17
that we can use on an upcoming episode on February 5th, we're
4:21
going to pick five questions, run them, You and I are going to
4:24
answer them. That's going to be the episode,
4:26
right. And we are going to have links
4:30
that people will get a free ebook copy of Learning Digital
4:36
Identity by Phil Wimley. And we had him on a recent
4:39
episode. Great interview, awesome book.
4:44
So if you're interested, you want a copy of the book or you
4:48
just want to play a role and hear your voice on the podcast,
4:51
go out to idakpodcast.com, click listen to or I'm sorry, leave a
4:57
voicemail or what is it? Is it that or talk to?
4:59
Contact us or something. Like that you go to the home
5:01
page and there's a little flyer on the right hand side that pops
5:03
up, says talk to us and then yeah, you just record.
5:06
You can do that. And thanks to, I think it was
5:08
Tim maybe who spotted that the mobile website was broken.
5:12
So I fixed that and we got his. So that's good.
5:15
So yeah, you can go into the mobile website or the regular
5:17
website. You'll see a little bears, just
5:18
talk to us. You can also go to the contact
5:20
page. It's there too.
5:21
Send us a voicemail comes to Jim and I, and that we'll use the
5:26
best ones. We'll pick five of them and get
5:28
yourself a free ebook. First time we've done a contest
5:30
giveaway. It's kind of exciting for us.
5:32
Yeah. And I would say that, look, even
5:35
if it's not one of the five be doing that episode, I think if
5:38
we get some extra questions, we'll incorporate them into
5:42
future episodes. You're responsible for, by the
5:45
way, for contacting winners and getting stuff out there.
5:48
I remember. I'm putting that on you.
5:50
Oh, what? That's my reward.
5:52
That is your reward. What else?
5:53
Anything else going on? Or should we get to our our main
5:56
let's? Get to it, man.
5:57
I mean, like, this is an episode I've been looking forward to for
6:01
a long time. We met these guys all the way
6:03
back at Identiverse last year, and, you know, it's kind of
6:07
finally come full circle. So let's get into it.
6:11
Yeah, and we got like, a little bit of an alphabet soup.
6:13
I'm not even sure what I'm going to call this episode yet.
6:15
Maybe it'll name itself as we're going along.
6:16
Or maybe if any of us come up with a good name for how I
6:19
should call this, I'm looking for ideas.
6:21
We're going to talk about Cape ITDRSSF.
6:25
We've got a tool from Signal. He's a CTO tool, Tool, Shiv.
6:31
I knew I would screw it up. I'm so sorry, I told a tool.
6:33
Toshi Baguale, CTO, a Signal and Co chair of the Shared Signals
6:38
Working Group and corporate board member at the Open ID
6:41
Foundation, Welcome a tool. Thank you.
6:43
Thanks for having me. Great to be here.
6:45
You know, I I was practicing before the show hit.
6:48
I was like, all right, let me try and get this in my head and
6:49
we get it right. And then immediately I goofed
6:51
up. I'm going to blame it on the
6:52
sickness. We've also got a bonus guest as
6:55
well. This is a 2 for one.
6:56
Today we've got Sean O'dell. He's a senior staff, security
7:00
engineer, consumer and workforce identity and access management
7:02
at Disney. Small little company that people
7:04
might have heard of. Welcome to the show, Sean.
7:06
Thank you both for having me and pleasure to be here.
7:09
So, as with some of our guests, sometimes we need to make sure
7:13
that opinions that are expressed are their own.
7:15
I'm going to make sure I I read this out so that people
7:19
understand viewpoints. Here this podcast appearance by.
7:23
Sean O'dell. Is for informational purposes
7:25
only. The content should be regarded
7:27
as general information and serve as a springboard for your own
7:30
independent investigations. All perspectives expressed by.
7:34
Sean O'dell. Hereafter are his own.
7:36
All right, now we're free and clear.
7:37
We can talk about anything we want.
7:38
Why don't we start with you, a tool?
7:39
Tell us a little bit about your identity or in the story we're
7:42
going to get to Sean as well. But how about you go first?
7:44
How did you get into the world of identity?
7:46
Is it something that you chose or did it choose you?
7:51
Yeah, it's actually an interesting story that I was
7:54
working on supercomputing and I was in India back then and I was
8:00
working on the first supercomputer that India
8:02
developed and the day we got the 1st order for that
8:06
supercomputer, USA kind of brought down the export
8:11
controls. So we are in the free market
8:13
after that and you know I was certainly feeling the pressure
8:18
of, you know, commercial pressure from American
8:23
competitors. So I was wondering what to do
8:25
next And I was like OK, you know there's this thing called the
8:29
Internet and you know you're never going to be sure who's on
8:31
the other end of that Internet. And and that's how I got into
8:34
publicly cryptography. It's was something that I had
8:37
read about and I found a job in in Pune in India that was a
8:43
startup that was doing cryptography based stuff.
8:46
And so I thought, hey, that's a good place to be.
8:48
So I, I go there and it turns out that I built on the software
8:53
and the the toolkit, the, you know, the cryptographic toolkit
8:57
that I was supposed to be using, they couldn't export that to
9:01
India. So that's how, you know, I ended
9:04
up in the US after they got some kind of a clearance from the
9:08
Department of Commerce to have me work on that toolkit over
9:10
here. And when I was here in Atlanta,
9:13
I was sort of introduced to this company called Verisign, which
9:18
was a very tiny company at that time.
9:20
And I was sort of really, you know, the I, it just caught my
9:26
imagination like all the different possibilities with
9:28
the, you know, public key cryptography and you know, the
9:32
public certificate authority and all that.
9:35
That's how I got it going in it is.
9:37
I joined Verisign as they, you know, the 13th engineer there.
9:42
And you also do some work with the shared signals working group
9:44
with the Open ID Foundation. I kind of mentioned that when I
9:46
introed you. Tell us about the Shared Signals
9:49
working Group. What is it and what would you
9:52
say you do around there? So the Shared Signals working
9:54
group is the part of the Open ID Foundation.
9:57
People know the Open ID Foundation mainly through the
10:00
Open ID Connect protocol, which is the Single Sign On protocol.
10:04
The Shared Signals Working group you can think of as a a
10:08
generalized framework for asynchronous communication,
10:13
right? And so you can think of, you
10:17
know, something like a web hook, like a, you know, an API web
10:21
book where you know you, you found an API and say, Oh well,
10:25
you know, tell me about this when something changes or
10:27
something like that. And that's, that's where the
10:29
shared signals framework is. What goes into those
10:32
asynchronous communications are events that in the form of, you
10:36
know, security event tokens or CPS and keep and risk our two
10:41
applications that sit on top of the shared signals framework.
10:45
And so the development of these standards, the shared signals
10:48
framework, the events and the risk events all together is the
10:52
work of the shared signals working.
10:55
And so we've just recently released the 2nd Implementers
10:59
draft of the Shared signals Framework, which is a pretty big
11:02
effort. And you know, onward and forward
11:06
and you know, and because we're talking about the shared signals
11:09
framework, maybe I should make a little announcement here for our
11:12
cool, cool speaker. Are you ready, Sean?
11:16
Let's hear it. So as of Tuesday, you'll be
11:19
sharing my burden of being a Co chair.
11:22
So you know, I'm. I'm happy to announce that here.
11:26
So congratulations. Happy to take on the workload
11:29
and and the honor. I appreciate it.
11:31
You put some applause on that one.
11:36
I got some effects for everything.
11:39
Well, that's great. That's exciting.
11:40
Sean, we're going to get to you a second.
11:41
I want to ask you again about Atul your background I mentioned
11:44
also you're the CTO of Signal and it's SGNL dot AI.
11:48
For people who aren't familiar with Signal, what is Signal's
11:52
purpose in life? Like what is the problems that
11:55
you're looking to solve? Right.
11:56
So I think you know, the immediate problem that we're
11:59
trying to solve is the ability to manage authorization at
12:03
enterprise scale, right. So we think that the access
12:07
management of access control problem is being solved largely
12:11
at the developed level and in some cases and you know and
12:14
through more static systems that don't really scale to the, you
12:20
know, the speed and the automation that is required in
12:23
today's enterprises. And So what we do is basically
12:26
we work on the principle that you should not have to manually,
12:30
you know decide permissions for anyone really at any point of
12:33
time. And so that you know naturally
12:37
leads to what we call as you know 0 standing axis.
12:40
And then you want to manage your access policies at scale.
12:43
So you need to have a very, you know, human readable policies
12:47
that you can organize in reusable snippets and you know
12:49
have very good controls around how to manage them and all that.
12:53
And then you need to be able to enforce that access at various
12:57
levels, your infrastructure like AWS and Azure or you know, even
13:02
Linux and SSH and all the way up to like your APIs and you know
13:06
various API gateways or internal applications and stuff like
13:09
that. And then all this needs to be,
13:11
you know, audited in real time and you know, be able to, you
13:16
know, enforce these decisions in real time.
13:19
So in a in a nutshell, that's kind of what Signal does well.
13:24
We'll have a link in our show notes so people can check out
13:26
kind of learn more about it. Sean let's let's turn over to
13:30
you identity origin stories. Tell us how you got into the
13:34
wonderful world of identity. I'll.
13:35
Give you a part one and a part 1.1.
13:38
So the first the first time came around.
13:41
It's working for a logistics company doing like LTL and
13:45
truckload, freight and even small pack of shipping and had
13:49
to hand build ACRM from scratch. But I had to figure out using
13:56
the lovely principal identity from Microsoft doing it in
13:59
like.net 1.1 before it was actually like a a thing.
14:02
So I had to figure out authentication, authorization,
14:05
and access before it was really a thing.
14:08
Built out home grown authorization engine, built out
14:12
a home grown access engine, migrated it out of out of Sequel
14:15
and put it into its own standing thing.
14:21
Then they got acquired and I went and worked for a medical
14:25
company. So that was our first foray into
14:27
it and it looked kind of interesting and it was a it was
14:29
it was a very good domain. I was much more intrigued with
14:33
authorization than authentication.
14:34
That was pretty easy. So and here's the part 1.1 to
14:37
it. I had to take over a thing which
14:41
is a surprisingly Stillwell known called Bit Q Keystone.
14:47
I had to learn that from scratch and it was it was a beast.
14:51
So my origin story is like 2 parts to it.
14:54
First it was the the dabble and oh, it shows me for sure.
14:58
And then I dived in deeper and won't look back.
15:02
It's it's it's so much fun. Every day is something
15:04
different. It's like a horse head left in
15:06
your in your bed. You try to get out and you just
15:09
can't you work with Disney now? I guess tell us something about
15:12
your role with Disney and sort of the maybe just kind of
15:16
briefly what does a you know, engineer do from AIM
15:20
perspective? I work with the entire company
15:23
on workforce and consumer identity.
15:25
Everything from pushing standards to be adopted, doing
15:28
it the right way with standards, helping build out
15:31
implementations, roll out services, own services, run
15:34
security services, insert IAM, bingo, buzzword here, cross the
15:39
gamut. We do privilege, access, all of
15:41
it. So my scale is the company and
15:45
my scope is IAM. And it's it's honestly so much
15:48
fun. I I enjoy it every day.
15:49
It's again Identity never sleeps.
15:53
So that quote from Gordon Gekko from Wall Street for sure, but.
15:58
Instead of 1 to steal, that's the one to steal.
16:00
Exactly right. It's it's a mixture of like
16:05
you're an engineer, you're an architect and you're a
16:07
consultant all in one. And your scope is it's so much
16:11
fun. And you were at Identiverse last
16:13
year and you gave a presentation there.
16:14
Can you tell us what about that and are you going to be at
16:16
Identiverse again this year and if so, you have anything planned
16:20
to talk about there? Did a couple submissions and a
16:22
panel being on the being on, you know participating in the
16:25
working group and now being, you know officially responsible for
16:29
shepherding that along. I did submit 2 submissions.
16:32
One was for 0 standing privilege the other one is for don't want
16:39
to give it away but it's it's an interesting title but it
16:42
involves shared signals and Cape and what powers it because you
16:46
know we'll we'll talk about it more on this on this podcast and
16:49
the other one is is is a panel with all of the Co chairs on the
16:53
shared signals working group. This sounds really cool.
16:56
So Sean, before we hit record, you had come up with an analogy
17:02
and I think we should use it because you know these terms,
17:05
shared signals and Cape. Most people are not familiar
17:08
with it. Why don't you throw your analogy
17:10
out there and we'll, we'll see. We'll throw it against the wall,
17:13
see if anyone salutes. Well, this is going to show my
17:17
age, so that's OK. The analogy with what Cape and
17:23
shared signals is goes back like let's say way back.
17:26
So you can look at it from my If a law enforcement agency were
17:30
ever to issue an all points bulletin, that would be
17:32
essentially a Cape event. Like this is a person of
17:35
interest. This is the person to watch out
17:36
for. If you see this person, there
17:39
should be dangerous, don't engage with them.
17:42
That's the event. But the shared signals framework
17:46
is when you have law agency in Denver sending a fax, Here's the
17:50
age to someone in Atlanta or a counterpart over in Colorado or
17:55
in LA. The transmission of the fax is
17:58
essentially the protocol to send the Cape event.
18:03
That is what shared signals is. Another way to look at it is you
18:06
had a a wanted flyer. I know that I'm in search of
18:09
something or a wanted flyer. I'm walking around and putting
18:12
one of Flyers out over telephone poles and whatnot.
18:15
Again, the event is wire, the transmission is me walking it
18:20
around 1 by 1. So it's kind of like a good
18:23
analogy to start sticking into like what is Cape, what's shared
18:26
signals and how does it trans? How does it transpose from real
18:29
world to digital? With one minor nuance.
18:33
There's a look. There's a lot of the difference
18:35
in the digital world versus the real world.
18:37
Real world, you know, this person's like a person of
18:40
interest or like a malicious actor, whereas in the digital
18:43
world it's a signal like we think it is, like this IP looks
18:47
suspicious or this behavioral event that Bob did looks bad or
18:52
what a total. Profiling.
18:55
Let's be honest, you're profiling these folks.
18:58
These these poor folks. That were only profiling because
19:01
the P in Cape stands for that. OK.
19:05
Well, no, I mean like, yeah, it makes a lot of sense, right.
19:08
You have the, the Central Agency, which is like your your
19:12
central IT capability and it's sending it to the individual
19:18
departments which are like your applications, right.
19:21
So that's the, that's the message that you're sending is
19:25
watch out for this person of interest because they're they're
19:32
throwing off these, these, they're fitting this profile of
19:35
like oh they're hitting it with a headless browser or they're,
19:39
you know, they've tried to authenticate unsuccessfully 50
19:42
times etcetera, etcetera, so. I just wanted to add to what
19:46
Sean just said, right. So it's not necessary that, you
19:50
know, each event could be anything suspicious in itself,
19:53
right? Like it could just be an
19:54
innocuous kind of observation like, hey, you know, I saw this
19:58
user come to this application. You know that by itself doesn't
20:02
mean anything. But then if you see the same
20:04
user within like a span of a few seconds visit, like you know 5
20:09
or 10 different applications then.
20:11
You know that could be a lateral movement attack, and you know
20:13
you want to respond to that, right?
20:15
So an event by itself doesn't necessarily mean anything's
20:20
wrong. It just means that you've
20:21
observed something that could be of interest to others.
20:26
And it's all connect. I'm going to add 1 you perfect.
20:28
I'm going to add one more thing it's and Jim I think the way you
20:31
said it is not every signal is bad.
20:34
The whole point of the shared symbols framework is the
20:37
beginning word of it. It's share because you know to
20:39
get to 0 trust, but I'll have to share it's top same language,
20:42
right. So if I present an A leading
20:45
indicator that you, Jim, your system sees even my leading
20:49
indicator with what you're seeing could lead to an
20:52
aggregate signal that you have collected and say, oh, Sean sent
20:56
me this, Jim has this both of them together to you could say
21:01
an informational signal for me and a medium one from you could
21:05
equal a high, which means you, Jim, as your system take action
21:08
on it. You don't have to, but you
21:10
could. Yeah, I.
21:11
See a ton of value in this. It is kind of complex, so I want
21:15
to try to bring it back to building blocks, especially for
21:19
people who might not have all the contacts.
21:20
So a tool, if you could kind of help us define and understand.
21:27
So it's Cape is Continuous Access Evaluation Profile.
21:32
That's the profiling bit that we're joking about a little bit
21:35
earlier. CA EP.
21:38
You know, The funny thing is, like, if you go on to Google and
21:43
Google CAEP identity, by the way, CAEP also stands for other
21:48
things. But within our space, within
21:50
this identity space, it's like a tool, a tool, a tool.
21:54
You're listed over and over again and you.
21:56
So we're hearing from the extra what?
21:58
What is this? What is Cape?
22:01
Yeah. So.
22:03
It started as and that's maybe some of the confusion that it
22:07
started as continuous access evaluation protocol and it was
22:11
you know based on a little blog that I wrote when I was in
22:13
Google back I guess five years ago now.
22:16
And then what happened was we started meeting informally as a
22:20
as a cross industry group. There was about you know 30 odd
22:24
companies from around the world that were meeting outside you
22:27
know any standard party at that point.
22:30
And then we realized that hey you know we we although the
22:35
objective that we're trying to achieve which is session
22:37
security is different, we are sharing the mechanism of
22:42
asynchronous publishing and subscribing with this other
22:45
thing called risk. And so the two merged and that's
22:48
how the shared segments framework came about and then
22:50
keep became you know continuous additive evaluation profile of
22:54
that shared segments framework, right.
22:55
So just just to clear up that, the little confusion there,
22:59
right. So so you know what Keith is
23:02
really all about is being able to improve your session security
23:07
by sharing signals that are relevant to your user session,
23:10
right. Because in today's world, A,
23:12
you're always signed into a large number of services, you're
23:16
using a large number of services simultaneously.
23:19
And B, there are many independent services that are
23:21
actually being able to tell information about what about
23:26
your posture, about your security, about you know,
23:28
something about your ability to have that session, right.
23:33
And like for instance, while I'm using my computer, you know,
23:37
there may be an endpoint security program that is on my
23:40
computer that is detecting something about my computer.
23:43
If if they detect something, then they need to be able to
23:46
tell someone else that, hey, you know, this person is on this
23:49
computer and I'm, I'm detecting some malware on it.
23:52
And so, you know, you should sort of take care of that
23:54
situation or a service provider that you're working like in,
23:58
let's say using Google Drive or some file sharing service and
24:03
they detect that all of a sudden the same user who was previously
24:06
in, you know, Cupertino, CA suddenly isn't in Taiwan or
24:11
something like that, right. So, you know, you should be able
24:14
to share this information about what you're seeing in order to
24:19
build a more complete security picture and then in real time be
24:23
able to affect, you know, what that user's experiences in terms
24:26
of using those services that they're using.
24:29
Yeah, I love that. Example that you just brought
24:31
up, which I often hear referred to as impossible travel, right.
24:34
You can't go from Cupertino to New York City in 15 minutes, so
24:41
or 15 seconds in some cases, right.
24:44
So just in thinking about that, you know, I usually hear that
24:48
associated with conditional access or adaptive
24:51
authentication, am I on the right track are the, but there's
24:55
got there's more to it, right? Yeah, I think.
24:58
Ultimately, I think there's recognition that this is a
25:00
problem that a lot of different companies have attempted to
25:03
solve, and the difference with Cape and everything else is
25:08
basically Cape is a standardized way of doing things, right?
25:11
So you may set rules of continue conditional access and let's say
25:15
your Azure or. You know other.
25:17
Systems where you can see or if this user is coming from this IP
25:20
address and allow them, allow them or it's not don't allow
25:23
them. But that's kind of specific to
25:25
one particular system, whereas what Cape is trying to do is
25:30
expand that across different vendors, across different, you
25:34
know, services. And why that is important is
25:38
because every enterprise, you know, without exception is going
25:43
to have a multitude of vendors. And then, you know, you really
25:46
cannot control what kind of technologies at play.
25:49
So you need to establish some kind of a baseline that
25:53
everybody can communicate with so that, you know, you improve
25:57
the overall security for all users, Right.
26:00
Yeah. That's a really good
26:01
explanation. And you know, you mentioned the
26:04
blog article. We're going to throw a link to
26:07
that in the show notes. You know the other thing, Sean,
26:10
that this is sounding a lot like so when I, when I hear Atul talk
26:15
about Cape, reminds me a lot of what an ITDR can do.
26:20
So what are the similarities and differences between Cape and an
26:25
ITDR? Or am I?
26:27
Am I missing the plane here? I think there's an element of
26:31
Cape and ITDR. So the way I broke it down is
26:35
the ITD is the Cape, the R is the ITD is like how explain
26:42
this, the ITD is how you figure out how do you assemble a Cape
26:45
event, right. But the R is the response and
26:48
the response is using the shared temples framework with a Cape
26:52
event. So it's it's very tangential to
26:54
it and it it it should be pivotal in any ITDR strategy
26:59
because it is like Atul said you you can use this in vendors,
27:04
vendors have heard to solve this independently, right?
27:06
But if you have them all speaking shared signals using
27:09
cave events then you get true vendor interop which sends you
27:12
you lower your security threshold of having to have a
27:15
privilege API into Azure or privilege privilege API inside
27:18
your IDP or into your your Pam system.
27:22
So if vendors all support shared signals using like cave events
27:25
for example your identity threat detection, you can focus harder
27:30
on that and then your response is emit signal to A, emit signal
27:33
to B, emit signal to C So the word where I think companies
27:37
should focus more on is their business and what looks
27:41
suspicious than worrying about I have to call 15 systems API
27:45
independently and I have to worry about when they change
27:47
their API versus if you just accept the standard everyone
27:50
wins. I really liked that.
27:51
Explanation how you said OK the the, the Cape and the shared
27:56
signals framework is essentially the ITD and then not the RA tool
28:04
actually. Where would you come from on?
28:05
This the R. No, no, no.
28:08
The R is the response and the response is the signal.
28:12
So the response is the shared signal.
28:14
The ITD is the brain behind it. So the response is the the
28:18
shared signal with the Cape in it.
28:19
So if I if I misspoke, sorry Jim.
28:22
OK. No, no, that's great.
28:25
A tool like you're you're ready to jump in and add something.
28:29
Yeah, I I just. Wanted to mention that you know,
28:32
threat detection is is a multi homed kind of, you know,
28:38
exercise right? Because you cannot detect a
28:41
threat by just observing someone in one little corner of you know
28:45
all the multiple systems that you're having, right?
28:49
If those systems can communicate with each other, even improve
28:52
your threat detection, right? So it's not just the response,
28:55
it also like helps in the threat detection itself.
28:58
That's right, I. Mean.
28:59
Yeah, you. I think that's one of the things
29:01
that we we talk about with our clients and we talk a lot about
29:06
on the podcast is you know you if you get overwhelmed with the
29:10
number of events or things that look suspicious, then the things
29:16
that actually are a problem just kind of like hide in that you
29:21
have to be able to separate the wheat and the chaff as they say
29:24
and Jim I want. To add on to what?
29:25
Atul said it's it's a it's a good follow on where it's almost
29:29
like the response of multiple systems helps with your threat
29:34
detection. So it's almost like sharing is
29:37
caring as part of my identity. First talk last year is sharing
29:39
is caring because if you have 15 systems all doing this and they
29:42
all share the same information, you get better the detection
29:46
because you get you get better responses.
29:48
So just thinking about. Denver's just a little plug out
29:51
there for people who are thinking about going.
29:54
It's going to be in May this year and it's an awesome
29:57
conference. So Jeff and I are planning on
29:59
being back there. Sean, I I I mean, one of the
30:04
really cool things about having you on the podcast is like
30:07
you're an actual practitioner putting these things to work.
30:13
Give us a. Look at.
30:15
Maybe not like really how you're what you're doing it on, but an
30:18
example of like real life where how how do you put something
30:23
like this into into motion. And then I also think like if
30:27
somebody's starting from you know from the base level, this
30:30
is like they don't have Cape or shared signals but they're
30:33
really intrigued by this concept.
30:35
Where did they get started? So first some kind of like grill
30:38
world examples, then maybe some some real world guidance of like
30:42
how you go from not using this to using it well.
30:46
It's actually a a good plug for there.
30:49
So part of what a tool has asked that I help shepherd along is
30:57
contributing use cases in the working group.
30:59
So that it addresses the exact question you have is where do I
31:02
start? Because you have to always start
31:05
with the business case 1st and why it's needed and what the use
31:07
cases are and build backwards because you can build a shared
31:10
table system of Cape awesome. What's the adoption look like.
31:16
So it's yeah you have to start business case first like what do
31:19
you what do you want to go after because you can very easily get
31:22
into a signal to noise ratio problem very quickly.
31:27
And by signal to noise meaning I'm going to pepper you with
31:30
10,000 events and you're going to know not know which one is
31:34
which one did you act on. So Jim, I think you asked like
31:38
what's a a real world example. I'm going to give this to you
31:42
and this is a pretty, pretty wide known problem.
31:47
It's more of more of an annoyance.
31:48
Everyone subscribes to some streaming platform.
31:51
Pick them across the board. This is not a plug for Disney
31:54
Plus, so please do not thank that.
31:55
Sometimes you get locked out of your TV.
31:58
And I don't know about everybody else, but like I hate putting my
32:02
password in until Roku or name System X.
32:05
It is so bothersome and annoying.
32:08
What this could help do is help enhance the user experience
32:13
through security. So let's let's give a prime
32:15
example. Let's say we talk about your
32:18
favorite example, Jim, the the Superman case.
32:20
I can't be in Cupertino in Atlanta.
32:22
And then in the same 15 seconds if I'm on my shooting
32:26
subscription and all of a sudden I I see like a a device came
32:30
from Atlanta. But you know, I usually watch
32:33
stuff in California using tape and share signals powered by
32:37
some detection engine that's that has to happen.
32:40
So that it you can't just implement shared demos and watch
32:42
it happen. There has to be some kind of
32:44
threat detection or behavioral analysis that says, I only watch
32:48
this show or I only watch this platform from California, You're
32:52
coming from Atlanta. That looks weird.
32:54
So using the shared demos framework you would admit a
32:57
session revoke Cape events or that dough fight not for your
33:02
entire account. So you can still be at home in
33:05
California streaming your your favorite shows and you're not
33:09
burdened because someone got your password on have I been
33:11
pwned or take your pick site X, right.
33:14
So the applicability there is is very real.
33:17
It's it's being it's being prescriptive in security and
33:21
being very consumer friendly to not not not to disturb someone's
33:25
user experience. So it's very, it's very good to
33:28
harp on that through security. You get through security, you
33:32
get better user experience as as one exact case.
33:36
But that's one of many that you come up with.
33:37
But that's a very one that should hit home with most
33:40
people. Let me throw A twist.
33:41
In there because I think that's that's a it's a compelling use
33:44
case. Let me flip it on its head
33:45
though. I travel a lot.
33:47
I'm constantly logging into things all over the US for the
33:51
most part. Is there a way that something
33:53
like Cape or the shared signals framework can help me?
33:57
Maybe is picked up that I did log on to 1 system already and
34:02
it's not going to throw me another word on another system
34:04
that I tried to log in or an application.
34:06
Is there a way to help my scenario with something like
34:09
this? If you travel A.
34:11
Lot. If you travel a lot, it is
34:13
consistent because you go to different places.
34:16
You have to make a lot, a lot of assumptions.
34:18
But whatever's powering your share channels implementation
34:22
using Cape, that is your behavioral analysis that we know
34:27
Jeff travels to, well, apparently 102 flights a year.
34:31
So that's a lot, right. So if you travel a lot, maybe
34:35
the geolocation where you're at is not an indicator for your
34:39
given account, but maybe it's like, OK, we move your
34:42
geographical, maybe we move your geographical boundary from state
34:45
to country, right. But if we see something coming
34:48
from like UK, Colombia, Switzerland, that's suspect or
34:56
other thing is even if you travel you tend to use the same
34:59
device, right? So.
35:02
If you're an iOS person or an Android person, let's say you're
35:04
iOS person and all of a sudden I see Samsung or high tech or
35:11
whatever now, then we can move. You've moved to behavioral
35:14
analysis from some fact to some other dimension.
35:19
So you don't go just based off a location, you go based off
35:21
device, even time of day. You could, but in your example I
35:25
would say device would be the device is the next leading
35:29
indicator. And again that's why it's
35:31
important that we could send signals that looks like
35:35
Jefferson, Arizona, Louisiana, Maine, wherever you are.
35:40
Not a bad thing. But if all of a sudden we see
35:43
you in Montana when we know you don't go, there could be and and
35:47
and you you could have some friction but that's kind of
35:50
where you have have to have, this is not a Cape or an or an
35:54
SSF spec, but you have to have that feedback loop from your
35:57
guest or from your users and say no, this is really me, this is
36:01
really me. That way you know that it's
36:03
really you and that your behavioural signal that you're
36:06
powering to enable signals and can't happen your data, your,
36:11
your data analysis has to be accurate and has to always be
36:15
given that feedback model. Great question.
36:18
Or greet twice. I went.
36:20
I think the device thing was what I was thinking of, that's
36:23
all. What do you want to add in?
36:25
I can add. A couple of enterprise cases
36:27
because one very early adopter of Cape although they predict
36:31
the standard and so they have adopted it in their own sort of
36:35
way is Microsoft and how they've done it is that you know
36:39
previously they used to use short lived tokens between you
36:43
know Microsoft as your AD and you know Exchange and Teams and
36:49
what the what the short look tokens meant that the user had
36:53
to re login every hour or so in order to prove that they still
36:58
are sort of the same user. Right.
37:01
Now what happened is after they started using Cape, they were
37:05
able to extend the token token lifetime to a much longer time
37:09
so that if something was wrong with that user, they could just
37:13
send a Cape message between Azure AD and Exchange or Azure
37:17
AD and Teams in order to say that this user should be logged
37:21
out, right, for example. And that sort of was a grand,
37:25
you know, it was something that they've actually said that, you
37:29
know, it's one of the four pillars of their, you know,
37:31
reliability strategy, right. And so it's a huge thing for,
37:36
you know, the top services of Microsoft to be using something
37:39
like, it's not the standard by itself, but it's something very
37:43
similar, right. And they even call it continuous
37:45
access evaluation and they acknowledged that at sort of
37:48
leveraging the concepts and the standard.
37:51
The other use case I was going to talk about was the Apple use
37:54
case. They recently announced in the
37:56
WWDC that they require custom Idps to support shared signals
38:02
in order to be able to integrate with Apple Business Manager.
38:06
Now Apple business managers make this device management thing
38:09
where if you get a Mac from your employer, you know you can
38:12
manage it using Apple Business Manager and you know you can
38:16
have certain restrictions about it's used and things like that.
38:19
Now let's say you're you're using your Mac or your iPhone
38:23
and you know your IDP says well this person has changed their
38:27
password and you need to change. You need to enter your change
38:31
password on your device. They're going to send a keep
38:34
message, which is a credential change message to Apple and then
38:37
Apple is going to lock you out of your device until you reenter
38:41
your password, for example. So those are some of the sort of
38:45
publicly known, you know, enterprise use cases.
38:49
I'm sure there are more and I'm sure Sean knows of a lot more,
38:51
but you know, those are the ones that we can talk about here and
38:55
Atoll I want. To hit on something that Jim
38:57
said earlier, like what's the difference between conditional
39:00
access and adaptive authentication.
39:02
The irony here is getting a thing in getting a thing in your
39:06
business in the workforce like Cape gives you that because you
39:09
could give the work your workforce user a longer session
39:14
with bigger trust. If you have a thing like Cape in
39:17
place and it's it's a very shared signals and Cape brings
39:21
together a lot of IM domains it really does like authentication
39:25
access authorization. It brings it all together and it
39:28
I don't want to say it's core to a strategy but it can it can
39:31
power a lot of what like a product team and what people
39:34
want to do not in space from a workforce perspective there's a
39:37
lot of workforce stuff to talk about too still.
39:39
So here's an update that. I would like to see, I don't
39:41
want to have to keep logging into my Blizzard account play
39:43
World of Warcraft every time my network changes.
39:46
I mean that's that's where I'm looking for Cape to benefit me
39:49
or shared signals framework or something.
39:50
It's like, dude, it's the same laptop.
39:53
Yes, you're logging in again. Why are you prompting me again?
39:56
Like I feel like, you know, I think very.
39:58
I mean, we've been doing those podcasts like 4 1/2 years and I
40:01
think very early on I kind of pointed to the gaming industry
40:04
as one of the early adopters of. Just MFA at large because of
40:08
account takeovers and things like that and how valuable, you
40:10
know some of those things, those digital things were.
40:12
And I was like, Oh yeah, like Blizzard is great.
40:14
Like, they're, they send you a push notification and you click
40:16
a button and you're in. And now it's like super
40:18
annoying. It's like all I did was go from
40:20
one network to another network. It's still the same device.
40:22
Like, what's the problem here, right?
40:24
Shouldn't we have a better way to do that?
40:27
You know, I got to do my dailies, man.
40:28
Come on, this has been a an interesting discussion.
40:31
I'll be honest, I don't know if quite sure if I get it yet.
40:34
You might have to do a follow up conversations.
40:36
OK. Is this what you mean?
40:38
I feel like I'm a little bit into that first month of like
40:41
high school chemistry and you're like what just happened and then
40:44
all of a sudden it's going to start to click.
40:47
But I think I'm starting to get it.
40:50
Let me try to wrap things up here and and and actually Sean
40:54
will ask you and I just want to have as simple of a definition
40:57
as you possibly can make it. Pretend I'm an idiot.
41:00
You know to pretend, but you know for the for the podcast,
41:02
just pretend. It's not.
41:05
True. What is Cape Cape in its
41:09
current? State is a way you can manage
41:11
user slash identity sessions, and the shared signals framework
41:15
is the way in which you communicate that message to.
41:19
OK, that's. Very helpful.
41:20
I appreciate that my simple brain was starting to explode
41:24
and I need to save some room to to talk about well a couple
41:27
things. The first thing is you're I
41:31
usually I have the most interesting like office kind of
41:33
background just because I have a nice camera and monitor and
41:35
trees and license like that behind me.
41:37
But Sean, you got to, you got to explain to people what a tool
41:42
Jim and I had been looking past you at for like the last 45
41:45
minutes or so. Tell explain your office to
41:48
people. Well, I'm a new.
41:49
Father, I used to have a bigger office downstairs that had
41:54
life-size Star Wars Storm trooper bust from episodes 2-3
41:59
and four. So clone troopers to to storm
42:02
troopers. But I got moved upstairs because
42:04
he now runs the first floor and I have been reclused up here.
42:09
So what you can see in the background is I have a problem.
42:14
I collect Hot toys and Sideshow Collectibles.
42:19
I'm a collector and I have 37 hilt and 22 helmets and eight
42:26
full size busts from Star Wars may range from command degree to
42:31
all the stormtroopers. I have so many helmets and I I
42:35
have probably, I don't even know how many, but I have a very
42:38
forgiving wife. It's just be collecting.
42:41
Like, more stuff, but I have a lot of cool things I have.
42:44
I have a Rose Gold Saber from General Leia as well.
42:48
I I have a. Too much to talk?
42:50
About but they're all, it's all very gets limited.
42:53
I don't go for like the the Black Series stuff.
42:55
I want like the The Collector stuff.
42:57
Yeah, and it's all behind UV glass.
42:59
And yeah, what's the? Most, I guess the rarest item
43:04
that you've got in your collection, the rarest.
43:06
Thing I have is a mint in box 1977 million Falcon.
43:13
Dude, I When I was a kid, that was what I wanted so badly.
43:17
I never got one. I have two.
43:19
One that I played with and one that is like not open.
43:22
That's so cool. Let's keep with the sort of the
43:25
the Disney theme here in honor, in honor of Sean and the small
43:28
company that he works for. And this is a question for
43:31
everybody. Atul, we'll start with you.
43:34
What's your favorite Star Wars, Marvel or Indiana Jones movie or
43:40
TV show? Yeah, I think there's so.
43:43
Many good ones, but I I got to go with Rogue One, which was a
43:48
recent movie from the Star Wars series.
43:50
And, you know, it's so good. It was so good.
43:54
I I did not expect it because, you know, ever since sort of the
43:59
merger between Disney and Star Wars happened, I was like, you
44:03
know, where is all this going? But Rogue One just completely,
44:07
you know, astonished me. And I just loved everything
44:11
about it. That's a good movie.
44:12
It's funny. It's, I don't want to spoil it,
44:15
but I feel like it's kind of like, oh, it's kind of out there
44:17
because it's already, I mean really it's kind of what happens
44:20
to get the Death Star plans right.
44:22
That's sort of like the thing. And in the first, well, 4th
44:26
episode, I guess depending on how you watch the, the original,
44:30
you know, arc of the movies, everyone dies at the end.
44:32
So it's kind of like a it ends like kind of a downer.
44:36
But it's such a good movie. I'm with you and I, I got my
44:38
ass. I love what Disney has done with
44:40
the Star Wars franchise. They've put out so many good
44:42
things. I mean, you know, I'm sure
44:44
there's caretaking going on to make sure that the brand doesn't
44:47
get, you know, screwed up. But between Mandalorian, you got
44:51
baby Yoda. I mean, there's you've got.
44:53
I liked Obi Wan. I thought it was great.
44:55
I liked the Boba Fett stories you've got.
44:58
I haven't seen Osaka yet, or. Yeah, no.
45:02
What is it? What's her name?
45:04
Ahsoka. Ahsoka.
45:05
Sorry, like Assoka's not right. That's a place, Ahsoka.
45:08
I haven't seen that one yet, but I've heard good things about it,
45:10
so I feel like there's there's a lot of good choices out there.
45:14
Sean, what's your favorite Marvel, Indiana Jones or Star
45:18
Wars movie or show? Well, took my answer.
45:22
So probably shouldn't say Rogue One again because we just heard
45:25
that because I talked about Star Wars the entire time.
45:28
I'll go marvel and it's traditional Iron Man.
45:31
Iron Man One set the foundation for the MCU.
45:35
It was an epic movie that if you haven't watched the the special
45:40
on it, see how it was filmed on like a shoestring budget.
45:45
Favreau made that film like he he set the stage for the MCU.
45:50
Is that behind? The scenes, is that something
45:52
that they can see on Disney? Because I I haven't seen that.
45:54
I'd be. I want to see that.
45:55
Yeah, it's on, I think. It's on Disney Plus.
45:56
Yeah. OK.
45:58
No, it's shameless plug. But no, hey, I mean, I have
46:03
Disney. A lot of people.
46:03
Disney says they don't need our help selling subscriptions.
46:07
That's the one thing. If if identity the setting or
46:09
makes a drop in the Disney numbers, hey, you know, we'll be
46:13
happy to have them sponsor us. Jim, what's your favorite Star
46:17
Wars, Marvel or Indiana Jones movie?
46:20
Actually, I was. Going to surprise you with by
46:22
picking a show, because I saw The Mandalorian a while ago and
46:27
like, I really enjoyed it, but I've got to go with like, old
46:30
school Return of the Jedi. I enjoyed that, man.
46:33
And like, you know, I think that was, it's, it's funny, you look
46:37
back at some of those Movies Now, you're just like, Oh my
46:38
God, these graphics suck. You got to remember the time
46:41
frame when they were created. And I mean, you know, at the
46:47
time, they just completely blew me away.
46:51
I mean, it was such a shift, right?
46:52
It was like at that point, when those movies came out, the
46:54
original was like, everybody wanted a lightsaber.
46:57
Like everybody wanted it, right. It was like the thing I remember
47:01
my, you know, my, my. I have younger brothers and the
47:03
next youngest, we each had plastic lightsabers and we would
47:07
chase each other around in the front yard, swinging at each
47:10
other. And I have a scar in my nose
47:12
from defeating him in battle and then him throwing a a chunk of a
47:15
door siding at me because he was not happy about that.
47:18
So I have a Star Wars Story. Oh, yeah.
47:20
Just. Before you do that, I just want
47:22
to my last notes would be, I kind of wish I did more than
47:26
what Sean did and kind of collected them.
47:28
Because I remember having like all these figurines and toys
47:31
from Star Wars and like remember I had the Luke Skywalker in the
47:35
orange jumpsuit and sticking his head in the dirt and pushing it
47:40
and breaking his head off. Like that's how I play with my
47:42
toys. Like I got full value out of
47:45
like destroying them. But I wish I could go back and
47:48
have that in the box, like never opened.
47:51
I have. Two of each, one to play with
47:54
and one put you to college. No.
47:58
But again they're like, they'll put you to college.
47:59
I'm like, let me tell you right now that I'm going to They
48:02
didn't. They didn't appreciate that once
48:04
that fall. I want to.
48:06
At some point, we have to unpack why Jim was taking action
48:08
figures and ripping their heads off.
48:09
I feel like that explains a lot, Jim, Yes.
48:12
That was young Jim. That was like 6-7 years old.
48:15
Like, yeah, but I mean, all my toys were broken.
48:18
Sean, you took. Mine, I'm a I'm a big Iron Man
48:20
fan. I really didn't know the
48:22
character until Fabro and kind of put that out and I was like,
48:26
holy S like this is, this is amazing, right.
48:28
It was kind of like, this is Marvel's answer to Batman for
48:32
the DC and it's like so much better.
48:34
I now what I love Batman. I think it's great too.
48:36
But the whole character of Iron Man and I think especially with
48:40
the way that it was portrayed as Tony Stark and it was just
48:44
perfect casting. So I don't know can I pick this?
48:47
I don't. I'm not going to pick the same
48:48
one. I'll say I I may enjoy a lot of
48:50
the different things. The one I think that captured me
48:53
most recently was probably Loki, the series on Disney for the
48:57
Marvel series. I really enjoyed it.
48:59
I thought it was fantastic. And alligator or crocodile, Loki
49:03
is is awesome. So if you ever watched that, you
49:04
know what that's all about. But I thought it was.
49:06
I thought it was original and it was a good story.
49:09
And I still have to watch Season 2, but I'm with you, Iron Man.
49:13
Is, is, is, is the bomb, as the kids say.
49:15
I don't know what to say anymore.
49:16
Do they casting? Casting for him is amazing.
49:20
Yeah. Yeah.
49:20
Sorry, Jim. No, no.
49:22
I'm going to make a suggestion because I'm sure most of our
49:25
listeners like these genres as well.
49:29
And if you're listening, you're just like shouting your answer
49:34
at your iPhone or however you're listening.
49:36
Go out to LinkedIn where we post this comment or when Jeff posts
49:40
this episode, and just drop in what your favorite was.
49:43
We'd love to hear it. Yeah, basically a lot.
49:46
Of out of context, like, hey, this episode's available and all
49:48
of a sudden it's just a bunch of TV's, movie show, things like
49:50
that. I think they're really funny.
49:52
All right. I think that's a good spot to
49:53
leave it. We'll go ahead and wrap things
49:56
up. A tool.
49:58
Sean, thank you guys for spending the time with us.
50:01
I think there's a such a dense topic.
50:03
It took me a little bit to get my head around it.
50:04
So I I feel like this is an area where it's kind of like just
50:07
beginning. So we definitely appreciate the
50:09
work that you guys are doing as part of the, as part of the, the
50:11
working group, right, to get this out.
50:13
This is how things start, right? It starts at that level and then
50:16
all of a sudden next thing you know it's like SAML, Open ID,
50:19
Connect, right. These things that everybody
50:20
knows about and understands. So I appreciate you guys being
50:23
part of the conversation and kind of helping start to
50:25
demystify how this works. We'll have links in our show
50:28
notes if you want to connect with Sean or a tool on LinkedIn,
50:31
you can definitely check them, check out the show notes there.
50:34
We'll have a link to signal SGNL dot AI so you can learn about
50:38
what Atul and his company does. We'll have a link to the blog
50:42
that a tool wrote around this rethinking Federated identity
50:44
with the Continuous Access Evaluation Protocol, which is
50:47
now Profile. It's my understanding what I got
50:49
from this conversation. And yeah, you can always connect
50:53
with Jim and I on LinkedIn, we're on the web idacpodcast.com
50:57
or on Twitter or X or whatever it is now at IDAC podcasts,
51:02
Mastodon at IDC podcast, at Infosec, dot exchange and yeah,
51:07
connect to the Sidlington as well.
51:08
Don't forget to leave us a voicemail when a copy of the
51:10
book that Phil Wenlind wrote and hear your voice on air February
51:15
5th. So anything else, Jim, that I
51:17
forget or are we ready to go? No.
51:19
You rocked it, man. And you know, you did really
51:21
well considering that again you have the cold or flu or RSV or
51:28
dare I say you've got the no COVID. 19 I'm.
51:32
Not sure I'm good on that I. Think it was just allergies or
51:35
some sort of allergies? Sinus.
51:39
Don't worry, I sneeze. Right on you, but don't worry,
51:41
it's just the flesh wound. Don't worry about it.
51:43
The show must go on. See, this is what I do because I
51:45
love it. All right, that's enough.
51:48
Thanks everyone for listening and we'll talk with everyone in
51:51
the next one you've been. Listening to Identity at the
51:56
Center. We hope you've enjoyed the show.
51:58
Make sure to like, rate and review and we'll be back soon.
52:03
But in the meantime, hit the website at
52:05
identity@thecenter.com and find us on Twitter at IDAC Podcast.
52:13
See you next time on Identity at the Center.