Latest / Identity at the Center / #280 - OpenID’s AuthZEN with Omri Gazitt of Aserto

Transcript

#280 - OpenID’s AuthZEN with Omri Gazitt of Aserto · Identity at the Center

0:00
All this sounds cool, but I'm definitely going to need need
0:02
technology. This is not something I can keep
0:04
track of a spreadsheet or you know, do manually and be
0:06
scalable. And do I need applications to
0:09
also be written in a way that they can do fine grain
0:12
authorization? Does that make sense?
0:15
Absolutely. And I think you hit the nail on
0:17
the head. If I think back 1015 years ago,
0:20
everybody kind of did login on their own, right?
0:23
Like they built that into their app.
0:25
There was no, no, I, no such thing as externalizing your, you
0:29
know, your authentication. So every application did it
0:34
differently. Now once you introduce
0:36
standards, all of a sudden you at least had a shot of having,
0:42
you know, kind of a single way of doing it.
0:45
That wasn't enough, though. This is identity at the center.
0:55
If it has anything to do with IAM, this is the go to podcast
1:01
now your hosts Jim McDonald and Jeff Stedman.
1:12
Welcome to the Identity at the Center podcast.
1:13
I'm Jeff and that's Jim. Hey, Jim.
1:16
Hey, Jeff, how are you not so? Bad.
1:18
It was a little bit of delay there.
1:19
Were you like thinking like, are you OK?
1:23
No, I'm, I'm fine. I potentially my internet's
1:26
going a little bit slow. I see the uploading in the
1:28
background is a little bit laggier than normal, but
1:31
hopefully everything's OK to have a conversation.
1:34
Yeah, we're good. I've been having a fantastic day
1:38
today, though. You know you and I do a very
1:41
similar role, right? We are focused on digital
1:44
identity. We do consulting, right?
1:46
We, our advisors, we are paid to give our advice, which I always
1:52
think is like the coolest thing. When I give the explanation to
1:55
people on what I do, I tell them I've been doing this for the
1:58
last 12 years and I've recently thought to myself, people really
2:02
think like you haven't been promoted in 12 years, how good
2:06
are you at this? But it's actually been that I've
2:10
always kind of come back to this, right?
2:12
I've had opportunities to be in higher roles management or
2:17
growing the business and things like that and I've stepped into
2:19
some of those things, but I've always kept 1 foot on the
2:22
advisory side. One of the reasons is we just
2:26
get so many opportunities to solve cool problems.
2:30
And the one I was involved with today, someone got me involved
2:33
in a conversation with a client and there this particular client
2:41
had a ton of PCI card holder information in their network and
2:47
they were wanting to understand like how do people normally go
2:52
about you know, building their identity strategy when they've
2:56
got you know a normal non PCI network and then a zone, a
3:02
security zone with all their PCI data in it.
3:06
And normally what I've seen is like every organization is just
3:11
like busting their hump to minimize the amount of card
3:15
holder data that they store. I tried to kind of explain that,
3:18
but it was just a fantastic conversation that I wasn't
3:22
really expecting this morning to get into.
3:25
And but that's also one of the really cool things about working
3:29
at a consulting firm like RSM is that we have so many, like,
3:33
really smart people to tap into. Like, for example, the person
3:38
that was, you know, pulled me into this opportunity was Aqsa,
3:43
and I reached out to another person who I know is Aqsa.
3:46
So Aqsa is a qualified security assessor in the area of PCI,
3:51
right? It's like a certified person.
3:54
And so I was able to tap in and like, was my answer, right?
3:58
I was like, absolutely. I mean, like that's what
4:02
everybody's trying to do these days is like minimize the scope
4:06
and then within that you adjust your strategy based on how big,
4:11
how small can you get that scope?
4:12
Can you get it to the point that you don't have any cardholder
4:16
data on your network? Yeah, that's I think that's
4:20
interesting about consulting is you can read as many books as
4:22
you want, but a lot of it is based on experience and what you
4:26
actually see in the real world. Because, you know, books are
4:29
great, but it it never survives the real world when it comes to
4:34
what people are doing. And you know, legacy decisions
4:37
that have been made and the reality of budgets and politics
4:39
and and all that good stuff. But do you feel so?
4:42
You've been doing this 12 years, I've been doing this nine years.
4:44
Do you feel like the advice you're giving now is better than
4:49
12 years ago? Yeah.
4:52
And why is that? It's based on experience, right?
4:56
I think there is a misconception that a lot of people hold, which
5:00
is no, our peers don't think that's maybe other folks in our
5:07
clients, prospective clients think, well, we should know
5:10
everything. And look, my job prior to coming
5:14
into consulting was at a bank. We've done consulting for credit
5:19
card processing firms and lots of organizations that have PCI
5:23
scope, right. But this particular situation
5:27
was an even new one, and you can't know everything we can do.
5:33
I think we do a really good job of this is like putting together
5:36
a team of people who combined, have all the right skills, have
5:40
all the right knowledge, and we ping things back and forth off
5:43
of each other. So that was, you know, it just,
5:47
it made my day because it's like, oh, this is really cool.
5:50
This isn't something that I think about every day, think
5:53
about the identity side of things every day, but I don't
5:55
think about the PCI side of things every day.
5:59
Yeah, it's a thinking exercise. And yeah, it's man, sounds
6:03
pretty cool. I think we had another
6:04
conversation this morning. You and I were both on a call
6:06
and it was about the ownership or the accountability.
6:09
Where does IM fall and what what parts of an IM program and
6:12
things like that. And we kind of jokes like, oh,
6:14
that's, you know, we should probably bring this up on an
6:16
episode. I feel like we talk about every
6:17
once in a while. But.
6:19
And there's a lot of answers. I don't think there's a right
6:20
answer. There's probably a generally
6:22
accepted practice, but even that may not survive the realities of
6:26
an organization or the politics involved and things like that.
6:29
I feel like that's an episode unto itself, and I think the
6:33
name of that episode is just like Highlander.
6:37
There's only one. AI love it.
6:39
That's. What?
6:39
I say it's. Like there could only be one.
6:42
I've heard you say it so many Times Now, right?
6:44
It's like I even say it and I don't know what that means.
6:47
Yeah, I'm trying to think I had. I had another clever one this
6:49
morning. At least clever to me.
6:50
Oh, you know, Rome wasn't built in a day, but it was built.
6:53
So you know, there you go. You know the thought that I was
6:57
having. I was like wondering if other
6:59
people were having this thought. It also fell.
7:01
It also collapsed. But it was they stretched beyond
7:05
their means. OK, let's.
7:07
Yeah, come on. It was good at the time And I'm
7:08
going to stick with that one, you know, until someone starts
7:11
shooting holes in it. So thanks, Jim.
7:15
Let's talk about. Well, you're right.
7:16
Let's not. Let's not drag lag things out
7:18
too much. Let's talk about the conferences
7:20
that are coming up. Yeah, Identivers is coming up
7:23
May 28th to the 31st at the lovely Aria Resort and Casino in
7:27
Las Vegas. You and I are going to be there.
7:29
We've got discount code ID or IDV 2 four dash, IDAC 25 get 25%
7:36
off. I think at this point you've
7:38
probably missed all the early birds.
7:40
But hey, money saved is still money saved.
7:41
So use that code. Good way to support the show.
7:43
Hopefully we'll see a lot of people out there that you and I
7:46
know. I know that people are kind of
7:47
excited for it. I think it's, I think it's
7:49
probably the best identity conference or maybe it's close
7:53
to being the best, I'm not sure yet.
7:55
And you know, I think I'm looking forward to the hallway
7:59
conversations and things like that.
8:01
So I'm hosting a panel out there.
8:03
Our friend Sean has asked me to do that.
8:07
So we're going to talk about Cape.
8:08
That's worth $1000 right there. Yeah, just to watch me be up
8:12
there and be that dumb guy on the stage while I'm asking all
8:14
these really smart people about continuous access, evaluation
8:17
profile and like, OK, So what does that mean?
8:20
Can you explain it like? I'm a fifth grader.
8:22
Because I totally don't get it. By having conversations like
8:25
that and all the hallway stuff, you and I are going to be
8:26
podcasting sort of all over the place in different spot.
8:30
I know we have a room that we're going to be podcasting mostly
8:32
out of. It's copper leaf something, but
8:34
I don't have it in front of me. Copper leaf. 7.
8:36
Copper Leaf 7 and we'll be recording what, two to three per
8:40
day in there. We're doing 2 on Tuesday
8:43
morning. We're doing one on Wednesday,
8:45
which will actually be in a different location.
8:47
It's not official yet. And then we're doing 3 on
8:50
Thursday. So Thursday is the day to, you
8:53
know, if you, if you're looking to see us live, meet us live.
8:57
And it hasn't happened by Thursday.
9:00
You know, Copper Leaf 7's the Place to be.
9:03
Pop your head in. You try to be quiet for in the
9:06
middle of of recording an episode, stuff like that.
9:08
But yeah, we'd love to have people stop by and say hello.
9:11
So is it the best identity conference?
9:14
I I don't know if it's the best, but it's definitely in the
9:18
conversation. I don't think anybody who
9:20
listens to this podcast will be disappointed that discount code.
9:25
So if you haven't registered, that discount code is the best
9:28
one that's out there. And I know that for a fact
9:32
because I've seen all the discount codes.
9:34
There are none that are better than that.
9:36
So if you're thinking like I'm going to Google for coupon code
9:39
for identivers, actually you can do that.
9:42
Ours will come up as. Part of the.
9:44
Answer generated by AI. No, no kidding.
9:47
Alright cool. Yeah yeah yeah.
9:49
So best code we're going to be doing a bunch of different
9:55
events like after hours events like we're Co sponsoring a happy
10:00
hour with Talus. I think you know, reach out to
10:05
either one of us and get on that invite list.
10:08
And plus, we'd love to meet you. You know, myself, Jeff and
10:13
several of our colleagues from RSM are going to be there and we
10:18
would love to set time aside with you to talk about whatever,
10:22
wherever you are in your IM cycle or or in your IM journey I
10:26
should say. Good sales pitch there.
10:29
Yeah, come come see us. RSM and Telus and Identity at
10:32
the center are all kind of combining forces.
10:34
I think we're doing things a couple nights and I think spaces
10:37
are limited too. So definitely reach out and try
10:40
to get on the lists and hopefully we'll see you there.
10:43
But if you see you just walking around, Jim, you've got a
10:45
jacket, you're going to be wearing a vest.
10:46
I haven't. I don't know if I've seen it
10:48
yet. I know we talked about it, but I
10:48
don't remember what it was. But you've got something that
10:50
you've. You're.
10:51
Yeah, I know. No, no, I've.
10:53
I've kept it hidden. And I also got a really cool
10:56
pair of Nike shoes, so just watch out, man.
10:59
Are they the kind that weighs themselves?
11:01
Because that would be pretty cool.
11:03
No, but you remember the type that had like a little
11:05
basketball on the front and it was like you could pump the
11:08
basketball and would. See, I couldn't afford the Nike
11:11
ones. I had the Reebok pump, so I was
11:14
super cool. In 8th grade I had the Reebok
11:15
pump. OK, mom, I don't remember which
11:19
ones were better or anything, but the whole pump idea was
11:22
pretty cool anyway. They're not those, but they
11:24
remind me of those. They're not those.
11:27
They're not that thing that we just talked about, but it's
11:29
something like that, OK, What about European, a European
11:33
identity and cloud conference that's coming up too?
11:36
It's like the week after so June 4th through 7th in Berlin, EIC
11:42
IDAC 25 gets you 25% off. So if you are among the lucky
11:48
people who can go there but you also haven't registered yet,
11:53
that's a fantastic discount. Code gets you 25% off.
11:57
Yeah, it's super cool and we'll have links in.
12:00
Our shows and be able to. Check that out.
12:01
We got identity week after that. You want to talk about any week
12:04
after that? Let me do it.
12:06
Let me do it. Let me run for you.
12:08
Identity Week, Identity week Europe, Amsterdam, June 11th and
12:13
12th. Identity Week, America,
12:16
Washington DC, September 11th and 12th.
12:19
Identity Week Asia, Singapore, October 22nd and 23rd.
12:23
We got one discount code works across all of those.
12:26
IDAC 30 gets you 30% off. That's a pretty killer discount.
12:31
And Jeff, you and I will be at Identity Week America, I think
12:36
you're doing a panel. I'll be in the audience, like
12:39
making funny faces and trying to distract you.
12:43
And you probably will or maybe I'll call you out on it.
12:45
I don't know. I seem to be settling into this
12:47
panel hosting groove with having done it now it'll be two or
12:51
three times. So we'll see.
12:53
It's like anything else. We'll get better at it as we go.
12:55
But yeah, IDAC 30, you get 30% off.
12:58
We'll have links in our show notes for all this stuff so you
13:00
don't have to remember them. Just click on the link either on
13:02
our website or in your podcast app or whatever may be all
13:05
right. That's all the prep I think we
13:07
need to do. We're going to talk about
13:09
something called Off Zen and meditate on what that means.
13:13
Sorry, I couldn't help it with the Zen there.
13:15
To help us with that conversation, we've got Omri
13:17
Gazit. He's the Co founder and CEO at
13:20
Acerto, and he's one of the Co chairs of the Off Zen working
13:23
group at the Open ID Foundation. Welcome to the show, Omri.
13:28
Thank you so much. Glad to be here.
13:30
And thank you so much for taking the time with us.
13:33
We'd like to find a little bit about your identity background.
13:36
Tell us how did you get into identity and access management
13:39
or digital identity? Is it something that you chose
13:42
or did it choose you? Oh gosh.
13:45
You know, I have to go back to, I would say, the early 2000s.
13:51
I was at Microsoft and we were doing, I was leading the XML
13:54
team at Microsoft and one of the most exciting applications of
13:57
XML was SOAP. You know, this idea of sending
14:01
messages across the Internet between different components.
14:04
And we started building out a set of protocols that were known
14:10
back then as WS STAR. And some people like to call
14:13
them later on WS Death Star because they're a little bit
14:17
heavyweight. But among those were W Security
14:20
and W Federation. And that really got me into, you
14:24
know, this idea of how do we actually get kind of all the
14:27
protocols that we know about, you know, kind of in the old
14:30
world L DAP and like, you know, all these kind of like old
14:33
Internet protocols and kind of move them to the age of, like
14:37
the, you know, kind of like the, you know, interoperability
14:41
across Internet things where you don't have a single trust
14:45
domain. You have all these organizations
14:47
that don't trust each other. They don't have a common
14:49
Kerberos. And so all these protocols were
14:52
developed at that time. SAML was developed around that
14:54
time. My team was very heavily
14:56
involved with that. So I would say that was how I
14:59
got my start in the identity and access world.
15:01
And that kind of led to as we were starting the Azure
15:05
platform, we realized that we needed to go take what was our
15:10
core asset Active Directory and move it to the cloud.
15:13
And so you know we had a Azure Access Control Service that
15:16
became Azure Active Directory. So yeah, like my my roots are
15:20
you know, kind of date back to the early to mid. 2000 And now
15:25
you're with a company called Asserto.
15:27
Tell us a little bit about Asserto.
15:29
What's the 32nd elevator pitch and what you guys do?
15:34
So we like to say that identity moved to the age of SAS and
15:37
cloud, but authorization never did and that's really what we're
15:41
trying to solve with Asserta. We want to create the definitive
15:44
platform for authorization in the age of SAS and in the age of
15:49
cloud. So just like you have today, you
15:52
know things like Octa and Alt 0 and a bunch of different
15:57
platforms, developer platforms that make it so that you don't
16:00
have to go build identity if you don't want to, you don't have to
16:03
solve the login problem over and over again.
16:06
There are services out there that just help you do that in a
16:09
standards compliant way that doesn't exist today with
16:12
authorization. And so that was the challenge
16:14
that we felt like was the biggest challenge for both
16:17
developers and organizations. You know, if you think about it,
16:21
SSO solved a lot of problems for organizations.
16:24
You, you, before you had all these SAS apps, each one had its
16:28
own user ID and password or e-mail and like managing all
16:32
that stuff was a mess. And today, you know, you
16:35
basically have a single SSO platform and all your apps
16:38
better hook up to that, you know?
16:40
Otherwise you won't even buy them, right?
16:42
And so authorization is just this complete mess today where
16:46
every application has its own admin screen and you have to
16:50
kind of manage the permissions or the entitlements for each
16:53
user separately. You have to do that for end
16:56
users and M applications, and so that's the problem that we're
17:00
trying to solve with a serno. All right, that was a long
17:03
elevator ride, but I think it was worth it.
17:06
I was. I was snooping your LinkedIn
17:08
profile and I noticed that for a time you served a head of
17:12
product for the Xbox platform. I was like, oh, the gamer.
17:14
Me just went, oh, you know, cool.
17:16
And one of the keywords you mentioned in there was the
17:19
Kinect platform. And I always thought Kinect was
17:22
just a killer app and a killer you know functionality that the
17:26
Xbox had but it never really seemed to take off I think is is
17:30
what probably people were hoping.
17:32
But now we're seeing a lot of motion based controls, right.
17:36
Apple Vision Pro has it, phones have it.
17:38
It's kind of in a in a in a spot right now where people are
17:41
starting to kind of get it I guess take me behind the scenes
17:46
a little bit, how did you know how to connect come around and
17:49
is it just a matter of the world wasn't quite ready for it was
17:52
it? The hardware wasn't quite
17:54
powerful. The software maybe was a
17:55
combination of kind of everything and just wasn't quite
17:57
the right time for it. Yeah, that's that takes me to
18:01
the time, the only time in my career where my kids could
18:03
actually say, I know what you do, this identity stuff, they
18:07
don't get it. They're like, are you, like
18:09
responsible for all of those? Like 2 Factor, like all these
18:14
codes? Like, Oh my God, that's so hard.
18:16
That's so terrible. But you know, the Xbox was kind
18:19
of fun. Yeah, The Kinect, the vision was
18:22
you are the controller and there was just a ton of really
18:27
advanced engineering that went into it.
18:29
A lot of machine learning actually went into it.
18:32
So this idea of creating this mic array, you know, that had
18:37
four different mics that could map out the room and you know,
18:41
like Beamform, effectively like all of the, you know, what your,
18:46
you know, where your voice was coming from and be able to
18:51
attenuate like. So you know, obviously voice
18:55
attenuates with a square of distance just like any wave.
18:58
And so having a model that could actually understand you from 9
19:05
feet away was completely unheard of at the time, right.
19:08
Like the best models were like phone models where you're
19:11
talking, you know, kind of like a few inches away.
19:14
That was a huge problem. The acoustic models, then the
19:16
language models. That was another problem.
19:19
And then of course the the motion sensing was a huge step
19:24
forward too. So what we had was we had an RGB
19:27
camera and a depth camera, and in the beginning we were trying
19:31
to get people like developers, the game developers are
19:34
unbelievable engineers, right? Like the best engineers that
19:38
exist on this planet. And they were like, OK, well,
19:42
you're giving me like lots of data, but I don't really know
19:44
what to do with it. So we actually had to build
19:46
another library, a skeletal tracking library that could map
19:50
out 18 joints in your body and give you kind of a vector for
19:54
what those joints were doing. And it was only like at that
19:58
point that people could actually start building experiences and
20:01
games for this thing. Now, you know, why didn't
20:04
succeed? It actually succeeded.
20:06
Like at the time, we sold 7 million units in the first
20:09
couple months. And it was unbelievable.
20:11
It was just like the fastest consumer electronic.
20:15
You know thing that you know kind of was sold at the time,
20:18
but definitely the paradigm, the paradigm of you are the
20:22
controller didn't quite like I would say take off in the way
20:25
that we wanted it to. I think some of that was just
20:28
that you know AAA hardcore gaming is still done with
20:32
controller. You know like you're basically
20:35
you're talking about the people really good at it.
20:38
They don't even want a cordless, a wireless controller.
20:41
They want a wired controller because that cuts latency.
20:45
They want to actually put their Xbox or whatever they're playing
20:49
on, on a, on a on an Ethernet cord, because even the ping
20:53
times like, you know, like really matter when it comes to
20:56
like playing first person shooters.
20:59
So that audience was never really going to embrace the
21:02
Kinect and I do think that the technology has gotten a lot
21:05
better since then. So we're starting to see all of
21:08
that re emerge. And a lot of these things, you
21:11
know, they they tend to take their time, right.
21:13
So you see the first examples of some innovative new technology
21:17
really 10 years, maybe even 15 years before it actually gets
21:20
completely adopted. So yeah, you're taking me back
21:23
to, you know, old, old days and and a lot of fun engineering.
21:28
Well, I, you know, I felt like I just had to ask that question
21:30
why he had you here. I was like, all right, you know,
21:31
this is such a cool concept back then.
21:33
And yeah, I I get it. And I thought it, you know, it
21:37
was like, oh, this is really revolutionary for the time.
21:39
And I was like, OK, I can't wait to see more of this.
21:41
And, you know, it's it's like anything else, right?
21:43
It it starts one place and then the name matures and evolves and
21:46
and and so forth. But we're not the Xbox Kinect
21:49
podcast. We're the identity podcast.
21:50
So I want to ask you about Authzen.
21:53
What is Authzen and what does that name even mean?
21:59
Yeah. So we basically, you know, let
22:03
me pick up the theme around standards in the authorization
22:06
space. So it's not like we have
22:09
enhanced standards. If you go back to the early
22:11
2000s, we had exact mole. We had other things in the
22:15
space, but we've noticed that there's a lot of innovation
22:20
that's happening with authorization over the last five
22:22
years. You have projects like Open
22:25
Policy Agent and you have papers like Zanzibar Paper.
22:28
But you know, and there's like probably a dozen different
22:32
implementations now that are all trying to solve the problem of
22:36
how do you know whether a user, Jeff, has this permission on
22:40
this object. And, you know, there's a lot of
22:43
different ways of asking the question and none of them are
22:47
interoperable. And so one of the things that we
22:49
noticed was, yeah, this kind of reminds us of the identity
22:52
space. You know, if we remember the
22:54
time where, like, you know, you had Google and Facebook and
22:57
Microsoft at its Passport and you had all these different
23:00
people that were trying to help you log in.
23:02
And it wasn't until they all kind of moved to a common
23:05
protocol that developers could say, well I'm going to write it
23:09
once and it's going to work with all these these different, you
23:12
know, Internet identity providers that was kind of like
23:16
this trigger point that really helped that industry start
23:21
coalescing, you know, the standards based identity
23:24
industry. And so we feel like the same
23:27
thing can be true for authorization.
23:30
There are a few of us that have been talking about this for a
23:32
while. Our conversation started,
23:34
actually gained steam after identiverse of 2023 and we said,
23:39
hey, let's go get together and define a charter and figure out
23:43
what where we want to do this work.
23:45
We took it to the Open ID Foundation, the same foundation
23:49
that did Open ID Connect and I'd like to say Open ID Connect was
23:53
where single sign on on the web really kind of like hit a hockey
23:57
stick, right? So if you talk to Mike Jones,
24:01
who has been around, was one of the original contributors Open
24:05
ID Connect and worked at Microsoft for many years,
24:08
they'll say that 97 or 98% of the logins that Microsoft does
24:12
are based on Open ID Connect. So incredible penetration within
24:16
the industry and we want to have our Open ID Connect moment for
24:21
authorization. And so that's why I made total
24:24
sense to bring that to the Open ID Foundation, the same
24:27
organization that you know, kind of codified Open ID Connect.
24:32
And so we started a working group there.
24:34
I was one of the Co founders and now one of the Co chairs and
24:38
we've made some really good progress on it.
24:40
The Zen, you know is a little bit apocryphal.
24:43
So we thought, Z, we need something kind of like that is,
24:47
you know, kind of rings off the tongue.
24:49
Somebody proposed Zen and I don't even remember what the E
24:53
and the N stand for, but odds then kind of stuck.
24:55
So we don't even remember what it stood for.
24:57
But you know, that's what we're called now.
25:01
Cool. Sorry, I'm gonna ask you the
25:03
hardest question of the day. Let's see how you do.
25:06
What is authorization? So authorization is the process
25:11
of determining that you have permissions to perform a certain
25:18
action on a certain resource. So in the old days, I mean
25:23
people use the term permissions to describe the same thing.
25:26
People use the term entitlements.
25:29
But you know, if identity or login or authentication is the
25:33
process of proving that you are who you say you are, then
25:36
authorization is the process of figuring out what you can do
25:39
within the context of this application based on the
25:41
permissions or the roles that you got granted.
25:44
That's a good answer. One of the things I always find
25:48
really hard to explain or even hard to answer, OK is this
25:52
authorization. So we talked about an account
25:56
that has these groups, roles, entitlements, whatever you want
25:59
to call them. Is that authorization or is it
26:04
is it authorization only when I go to try to use those things?
26:09
That's a fantastic question and really the there are really two
26:14
processes here. There is something that you do
26:17
like to set things up, right. So like you're basically going
26:21
to assign a user to a role, you know, or put them in a group or
26:26
give them a permission and that's something that you do as
26:29
an admin. Or one of the other scenarios is
26:33
you have a Google Doc and you add Jeff as a viewer of that
26:36
doc. That's the process of kind of
26:38
setting up the permissions, like granting or delegating a
26:43
permission to someone. Now the process of authorization
26:46
is actually checking. So when Jeff goes to open that
26:49
document, authorization is really the service or the
26:54
process that determines that Jeff actually has read access to
26:58
this document and therefore can open.
27:01
Yeah, I've always felt like authorization is inextricably
27:06
tied to authentication. Would you agree with that?
27:11
I think it's downstream from authentication.
27:14
The two things are often very confused and it doesn't really
27:18
help that some of the authentication you know, specs
27:23
like O Auth 2 and Open ID Connect, especially O Auth 2.
27:27
They talk about things as authorization, delegated
27:30
authorization. The idea of if I'm logging in,
27:34
you know, if I'm basically I I want to delegate access to some
27:39
application to something that Google manages for me, like a
27:42
Google doc. You know, the user basically has
27:45
to grant their permission so that process is in some way a
27:49
delegated authorization process. But Open ID Connect is just a
27:54
login process and so you know, these things are muddled
27:57
together and that's a very confusing thing.
28:01
But using an authentication system for authorization is
28:05
considered an anti pattern because at authentication time I
28:10
don't know what you can do within the system.
28:13
Like imagine for example, Google, you know, wanted to
28:17
implement authorization by, you know, at at login time, they
28:22
would say, OK, well, Jim just logged in to Google Docs.
28:25
Let's see, which documents does Jim have access to.
28:30
Could be 10, could be hundreds, could be thousands.
28:33
And somehow I'm going to go figure all that stuff out at
28:37
long in time, which shouldn't take too long, and then put a
28:41
claim in an access token that corresponds to the fact that Jim
28:45
actually has access to this document.
28:47
Well, even if you did that, even if it took a reasonable amount
28:51
of time, not like any, a huge amount of time.
28:54
As soon as you minted that access token and you tried to
28:57
use it and you tried to figure out whether Jim actually has
29:00
access to the document before allowing him access, Jim may
29:04
have like gained access 2 seconds ago, whereas the access
29:08
token may have been minted 2 hours ago.
29:10
So all of that information is by definition stale.
29:15
And so this idea of authentication really needs to
29:18
be focused on is Jim who who they say they are, right?
29:22
Can Jim prove it? Jim has a password.
29:25
Jim has, you know, like a biometric.
29:27
Jim has a passkey. Jim has some way of proving
29:30
that. Jim is Jim.
29:31
But the process of authorization really needs to be downstream
29:34
for that. Now that we know that Jim is who
29:37
he says he is, let's go figure out whether Jim has access to
29:39
this document at this time. And that's a very distinct
29:42
process in the process of authorization.
29:46
I really appreciate you going through that.
29:48
And I think for folks who you know that was going too fast,
29:52
like back it up, listen to that again.
29:55
It really breaks down the difference between
29:57
authentication, authorization. If you start running into some
30:01
of these terms that you're maybe not familiar with like claims, I
30:05
was going to throw another one out there.
30:06
Grants, you know, you hear these terms used all the time and go
30:11
ahead and look those up. Just start to educate yourself
30:14
and eventually next time you hear it or the time after that,
30:17
it'll start to make sense again. Great background, Omri.
30:24
And what I wanted to ask you next was kind of like
30:28
authorization. It's been around an identity for
30:31
as long as I've been an identity, which is over 20
30:34
years. Can you give us a little history
30:37
of authorization through the years of identity?
30:43
Yeah. I mean we can go back many
30:45
decades to mandatory access control and discretionary access
30:49
control, which are kind of like the kind of the O, GS in the
30:52
space. The idea that, you know,
30:55
mandatory would be like I'm assigning you to a particular
30:59
role as an admin and you can only do the things that this
31:02
role grants you. Discretionary is really I can
31:05
actually delegate access to some resource that I own to somebody
31:10
else, right. So those two concepts I are I
31:13
think, you know, kind of core concepts within the idea of
31:16
access control. So if you think about the old
31:19
Unix world, the old Unix world had you know everything with a
31:23
file, right? And files had user and group and
31:28
other, and then each one of those like had read, write and
31:33
execute bits. So you had a total of 9 bits
31:36
that determined access control on a file.
31:39
So for example, as a user, as an owner of the file, as an owner,
31:43
I could have a read, a write or an execute bit on that file and
31:47
then I I would have that on groups and for others as well.
31:51
And so that was the level of granularity that you had for
31:54
access control. And that was, you know, kind of
31:57
like a a simple system because everything that you needed to
32:01
secure access to at the time on a Unix system was a file.
32:05
Like everything was modeled as a file.
32:07
Everything on a Unix system or a Linux system is an inode.
32:10
And so that model was kind of a a prevalent model.
32:14
I would take through the 80s and maybe a little bit of the 90s
32:17
and then you know you start getting into directories.
32:20
So LDAP and Active Directory kind of brought in this idea
32:24
that you had users that could belong to groups and groups
32:28
could be nested. And so all of a sudden you could
32:30
say, OK, well if Jim is a member of the, you know sales group
32:35
then you know that means that he is has a a a role, a sales role
32:41
in Salesforce or in whatever application, you know like was
32:45
around in the 90s. I think Salesforce started in
32:48
the early 2000s. So you know things like
32:51
PeopleSoft or SAP or things like that, right, the good old
32:56
enterprise software days. So that was the idea of role
32:59
based access control. The, you know, the idea that,
33:02
you know, if I assigned you to a group, that group corresponded
33:06
to a role and that role gave you some set of permission.
33:09
They were typically fairly, you know, coarse grain permissions,
33:12
but they were still that's kind of like the way that people
33:15
organize. Now the problem with that was
33:17
that, you know, you ended up having lots and lots of groups
33:21
because every application defined its own group.
33:24
And so when I left Microsoft in, I think it was 2011, we had
33:28
about, let's call it, 100,000 employees and we had 300,000
33:32
groups. So no one could actually reason
33:36
about who had access to what. You know, like you basically you
33:39
had a new app, you created groups for it, you put users in
33:42
it and like you had no idea whether these groups were still
33:46
used. I mean it was kind of a mess.
33:48
And so then you've got to this idea of fine grained access
33:52
control and specifically this idea of attribute based access
33:56
control that got started in the early 2000s.
33:59
Everybody, kind of. Most people have heard of SAML,
34:01
the security Assertion Markup language that got started in
34:04
2001. The idea of essentially doing
34:07
Single Sign on on the web that, you know, kind of eventually
34:10
gave way to Open ID Connect. And that's what most most of us
34:13
use. But there was a much lesser
34:15
known spec at the time that started around the same time
34:17
called Xacmo. So it stood for XML Access
34:21
Control Markup Language. The idea was, hey, instead of
34:24
doing these roles, let's actually grant attributes to
34:28
everybody and hopefully share these attributes, right?
34:31
So Jeff has an attribute called department and you know he also
34:36
has an attribute. You know manager or not, right?
34:40
Or you know a number of different things where in the
34:43
military you could have Jeff has a top secret attribute.
34:46
And then if you look at resources, they may have
34:49
attributes too. So if you have a document that
34:52
has a top secret attribute, only people with a top secret
34:56
attribute like as part of their attribute set can actually read
34:59
that document. That makes a lot of sense if you
35:02
know all of these attributes can be shared.
35:05
But what ended up happening was I just had a last night in
35:08
reverse. Somebody came up to me from the,
35:11
you know, the defense, you know, area.
35:13
And he said, so yeah, attribute based access control.
35:16
Guess how many attributes we have on our on our principles.
35:19
He said how many. He goes, guess they say
35:23
hundredth. He goes, keep going.
35:26
I say thousands. He says keep going.
35:28
It's like 40,000 attributes and so you're not much better than
35:33
groups. You know, honestly when you're
35:35
essentially using attributes the same way they use groups.
35:39
And the last evolution of this is what I call relationship
35:43
based access control. So this is what Google
35:46
repopularized with the Zanzibar paper.
35:49
So Zanzibar is the system that they use internally for doing
35:53
active control on Google Docs and Google Drive and Calendar
35:57
and Google Cloud and bunch of Google properties.
36:00
And the idea is this kind of like remix between access
36:04
control lists and and roles. So if you've ever used Google
36:10
Drive or Google Docs, you know what I'm talking about.
36:12
So if Jim is a member of the engineering group and the
36:17
engineer group is an owner of the engineering folder and the
36:22
you know road map document is you know is parented by the
36:26
engineering folder, then Jim has a path from Jim through the
36:31
group through the folder all the way to the document that carries
36:34
that read permission. So Jim can open the file because
36:38
Jim is you know like you know kind of we walk the graph of
36:42
relationships and so you can create these simple roles like
36:47
owner or viewer or commenter or you know editor on these
36:52
documents or folders, right. And you can assign them to
36:56
people and that helps you kind of, you know create a much more
37:02
succinct way of expressing who has access to what.
37:05
So that would be relationship based access control.
37:10
And most of the companies, the modern companies in the
37:15
authorization space are now and they have some form of either
37:19
attribute based or relationship based access control.
37:22
And our company, Asserto, through our open source project
37:25
Topaz actually combines them both.
37:27
So that's, you know, the kind of the evolution in 5 minutes of
37:32
the access control models, Yeah, you know, and you brought up a
37:37
lot of points there. You brought talked about exact
37:39
Mole which you know that's really was my big exposure early
37:45
on in my identity career. And looking at that, I think a
37:49
lot of those roles that are defined within that standard
37:53
still makes sense today in terms of like policy, decision point
37:57
policy. Enforcement Point.
38:01
Enforcement point. Yep.
38:03
Enforcement Point. Thank you.
38:04
Hey, every once in a while, yeah, I read that book.
38:05
A little lapse. But you know what's really
38:10
gotten me excited recently was Policy Based Access Control.
38:16
And I'm going to throw this out there because there may be a
38:19
misunderstanding on my part. But I've always thought Identity
38:22
Systems would build an authorization model based on
38:27
data that it had within its purview.
38:30
And when you start going into a policy based access control
38:36
framework, now all the data within your enterprise becomes
38:41
available to build policies around.
38:43
So here's the scenario. You don't have within your
38:48
identity systems information about account balances, right?
38:52
That's back in some business system, but you may want to
38:56
create a role or a grouping or allow people to access something
39:02
based on the fact that they have, you know, policy balances
39:07
in excess of, say, $50,000. It's a black and white question,
39:12
but that data is outside of your realm and you don't want to keep
39:15
a synchronized copy of that data locally, right.
39:18
You just want to basically have some kind of API call a policy
39:23
around it and it's either a yes or no question.
39:26
I think that's kind of revolutionary.
39:28
And to me that was like OK, that's one of the things that's
39:31
making authorization so hot. What do you think?
39:36
Yeah, I think from so if you look at Identity, you know and
39:41
and specifically authentication, you can define it with a small
39:46
set of protocols because it's mostly you know, kind of a
39:49
fairly constrained problem. But authorization, as you said,
39:53
is really a combination of data that you have about people and
39:58
group membership and things like that.
39:59
That's like common to all these applications.
40:02
And then application specific data and you kind of want to
40:06
bring these things together. So in your example you know
40:10
things like balances. My my favorite example for that
40:12
is you have a approval limit. So managers tend to have
40:17
approval limits or if you are in the financial services or
40:20
insurance industry you may have as a claims adjuster a an
40:23
approval limit and you have an some kind of claim that comes in
40:28
and if the claim is underneath under the approval limit then
40:32
you can approve it, otherwise you can't.
40:34
And that's a perfect example of a policy based authorization
40:40
decision. Now often times these systems
40:43
are implemented using a backed models, attribute based access
40:47
control models. So the attribute of the resource
40:51
in this case the claim would be well it's 20,000 and the
40:54
attribute of the user in this case Jim the claims adjuster is
40:59
approval limit is 50,000. And so you can write a policy
41:02
that has simple logic in it that says essentially that says if
41:06
the you know claim is under the approvers limit then allow
41:12
otherwise deny. And so that's why I would say
41:16
that policy based systems have grown you know out of the the
41:23
attribute based access control world.
41:26
And the the the most exciting thing actually is you can
41:29
combine these models. So you could basically say, hey,
41:34
I want to grant Jim access to this document if Jim has a view
41:41
relationship to this document, but also if it's during business
41:45
hours or but also if Jim is not, you know, on the disabled user
41:51
list. And so those scenarios are
41:54
scenarios where you're combining this idea of relationships and
41:57
the idea of attributes, whether they are environmental
42:00
attributes or attributes about the user or attributes about.
42:04
Them, why do you think that other areas of identity have
42:07
matured quicker than the authorization space?
42:10
So I think about things like the authentication space, access
42:13
management, identity governance, administration and access
42:16
reviews and onboarding and automation and Privileged access
42:19
Management. I mean, it seems like those
42:22
areas have either matured or maybe evolved faster than the
42:26
authorization space. Is this just because this is the
42:30
way the train is built? You kind of have to start at the
42:32
front door, get people in through authentication and then
42:35
start to think about, OK, well how does that all work And then
42:37
we get to authorization. I guess what's working now that
42:41
didn't work before. That makes now the time to solve
42:44
the authorization issue. Yeah, I think that we've now
42:50
gone to the point where people are ready for this idea of the
42:54
principle of least privilege or 0 standard privileges.
42:58
These are all I I don't love to use the terms because they sound
43:01
too buzz wordy. But the basic idea here is that
43:05
most people in organizations are over provisioned.
43:09
Most people have are a member of a role that gives them more
43:13
access than they need to. They have a bunch of different
43:16
roles. This whole idea of
43:17
recertification, you know, like every year an organization goes
43:21
through every personnel and figures out whether the roles
43:24
that they have or still the roles that they should have.
43:26
And it's like a manual, error prone, soul crushing experience
43:33
for everybody involved, right? It's all because we just grant
43:38
like a whole bunch of permissions to people because
43:41
that's all we can do. And that comes from this kind of
43:45
what we call the anti pattern of using your authentication system
43:50
for authorization. So for example, if all if the
43:54
only tool I have in my tool chest is, well, Jeff's the
43:59
salesperson, so he gets to access Salesforce, that's it.
44:03
That's all I have. Like, I can do that with an IGA
44:07
system, but that's probably not everything I need.
44:11
You know, if we really want to go lock down the system, I want
44:14
to be able to allow Jeff only to access a set of records that
44:18
either, you know, correspond to, you know, kind of his customers
44:22
or his manager should be able to look at all the people
44:25
underneath them. But, you know, perhaps not
44:28
everything else. The VPS sales should be able to
44:30
look at, you know, all the forecasts.
44:33
You know, everybody should have access according to their, the
44:36
needs of their role. And today we're just not there
44:40
and that's what you know authorization systems or fine
44:43
grained authorization systems, that's the promise they they
44:47
hold. And I really do feel like both
44:49
from a capability and a technology perspective, we're
44:53
finally at the point where the technology can you know kind of
44:57
really deliver on the requirement and then you ask
45:01
where the requirement comes from.
45:03
You know I think we've all seen like a horror stories of
45:07
breaches. You know like some identity got
45:10
breached. It was over provisioned the user
45:13
the the you know kind of the the the the actor was able to
45:18
penetrate the system do a lot more than they would have if the
45:22
user had a much smaller set of privileges.
45:26
And so that's why I think organizations are starting to
45:29
get really interested in OK so how do we really solve this
45:32
problem of like over provisioned access OMRI one of the OK so
45:38
identity is about ensuring that three people have the right
45:41
access having a one place to go to new has access to what And I
45:45
kind of feel like when that access is very dynamic maybe
45:50
that paper trail isn't there. That's a concern for me.
45:54
I I well I think we can be more secure by making it more
45:58
dynamic. I I worry that there's a a
46:02
disconnect in terms of the audit trail of who had access at this
46:07
specific moment in time. Yeah, I think that's an
46:10
excellent observation and in fact most of the authorization
46:15
products I know make it a point to gather fine grained decision
46:20
logs. So every time APDP policy
46:23
decision point in the parlance makes a decision as to whether
46:27
Jim you know has access or not, it will log that.
46:32
It will basically say it was Jim, this is the policy we used.
46:36
This is the version of the policy we used.
46:38
This is the data that we used to make that decision so that you
46:41
can actually have full audit trails for compliance and for
46:45
forensics. So if Jim's, you know, identity
46:49
was compromised in some way and somebody came in and tried to do
46:53
some things, we don't just know that you know, like the, you
46:57
know, the bad actor logged in. We also know exactly what they
47:00
did and what they were granted access to and what they were
47:03
denied access to after the fact. And you can, you know, project
47:08
that forward even more and say, OK, well, in the age of AI, we
47:12
could actually go do some, you know, kind of anomaly detection
47:16
and go, huh, well, it looks like we can derive some risk signal
47:21
because Jim, the engineer just logged into the sale system.
47:25
That doesn't sound right. So let's actually go, you know,
47:30
kind of add that signal to the decision process in the policy
47:36
decision point say, hey, you know we're going to flip a bid,
47:38
you know like suspicious and start failing some of these
47:42
authorizations in real time. So I think having a real time
47:46
system that has a data exhaust that you can actually use both
47:49
reactively and proactively really does help you with.
47:53
This problem it strikes me that the more back you get into this
48:00
meaning you know I think everybody's familiar with RBAC
48:03
and roles and sort of that's where we've been.
48:04
But now we're looking at things like attribute based access
48:07
control, policy based access control, relationship
48:11
relationship based access control that those backs require
48:17
technology to keep that footprint in place, to keep that
48:20
audit trail in place, to keep you know the receipts and to
48:23
make this manageable for people. Which leads me to my, I guess my
48:27
second thought here is that what is the responsibility or the
48:31
maturation of applications and do they need to be constructed
48:36
in a way that they do support these this level of granularity
48:39
with permissions? Because you know the the old
48:42
days, right? Like we're all old here, it's
48:44
like 20 years ago, 10 years ago, right.
48:45
Apps were built on, you know, yes, no or a single group.
48:50
But now you see some advanced applications notably like ERP
48:54
applications for example have these giant matrices of yes,
48:58
this role can do these specific transactions or functions,
49:01
whatever it may be. It was almost like it was
49:03
designed for attribute based or policy based or relationship
49:07
based access control where some applications just they can't
49:11
support that and so either you have to create a number of
49:15
groups to support that which you know, maybe that's maybe that's
49:19
what happens a lot of times or maybe it's just not the right
49:22
fit from a control method to use for that specific application.
49:25
I guess what are your thoughts on that idea of like, OK all
49:29
this sounds cool but I'm definitely going to need need
49:31
technology. This is not something I can keep
49:32
track of a spreadsheet or you know, do manually and be
49:35
scalable. And do I need applications to
49:38
also be written in a way that they can do fine grained
49:41
authorization? Does that make sense?
49:43
Absolutely. And I think you hit the nail on
49:45
the head. If I think back 1015 years ago,
49:49
everybody kind of did login on their own, right?
49:51
Like they built that into their app.
49:54
There was no, no, I, no such thing as externalizing your, you
49:58
know, your authentication. So every application did it
50:02
differently. Now, once you introduce
50:04
standards, all of a sudden you at least had a shot of having,
50:11
you know, kind of a single way of doing it.
50:13
That wasn't enough, though. It wasn't until developers
50:17
incorporated that into their applications that you really
50:22
ended up with. Like imagine a world in which
50:25
you had Okta, but you didn't have any applications that
50:30
talked to the protocols that Okta talks to.
50:32
What good would you would your single sign on system be?
50:35
Not not so very good, right? So there's got to be a tipping
50:38
point where enough applications are compliant, so to speak, or
50:43
integrate within with your bus with your authorization control
50:47
plane for that authorization control plane to make sense.
50:50
And that brings us all the way back to the world of standards.
50:54
How do you actually get to the tipping point?
50:56
Well, you have to convince developers that building that
50:59
using an externalized authorization system, it's
51:02
actually less work than building all of that spaghetti logic.
51:07
The if statements, the switch statements, the stuff that's
51:10
completely unmaintainable, The stuff that really kind of hurts
51:13
your soul when you have to, like, change it instead.
51:18
Like if you delegate it to an external system and you have
51:22
those authorization rules really written as a set of rules, as a
51:27
policy, all of a sudden you get out of this game of having to
51:30
like maintain all this logic. And from what we like, from what
51:35
we've read like 10 to 20% of application logic is like this
51:39
crazy authorization logic. So developers don't want to do
51:43
it right. Like have you ever heard a
51:45
developer say, hey, I want to build rules in RBAC into an
51:48
application? Said no developer ever, right?
51:51
They just don't have the tools to be able to do it.
51:54
And so there is a chicken and egg thing here.
51:56
And if we give them better tools that like work with a bunch of
52:00
different vendor systems, then we now have a shot of having
52:04
developers join the party. And once the developers join the
52:07
party, then that gives you the ability to say, OK, I have a
52:10
single authorization patrol plane that I can use to control
52:14
the entitlements or you know, kind of the permissions of
52:16
multiple applications. That's the vision that we're
52:19
trying to, you know, kind of drive towards and it sounds
52:23
like, you know, kind of pie in the sky, far off vision.
52:27
But I'll remind you that 10 or 10 years ago, 15 years ago, we
52:30
didn't have things like Open ID Connect and every app did log in
52:33
its own way. And so we were back in that like
52:36
crazy world where like admins had to like manage you know, end
52:41
different, you know, like credentials for all their users
52:45
because none of these systems talk to each other.
52:48
So yeah, that's exactly what we're trying to to to go and
52:51
your observation is exactly on point that developers had to
52:55
have to to get on board and the only way they get on board is if
52:59
you make it easier than if they just did the path, the previous
53:03
path of least resistance. Yeah.
53:06
E 0 And they and they see the benefit of doing it right.
53:09
Exactly. And if you ask me why it hasn't
53:12
happened yet, it's exactly because it's been too hard.
53:15
I mean you go back and look at exact.
53:17
I mean it's a bunch of XML like my team worked on it.
53:20
So I can say this, but it's a language that only a mother
53:22
could love, You know, I mean it's no developer, let's
53:25
actually write that, the angle bracket.
53:28
So I think that's where, where where we have better tools now,
53:32
right. So and we really appreciate the
53:35
time that you've given to us and our listeners today.
53:39
A large portion of our listeners are the I am practitioners of
53:44
the world. In other words, they're making
53:47
this stuff actually work in the real world.
53:51
And what I'd like to do ask you to do is kind of like put
53:55
yourself in their shoes and kind of talk about a right sized
54:00
approach to authorization. So imagine you, you just got the
54:04
job of your dreams, the company that you love.
54:07
And you're going to, you're supposed to go in there and get
54:12
authorization humming. And the first thing you come in
54:18
is to realize that there is, like the authorization today is
54:22
just a bunch of Active Directory groups.
54:25
They're a total mess. You know, maybe there's an IGA,
54:29
but it's not doing any kind of R BAC.
54:32
There's no any kind of advanced authorization tool.
54:36
What what's kind of that maturity cycle look like?
54:41
Yeah. So I'm a big believer in you
54:43
know kind of building things incrementally.
54:45
So the first thing is you got to, you got to understand where
54:49
you're at and start there. And most organizations, if they
54:53
have anything at all is going to be some group based RBAC thing.
54:57
They have an Active Directory or an Azure AD or something, you
55:01
know an held app or some you know way of managing users and
55:05
groups. And that's a good start.
55:07
You know like that that's that's a place where you can at least,
55:11
you know start from and if you then have a a couple of
55:16
Lighthouse applications start small.
55:18
Start with like an app that you know that you can actually
55:22
control and say you know what, we're going to go build an
55:25
authorization system for my organization now and we're going
55:31
to start hooking up some apps to it.
55:33
And you know, if you could basically have a very simple
55:37
onboarding for your developers and you say, OK, well, you know,
55:41
you're basically going to talk to this authorization system to
55:45
get whether like to, to get whether this user is a member of
55:49
this group. Now you have this clearinghouse,
55:51
this, you know, kind of authorization service that
55:54
becomes the Nexus for making these decisions.
55:57
And for every application you can basically create its own
56:01
model. So you know, some applications
56:04
have, most applications are going to have users and groups.
56:08
But some applications are going to have, you know like if it's
56:11
an applicant tracking application, it'll have
56:13
candidates and it'll have job description.
56:16
If it's an ERP system, you know it'll have whatever products you
56:19
know you have or you know, you basically will create a model
56:24
for each one of these things and you'll be able to assign those
56:28
users and groups to, you know, kind of the, you know, kind of
56:32
be owners or viewers or editors of those particular assets, you
56:37
know, within the system. So I think that the work here is
56:41
not to like try to do this Big Bang thing and take five years.
56:45
It's to just basically start with this idea that we're going
56:48
to centralized our authorization models and like go work with,
56:54
you know, some number of applications that you have
56:56
control over or or at least influence over and see if you
57:00
can get some quick wins. And a lot of customers that we
57:03
work with have done exactly that.
57:05
They'll have a Lighthouse app. They'll prove out the concept.
57:08
They'll then say, OK, now we're going to build more apps around
57:12
the central authorization system and they'll that's how they'll
57:16
kind of build success. What's a Lighthouse app?
57:21
Lighthouse is. I mean, maybe it's a Microsoft
57:24
ISM, but we used to say like this is kind of like the
57:27
exemplar or kind of like everybody knows this app.
57:31
Back in Microsoft, we used to have this app called Head
57:33
Tracks. Head Tracks was like the way
57:35
that you the corporate directory viewer, right.
57:38
So everybody knew what head Tracks was.
57:40
And so if you could get head Tracks to do something, if you
57:43
could get it to like do a single sign on through Azure Active
57:46
Directory, boy, that was something because everybody in
57:48
the company used head tracks every day.
57:51
And so you know, like if you could get like one of those, you
57:54
know, kind of very popular, very well known applications within
57:58
your environment to be able to support something new, then that
58:01
shows people the way and it now shows them the benefit of using
58:04
one. Hence the hence the lighthouse,
58:07
right. Shining the light exactly.
58:11
So you've been generous with your time and and I promised
58:13
that we'd let you get on with your with your day and your
58:15
evening. We were talking before we hit
58:18
record and you mentioned that you are into Kung Fu, which I
58:25
find super interesting. We we've had martial arts kind
58:27
of on the show before. I think I've mentioned I've
58:30
studied Taekwondo way a long, long, long time ago, so I've
58:33
probably forgotten everything at this point.
58:36
But I want to ask you about Kung Fu, I guess.
58:39
How did you get into it? And then how it has it
58:41
influenced other areas of your life?
58:43
Is there some sort of process that kind of has permeated
58:47
beyond just what you've learned at Kung Fu and said, oh, I can
58:50
take this into this other aspect of my life?
58:54
Yeah, I got into it completely randomly.
58:56
I was on a sabbatical for Microsoft and my wife decided I
59:00
was going to do, you know, a few different things, but none of
59:04
them included a computer. And so I she signed me up for
59:09
two weeks free. You know, Kung Fu classes at a
59:13
local Dojo. That was just getting started
59:16
and I didn't really know what I want want to get out of it.
59:19
I just thought it would be cool and really kind of fell in love
59:22
with it. And so it's interesting.
59:26
One of the, like the journey has been kind of an interesting
59:29
journey. I when I tested for my black
59:33
belt test, I failed that test. And I remember the, you know,
59:38
the, the, the Sensei's, the masters that were testing us,
59:42
the black belt, which is a big deal.
59:43
I would like it took, you know, five years to get there and it
59:46
was a very long test. It was like 7 or 8 hours, very
59:50
physically demanding. And they asked me, you know,
59:54
kind of at the very end, would it, you know, would you feel
59:59
like it was all worth it if you if the belt that we put in front
1:00:02
of you is a black belt or the same belt that you had before.
1:00:09
And I kind of had to think about reflect and I was like, you
1:00:12
know, it really is about the journey.
1:00:14
Of course I want to get the belt, but it's not about.
1:00:17
The result or it's not about the destination, it's about the
1:00:20
journey. And I could, you know, like load
1:00:23
myself with a straight base and say no, like if I don't get the
1:00:26
black belt, then I actually feel like you have good quality
1:00:29
control and you know that that that I just want to keep going
1:00:35
at it and get better at it. It turns out that they there are
1:00:38
two other people that tested for their black belt and all of us
1:00:40
failed the test. They, you know, they wouldn't
1:00:43
quite come out and say you failed.
1:00:45
I'm like, oh, it's cool. You told me I failed.
1:00:47
Like, I'm good with that. Like I what I want is I want you
1:00:51
to help me kind of figure out how it's better.
1:00:54
And that happened to me for my third degree test as well.
1:00:57
I just got my 4th about, you know, I think it was two or
1:01:00
three years ago. So I've been on this journey for
1:01:03
going on 20 years now. But it really is about the
1:01:05
journey and the belts matter a lot less than, you know, kind of
1:01:09
developing as a martial artist. And I think that's a great
1:01:12
metaphor for, like, you know, certainly in my career I've had
1:01:16
times where I've, I was obsessed with this promotion or with this
1:01:19
job or whatever. And Kung Fu, I would say, helped
1:01:23
me kind of contextualize that and go, you know, really life is
1:01:27
a journey. It's really about all the
1:01:30
experiences you can gain as a startup founder.
1:01:33
You know, you have to have that kind of mentality because
1:01:37
there's a lot of highs and a lot of lows.
1:01:39
And you got to make sure that you're in it for the journey
1:01:42
because you're not in it for the glamour.
1:01:44
You're not in it for the money for the most part, unless you,
1:01:46
you know, got to somehow manage to, you know, to hit a home run.
1:01:51
So what are you in it for? You're in it for the journey.
1:01:54
And I think I definitely internalized that from from Kung
1:01:57
Fu. Well, yeah, I mean if everybody
1:01:59
has a black belt, then what's the, you know, it doesn't really
1:02:02
signify anything at at that level.
1:02:05
I think one of the things that I learned, you know, going through
1:02:07
the tech window side was discipline and consistency.
1:02:11
And you know, I I only did it for a few years kind of
1:02:14
actively, but you know, it was the best shape I ever got in my
1:02:18
life, that's for sure. But the idea of day in, day out
1:02:23
repetition and you may not see results in a day or two days,
1:02:29
but then all of a sudden you look back and that journey that
1:02:31
you mentioned a month later, two months later, three months
1:02:35
later, it's like, oh wow, I I, you know, I I could only kick so
1:02:39
high now I can kick this high or, you know, I could only
1:02:42
develop this much force with a certain type of strike.
1:02:44
And now I'm developing so much force or I'm not just hurting
1:02:47
myself. We used to have a saying, I
1:02:48
don't know if this is true from from your studies as well, but
1:02:52
the most dangerous belt in the world is the white belt because
1:02:54
you don't know what you're doing.
1:02:55
I don't know if there was something similar on the Kung Fu
1:02:58
side, but we talked about that in Taekwondo a lot.
1:03:01
Was there something similar on the Kung Fu side?
1:03:04
I I my favorite phrase is a black belt is a white belt who
1:03:08
never quit. That's a good one.
1:03:11
That's a good one. Jim.
1:03:13
What about what martial arts that you have you worked on,
1:03:15
Jim? No martial arts.
1:03:18
But when Omri was telling his story, it kind of reminded me of
1:03:21
when I was in my MBA program. And I remember taking the first
1:03:25
couple of classes and thinking if I could just give them the
1:03:29
$60,000 and they would give me to the degree, I would take that
1:03:33
deal. Then by the time I got to the
1:03:36
end and took me 6 years to finish it, I said the only thing
1:03:40
that matters is what I learned. You can take the degree off the
1:03:44
wall, throw it in the trash. Really.
1:03:46
Because nobody cares that I have.
1:03:48
An MBA, right? I mean it's.
1:03:50
It's nice and all. It looks good on my wall, but
1:03:53
it's what I learned during that process that made it what it's
1:03:58
that got me thinking of. What's that?
1:04:01
I said there's different ways to learn, too, right?
1:04:02
For you, your path was an MBA. And for some people, that's not
1:04:06
the path. Like, they learn other ways.
1:04:08
And I think you just threw something really important
1:04:10
there. It's like the paper on the wall
1:04:12
is nice, but it shouldn't be like, oh, this is how you
1:04:14
certify that you know it, right? Omar, you talked about like the
1:04:17
black belt. I was like, you knew it.
1:04:18
You know, maybe there were things that weren't quite up to
1:04:21
black belt level at the time, but it's not like it's not like
1:04:24
you forgot it when you didn't get it right.
1:04:26
You still knew it. And I would imagine the same
1:04:28
thing for you. Jim's like you still knew it.
1:04:30
Yeah, yeah. So what was worth was how it
1:04:34
changed me. And then my other thought was
1:04:37
what I'd like to do for fitness is work out and there's really
1:04:41
no like trophies or recognition for working out.
1:04:46
And as I've changed, and I've I've changed a lot in 10 years,
1:04:50
right, I see that in myself. The working out really hasn't
1:04:54
changed, but what I get out of it change has changed over time
1:04:58
and what I get out of it nowadays, it's going to sound so
1:05:01
simple. I just like doing it.
1:05:04
I just like working out. Like to feel?
1:05:07
The burn. So it's my enjoyment.
1:05:09
I do it for enjoyment and I'll never get a trophy or I'll never
1:05:12
get any recognition by somebody else.
1:05:15
And nobody 30 years from now is going to be like, oh man, you
1:05:18
used to work out so great. I just do it because I enjoy it.
1:05:22
And that that's not, you know, when I first started, I was
1:05:26
like, oh, I feel overweight and I want to look a certain way.
1:05:30
And then it evolved to, well, now I'm actually starting to
1:05:34
look better. Now I want to feel better,
1:05:36
right. There's some aches and pains in
1:05:38
my body, and we're want to work on that.
1:05:40
But now it's gotten to the point where I just do it for fun.
1:05:44
And I think a lot of people will be maybe not surprised, but this
1:05:47
is something that's always impressed me by you, Jim.
1:05:49
I'm going to give you a compliment is your consistency
1:05:52
to it. Like, you know, we've been on
1:05:54
the road traveling. You know, we work all the time
1:05:57
together and it's like, OK, day's over.
1:06:00
Jim goes and does this work out whether we're traveling on the
1:06:02
road or whatever and then we meet up for dinner kind of after
1:06:06
that. But you put in the time, you put
1:06:07
in the work even, you know, even when it's maybe not convenient.
1:06:10
Which which is really admirable. I think thank you, thank you.
1:06:14
And I think that's, I think that's important.
1:06:17
If you really want to get good at something, it's consistency.
1:06:20
Like, I know you were doing a lot with the guitar and I think
1:06:24
if you just stay with it for whatever amount of years it
1:06:27
takes, you're going to like knock yourself out with how far
1:06:30
you get with it. See, that's my problems.
1:06:32
I'm not consistent with it. And you know, the one thing I
1:06:34
have been consistent with is learning how to, like, edit.
1:06:36
So, you know, doing audio editing and, you know, starting
1:06:39
to do more video editing. Now I've gotten better at it.
1:06:41
Sure, right, you. It's like, you know, you put the
1:06:43
hours and the time into it. Of course, you're going to learn
1:06:45
a few things. And if our listeners or our
1:06:48
viewers can do one thing to recognize the awesome job that
1:06:52
Jeff's doing is like subscribe, do all those things.
1:06:57
Yeah, do all that fun stuff. All right.
1:06:58
Now we're starting to, like, get beyond where we want to be.
1:07:01
We're over an hour. Let's go ahead and wrap it up
1:07:04
for this week. Omri, thank you so much for
1:07:06
being part of the conversation. I'll have links in our show
1:07:09
notes to to connect with you on LinkedIn.
1:07:11
I'll have a link to assertoaserto.com so you can
1:07:16
check out more about that. I'll have links to the Open ID
1:07:18
working group that we just talked about off Zen, as well as
1:07:21
the Google Zanzibar papers so people can check out what that
1:07:24
was about. And of course, links to all of
1:07:26
our discount codes and all that good stuff.
1:07:28
And for Jim and I, So you can reach out if there's questions,
1:07:31
comments, concerns, complaints. If they're complaints, send them
1:07:35
to the gym. Now I'm just getting sent to
1:07:36
either of us, you know, We'll be happy to take the feedback.
1:07:38
And yeah, like subscribe to all that fun stuff on whatever
1:07:41
podcast platform you're listening to.
1:07:43
If you're watching this or listening to this on YouTube, do
1:07:46
it there. We're on the web.
1:07:47
idacpodcast.com, Twitter X, whatever.
1:07:50
It's called. IDAC Podcast Mastodon.
1:07:53
IDAC Podcast at Infosec dot Exchange.
1:07:57
What else we got? Our LinkedIn channel.
1:07:58
We have our YouTube channel. Yeah, connect with us any number
1:08:02
of ways. But yeah, feel free to like and
1:08:04
subscribe so you don't miss anything.
1:08:05
All right, enough self promotion.
1:08:06
We're going to wrap it there. Thanks everybody for listening
1:08:09
and we'll talk with you all in the next one.
1:08:14
You've been listening to Identity at the center.
1:08:17
We hope you've enjoyed the show. Make sure to like, rate and
1:08:21
review and we'll be back soon. But in the meantime, hit the
1:08:25
website at identity@thecenter.com.
1:08:29
See you next time on Identity at the center.