Latest / Identity at the Center / #372 - Exploring the Evolution of Identity Management with Darren Rolls

Transcript

#372 - Exploring the Evolution of Identity Management with Darren Rolls · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:17
Hey, I've been reading the recently released Leadership
0:21
Compass from Cooper and Cole on identity fabrics.
0:26
It's, you know, as most analysts reports, there's a lot there.
0:30
You're a real nerd, man. Well, that has nothing to do
0:34
with this, but yes, it's also true.
0:37
But that's totally unrelated. But yeah, I've been reading this
0:41
thing and you know, it's kind of like I'm still trying to wrap my
0:46
brain around identity fabrics a little bit to think that there's
0:50
a leadership compass that lists vendors and kind of says, OK,
0:55
these are the vendors that do identity fabrics the best.
0:59
Because I I always kind of think of identity fabric as kind of
1:03
product to agnostic or vendor agnostic vendor non specific.
1:11
It's kind of like saying there's a leadership compass for zero
1:15
trust. I mean, zero trust is kind of a
1:17
concept that a product can kind of emulate, but there's not a
1:23
product to go in do zero trust with, right?
1:27
Yeah. But this, this is our desire as
1:29
human nature to rank things, right?
1:30
We have to have a list for everything.
1:32
So, you know, Identifrabic is just one of those things that we
1:34
rank. And I still think it's a, it's a
1:36
concept constantly under definition and maybe
1:40
redefinition as we're kind of figuring it out.
1:42
I had a really fun conversation with Eric, my friend Eric from
1:45
Gartner, actually. So this was at, I think it,
1:47
where was at Ideniverse, I think.
1:48
And he was kind of explained some things to me and I was
1:51
like, OK, I can kind of understand how that goes.
1:53
So yeah, I it's, it's an interesting space for sure.
1:56
But I love the fact that we have like, you know, rankings to help
1:59
me understand, OK, where do things fit together?
2:01
Because there's just, there's just too many products, man.
2:04
I can't keep up with all of them.
2:05
Yeah, but I, you know, I really got big on the identity fabric
2:09
concept to EIC last year. I'm hoping that, you know, and
2:13
obviously Kufringer Cole is the the firm that puts on that
2:17
conference. So the ones who released the
2:19
leadership compo. So they are kind of driving this
2:22
concept. I want to keep learning more
2:25
about it. The reason I brought it up was
2:27
mostly just to mention everybody, if you want to get a
2:30
copy of this thing, here's the freeway to do it, which is, you
2:33
know, go out to I'm not, I'm not, this is not a product
2:36
pitch, but go out to Cyberx website.
2:38
They've got it there. It's a free download.
2:41
Yeah, you got to give a little bit of information, but you can
2:44
go ahead and get a copy of that report and read it for yourself.
2:48
Exchange your e-mail for information.
2:50
That's pretty much how that works.
2:52
It's true they got to get a little something.
2:54
I'm sure they paid Cooper Cole to have it on their website.
2:58
But anyway, as a listeners, like I'm all about, you know, telling
3:03
people how to get some free stuff without breaking the law.
3:07
Yeah, without breaking a law. That's the, that's the key part
3:09
here. You know, don't, don't and don't
3:10
turn to us for legal advice. We're not lawyers.
3:12
We're just a bunch of identity nerds on this show.
3:14
Yeah, exactly. So anyway, hopefully you can go
3:17
out and check that out. Yeah.
3:19
So other things people can check out are smorgasbord of
3:23
conferences that we have coming up and other things that you and
3:26
I and some combination of one or both of us will be there.
3:29
We've got things like the official cybersecurity summit
3:32
in, let's see that is in Chicago and Philly.
3:34
I'm trying to think when this, when this episode comes out,
3:36
hopefully those will still be there.
3:38
The authenticate conference with Fido, yes, Fido feud Round 2 is
3:43
coming back. Jim is going to try to topple
3:46
Megan from her championship post.
3:49
It's a, it's a definite thing. I mean, let me just say it here.
3:51
This is the first time I've gotten braggadocious.
3:54
But First off, we kind of got cheated a little bit last year.
3:58
I mean, the, the, the ranking system, the point system, there
4:03
were some problems this year. We're going to win.
4:07
My team is going to win. The gauntlet has been thrown
4:09
down. I'm sure we'll see more stuff on
4:11
social media that we've been kind of planning out to kind of
4:13
tease that up to it. But that was exciting time.
4:15
So looking forward to that. Let's see.
4:17
That's in October. And then we've also got Infosec
4:20
World 2025, that's also in October.
4:22
So first time that you and I have been at that conference,
4:24
more of a general cybersecurity conference.
4:26
So we'll be there with our friends from RSM and some
4:28
others. Identities at the center of
4:30
cybersecurity, though, So what the heck.
4:33
Yep. That a name 6 plus years that is
4:36
still relevant today. Let's see then we got Ideniverse
4:39
in November in Washington DC and then we've got the Gartner
4:43
conference at the end of the year in Grapevine, TX with yet
4:46
another game show plan for that one different than what we've
4:48
done before. So lots of.
4:50
Stuff. Talk to a few other folks that
4:52
are putting on, like putting on conferences of one sort or
4:56
another. Go into the website.
4:58
That's definitely the place to go.
4:59
I mean, we get them up there as soon as possible, sometimes only
5:03
a couple weeks before the conference date.
5:05
Yeah, I have like 6, I think maybe 7 different discount codes
5:09
all at the same time. And rather than read them off
5:11
and nobody's going to write them down anyway as I'm talking here,
5:13
just go to our website, idacpodcast.com.
5:16
Scroll down just a little bit and you'll see everything we've
5:18
got active there with, you know, more kind of constantly being
5:20
added as we as we firm up some of those partnerships with those
5:23
conferences. But that's the way you can show
5:25
support for the show. Use our conference stuff, you
5:27
know, doesn't cost you anything. We don't get anything out of it
5:30
other than just a week show. We can bring a crowd.
5:32
And you know, hopefully, you know, that helps get us great
5:34
guests like we have today with Mr. Dan Rolls, who I am shocked
5:38
to say has been five years since he's been on this show way back
5:42
in July of 2020. And, you know, I introduced him
5:46
a long time ago as an identity dude.
5:47
He was here, you know, one of the OG guests that we've ever
5:50
had on the show. So let me go ahead and introduce
5:53
Mr. Darren Rolls, You know, identity dude at large, maybe
5:56
independent identity dude, something like that.
5:58
There you go, something like that.
6:00
Still here, still here, still doing it so.
6:04
We've got a couple things we've, you know, we've kind of UPS, UPS
6:07
the game a little bit around here.
6:09
You were here before a couple of our traditions.
6:11
One of our first traditions that we kind of started was how did
6:16
people get into identity? And so you were with us with
6:18
Episode 53 and that was probably, you know, way, way,
6:22
way before we even started out of question.
6:23
And that's something now we ask all of our guests.
6:25
Now, since we didn't get a chance to ask you that last
6:27
time, I'm going to ask you for the first time on your second
6:30
appearance. How did you get into identity
6:32
and access management? Is it something that you chose
6:34
or did it choose you? It definitely chose me way, way,
6:40
way back in the early 90s before I came to the US actually I was
6:44
working on CORBA distributed frameworks and for about banking
6:50
in in the UK and we were using CORBA framework to do
6:54
distributed user and schema management for CI Sam databases.
6:59
And so we were basically packaging up schema and user
7:02
changes and then pushing them out to multiple endpoints in in
7:06
front end trading ecosystem and Tivoli systems at that time saw
7:11
what we were doing, we were actually using the Tivoli M dis
7:15
distribution framework. We're doing that and they were
7:17
like they were trying to, you know, we're building out
7:19
assisted management framework and they wanted to do user and
7:22
schema management. And so they basically acquired
7:26
the group that I was working with.
7:28
And of course it wasn't called, it wasn't called any management
7:31
then it wasn't really even called user management.
7:34
But that was the the technology in the framework that became the
7:37
first user management framework within.
7:40
And that's what shipped me to the US.
7:42
So I didn't know what I was working on at the time, but I
7:47
was, you know, I was kind of geeking out on, I was an Oracle
7:49
database administrator and, you know, C programmer and geeking
7:54
out on, on corporate frameworks and distribution at the early
7:57
times. That's what dragged me into it
7:59
really. But but yeah, so Gee, that was
8:02
many years ago, nearly 30 years ago.
8:06
And I've pretty much stayed with that ever since.
8:10
We, we were actively as the user administration framework in
8:13
Tivoli and and then less typically with a small gang of
8:17
folks and went to wave set technologies, which was very
8:20
early in that cycle that was becoming identity management.
8:23
It was provisioning at the time and we were acquired by Sun
8:26
Microsystems in 2004. And so that became the Sun
8:30
identity manager. And so throughout that whole
8:33
cycle, obviously I'm, I'm moving through from being fundamentally
8:36
just the, you know, programming engineer through to being
8:39
director of technology and through to CTO.
8:42
And then we left Waveset and created sale point technologies
8:46
at the time where I stayed for 12 years.
8:48
And of course, it's absolutely, I don't imagine at that point,
8:52
and I think, you know, we would some of the first people to
8:54
actually write governance down as a, you know, IGA, if you
8:57
like, as it was phrased. And so I can say I've been in it
9:02
for my entire career. That's a long, I mean, that's.
9:07
Such a long time, decades, right?
9:09
So what is the most significant development that you've seen in
9:13
your career in Identity? Is there something you can point
9:16
back and say it's like, I don't know, like SAML was a thing or
9:19
you know, the invention of XY or Z or whatever that is?
9:22
Like, what's the something that's like what really changed
9:25
the game? I think standards obviously a
9:29
big part of that and I sort of came into it with that first
9:31
Samuel Wando specification, worked on that TC and then I, I
9:36
was the editor of the SPML specification, the first service
9:39
provisioning markup language spec itself.
9:42
So I think standards were a big piece of it.
9:44
It was evident at that point that standardization was going
9:47
to have to happen because there was an industry building around
9:49
it. I think maybe the largest thing
9:52
I would say that's happened in and around us is, is the fact
9:56
that it stayed the same. Well, this seems like a strange
9:58
thing to say. You know, it's like everything's
10:00
changed, but everything's remained the same.
10:01
I can honestly look back and say the things, the, the, the tenets
10:05
of what we were trying to do back then.
10:07
And I had this thing, the 10 tenets of identity day.
10:10
It's completely relevant and almost the same now.
10:14
So maybe the thing, the biggest thing that's happened is it's
10:17
remained consistent in what it's trying to achieve and what it
10:21
is. And I know that IGA has
10:23
certainly had a bit of a tough rapping in news and media of
10:27
late, but I think the principles that it stands for us still,
10:30
still hold water. So I think identity in the
10:33
centre is is maybe something to have captured early like you
10:37
did, because it's still very true.
10:39
So is that consistency good or bad?
10:42
Because consistency is I can, I can interpret that a couple
10:46
ways, right? It's OK.
10:47
Yeah, we're still doing the same thing.
10:48
It's great. But same time are we evolving
10:50
the the way we need to from an identity perspective.
10:53
I, I think we are, I mean, the underlying technology is
10:56
continually moving and that's, I think the underlying principles,
10:59
tenants and laws, if you like the, you know, you know, if, if
11:05
Kim Cameron was still with us, I'm sure there would be more
11:07
laws developing right now to, to sit on top of the ones that we
11:10
have. But I think that the it's good
11:14
in one respect because it says that the principles that we're
11:17
trying to achieve of knowing, you know, knowing who has access
11:20
concretely understanding entitlement independent of the
11:23
system that it's in or the technology stack that it sits
11:25
on. I think those things are still
11:27
relevant. And that has to, if you like, a
11:29
solid set of intent that has to sit on top of an ever changing
11:33
set of underlying technology because it has changed, right?
11:36
I mean, look what we can now do with AII mean it is phenomenal
11:39
and it is changing what we do. So it's good and bad.
11:44
I think, you know, we just got to keep, we just got to keep
11:47
reinventing ourselves to some degree.
11:50
Hey, Darren, first I want to just start by just thanking you
11:54
for coming on the show, but even more grateful for coming on the
11:58
show back in 2020 when really nobody was listening and we're
12:02
like, Oh my gosh, Darren rolled. I said the same thing with Eve
12:06
mailers, like you guys were willing to give us a shot when
12:10
nobody was listening. Obviously now people are
12:13
listening, so all the better. But really do appreciate you
12:18
giving your time to us, but also to the community.
12:22
And the first question I wanted to ask you is kind of related to
12:25
that, which is around who are the people in the industry that
12:32
really have an impact on you that you look up to?
12:35
They're your identity heroes. So you're probably the identity
12:38
hero for some people, maybe one in the past and a couple of
12:42
people one or two for that are current people in the industry
12:46
or, you know, still local. Yeah, I think, you know, there
12:52
are so many in some respects, you know, I've having seen this
12:57
space sort of evolve through the standard side first if we look
13:00
there. I agree.
13:01
I mean, I've always loved the, you know, she's such a such a
13:05
thoughtful, hard working, considered person and had the
13:10
bravery to get out there on some of the initiatives where she's
13:14
kind of stood alone for a long period of time.
13:16
And that takes that takes stamina and determination and
13:20
things. So, you know, I think even Ian
13:23
Glaser, Ian's always, you know, worked with Ian many, many
13:27
years. And Larry Robinson at the time
13:30
when they were both prior to Gardner, when they were at
13:33
Burton Group, they were the first really, I remember a
13:36
little, little stack of us at Waste at sitting at the back of
13:39
the room. When they mentioned their name.
13:41
It was like they mentioned their name.
13:43
It was this like kind of thing because they were really at the
13:47
forefront of looking at what we were trying to do and others
13:50
were trying to do and pull it out and make it relevant to the
13:53
customer. So you know, people like that
13:56
are they're eloquent, understand the technology, but understand
13:59
the market forces. I'd say coming back to some of
14:03
my brethren Wakeset activity, Sell Point or wakeset and Sell
14:09
Point, both Mark McClain and and Kevin Cunningham, who were our
14:13
founder and president at Sale Point had a huge impact on my
14:19
life. I mean, I worked for Kevin for
14:21
25 years. In fact, when I came over to the
14:24
US, he was my hiring manager at Italy.
14:27
And so that view of product to market I think trained A
14:34
discipline within myself and many people within the
14:37
organization that I think was directly accounted for the
14:40
successor of Sale Point. So I think that, you know, I'm
14:43
pretty much all of the team, very fortunate there to have
14:45
just worked with really good people, good people, smart money
14:49
make success, right? Those folks that you just
14:52
mentioned and what you guys did at sell point and obviously sell
14:55
points to incumbent now, but it wasn't always that way.
15:00
There's a time where the sale point was the upstart banging
15:04
the pots and pans. And you know what I mean by that
15:08
is like making noise, like upsetting the apple cart.
15:13
And now, you know, now South Point, the incumbent, right,
15:17
that that vision kind of took hold.
15:20
Yeah, very much so. I remember us fighting for
15:24
recognition. It was a number of us Access 360
15:27
and a bunch of other little companies around here at the
15:29
time. And really we're bashing against
15:30
the, against IBM and against Oracle as as many were.
15:34
And, and I think many of the, the new upstarts now feel like,
15:38
and, and I'm, I do a bunch of advisory work with, with a, with
15:41
a, a lot of those guys and it's, it's so interesting to watch.
15:44
It's like, I think it's all reversed.
15:45
You know, it's like I'm now advising them about what we used
15:48
to do, about how, you know, you, you, you better win Better
15:52
Together is the way that you compete with an incumbent.
15:55
And it sounds like strange you, you augment their
15:58
infrastructure, you know, now, now we're going to beat them.
16:01
You add to their value. You know, the best thing you do
16:03
in the company is have them resell you, you know, so find a
16:06
value proposition with it, which is added to it and then slowly
16:09
move sideways until you eat their lunch.
16:12
You know, and that's kind of what we did with Oracle at the
16:15
time. And and I see others, you know,
16:17
attempting to do that now with, you know, with cell point and
16:20
Noctur and and cyber Ark and others.
16:22
So really interesting cycle. Just just seeing it almost third
16:26
generation. Have you thought about it from
16:28
the other side, where if you're the in the incumbent position,
16:32
what do you have to do to bend off the upstarts?
16:37
You want to eat your lunch? Yeah, it is.
16:40
And I'm fascinated by this. And I'm sure there's a book to
16:43
be written about this curve, this perpetual curve that goes
16:47
on. I think as an incumbent, it
16:49
becomes very hard to remain the innovator because it's all about
16:54
market acceptance. You're coming down the other
16:55
side of the of the bell curve and and you're pushing our
16:59
product as fast as you possibly can.
17:00
Your challenges are, are more about market fulfilment than
17:05
they are market innovation. The market doesn't look to you
17:08
to be an innovator and so you tend not to.
17:11
And so it's very challenging to remain innovative, particularly,
17:15
you know, if you're a large company, things move slower, you
17:17
have you're publicly traded, you, you have all kinds of
17:20
additional pressure on you to do so.
17:23
So I think it's a very special type of company that that still
17:27
pushes the envelope, still innovates.
17:30
And and to be honest with you, I mean, I think all innovation is
17:34
plagiarism to some degree. I mean, what do the best of us
17:36
do is go, Jim, that's a great idea.
17:40
Did you hear what Jim just said? Let's go do that.
17:42
And then you'll get around. You're right on the right board.
17:44
And then the crazy people go invent it and they go build it
17:46
or anyone else's needed fought with it.
17:48
And that's pure plagiarism. So, you know, I think it's just
17:51
how it worked. Yeah, right.
17:53
And sometimes ideas take a while to I was having a conversation
17:57
with somebody at the other day and they talked about
18:00
authorization companies. They, they're early.
18:04
And actually, I think it might have been you.
18:06
The early authorization companies had the great, the
18:09
great ideas that are more relevant now than ever, but they
18:13
had them 20 years too soon. Yeah, I mean, literally 20 years
18:18
and that's kind of scary. You know, all this grey.
18:20
I think it comes from something, you know, it's like, yeah,
18:23
exactly that. I mean, I've always been a big
18:25
fan of externalized authorization because as a as a
18:28
governance thinker, I think that the authorization model is the
18:31
authorization is so much more interested in authentication.
18:34
The, you know, that binary decision, I think we talked
18:36
about, there's the binary decision is sort of, you know,
18:39
less interesting than authorization and externalizing.
18:42
That is surely the way to go. But who wanted to rewrite the
18:45
app? Who wanted to restart?
18:48
And you, you know that, who did it?
18:49
You know, Boeing did it, Disney did it.
18:51
You know, axiomatics were, were literally 15 years ahead of
18:55
their time. The time is now, right?
18:58
I mean, every dog has its day. And, and I now I'm a big fan of
19:02
externalising the youth model and sitting on top of the data
19:05
graph. And there's, you know, some
19:07
vendors that we know that are doing very well in, in bringing
19:10
that architecture to market. Jeff and I have the pleasure of
19:14
sitting around and talking to folks like you, and you do too.
19:17
Are you talking to other bright people in the space we're
19:21
talking about? What's the next generation of I
19:23
am Hold and we've talked to guests in the past, like I wish
19:28
I could remember he said this, but there's the IM or the
19:32
information security poverty line and there's companies that
19:36
live below the the poverty line. I mean, I see it sometimes with
19:40
organizations where they've just under invested in identity for
19:44
so long and they they're still pushing spreadsheets and and
19:48
things like that. Where what is the state of
19:52
identity? What's the state of the Union
19:55
are, you know, the I think sometimes the problem is
19:58
sometimes companies think we're doing all right.
20:00
We're pushing paper and things, but we're doing right.
20:03
We're emailing spreadsheets around.
20:04
But it's not that bad. It it does seem to me like it is
20:08
that bad, but I'm wondering what your thoughts are.
20:13
Well, I think it's there's that phrase the desert of the real,
20:18
right? You know, it's sort of, you
20:19
know, the, yeah, well, you're out there in the rear, right.
20:24
You know, the, the, the real world is just much harder than
20:27
we as Avengers and I, you know, we as ex vendors, as I'm no
20:31
longer a vendor, still think that way.
20:33
Obviously come to realise. And I think being real life CISO
20:38
for the last four years of my tenure at Sail point was a real
20:42
life. I had enough feeling it being it
20:45
and being a security guy in a security company is a pretty
20:47
tough place to be. I mean, it's a job I would never
20:50
have again because it's just just too hard.
20:53
But I think to answer your question is that the desert of
20:55
the real is just so much harder than we think it is.
20:58
So when you come out then look, look around, you're sort of like
21:01
you're still doing that. Surely not, You know, pushing.
21:05
I think Ian Glaser once had that phrase.
21:08
He said the most comprehensive technical element in identity
21:11
today is the is the comma. You know, it's the CSV, you
21:15
know, like this holy comma, yet this holy comma presentation,
21:18
which I thought was great. But yeah, that's the reality of
21:21
the world, that most people, and this is one of these fundamental
21:26
underlying tenets of truth, is that legacy just doesn't go
21:29
away. It's still there.
21:31
And so most people are still trying to chase down things that
21:35
we said 15 years ago, right? I mean, and it's easy as a
21:40
vendor to kind of assume that everybody's moved, right, and
21:43
they're over here. No, you know, I think it was my
21:46
friend and said mentor Kevin Cunningham said when you're sick
21:50
of saying it, everybody else is just hearing it.
21:53
And that's so true. And I think when you're sick of
21:55
deploying it, everybody else is just deploying it to some
21:59
degree. You know, it's the, the, the
22:01
long tail is, is significant. I, I think the state of the
22:05
union out there is still pretty bleak in lots of environments.
22:08
I think we've, we've continue to over focus on what I would refer
22:14
to as the known known, you know, the things that the compliance
22:18
team said would they would fund. Here's the 32 apps we want them
22:24
soup to nuts under 32 go. And you know, and some people
22:27
five years in are still doing it 3264, whatever the number of
22:31
apps it might be, you know, they're they're still working
22:35
their way down that old line of thought, if you as it were.
22:41
And so I think, you know, it's, it's challenging and something
22:44
has to come in to challenge people to think about that
22:46
differently and from a different angle.
22:49
I think it's so true what you're just saying there of like you're
22:52
tired of talking about it and somebody else is like brand new
22:55
to them. Jeff and I have been doing this
22:58
strategy road map development with our clients for a decade or
23:03
more now and I I still have slides.
23:07
I'm just like, nobody wants to talk about that anymore.
23:09
But it's like, it's the thing. It's like Square dead on and
23:13
they're still companies that are innovating and new start-ups in
23:17
the IGA space, even though IGA has been around forever.
23:21
And like at some point we'd like to just say, OK, well, we're
23:24
going to focus on the new stuff, but it's that basic blocking,
23:28
tackling, it's not going to go away.
23:31
Yeah, I agree. And I think this idea, and I've
23:34
heard it from several CIOs in this realm, that that, that for
23:38
the first time I hear it. It's almost like to hell with
23:41
the past. You know, I, I'm every day I get
23:44
further from the future and the, the curve of exponential curve
23:49
of technology that we now see that future is coming faster and
23:52
faster and the threats from it are larger and larger.
23:55
And so some people now sort of go, you know what, I'm going to
23:58
pause the past, the legacy, the old way of thinking.
24:02
And I'm just going to, I'm going to try and get my real time,
24:05
just in time policy based contextual access sorted.
24:10
And I'll come back to the old world after.
24:15
Because they could never catch up, you know, So they're a
24:20
factor reality, I think. And but but within that you
24:23
still have to say, you know, the old stuff never goes away.
24:25
We create today, you know today. We create tomorrow's legacy
24:28
everyday. It's so true that plumbing needs
24:31
to be there. And I think a lot of people try
24:33
to build a house without, you know, water, electricity, a
24:36
door, like things like that. Are we in I am I Well, so from a
24:43
generational standpoint, you mentioned kind of the different
24:45
generations in ABA, we're on Gen. 3 and maybe that's specific
24:48
to IGA, but you did share a concept with Jim and I earlier
24:51
around this concept of IMV 3. Is that because of AI?
24:56
Is that something else that is driving in?
24:59
I mean, I'm assuming AI drives a ton of different.
25:02
I'm assuming IAI does drive a lot of things when it comes to
25:05
an identity standpoint because now we're talking about things
25:07
like agents and you know, non human, which is the new term for
25:11
machine or you know, server account, you know, server cervix
25:15
accounts, things like that. Tell me about this concept of
25:18
IMV 3 and kind of help help our audience understand your
25:21
thinking around that. Yeah, I see.
25:23
And and the the question I usually get if I mention that V3
25:26
is like where's it come from? And is it, is it V3 in terms of
25:30
Web 3 or wherever it come? I use it just to sort of say dot
25:34
next. Really, it's much easier than
25:35
saying identity dot next. The, the I do think now there's
25:39
a need to rethink prioritisation, if nothing else.
25:44
And it really, and everyone says, show me the architecture.
25:47
And I said, well, I can show you patterns of excitation if you
25:51
like, in the ether that that represent products, if you like,
25:55
but don't even think of it that way.
25:57
I think some of it comes down to recognising a changing priority.
26:02
And it sort of comes back to the, you know, I'm a big
26:04
advocate right now for the fact that folks need to rethink the
26:08
drivers, particularly for a classic enterprise IEM project.
26:12
But who's paying for it and where does it come from?
26:15
And it's still very much comes from a, the known, known, as I
26:19
would put it, from sets of large enterprise applications that we
26:22
consider sloppy administration is our biggest enemy.
26:26
Well, we now know that the adversary who is, as you rightly
26:31
now say, Jeff is a, is an agent. I mean the This is the Future
26:35
isn't a hacker. The future is agentry.
26:38
That's going to be all over the enterprise, all over everything.
26:43
But they're not just adversaries, they're also your
26:45
allies in some cases, right? Because you're going to have
26:47
agents on both sides. This is like the Matrix.
26:49
We've got AI programs on both the good and bad side kind of
26:53
fighting each other. And I've kind of joked before
26:54
and said, all right, well, UA as fight and then let me know what
26:57
you decide as the human. Yeah, and and and it is an
27:02
interesting, terrifying and intellectually challenging thing
27:05
to think about. But yeah, I mean, how good can
27:07
be how bad? Just like we said, you know,
27:09
campaigns on this many years in the past, you know, the biggest
27:12
problem is your best employee kind of thing making a mistake
27:15
or or being being fished. But the same thing is going to
27:18
happen for agents, right? I mean, we know how to spoof
27:20
agents. We know how to spoof, you know,
27:23
many things. And now with so much movement
27:26
and it come in so quickly, you know, one of my greatest, you
27:30
know, it's the old, it's the OG thing.
27:32
It's like, have we learnt nothing?
27:34
That, you know, the recurring pattern of what we're doing with
27:38
NCP right now and what we're doing with tooling and how
27:41
quickly we're putting these scaffoldings together for these
27:45
new things. Are we sure we've got it right?
27:48
I, I can't believe why would we get it right this time?
27:51
You know, we got it right every other time.
27:54
History shows us and so I think V3 for me is a bit like, OK,
27:58
stop for a second and let's think about where these projects
28:01
come from. And.
28:03
And I've got this nice little chart where I sort of visualise
28:06
every resource that an enterprise might have be they
28:09
large, small, whatever and. And you've got sort of how
28:13
important the business thinks it is and how instrumented it is in
28:19
the infrastructure running on the other axis.
28:22
And what we tend to do, the truth is the, the vulnerability
28:25
is across the whole spectrum, right?
28:27
Little tiny Java apps sitting on the edge that Bob created and
28:31
threw out there and forgot about massive things in the cloud.
28:35
The which we're hopefully managing the entire before
28:39
that's spread across this, this matrix.
28:41
And what we tend to do is choose things in the first phases of
28:44
our projects that suit our funding and suit our capability
28:49
in the infrastructure. And they tend to be large apps
28:52
that we have when you go to your vendor, you say, do you support?
28:55
And they go, yes, So you start there.
28:58
And, and that's very much whereas I think this notion in a
29:02
phrase that that I've used many times in the past is, you know,
29:05
time to visibility and time to understanding is maybe the prime
29:09
visibility because the adversary knows that we train the agent to
29:13
do that. The agent, the adversary agent
29:16
now looks for things that that look for low management.
29:20
That's, you know, if you're managing it, you'll notice
29:23
what's going on. So I think V3 is a little bit
29:26
about timing of course there if that makes sense, you know
29:28
timing and and funding and thinking about scope.
29:32
Are we getting fast, smarter, faster?
29:36
So I look at AI, right? And it's just, you know, every
29:39
day there's some breathtaking new use case for it, and it just
29:43
keeps getting better and better. But I'm also seeing that there's
29:46
a lot more coordination with some of these vendors.
29:48
So things like for example, MCP and A to AI kind of think of
29:53
those as sort of like SAML and Oauth.
29:56
But it took many years to get to the point for SAML and Oauth.
29:58
And here we are only, let's call it one to two years into the
30:02
kind of the next Gen. or the generative AI kind of world that
30:06
we're all living in now. So I feel like we have learned
30:09
some things in the past. Now is never going to be as fast
30:11
as you want to know, but is are are we getting smarter faster
30:15
when it comes to developing standards and integrating all of
30:19
these different technologies in a way that you know hopefully is
30:22
secure and has the appropriate controls and things like that in
30:24
place? But maybe I am a big fan, you
30:30
might say, because I'm a I'm a sidelines fan.
30:33
I haven't contributed anything to SSF the, the, the framework
30:38
or to Cape or any of the standards that sit on top of it.
30:42
But I do think an ontology of method, an ontology of typing,
30:49
of people, of things, of entitlement, of classes of risk.
30:52
I'm a big ontology fan. I kind of always have been the
30:55
semantic web. When I saw it, you know,
30:58
Barnsley and the crew came out, I was like, this is the future.
31:01
This is how we're going to solve everything.
31:04
Because without a knowledge of a type, how can you interact with
31:07
it in an automated fashion? So I think there's a lot of hope
31:10
there. And, and so I do think in my 3.0
31:13
architecture, I would have a shared signals framework.
31:18
I would put a lot of faith there, but unfortunately,
31:21
there's not a lot of agreement capability.
31:24
There's some simple things like we're finally going to do global
31:26
sign out. Amazing.
31:28
You know, after all this time. You know, we're going to do it
31:31
with with SSI for a while, you know, but OK, so we've got that.
31:36
But there's much potential there for much more interesting
31:39
things. And it could come from from
31:42
operational telemetry as well. This idea to create ontologies
31:46
of things that are well described that understand things
31:50
like what an entitlement is and and how you can grade it.
31:53
I think that's super interesting because then we can attach
31:56
machine intelligence to to that typing and that that reference
32:00
model and do do do more interesting things with it.
32:04
Big fan there. Darren, one of the things I
32:07
want, I want to bring this back to this AI conversation because
32:15
here's what I think. I think practitioners throughout
32:18
time, and this is one of the reasons I think that
32:23
organizations under invest in I am because there's always
32:27
something better out there just on the cusp.
32:30
And now it's AI and it's like why you've been invest in I am
32:35
right now when this AI thing is going to come and it's going to
32:39
be way better than what I have now.
32:42
I guess to turn that into a question for you would be, are
32:47
my current investments just going to become like worthless
32:50
junk in a couple of years when the whole enterprise goes AI?
32:55
Is that even a reality or will some of these things still be is
33:02
identity and access? Is it going to look something
33:05
like it does now, you know, a few years down the road where
33:09
maybe we're not 100% AI, maybe that's just a pipe dream, but AI
33:13
is definitely having a major impact and replacing
33:16
applications and our organizations are starting to
33:19
build agent based applications rather than the traditional
33:24
coding model of client server applications or web-based
33:28
applications the way they are today.
33:32
Well, let's face it, right? I'll say, geez, here we can say
33:35
everything that we come up with today is going to completely
33:37
change everything we've done before, right?
33:39
This is what we do, right? Because we're all fascinated by
33:44
it. You know, we're all like little
33:45
scientists who who love the new thing and we wouldn't be here if
33:48
we didn't, right? So there's a certain element of
33:51
that. I do think the composition of
33:52
the stack changes and, and, and time to implementation should
33:56
shorten in every sense. Even in the AI that we add to
34:00
our legacy IAM stack, it's focused on faster deployment,
34:04
faster type of value. So I think there's a certain, a
34:08
certain amount of that that is definitely tangible.
34:13
I do think the way, so, so the way we're going to implement
34:15
these things is changing. And, and the, I mean, let's face
34:19
it, what you can now do with a simple ChatGPT session is
34:23
remarkable, whichever foundation model you tend to to work with.
34:30
But let's just stop for a second and go.
34:31
All that does is accelerate us to the same place, right?
34:34
We've still got an entity, be it human or more human than human,
34:40
which is, I'm a bit of a Blade Runner fan.
34:44
You're still going to make an access decision, right?
34:46
And, and what we've done is we've made the Matrix even
34:49
worse, right? Because we've now got an agent
34:52
that is owned by somebody operating on behalf of somebody
34:56
using a proxy account to get hold of some legacy data.
34:59
So we've now got 3 pins, if you like, of of exponential variable
35:05
to apply, but we've got to make the same decision who has access
35:09
to what, when and why And then when they did, was that
35:12
appropriate and can I prove it? I don't see how this is my point
35:16
earlier. I don't that fundamental tenant
35:19
doesn't change. It's just got harder and it's
35:22
going to happen faster without people knowing about it.
35:26
So. Then reading about and learning
35:30
about and I don't know why I haven't put any into action yet,
35:33
but this whole idea of vibe coding.
35:36
And so I'm not sure if you've given it a try, but I keep
35:40
hearing about how, you know, development as it's done today
35:43
is not going to happen much longer.
35:45
Consulting isn't going to, you're not going to need
35:48
consultants pretty soon. So I don't know what the heck
35:51
any of us are going to do. The AI is going to be doing
35:54
everything for us, you know, podcasts, and we're going to
35:57
have to wash our clothes because the robots aren't there yet.
36:01
Well I hate to say it but there's already AI doing
36:03
podcasts so yeah, it is washing clothes.
36:07
Yeah, I don't know what the rest of us are going to do, and maybe
36:09
we'll have to do some kind of manual work, which I know Jeff
36:14
and I are both allergic to, but I don't know, vibe coding.
36:20
Have you gotten into it at all? Where you kind of like tell the
36:24
AI the LLM? Here's what I'm trying to
36:26
achieve, then we'll write the code for you.
36:29
Absolutely. I'm a bit of a hack, you know, a
36:30
bit of a hacker. You know, you can usually look
36:33
at somebody's coding preferences and decide where they are.
36:35
I like Pearl straightaway. Soon as I move, I move from sea
36:39
to Pearl straight away because I like something, you know, I'm,
36:42
I'm piping even more so low declaration.
36:45
There's no better intuitive declaration language and
36:50
speaking to a computer, right? And so, yeah, I have a little
36:54
bit. So my daughter's a type 1
36:57
diabetic. And so I'm sort of, I'm always
37:00
interested in how I can create utilities that could help more
37:04
right when you look at panel information.
37:07
So I've sat myself down and said, hey, I'm going to create,
37:10
I want to create a system that will take in blood panel data,
37:13
do it securely. Don't want it in the cloud.
37:15
Want to do the edge rag list and blah, blah, blah.
37:18
I just blurb it out to the thing.
37:20
I mean it gives me a. Package.
37:23
It gives me a complete package and then I've got a primary, my
37:26
partner in store and it tells me how to fix it.
37:30
It's like holy mackerel. And you know what?
37:32
I now get a little UI and go pop.
37:34
It pops up and it says, do you want to download your stuff in
37:36
your Apple profile? And I go, yes.
37:38
And it just does it. And I say, pull in this
37:39
spreadsheet and it gives me the normative curves for it and then
37:42
points to a whole bunch of medical research that I mean,
37:45
holy mackerel. Yeah.
37:48
No, it's not perfect. It's a hack.
37:52
But I mean, but you weren't able to just like, knock that out in
37:56
that amount of time before. Oh goodness.
37:59
I think, you know, one of the cool things about having you
38:01
here, Darren, like we have like some rough notes that we want,
38:04
but I'm just like, I got this guy here, I'm going to pick his
38:08
brain. You know, one of the other
38:11
things that kind of a shift that I'm seeing in our identity
38:15
industry is more of a shift toward when you look at like the
38:21
new. And I shouldn't say it's a shift
38:22
toward, but it's like a lot of the new products are spinning up
38:26
and, you know, a big thing is about monitoring what's going
38:31
on. So rather than managing and
38:34
controlling the access being the focus of the new product, the
38:38
new product says, all right, here's your environment, put our
38:42
tool in your environment. We're going to watch what's
38:45
going on. We're going to monitor what the
38:47
identities and access is doing, and we're going to tell you when
38:50
things are wrong. I mean, I was talking about it
38:52
at a very high level. They all have their own
38:55
different approaches to do that, but that seems to be a big
38:58
shift. How do you feel about that?
39:01
I think it's inevitable and it's good and it's right, and we
39:05
should castaway some of the historical legacy preference
39:11
that we have in order to make that work.
39:12
And let me explain what I mean by that.
39:14
So one of the companies that I work quite closely with Orkid,
39:19
they have an orchestrator, an end point, and I don't want to
39:22
make this about them, but it's indicative of the class.
39:25
That's why I'm bringing it up. They have, if you like, an OS
39:29
telemetry, OS level telemetry, dissolvable agent that is like
39:34
the smartest identity guy you've ever met.
39:37
And it sits there and it goes, oh, there's a port over there.
39:40
What's going on over there? Oh, there's a port connected to
39:42
some code. Wow, let's have to go see where
39:44
that code is. Let's reverse engineer that
39:45
code. Oh, that code.
39:47
Wait, there's an AD group call coming on here and it reverse
39:50
engineers you down to a registerable connector for an
39:55
IGA platform, for example. And you go, holy mackerel, it
39:58
can do that. And yes, it can.
40:02
And it's fundamentally hotel, right?
40:04
It's operational telemetry mixed with a whole bunch of other
40:06
tech. And you look at it and you say,
40:09
well, but it's a, you know, identity is agent nurse and you
40:13
go, well, maybe in the future it's not.
40:15
It's self aware. And I think one of the things
40:18
that coming out of Cell Point in 2020, I was sort of very keen on
40:22
this idea that we had to stop identity from being a
40:25
centralised management funded process.
40:28
That's kind of what we've been talking about to being this
40:30
disseminated thing. And I don't mean distributed in
40:33
terms of, you know, self sovereign identity, maybe, but I
40:38
mean in terms of it just being there, being present and being
40:42
self operating. It's sort of unable to
40:46
understand what that means and integrate it for you.
40:50
And that future is a real potential.
40:54
It's that technology, you see, it's enabled by AI and it's
40:57
enabled by, you know, thinking in a new stack.
41:01
And, and, and so I, I do think that has a big chance to change
41:08
the game a little. When we're fighting an automated
41:10
adversary, obviously we have to defend it with an automated
41:15
ecosystem and that's one of them.
41:18
So I think there's a lot there. And I think also, again, I'll
41:21
come back to that ontology. I think one of the things that
41:24
I'd like to see in, in the hotel standards and others is this
41:28
firm view of what things are. Because if I say to you guys, I
41:31
mean, we're really anointed, right?
41:33
I say what an entitlement is. We've all got a different view
41:37
of what it means and we say what a risk factor is or what a, you
41:41
know, a Commission is. And And so, yeah, patterning
41:44
that stuff down in the underlying infrastructure would
41:47
be a very, very small thing to do.
41:50
And this is the worst it is ever going to be right for AI in some
41:54
of these tools, right? It's it can just continue gets
41:56
better and better and better. Or I should say maybe better is
41:59
not the right word. More capable is probably more
42:01
appropriate word because we don't know yet if it's kind of
42:03
bad and it's going to be used for both.
42:05
But this leads me to one thing that you've mentioned in the
42:09
past somewhere that I saw was that laws might be better than
42:12
architecture. And so I'd like to understand a
42:15
little bit more. First of all, did I get that
42:16
right? And if so, you know what?
42:19
What is the the thought process behind that?
42:22
Yeah, I think a lot of it coming down to some of the things we
42:24
we've touched on recurring theme, right, is that the
42:26
architecture will continue to change.
42:29
Like for example, you're doing this speaking to companies
42:32
yourselves. And, you know, I think the
42:34
legacy is part of that architecture and we tend to not
42:38
think of it. And and that's almost a law unto
42:41
itself is to say that you, you, you can't flush stuff it, it
42:45
just doesn't work like that. You know, the long tail of these
42:48
technologies remain in place for some considerable time.
42:52
And so that what does that mean in in practical terms?
42:55
It doesn't mean it doesn't boil down to a specification.
42:59
It boils down to a principle that says, you know, come into
43:03
this understanding that the integration of the new and the
43:05
old is a prime directive because that's what you're going to have
43:11
to do. And I think things like, you
43:16
know, I've always used this term model based.
43:20
We used to talk about it in the birth point of governance where
43:22
it was, oh, it's model based and being guilty there of that
43:25
ontology. What the Hell's a model there?
43:27
And well, a model is a conceptual understanding of
43:30
something. And again, the law we've learnt
43:33
here is, is that we have to make our desired state model based.
43:38
And whether that does it, when I say model, is that our back?
43:40
Well, it wasn't one time. It's probably not now, is it?
43:44
You know, Mike over at glue talks about T back, you know,
43:50
you know, token based access control and I think we're going
43:52
to keep inventing things. But a law rather than an
43:56
architecture for me would be make sure that you can codify
44:00
the thing that represents the rule for you in a way that it
44:05
can be governed, that it can be understood.
44:09
Because, you know, we we're not doing a great job of that right
44:13
now, even in the new red red that we're putting in terms of
44:16
the policy languages, just the ability to test the policy and
44:20
see what it means. That should be a law of the
44:23
model, the model. You should be able to express it
44:25
and you should be able to say prove yourself, prove yourself,
44:28
prove yourself. And that means show me who would
44:31
have. Oh, Jim, Darren and Jeff, that's
44:34
the answer to my evaluation of the policy as a speculative
44:39
evaluation. So God, sorry, that's a huge
44:41
diatribe to get to a point of saying that's a good example of
44:44
a model of a law. The law should be the law of
44:47
models for access, regardless of what they are.
44:50
Does that make sense? Yeah.
44:52
Yeah, it. Totally makes sense and leads
44:54
them to this next question I'm going to ask because I think
44:58
that the IAM practitioner is the ultimate pragmatist.
45:04
I think sometimes people believe that consultants live in the
45:07
ivory tower and some do. But for the most part, we're
45:10
kind of probably get this too, because we have all these great
45:13
concepts and everything that the industry's trying to do.
45:17
If we work with clients who they got a problem now, like we need
45:22
to fix this problem now, not worry about down the road.
45:26
And I think you know, the, the clients, the, OR what I'll just
45:30
call the IM practitioners of the world, they're the ones living
45:34
with this problem. They got 1 foot in the past and
45:37
have to support legacy systems, but they have to have one foot
45:41
in the future. They have to be thinking about
45:43
the next thing or else it happens and they don't have a
45:47
solution for it. I think this piece around shared
45:50
signals it to me is like the right solution for the right
45:55
time. At the same time, folks are
45:58
trying to solve from the current problems and they might not know
46:02
how to articulate that business value of kind of investing in
46:07
something that is more future facing, especially if they're
46:11
not like a technology company or cutting edge company.
46:16
Taking all that context, I would like to ask you to help those
46:20
that practitioner put together their sales pitch or their their
46:27
way of thinking about something like that to make the case, you
46:31
know, and I call this that identity version three, you know
46:34
the kind of next generation. How do they think about that and
46:37
then make that business case in their in the boardroom of their
46:41
company? Yeah, always hard.
46:43
I mean that, you know, making that business case is is so
46:47
hard, right. I think IGA did a very good job
46:50
of that by by professing automation.
46:54
We can get you what you need, pastor, don't wait for your
46:56
account. There were real things that made
46:58
that business case pointy and, and resulted in it sort of being
47:03
lead project directive from, from for many, many years.
47:08
I, I, I still, I could sort of come back again to that
47:10
underlying thought that we as practitioners have to live in a
47:15
world of reality, which involves the past, the current and the
47:19
future. And so I think a meta
47:22
architecture, you might say for that is one that says, I think
47:26
we're still going to be doing static profile based legacy
47:31
systems administration, administration time stuff.
47:35
I just don't see how that's going to go away.
47:37
Those systems are still going to be there.
47:39
So the, the pitch is we, we, we have to manage that.
47:43
We do still have to manage profiles in static applications
47:46
to be the on premier in the cloud, traditional governance
47:49
administration you might say. But now we've got to think much
47:52
more critically about runtime, real time context right in
47:58
session, if you like, which is where externalised authorisation
48:03
and and some of the things that the likes of Signal talk about
48:07
in that bucket there, they've obviously got our brethren and
48:10
others that that do the same where it's much more about the
48:13
context making decision in the session.
48:16
You've got to do that as well. Now it's unfortunate that, but
48:20
yeah, that's not. And then we've got to look over
48:23
on the right hand side of that, almost like to a third pillar
48:26
and say, well, what am I going to do about these agents?
48:29
I mean, it would be foolish now not to consider that.
48:33
And, and, and, and I think there's, you know, some things
48:36
we touched on about NCP and how you're going to put, you know,
48:39
gateways in front of NCP and now some of the things that you can
48:42
do there, but it has to be in the diagram at once.
48:45
So I think the mature thing for us to do now is to, is to sort
48:48
of fess up a little bit and say, look, this stuff is moving
48:51
faster than any brain can manage.
48:55
So let's accept that we have a past, the present and the future
48:59
and let's try and find commonality there.
49:02
Let's try and find things that could leverage all three, all
49:07
three tiers of the that sort of legacy static admin time, that
49:11
current state in the loop just in time, whatever enables you're
49:17
going to call it, right decision making, right.
49:20
And this edgy future, which is still not baked.
49:23
Let's face it, is that an easier to sell to a SIFO?
49:27
No, but I think we're going to see a new, I honestly believe
49:33
we're going to see a new extent of vulnerability coming out.
49:38
This is not just going to be about ransomware and being
49:41
popped. It's going to be like opening a
49:43
can and it being festering with insects.
49:47
We're going to find big. A friend of mine was dealing
49:50
with last night said, imagine a scenario where somebody gets in
49:54
and trades all of your stock, you're a pension fund, trades
49:57
all of your stuff. It's all gone.
49:58
It's all traded and gone. What are you going to do?
50:00
Billions of dollars and you open that count up and it's full of
50:04
that future is coming. And maybe that will change us
50:09
because I think we've got to become a bit like, Oh yeah, I
50:11
got parked. Oh, well, everyone else did too,
50:13
so no problem. Yeah, I think maybe that will
50:16
flush us to me. You know, we, we make us a bit
50:18
more conscious. Well, congratulations Darren.
50:21
Now I'm thoroughly disgusted, but just the visual of a
50:24
festering, you know, pot of bugs, not my jam.
50:29
I know we only have a few minutes left and I want to make
50:31
sure that I'm cognitive time because I do want to ask you
50:33
about kite surfing. But before I get to that, give
50:35
me one. What's 1 prediction that you'll
50:39
make around I am and let's say sometime in the next three to
50:42
five years. So sort of near term, like
50:44
what's the what's something that you think will surprise people
50:46
for an I am perspective? I think people will be surprised
50:51
what we can do with next generation infrastructure that
50:57
is layered on top of the legacy, that's layered on top that's
51:00
quite the legacy, the current, the current operate.
51:03
If we're able to keep moving forward on the operate, I think
51:06
people will be amazed just like I am today when I want to write
51:10
something, how intuitive the machine can be.
51:14
I don't believe it will ever be sentient, truly sentient.
51:18
I don't believe it will be conscious.
51:19
We can get into that for a whole podcast that boy, is it going to
51:23
be smart. And, and, and, and that's no
51:25
news for anybody, right? So I would temper that by just
51:29
saying, and you know what, you're going to have all the old
51:31
stuff. I'm less disgusted, so that's
51:34
good. Let's shift here to a little bit
51:38
of a lighter note before we wrap things up.
51:40
You mentioned before we hit record here that you're into
51:42
kite surfing, and that's one of the things that we've we've also
51:45
started since the first time you joined us way back five years
51:47
ago. As we end shows on sort of, you
51:49
know, something non identity related, We get kind of neck
51:51
deep sometimes into identity or if we're talking to the clouds,
51:54
sky high in our heads, right, things like that.
51:56
And so we like to kind of find out what people do in their
51:58
spare times or just kind of fun conversations.
52:00
So that's sort of like the genesis of this.
52:02
And you mentioned kite surfing. Now I've never been kite
52:05
surfing. And so you're going to be by Obi
52:08
Wan and you're going to explain to me, first of all, how you
52:11
know? First of all, what is it for
52:12
people who aren't familiar? I think I'm familiar with it,
52:14
but maybe people aren't out there.
52:16
And if I wanted to get started, what is the easiest way for me
52:20
to get started with kite surfing?
52:22
Right. And I guess I what I do know is
52:24
kite foiling. So basically I ride a hydrofoil,
52:27
which is basically an aeroplane wing under a surfboard.
52:30
Tiny little one with a kite in the air to drive it forward.
52:35
So it's incredible. Really low drag coefficient, so
52:39
it's very efficient on the water, very fast.
52:41
You can jump, move around. I've always been interested in
52:45
ring sports. I was a windsurfer for many
52:47
years. Came to the US as a windsurfer,
52:49
stayed in Austin because it was like, you could, you could.
52:51
You don't need a wet suit with you.
52:53
It's amazing. Now I'm just picturing you like,
52:56
you know, windsurfing all the way from into the United States
52:59
off the off the water. Pretty much.
53:01
I mean, I came here, like I said, you know, if it's windy in
53:04
England, the weather's crummy here in Austin, we had good.
53:08
So I came here as a windsurfer and then progressed to kite
53:11
surfing. So you're on this little tiny
53:14
surfboard with a, with a hydrofoil and a plane wing
53:16
underneath you and a kite dragging you around.
53:18
It's extremely exhilarating. It's outdoors, It's it's in the
53:22
environment. And I think I'm drawn to it
53:24
because it's kind of an in the moment thing.
53:28
I'm very, we live very cerebral lives.
53:31
We, you know, I'm fascinated. I'm a bit of a researchy.
53:34
I'm fascinated by by brain at the moment.
53:37
I've been fascinated by geology. I'm always sort of this is
53:40
something. No, you shut it down, you're on
53:43
the water, you've got this giant powerful thing above you covered
53:47
in lines that cut your head off. Boy, you better be present.
53:52
So it's very here and now. So I love that from it.
53:56
If you want to start with it, you have to dedicate some time
53:59
to it and you just have to go to a great resort where there's a
54:01
nice beach so you can learn how to fly a kite because ultimately
54:06
you're flying a kite, just a kite in the sky and and you have
54:10
to it's not something you can just go try, go try.
54:13
It's not like riding a bike. You know, anyone can mount a
54:15
bike, right? Not everyone can kite surf.
54:18
And I think that's one of the things he got found a good kite
54:20
school in a great location in South Padre in Texas or I have a
54:24
place in the Columbia River now in I'm actually at Washington
54:28
State just in Hood River is one of the founding places for it.
54:32
So go somewhere like Hood River, find a good kite school and you
54:36
know, go for it because it's always exhilarate.
54:41
How how fast do you get doing that?
54:43
Because I met and obviously it's, you know, wind probably
54:45
plays a big factor in that, but how fast can you get going?
54:49
You can go faster than the wind, which is very interesting.
54:51
So it's physics from physics perspective, it's very
54:54
interesting. So you can go anywhere from 25
54:58
to 40 knots, so, you know, anywhere from 30 to 45 miles an
55:02
hour, depending on the foil that you're using and, and where you
55:06
are. And you can jump.
55:08
And that's the way I like about it.
55:09
So for an old, you know, I'm 58 now, you really shouldn't be
55:12
doing any of this. But I like to jump.
55:15
You can hear a wave. And we've now got all these
55:18
devices that will tell us our GPS locations.
55:21
I'm on a thing called surfer and I can, so I can jump 40 feet in
55:25
the air. So you can boost up a wave and
55:27
go 40 feet in the air and feel and, and in Hood River, there's
55:31
the manhood there and it looks like you're jumping over it.
55:34
It's just a nominal. And so you know, that's quite a
55:37
rush. So you can go fast, you can jump
55:40
high, so. That sounds amazing.
55:43
So I guess you could probably get carried away by the wind as
55:47
well, right? How do you control coming back
55:49
down? If you're if you get caught up
55:50
in in a strong wind, I imagine you're going to go quite a
55:54
distance. It has happened.
55:55
People get picked up, thrown around.
55:57
I've been thrown on the floor. In fact, I remember going to a,
56:00
an identity event in new in on the East Coast.
56:03
It was maybe when the Gardner events on, on the Sunday, I got
56:06
picked up and slapped on the floor.
56:08
And yeah, I, I, that wasn't a lot of fun.
56:12
I could barely walk and I still made it.
56:15
In fact, in 2008, I think I broke my leg actually
56:17
windsurfing and I, I actually went to a conference to use a
56:21
conference on crutches from it. So yeah, I can be.
56:25
You've got to be careful, but I think without risk, you know.
56:29
That's what adds the spice, right?
56:31
That's part of the the sport, I guess of it too, right?
56:33
Is it is a physical activity. So there's, you know, inevitably
56:37
some chance of injury. At first I was thinking, OK,
56:39
well, you're over the water and like you've got water to break
56:42
your fall. But if you hit the water going,
56:44
you know, $3045.00 an hour, that can cause some, some damage.
56:48
Oh, big time. Particularly if you if you get
56:51
the kite wrong, it can swing you like a, you know, like a
56:53
pendulum and slap you down on the ground if you're unlucky.
56:57
Don't go near the ground, but on the water.
56:58
Yeah. I don't want to make it sound
57:00
like it's big radical there. I now like to cruise around.
57:03
I'm an OG definitely. I like to cruise around and
57:05
jump. But it is fun when you, when you
57:07
can jump over those young kids that take that really hard.
57:11
They're like that old man just jumped over me.
57:13
What the heck? Jim, have you ever been kite
57:17
surfing or windsurfing? No, you know what?
57:19
But I've seen it so many times, and it looks so much fun.
57:24
So I was just sitting here enjoying hearing Darren, and
57:28
then when he said, well, you know, you got to have some risk
57:32
or something, I was just thinking, he's spent his career
57:36
building systems and building around the business proposition
57:41
of reducing risk. And here he is inserting risk
57:46
into his life. I just find it a little ironic.
57:49
But yeah, sounds super fun. I would love to try it.
57:54
How about you? Yeah, I've, I'm not much for
57:58
water sports. I think the one time that I
58:00
tried to water ski, I got dragged behind a boat.
58:03
I forgot to let go of the rope. And so I was kind of going face
58:06
1st and through the lake for a while.
58:08
I was like, oh, I should probably let go of this thing
58:10
now. And that was my one and only
58:12
attempt at, you know, standing up on skis.
58:14
So I, Darren, you're I know you're laughing at me, but
58:16
that's a true story. And that was 30 plus years ago.
58:21
That's the thing, you know, be prepared for a little humility,
58:23
right? Because, you know, it happens to
58:25
everybody. I pulled up at the beach the
58:28
other day and there was a little work on the peanut gallery.
58:30
There's a little gang of them all people.
58:31
I know that. And right in front of everybody
58:34
got it wrong, got slapped down in the water like a newbie, and
58:37
everyone cheers and waves their arms in the air.
58:39
You know, it's kind of like generally a good crowd with
58:43
that. But yeah, you know, hey, we're
58:44
all human. That's what happens.
58:46
Again, if it was easy, you know probably wouldn't want to do it.
58:49
That's true. And we're, and you know, it's
58:51
probably a rite of passage, right, to, to eat the water, so
58:55
to speak. Most definitely.
58:57
Like I said, I've been dragged behind that same boat.
59:01
Well, Darren, I appreciate you coming back.
59:03
I I can't believe it's been five years.
59:04
Let's not make it so long next time, I hope you'll come back
59:06
and share some more of your insights.
59:08
It's always great when we get to talk to just, you know, O GS in
59:11
the space and people have such an influence on it.
59:13
So, and I echo Jim early on saying, yeah, thanks for thanks
59:17
for joining us so early on, like I said, nobody was listening and
59:21
you know, to to get Someone Like You on was really validating for
59:24
us and it still is so. Thank you for being I I think
59:27
you guys are doing an awesome job and you back it up with
59:30
practical real experience in the field and and you know, you're
59:34
at the events and so I'd love to come.
59:35
I'm going to go. I didn't know about the using
59:38
the code. I'll absolutely do that.
59:39
And next event, let's make sure we sit down, have a soda.
59:42
Together, that is a deal for sure.
59:45
All right, I'm going to put your LinkedIn in our show notes as
59:47
well as some other links for people that I didn't check out.
59:48
So, you know, that's it. I think that's all we got for
59:52
for this week. You know, we're on the web, IDC,
59:55
podcast.com, do all those fun things like like and subscribe
59:57
helps us get great guests like Darren and yeah, don't forget
1:00:00
our discount codes on the website as well.
1:00:02
So hopefully we'll see a lot of friendly faces at our different
1:00:05
conferences we'll be at. And yeah, that's it.
1:00:08
So thanks for watching and or listening and we'll talk with
1:00:11
you all in the next one. You've been listening to
1:00:16
Identity at the Center. We hope you've enjoyed the show.
1:00:20
Make sure to like, rate and review, and we'll be back soon.
1:00:24
But in the meantime, hit the website at
1:00:27
identity@thecenter.com. See you next time on Identity at
1:00:33
the Center.