Latest / Identity at the Center / #204 - 2023 Gartner US IAM Summit Preview

Transcript

#204 - 2023 Gartner US IAM Summit Preview · Identity at the Center

0:01
This is identity at the center. If it has anything to do with I
0:08
am this is the go-to podcast. So if you're a beginner or an
0:14
expert or anyone in between you've found your new home
0:18
welcome to Identity at the center now your host Jim
0:23
McDonald and Jeff Steadman Welcome to the identity of the
0:29
center podcast I'm Jeff and that's Jim.
0:31
Hey Jim hey Jeff, how are you not so bad yourself.
0:35
Good man, conference season starts in three, two.
0:40
One might be under way man. Type, you look here this yet.
0:43
Well it should be. I'm flying out on Saturday to
0:49
enjoy a little bit of extra time in Texas.
0:55
Going to go to a country line dancing.
0:58
What do you think of that gross? You want to go with us?
1:03
That's, that's a big unfortunately will not be there.
1:06
I will be flying in on Sunday, too.
1:09
We won't be able to make it. I've already the Gartner, I am
1:11
Summit in the u.s. so I'll be there Sunday, Sunday night,
1:14
specifically. So I I'm sorry, I will not be
1:17
able to make your your gross line.
1:19
Dancing thing. I actually had never done line
1:23
dancing. Like I can't even do like I
1:25
could never do the Macarena there.
1:27
Any of those things? Is but I do like watching people
1:31
do it. Some people are like, real
1:33
serious and get it down. Other people are just goofing
1:37
off and having fun. I think I'd have to try and play
1:40
it off. It's a goof off because I if I
1:42
got serious, I would look like a total goober.
1:45
Yeah, I would look like a full to but I have zero interest.
1:48
I'll watch it's entertaining, it's fine.
1:50
But yeah, I have no, no interest in participating I am.
1:53
Yeah, I may sit down at the table person at the party or the
1:57
wedding or whatever it may be, you know, chill relax, that kind
2:00
of thing rather than try to get up and I figure out how to make
2:03
these old bones move in a way that makes any sense whatsoever.
2:06
Yeah, well I've been we've been traveling a lot.
2:10
You've been traveling a lot more than me.
2:12
I think the conference is going to be my last business trip for
2:15
a few weeks. So I'm kind of like, like,
2:20
burning the candle at both ends, but it's kind of like this going
2:23
to be the end of the travel for a couple of weeks.
2:27
Doesn't mean I won't be working, but it actually I'm taking a
2:30
week off in the beginning of April.
2:32
And so we've pre-recorded some podcast, we've recorded one
2:35
earlier so we're all cued up, don't worry, folks will have an
2:39
episode every Monday, the hits. But I think I think the big
2:45
question you're going to bring all the recording equipment with
2:48
us to Texas. But I mean I don't know that
2:52
we're going on that. We don't have recording space.
2:54
I don't know that we'll have time to do much in the way of
2:57
recording, but it will treat our listeners will see.
3:02
Yeah, I was thinking maybe something our event, I don't
3:04
know. I'm looking at the stuff, I have
3:05
the gear sitting next to me here.
3:07
I ordered some new gear as well, was hoping to bring that with
3:10
me, but the tripods that I ordered apparently did not
3:14
arrive in time and probably will not until next week.
3:17
So now, I got to figure out if I'm going to bring the new gear,
3:20
the old gear, or some mishmash of the to, I got new microphones
3:23
that I think would be super cool for recording in person rather
3:28
than the ones we've been using, which still stands.
3:30
What? What are they look like?
3:31
Like their shotgun microphone. It's just a it's a road video.
3:36
Video mic to something like that.
3:40
It's designed to go on top of the camera but they're they're
3:42
nice and short portable shotgun microphones that are really good
3:44
at noise, rejection from anything except right in front
3:48
of it, so good for like a noisy conference area.
3:52
That's not our fate was thinking, yes, but they require
3:54
some sort of Mount. You don't just hold it in your
3:56
hand or anything like that. So my tripods did not arrive
4:01
when The in the package that I'm looking at right here.
4:03
So I got to figure out an alternative for that.
4:05
So, what's your plan for your existing gear is a are going to
4:10
sell it or just putting the closet and wait till it's like
4:13
worthless. No, they're probably still bring
4:16
with me. There are two wireless
4:18
microphones and transmitters and stuff like that, so they're good
4:20
for we have. That's what we've been using
4:23
whenever you go on site, so they're nice and portable.
4:26
They work really well. They catch a little more
4:28
background noise and I would like them to but that sort of
4:30
the Ambiance of a You know conference anyway so who cares?
4:34
But now we're getting super technical into like what what
4:37
what equipment do we use? Stuff like that fact, this like
4:39
a YouTube channel a video or something like that but now
4:41
they're still good. I'll still also use them and
4:44
figure out other ways to take advantage of that stuff.
4:47
I always thought that they're a little weird so they are really
4:52
not designed for It's not like a microphone that sits in front of
4:56
you like you would expect to see like a radio or you know
4:59
something like that. It's a wireless lapel mic that
5:02
you clip to yourself and it has the little, what they call a
5:04
dead cat on it. It's what they call.
5:07
It looks like a bobcat. Yeah.
5:09
It blocks the wind noise and stuff like that, and kind of,
5:11
you know, breezes and stuff like that.
5:12
So it's designed for that. But they do work really well for
5:16
casual podcasting and things like that.
5:18
And I kind of put together a little system that makes it look
5:23
like a handheld mic so that People have to clip it to them
5:25
and works that way. Yeah, I think what people don't
5:30
realize is like behind unless they've been on the show is like
5:34
behind the scenes. You kind of, you know, you have
5:36
to hold the mic like this and you always give him like the
5:39
physical demonstration, and then they, they mimic it.
5:43
And it's an essay, see how to record.
5:46
They forget about it and they forget, and they move their head
5:49
all around. And yeah.
5:50
Yeah. But it's, it works.
5:53
It works, it works. I don't know.
5:55
So yeah, I think this is going to be the, I don't know when
5:57
we're going to record two hours with you because We're so kick
6:00
down to fourth wall here, it's Friday evening, we're recording.
6:04
This this is going to go like Monday, right?
6:06
When the conference starts. And then you and I are going to
6:10
be busy Monday doing stuff, we're going to be busy Tuesday,
6:13
doing stuff, you leave on Wednesday and then I leave on
6:17
Thursday. So I'm not sure when actually
6:19
would have time to do any recording other than potentially
6:22
Tuesday night. I will say that you know, what
6:26
was who we've got a question coming up from a listener.
6:29
And it made me think when we first started doing this
6:33
podcast, there weren't many like, hey, it's Friday at 6:30.
6:37
Let's record the podcast, but we've done this a few times,
6:43
there's no time during the week to get the episodes in, but
6:46
yeah, you know, we're dedicated wheel.
6:48
Yeah, well, you mentioned the travel, I mean, this is Gardner
6:51
will be the sixth consecutive week that I've been on the road.
6:54
Or something. I just got back from a trip
6:56
where I was gone. Two weeks come back, I came
7:00
back. Today recorder two episodes.
7:02
I will reload my suitcase pack my gear and head out again on
7:05
Sunday. And then I think I have at least
7:08
a week off or I'm not going anywhere.
7:09
I help at least at this point. I need to ask your time to
7:12
recharge batteries and things like that recharge batteries and
7:15
see the Bears on your security camera and all that.
7:18
We had our first bear sighting of the season.
7:20
So yeah, they are back there in the hibernation is over in
7:24
Western North Carolina. Yeah, I forgot who said it but
7:27
somebody were so you and I were traveling together this week and
7:30
you were talking about the Bears and sometimes they do, they live
7:33
on your property, you know. I got no no, I think they're but
7:37
I wasn't convinced. They might live on your property
7:40
job. They might.
7:40
Yeah, they could and it's a pretty pretty wooded.
7:43
It's five acres. So I'm sure there's a lot of
7:45
nooks and crannies that they can probably dive into, I have not
7:48
gone exploring into it. So it's very it's very possible
7:52
that you know, One or more bears.
7:55
Conveyed with the property when I bought it, I think we should
7:59
do is get one of those old-fashioned honey pots and
8:02
like, leave it out in the backyard and see if like, like
8:05
Winnie the Pooh. Like you see, that's still there
8:06
and connect gasket, there's something like that.
8:09
Yeah, put a picnic basket out. I'll tell you what draws them is
8:11
bird feeders. So when bird feeders are out
8:14
they definitely will come out for that as we have learned the
8:17
difficult way last year. So I'm not sure how we're going
8:19
to tackle that this year, so it's beginning of conference
8:23
season. And and what are the other
8:26
conferences we love to frequent is the phyto authenticate
8:31
conference. The 2023 call for speakers is
8:35
now open through the end of the month.
8:37
So this episode will drop on the 20th.
8:41
That deadline is March 31st. Yeah.
8:45
So you know one thing I found just like kind of a hint for
8:49
anybody is like one way to get your company to pay for a
8:53
conference. Says view speaker.
8:56
And, you know, just knowing that actually find one of the most
9:01
interesting angles of conferences.
9:04
When you get the real world, stories of people who have, you
9:08
know, implemented, obviously it's great to hear about the
9:10
technology and all the buzz, but I remember there was one one
9:17
group of presentations in particular was like, Target
9:23
sales force. Or Sand City, all talking about
9:25
how they roll out password list. And it's like, well, this really
9:29
seems real now. So, you know, the whole password
9:32
list angle rolling that out for your customers, or rolling out
9:37
for the Enterprise. If you've done that, and you
9:40
have any interest in getting on stage and talking about it,
9:44
people either it up. I even up.
9:46
So, anyway, that's the deadline. Yeah, and I'll have a link in
9:49
our show notes for people to check it out the call for
9:52
speakers for authentic 8. T23, which will be in
9:55
California. I believe this year instead of
9:57
Seattle like the last couple years.
9:59
So another you know, another carrot there is if you if you
10:03
you know if you're a speaker and you can you know that helps
10:06
maybe get you out there and then you're going to a nice place for
10:09
weather perspective. So here's a question for you.
10:13
Jeff best Mexican food in the United States, San Diego.
10:18
I'll give you some options, San Diego.
10:20
Texas, which is more like Tex-Mex or dealer's choice you
10:25
guys some other answer. Well, I mean, Taco Bells
10:29
everywhere, right? Oh, bad.
10:32
Are you talking about last night?
10:33
It was horrible. I still enjoy a Taco Bell ruins.
10:37
Well, I'll tell you, I'm I'm not a professional on that side of
10:41
things but I do enjoy a place called Uncle Julio's in Chicago
10:44
area, so I'm not sure if I think it's probably more Tex-Mex or
10:48
not Tex-Mex more of calvary california-style.
10:50
I'll but that's my go-to place. I was just there last week and,
10:56
you know, my first night in have to have employed in.
10:58
I went to Uncle Julio with my brother and we had a nice nice
11:02
little taco dinner there. I missed it.
11:04
And I having you know, having that here in North Carolina I
11:07
can't even believe you told the Taco, Bell joke.
11:11
Hey, there's a lot of Taco Bell fans out there.
11:13
No no, I mean like a good taco bells, a good Taco Bell but I
11:18
decided on my way home from the airport.
11:20
Obviously it 10:30 at night. There's not much open.
11:23
I decided to go to Taco Bell sat in line for about a half an
11:27
hour. This is after basically working
11:29
all day and then traveling all night, I get up to the window,
11:35
get my food, get my beverage, my Pepsi, and he hands it to me and
11:42
it's warm. I guess, I feel as like, feels
11:45
warm, is there ice in here, we're out of ice.
11:51
I was on happy happy at all. And then the food was horrible,
11:55
man. It was like, I got a Crunch Wrap
11:59
and it was like 90% sour cream. And I like sour cream and all
12:04
but I didn't want like a big tortilla full of sour cream.
12:11
Well, that's what you get for going.
12:13
I guess late at night and not saying Taco Bell is the is the
12:15
Premier Choice. But yeah, because just so it is
12:19
with the correct answer. San Diego.
12:21
Well I'm just saying that. So take that, there you go,
12:25
there you go. Hey, we got a question from one
12:28
of our listeners Quaid Anderson and he asks, one of the
12:33
questions I have is how the identity.
12:36
How is identity changed since episode one?
12:39
This is what episode 2. So 4.
12:42
So, almost four years ago, are there things, you are
12:46
recommending then That now you are saying we have come a long
12:52
way. It's a good question nothing
12:56
comes to mind but I'll be honest I have not listened episode 1 in
12:59
a very long time. So I'm having sure what might
13:03
come out of that. I think you know the adage is of
13:07
I think we're talking about strategy and who has access to
13:09
what sort of things like that if you can make it out with a
13:12
really crappy microphones. And basement, Echo room that I
13:14
was broadcasting from but I don't think so.
13:19
Not fundamentally. Anyway, I think technology has
13:22
changed and we've seen things like SMS MFA become you know,
13:27
less of a focus, given the security challenges, run it,
13:32
it's still better than nothing but I think that now the push is
13:34
move too much stronger versions of multi-factor authentication
13:38
or in the case of password less things like that.
13:40
So I think technology has marched on and as more
13:43
capabilities have kind of come through I think it's just
13:46
matured maybe some of the recommendations so we say yeah
13:49
you should be using an fa you know five years ago.
13:52
It would have been yeah SMS that's sort of like the gold
13:55
standard because of X and now we've seen okay technology has
14:00
caught up with that as well as the attackers and you know the
14:03
benefits of that are still good but maybe they're less.
14:06
So just because it security applications around SMS.
14:09
Yeah. And I can't say that, you know,
14:13
I'm going to trace this back to exactly episode 1.
14:16
But there are a few Technologies.
14:19
And you hit it with SMS. That's one that comes to mind,
14:23
right? My thinking, you know, four or
14:26
five years ago was. Well, it's a heck of a lot
14:29
better than nothing and I still think that but I also think it's
14:34
slightly better than nothing. It's, you know, it's clearly not
14:40
if you're starting out. Now, why would you start out now
14:44
with with SMS? Yeah, yeah, skip that soccer
14:48
move on to something better. Or if you have SMS in place, you
14:51
should be thinking about replacing it.
14:52
So speaking of which, you know, one technology that I used to
14:59
talk to clients a lot, I felt like I was talking to clients a
15:02
lot about, but it's probably more than five years ago.
15:05
Was virtual directories. My opinion on Virtual directory
15:09
is like, it kind of covers up the problem.
15:13
The problem is your data is all over the place.
15:16
Your data is kind of a mess and you're just putting this virtual
15:20
directory in the middle to kind of like obscure the problem and
15:26
can let the problem continued rather than like forced the
15:30
proper solution. So that's one interesting.
15:34
Ya think? Go ahead?
15:36
No, I that is interesting because I feel the same way.
15:41
But now I'm back on to the band not bandwagon.
15:44
I'm still thinking about, if I want to jump on it back on
15:46
again, is maybe not necessarily virtual directory, but this idea
15:50
of like identity fabrics and security meshes and things like
15:53
that, I just I get what you're going with trying to, you know,
15:59
it may cover up, less than ideal data scenarios within an
16:03
organization. But sometimes those data
16:05
scenarios can't be fixed for any number of reasons or the lift is
16:09
too great. And maybe it just It does make
16:12
sense to bite the bullet and create you know and identity
16:14
Fabric or a virtual directory or something.
16:17
Similar on those lines. I'm not saying that that's the
16:20
you know, the way to solve all the problems but I feel like
16:22
you're totally right. It's like, yeah, it was kind of
16:24
popular way to approach it and then it kind of went away a
16:26
little while is, as there was this focus on, hey, fix the
16:29
data, right? Stop putting a Band-Aid over it.
16:32
And now, I think we're starting to see a little bit of a shift,
16:34
back towards things like, identity Fabrics, meshes things
16:37
like that, which Sony sound very similar to it too.
16:42
A meta or a virtual directory. When it comes to, you know,
16:45
combining data attributes of different sources.
16:48
Yeah. No, I think you're making a
16:50
great point. I think that, you know,
16:53
understanding, they'll cycle that we live in its I want the
16:58
functionality. Now, how can I make the
17:00
functionality work? Well, I can either do this layer
17:04
of abstraction and get The functionality want within some
17:10
acceptable time period or I can go back and clean up the problem
17:14
deliver no new functionality but have a better base to build from
17:18
for the future and then if I want the functionality is going
17:21
to be, you know, down the road from there or worse.
17:25
You can't even fix the problem. It's not your problem to fix
17:27
someone else asked to fix it. So now you're waiting on them.
17:31
The I am team doesn't always have controlled fix it.
17:34
You're right. But I don't think That defeatist
17:40
perspective, if you will is the right perspective to take.
17:44
Come on now man. The way you, the way, some of
17:46
our previous shows have gone down.
17:48
Her Jimmy has been now, you're saying you want to be on the
17:51
positive side? You've got to pick a lane, dude.
17:53
Hey, man, no, no, I can jump from Lane to Lane.
17:56
That's the beauty of the podcast is.
17:58
Most people don't listen to every single episode, like all
18:01
of you at all Jim changed. Now, he's mr.
18:04
Positive. Yeah, some do first, we
18:06
appreciate those folks. X.
18:08
Yeah, for sure. So yeah, one another.
18:13
I mean, undeniable trend has been this shift toward
18:21
cloud-based IM solution, so I think the cloud-based I am
18:26
Solutions on the access management side for years ago,
18:29
were pretty strong and there were a lot more on-prem
18:35
deployment still happening. I think now they're very few
18:39
folks that go out and roll out and on-prem access management
18:44
solution. Everybody's looking at a
18:47
cloud-based solution, but I think even like the IGA space
18:52
and Pam space and Hakeem space. It's like most new vendors are
18:59
starting in the cloud, most who are traditionally on-prem are
19:02
building Cloud version. So you know, probably four years
19:06
from now, it will be your own Option.
19:09
You know, it's funny. You bring that up because I was
19:10
thinking here, while we're talking like, you know, what has
19:12
changed? I think privileged access
19:13
management has changed. I think with a shift of the
19:16
cloud space is like, Keen Cloud infrastructure and title and
19:20
management and I'd any threat, detection, response, and sort of
19:24
all the stuff that's happened to Cloud.
19:25
A lot of that on-prem privileged access management may be,
19:29
starting to go away. I don't think it's gone.
19:31
I think there's still a very significant number, but as we
19:35
shift, more and more to sass based and As a service-based
19:39
infrastructures or platforms, do you really need on-premise, you
19:44
know, on-premise privileged access management as much as you
19:46
did for five years ago? If all your resources in the
19:49
cloud that are sensitive, should you be looking at, you know, the
19:52
newer versions of Pam, which I feel like our team and I TDR and
19:58
things like that. So that could be another way
20:01
again. Maturation of the idea of.
20:03
Yes, you should protect the keys to your Castle.
20:06
How you do it though? I think is I have shifted from
20:09
more of an on-prem problem, to a hybrid problem.
20:12
And at some point, I would think would be predominantly a cloud
20:16
problem solve for. Yeah, you're right.
20:19
I mean and the thing is that those solutions that are now
20:26
everywhere in our own tip of everyone's tongue, it's not like
20:30
there were invented within the last four years or that the
20:33
problem surfaced within the last four years.
20:36
But something like Infrastructure as code might
20:40
have been 10 15, 20 % of Enterprises doing it now.
20:44
It's 50 60 % everybody's doing automated deployment of their
20:50
infrastructure. Yeah, I think it another one
20:53
that I was really hot to trot for was you be a user Behavior,
20:58
analytics, and user identity Behavior, analytics.
21:00
Ueb a right. Whichever version you want to go
21:02
with. I don't think it took off the
21:05
way that I thought it would over the last couple of years.
21:07
Ears. I think it's now kind of evolved
21:09
somewhat into the itd. Are speyside.
21:12
Any threat detection and response and maybe that's okay,
21:14
right? Maybe it's maybe now is a better
21:17
time to look at that because we are using more cloud-based
21:20
Solutions and there is more prevalence of single sign-on
21:24
going through your access management platforms and things
21:27
like that. So I'm almost I Won't Say I'm
21:31
disappointed, but I thought that we would see more User Behavior
21:37
analytics type things. Driving more mature identity for
21:43
Enterprises and I don't know if I've seen that.
21:45
Yeah, no, I think that's that's a great point because I ueb a
21:50
space I thought was I thought that was here to stay and I
21:55
don't, you know, see anybody talking about it anymore.
21:59
So remember, when I said nothing and changed, I guess I just
22:01
don't like, we just get like four or five things.
22:03
Well, think about all this. The things that are coming, next
22:07
things like self Sovereign, eye candy.
22:11
I mean, to me, that's not the here.
22:13
And now I don't feel like I'm using my phone and the wall of
22:18
function of my phone to authenticate myself anywhere,
22:22
but I hear a lot of talk about it.
22:25
Pastor lives. I'm starting to see four years
22:27
ago. I don't think we're talking
22:28
about Pastor lives. I think.
22:30
Now, we're talking about us like, You know why would you
22:33
roll out some new functionality for a self-service password?
22:37
Reset mom, maybe it's just part of your Microsoft so you have it
22:43
for resetting, your Azure password, which maybe is the
22:47
main password that you using for most of your Enterprise
22:51
applications. But for the most part we're
22:54
thinking, okay, well how do you get to True password list?
22:58
So like those are think it's, I think it's it's shift its
23:01
shifted from didn't exist to if it comes.
23:05
And now, I think we're in the when it comes face like it's
23:08
coming. How quickly will we get there?
23:10
I think, is the stage that we're in right now?
23:13
Yeah. Well, the soft Sovereign
23:15
identity. I'm, I think it's so nasty.
23:18
Sorry. Yeah, for pastoralist.
23:19
I think, for self-serving identity, it still.
23:22
Is it going to come? I feel like there's got to be
23:27
some kind of digital. Oil replacement for physical ID
23:31
cards. I think it'll be driven by
23:34
government Education, Health, or Finance, one of those sectors
23:40
and maybe all four are going to band together and kind of figure
23:43
out this thing and come up with with a solution, that makes
23:46
sense. That most people will look to
23:49
adopt driver's license. A great one.
23:52
I'd love to have my driver's license digital.
23:53
I think you guys have it in Georgia, right?
23:55
Is that an option? I don't have it but I think and
23:59
I I like to keep my notes on paper.
24:03
This is true, right? Like people like well can you
24:05
put that on team? So I take a picture and I upload
24:08
the picture two teams. Yeah so one of the other things
24:12
that we wanted to mention is a company named work, had a state
24:17
of identity report that they publish on the internet.
24:20
Every can go out and find it. We'll put a link in the show
24:23
notes but Jeff, what's an ort? It is a cosmic or astronomical
24:32
thing I do. I'm not the expert on it, but
24:35
it's basically the area past Neptune past the heliosphere and
24:40
like this area in between other galaxies and things like that is
24:44
the best way that I can think about it, but I'm sure I'll get
24:47
roasted on Twitter LinkedIn or something.
24:49
Someone telling me, you know, the correct one.
24:51
I when I literally just want to bang on it.
24:54
Yeah, that's that. I'm like, okay, I get where it
24:56
is now. For a picture and that's kind of
24:58
my explanation. Yeah, maybe we'll we'll pull in
25:01
somebody from word to some point.
25:03
They can explain it to us better like FR, our that listeners that
25:06
far out. That'd be great.
25:09
I remember when I learned what an OCTA was.
25:14
So OCTA is basically the measurement or a way to
25:20
represent cloud cover. So, I think it's An octet.
25:25
So that would be like, 8, different wedges of a circle or,
25:31
you know, I'm not explaining it well but they're, you know, from
25:35
cloud cover perspective, you could be 0% clouds to 100%
25:40
clouds, that would be an 80 would be a zero and then it's 18
25:47
in 1/8 increments. How anyway, I thought that was
25:50
really cool because I didn't even know about that
25:53
measurement. I learned about it and OCTA at
25:56
the same time, not as a pretty cool name.
26:00
Right now, I'm added eight out of eight.
26:01
We have 100% cloud cover right now for those wondering.
26:05
Yeah, same here. So the the state of identity
26:10
report was pretty cool. I mean, you know, so looking at
26:13
it right on the Fly? It's number one Enterprises lack
26:17
strong, MFA adoption. I don't know meet a lot of the
26:22
Enterprises that I'm working with.
26:24
Actually have a lot of MFA adoption at least getting
26:29
through the front door. So might be talking about here
26:32
kind of the breadth of the MFA adoption or maybe the key is the
26:39
word strong. So made against the key.
26:41
I think it means your own. Yeah.
26:43
Weaker MFA, doesn't count as much, you know.
26:49
I think the best is to use an authenticator app.
26:52
I think that Get the authenticator app with the
26:56
number matching, so kind of that extra step of actually have to
27:00
go into the app and type. The number that showing up that
27:04
prevents, that MFA fatigue attack where you just keep
27:09
pounding the person until they say, yes, I approve.
27:12
Stop sending something to my phone.
27:15
I don't think it does. I think it's the same thing.
27:18
You're basically getting a prompt on your phone.
27:19
It says, pick your three numbers, which one is the right
27:22
one? And you think people think pick
27:25
one of those numbers? Eventually, if they're if
27:28
they're typing in a code, they're going to pick a number
27:31
because it's even easier. You don't have type A that you
27:32
just touch it and you've authorized it.
27:35
No. But I think like like the push
27:38
authentications would just say yes or no by default.
27:41
So you by default but number matching adds a number to the
27:44
screen so it's not just yes or no.
27:46
It's in addition to yes or no. The yes or no is implied.
27:50
It is, which is the right number.
27:52
I've got three numbers 1746, 38 and my browser shows the right.
27:57
One way my phone have to pick the right.
27:59
So the attacker has to browser. The legitimate user has the
28:03
number. They have three numbers in front
28:06
of them through number. They might pick the right one by
28:08
mistake. It's possible.
28:12
It's possible. Especially since there's only
28:13
three, and it's better than many other version.
28:19
If somebody does that bad, bad bad, bad kisser, I smell
28:24
security awareness training for that individual come Monday
28:27
morning or whatever that. Yes, exactly.
28:29
Well, if the company is not sunk by them ROM.
28:33
Okay. So, second one was dormant
28:36
accounts. In the crosshairs, the idea that
28:38
attackers are You can advantage of dormant accounts as their
28:44
method for getting in. There's definitely dormant
28:48
accounts. I think that one of the things I
28:50
see with clients is they do a pretty good job of getting
28:55
active directory accounts enabled, disabled, but do less
28:58
of a good job in terms of disabling accounts in
29:04
applications. Now, usually the defense in
29:08
depth or where the compensating control, is that you can't get
29:11
him without, you know, authenticating to active
29:14
directory. So I'm kind of split on this
29:17
one. It I think it's important but I
29:21
don't know that it would be a major attack Vector.
29:26
What do you think I answered? It's a potential open door.
29:30
And if you're in numerating a Target that you're trying to
29:34
breach the number of open doors, the number of potential open
29:38
doors is in your Ever. That's what you want to me like
29:44
this, you know this thing of okay.
29:45
Yeah. Dormant accounts are in the
29:46
crosshairs that for my mind is I very no, no s Sherlock type
29:53
scenarios. Like yes.
29:54
Of course we were trying to get those accounts.
29:57
Should they be cleaning up? Yes.
29:59
Do they do a good job of it varies?
30:00
I think a lot of organizations rely on well to kick in the
30:04
front door, that's our control. Well, what happens if they're
30:06
already in the front door and you didn't clean up the account
30:08
in sap or or workday or any of these other, you know, highly
30:13
privileged systems, right? They have a lot of data in them.
30:16
Well, guess what? Didn't matter did it that you
30:20
shut down the active directory account.
30:21
They got in some other way and then they you know they they
30:24
laterally moved up and over until they got to what they
30:27
wanted. Great Point.
30:29
Okay. So the third and final was
30:31
admins and Executives under attack so I guess spearfishing
30:35
targeted attacks against domain administrators I would look most
30:43
organizations do a pretty run a pretty tight ship in terms of
30:47
like making sure that domain admins is the limited group
30:51
using accounts that are not the Everyday, Use accounts is still
30:59
best practice because I think getting fished with your admin
31:04
account is would be horrible. It would just be bad. um, So I
31:12
yeah, I think, I think this is like, this pretty good
31:16
information. What do you think?
31:18
I think it's good information. I don't think it's new
31:19
information. Perfect.
31:21
Of course, they're targeting administrators who have the
31:24
access that they need and they're targeting the
31:26
executives. That's not news.
31:29
I think, you know, I'm interested to get into it
31:31
further. Maybe we get somebody on from
31:33
work to kind of take us through it.
31:35
They think it comes down to the details, right?
31:37
What specifically are we looking at?
31:40
What is the specific threat? How is it happening?
31:42
What are things that you know we as people in the identity space
31:46
can take back to you know our organizations to better protect
31:49
ourselves or to drive awareness towards.
31:51
I think that's that's where I would like to see it.
31:53
Take it. So if you're listening from ort,
31:56
reach out to us on LinkedIn, would love someone to come on
31:58
the show and kind of Step us through the report and kind of
32:00
talk about an into more detail. Yeah, the only thing I'm going
32:04
to say it's like as a defense of this is that you keep seeing
32:08
presentation for like most the top form of packets.
32:12
Fishing social engineering if you two clades excellent.
32:17
Question earlier what's changed is not that testing the same
32:22
answer for the last 10, 15 years, social engineering and
32:27
fishing. So some things like they might
32:30
be no, es Sherlock but okay. Well, you know, it doesn't make
32:36
it any less route. We're gonna have a creative new
32:39
answer better. Damn, well, better be right?
32:41
Right. So anyway, I'm going to Gartner
32:46
next week, man. Are you excited?
32:48
Theoretically, we're already here if you're listening to this
32:51
somewhere somewhere in the holes of the of the the Gaylord Texan.
32:55
I've never been there before. So I hear its massive.
32:57
But yeah, somewhere we are at Gartner.
33:00
Yeah, I'm going to be wearing my fanciest new clothes.
33:04
No boy, gimme you stand out in a crowd.
33:06
That is for sure. Yeah, I make sure I do.
33:09
So any sessions that are peaking your interest.
33:15
Well there's one that is definitely piquing my interest,
33:18
the one that we're doing at noon on Tuesday the identity at the
33:23
center podcast goes, inside the belly of the Gartner, I am Beast
33:27
basically we got 30 minutes. We're going to try and do an
33:30
action packed quickfire Show podcast style format on stage
33:36
with Henry, K and Becky and really get into it.
33:39
The idea is to put them on on the spot to answer questions
33:42
that they don't normally have to answer.
33:44
Sir and hopefully good time. So definitely that one Shameless
33:47
promotion. But you know, what can I say
33:49
something about that? So people have been losing this
33:52
podcast long enough, probably through osmosis or maybe
33:57
explicitly? No, we don't.
34:01
We don't have any interviews where it's like, gotcha.
34:04
You made that? We're trying to make our guests
34:06
look stupid. No, we in fact we tell our
34:08
guests like this isn't Meet the Press.
34:11
You know? It's we all want to sound smart.
34:14
We want to have information that educates, people were listening
34:19
but we also want to be entertaining.
34:22
It's not a got your for for gardeners and some of these
34:25
questions are pretty tough questions.
34:28
And well we got some of them, we came up with some came from
34:30
listeners. We're going to give credit where
34:32
where we are authorized to do. So some might be anonymous was,
34:36
you know, listeners or whatever. But yeah, I'm I'm pleased with
34:39
the way with with the content. My fear is will we get through
34:44
it. We only have 30 minutes and, you
34:46
know, sneak peek. We have a shot clock at the
34:48
bottom of every slide, which has the questions on it to try and
34:51
keep us moving. In and moving through your
34:53
moving through the show as quickly as I can, but I'm sure
34:56
it'll go. Well, if you're in the area,
34:58
stop by noon, wherever we happen to be come watch us.
35:01
Do basically a podcast live. I'm green stickers.
35:05
Oh, yeah. And yeah.
35:05
And Jim has stickers wall stickers.
35:08
So you want to come up after we're done speaking and grab a
35:12
sticker. Please do.
35:14
Yeah, outside of that, I am, as I mentioned before, things
35:17
around fabrics and meshes, I think I'm going to try and jump
35:20
into those and see what is new in those areas because I'm
35:25
starting to see some of the value especially with
35:27
distributed data sources in some, pretty complex
35:30
organizations looking to solve something, especially on the on
35:33
the customer or consumer side of I am.
35:35
I think there's some value there and want to Bone up a little bit
35:39
on that. So, that's, that's what I'm
35:41
looking at. And then, of course, the
35:43
networking, In the event that we're good.
35:45
We got go on Tuesday night. One track that really interest
35:48
me which is I am program management and there's one
35:53
session which I love the title as the expert measuring the
35:57
business value of identity and access management.
36:01
I really think this is so important, I think that even if
36:04
you kind of come from the perspective that we don't need
36:07
to sell our Executives on, I am there to get the value like well
36:13
challenge yourself. So then, what is the return on
36:16
investment that you're going to deliver to the business through
36:20
your IM initiatives and then live it?
36:24
Like you know, if you get that money and you promised to return
36:28
measure yourself. So I'm hoping that a session
36:32
like that really hits it hard. It's over by Paul Proctor.
36:38
I don't know. Paul distinguish VP analyst from
36:41
Gartner but I'm really interested in Diving into that
36:45
or listening about that topic in a way to hone your message to
36:51
great way to hone your message. So the other thing is, I mean,
36:55
if you're listening to this on Monday or Tuesday morning and
37:01
you're running to Jeff Rye, we may still have a few seats
37:06
available for our networking event.
37:10
It's at Corky's gaming Bistro was going to be A boatload of
37:14
fun. Just come off to us if we have
37:17
some openings left, I mean, the reason why we're being so
37:21
judicious with the openings is that they actually do have a cap
37:27
of how many people they can fit into the place.
37:30
And I'm just very conservative want to invite more people than
37:34
they'll let in and then have people turned away at the door.
37:37
So we're going to stay under that, that fire limit.
37:41
How many people can fit into the place.
37:44
And we're going to copy room to throw axes.
37:46
I mean how I suppose the rocks of the place is jam-packed,
37:48
right? It's yeah.
37:50
It's going to make you sign a waiver by the way but hopefully
37:53
will like we don't have to depend on the waiver because we
37:56
don't want anybody getting injured by the axis.
37:58
Don't get hurt. But yeah, if you see us, you
38:01
know, come up introduce yourselves.
38:03
We're happy to chat but that's gonna be cool event.
38:06
It's our first-ever identity. At the center community, meet
38:10
up. It's being sponsored by our SM
38:13
OCTA and One Cosmo so definitely thanks to them.
38:16
They are the ones footing the bill.
38:17
I think as you know people may or may not be aware, the podcast
38:20
is literally just the two of us and we do this on the side
38:22
outside of our day job. So to get, you know,
38:25
organizations like that, you know, Believe in Us and trust us
38:30
and sponsor us, you know, for that kind of thing is very cool.
38:32
So we definitely appreciate those three companies chip it in
38:35
ya. All the other thing is like, we
38:37
love our listeners Jeff but, you know, we're not splitting that
38:41
bill between you and me, man, that's that's pretty hefty bill.
38:44
So yeah, I just, I got a box here.
38:46
I have a new of new microphones that those are not cheap.
38:49
Yeah, yeah. Well I guess stickers, gasps
38:51
stickers. So anyway, any predictions for
38:55
the conference chef I don't know yet.
39:03
I feel like I have a better idea after the first day but I think
39:06
it's going to be a good conference.
39:08
I'm very impressed by the just the sheer quantity of topics
39:14
that are out there. I'm looking at my conference
39:17
Navigator and the things that I've signed up for and I have
39:20
multiple like overlapping. Like I wish there was like four
39:23
things taking place at the same time.
39:24
I wish I could go to all of them.
39:26
So there's gonna be hard choices to make, as to, which ones I,
39:30
you know, actually, you know, stick in and Things like that
39:33
but I don't know. I think I think I'll lead the
39:37
predictions to you because I don't know if I have any good
39:39
ones right now other than I think we're gonna have a good
39:42
time. Yeah.
39:43
So my one prediction is that I'm going to end up with meeting
39:47
five people during the conference who will be guests on
39:53
the show within the next 12 months.
39:57
That's predicts good. Okay.
39:59
Yeah. Okay.
40:00
The other prediction is all eat. 10 desserts over the course, the
40:05
over-under is 10 for desserts, for for Jim in.
40:09
Basically two nights right? Because you're leaving on
40:11
Wednesday. So you're not gonna be there
40:12
Wednesday night. Right?
40:14
It's just two nights. I would take the under folks.
40:17
Now, if it was me, I'm going to be there, Monday, Tuesday, and
40:20
Wednesday, and I do. Enjoy my desserts.
40:24
So, yeah. I like it.
40:26
I like a good dessert too. Yeah.
40:32
Yeah, I don't know if I have any other like Gartner predictions
40:34
and, you know, hopefully people, you know, come up.
40:37
We always like to meet listeners and stuff like that.
40:40
That would be cool to meet folks out there and and stuff.
40:42
So, one thing I'm going to say so for people who are going, if
40:46
you are Up for some fun, Becky archambault who is the one of
40:54
the animals from gardeners. Don't be on the panel of Jeff
40:58
and I is a big Buffalo Bills fan and they got their man and um I
41:04
don't do this to her. I'm doing it, I'm doing it.
41:06
So just go over give her a hard time r as r a little bit because
41:10
I didn't realize like we, we talked about like razzing her on
41:14
stage about it, just thought like okay well it's an old
41:18
wound. At this point, it's probably not
41:20
that interesting for most people.
41:22
But if you're an NFL fan anyway, she takes a very, very secretly
41:29
like even though it's an old wound, it was like pouring salt
41:32
in it. Yeah.
41:34
Well, some inside news right, that we did have a question that
41:38
was in our, in our outline of asking Becky to provided Gartner
41:43
analysis of the Buffalo Bills loss in the playoffs.
41:46
We left it on the Cutting Room floor for time.
41:48
I'm so proud of you, we were going to bring it honor.
41:53
If you spray it on, I'm sure she would appreciate that.
41:55
A bunch of people walking up to her asking her.
41:57
Why the bills underperformed. Let's just say in the playoffs.
42:02
Be nice, be respectful. Come on guys, what else
42:09
anything? That's it, that's it.
42:11
It got any, underrated him. What's an underrated travel?
42:14
Hacker tip for people out there. Something you do that is like
42:20
this is a this is a Jimmy Mac thing.
42:23
I hope that you just don't even act thing.
42:25
I think it's the thing that a lot of people do which is You
42:29
get like some kind of like insulated bottle and like fill
42:33
it with water. Don't go in the airplane without
42:35
your own water because it's like they might hit turbulence and
42:40
not serve water or whatever, or drinks and they hydrated, what's
42:46
that stay hydrated? Basic hydrated.
42:49
That's You know, I always like, here's okay, here's a tip.
42:54
So I was flying back from Canada like two weeks ago.
42:58
I had a middle seat on the back of the plane.
43:02
I'd say one Saving Grace. First off the, the seat didn't
43:05
recline back. I mean, it was just the worst
43:07
seat on the airplane and I had like, I bought myself to meals.
43:15
So I just like I just was like, all right, well I'm going to
43:20
have a bunch of meals in a bunch of food on this plane.
43:23
And, you know, I had like some entertainment on my phone, some
43:26
podcasts and some things to watch and actually didn't turn
43:30
out to be nearly as bad. Because of those moves right
43:34
there. Entertainment and food that's
43:38
it. Okay.
43:40
What are your tips? Really small stuff like one,
43:48
don't overpack. I see a lot of people carry a
43:50
bunch of crap with them but they'll never use travel light.
43:54
Get a, get a bag or backpack. That has a trolley sleeve.
43:58
That will save your back so much, especially if you're just
44:01
kind of stand around waiting for planes and things like that.
44:03
So a lot of people were just carrying shoulder bags and stuff
44:06
like that and how they do that but that's a must have on my bag
44:10
collection. And get clear, get TSA PreCheck,
44:13
get a airline Club if you travel at all.
44:16
I mean all that stuff makes it so much easier you know, to have
44:21
a decent travel experience. I won't say great but little
44:24
stuff like that can add up to a somewhat decent experience.
44:29
Yeah, per user must have. I mean anybody who's traveling a
44:33
few times a year, should get TSA Pre.
44:36
I don't know about clear. It's a lot of money and some are
44:40
even hotter. 150, you might get a discount through your airline
44:43
status or through credit card. When you you wish you'll have
44:47
it. And again, if you do any type of
44:50
travel, I think it's spend a little money to make make travel
44:54
easier, makes travel easier near the Uber of tip, for traveling
44:59
is remember in your mind. Nobody's really happy about
45:07
being there. Nobody's enjoying the hot plane
45:10
or the middle C or whatever, you know, don't make it all about,
45:14
you don't get - and be rude towards other people and just
45:20
try to be a good positive person.
45:24
It's be a decent human being. That's it.
45:26
There's a there's a protraction. Alright, let's go ahead and wrap
45:29
it up there. Looking forward to seeing Folks
45:32
at Gartner. You can find us on the web
45:35
identity at the center.com. We're on Twitter idea.
45:38
See podcasts mastodons and idea, see podcast at infosec, got
45:43
exchanged hit us up on LinkedIn. We're always happy to meet.
45:46
And their conversations and yeah, don't forget to like,
45:49
subscribe to all that stuff. That's how you can help us and
45:52
get the word out. So we'll go and leave it there
45:55
for this week. Jim.
45:56
Anything else? What's a mess of on?
45:59
Boy. All right, we'll talk everyone
46:00
later. You've been listening to
46:03
Identity at the center. We hope you've enjoyed the show,
46:07
make sure to like, rate and review and we'll be back soon,
46:11
but in the meantime, hit the website at identity at the
46:15
center. Are.com and find us on Twitter
46:18
at, idac podcast. See you next time on identity at
46:24
the center, Are.com and find us on Twitter at, idac podcast.
46:21
See you next time on identity at the center,