Latest / Identity at the Center / #194 - IAM AMA with Martin Kuppinger

Transcript

#194 - IAM AMA with Martin Kuppinger · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity of the
0:26
sender podcast. I'm Jeff.
0:28
And that's Jim. Hey, Jim.
0:29
Hey, Jeff. How are you?
0:30
Happy New Year? My man happy New Year.
0:33
Feels like forever. Since we've done one of these at
0:35
least a couple weeks for sure. Yeah.
0:39
But you have to, you have to get the cobwebs out.
0:41
I was wondering Jeff. Did you get a nice Christmas
0:44
gifts? You know, I did go nice wallet
0:47
for my wife. I am a terrible person to shop
0:50
for because I'm one of those people who just if I see
0:52
something, I just buy it. So I did get a wallet for my
0:56
wife, the proverbial Snickers bar every year, which I'm a huge
1:00
fan of Snickers bars. So yeah, it was, it was good
1:03
about yourself, I did. But but first, just the wallet.
1:07
I can't see you with like, the big George Costanza wallet with
1:11
a bunch of coupons. Like you're a cashless guy, I'm
1:15
picture. Some kind of high-tech wallet
1:17
that blocks the ability to scan your chip cards and all that
1:22
jazz. Of course, for those interested
1:25
I have a ridge wallet now, so one of those with an air tag
1:29
connected to it. So if I lose it can kind of find
1:31
it. But yes, a very very slim.
1:34
You know. I don't like to have the that
1:36
the jit the big George Costanza, you know, like it's like a
1:39
library book. You got your back pocket.
1:43
Yeah, you keep in your back pocket, then 30 years down the
1:45
The road, it's got back problems.
1:47
Yeah, exactly. Sitting on it or when you sit on
1:49
it, like you're sitting at an angle.
1:51
Well, my beautiful significant. Other Denise got me, 100
1:55
identity at the center. Stickers vinyl stickers, which
1:59
we can give out a conferences this year and to guess.
2:02
So I guess we can say this episode was sponsored by Denise.
2:06
All right, well, thanks Denise, appreciate that.
2:08
They look good, right? I mean it's our logo, it sticks
2:11
onto stuff. It's a sticker needs.
2:13
No more introduction. I think right?
2:15
Yeah, yeah. Ellis T, dishwasher proof to at
2:18
that. So if you want to wear in the
2:20
dishwasher that would be okay. Mark a shower with it.
2:23
I guess you know whatever you do with the sticker is totally your
2:26
business. We don't judge we don't care
2:28
exactly what else we got going on over the break.
2:33
We finally joined the feta verse and created a mastodon account.
2:37
So now we are at idac podcast at infosec dot.
2:41
Exchange seem to be like we're most people were sort of
2:44
gravitating towards from the ND space.
2:46
So now we're over there still kind of learning the ins and
2:49
outs of it. I realized my first posts, the I
2:53
do like the little videos and stuff like that.
2:55
The dimensions were way off like they use, they use a totally
2:58
different aspect ratio, then Twitter and like, LinkedIn and
3:02
others sigh. It was like, trying to mess
3:03
around with the app, but yeah, you'll find us now on Macedon at
3:07
IDC podcast at infosec data Exchange, in addition to Twitter
3:12
at DDC podcast, Website has our has all our info and stuff like
3:16
that, but that was, that was something new.
3:17
We also started, I know you're not big into the social side gym
3:20
but we're on Mastodon though. Okay, I'll be right there.
3:27
Hey, I also wanted to mention our friend friend of the show
3:31
Espen Bago reach out to me over the break and he's written a
3:36
Blog on the ID Pro website called words of identity.
3:39
So it's really kind of a meant to be like a go to Index of kind
3:45
of popular I guess for outside of our industry there Buzz terms
3:50
for inside of our industry, they're just a lingua Franca and
3:55
the idac podcast is cited as a source for how he came up with
4:00
some of the definitions. So it's pretty proud of that
4:03
will put the link to that blog in the in the show notes as
4:07
well. Yeah, it's like a dictionary for
4:11
Stuff. Mutt.
4:11
Who knows, right? Maybe we'll actually all agree.
4:14
Three, same definitions for stuff in a dining space.
4:17
We'll see. It's called a mess.
4:18
I know. So, so definitely thanks to
4:20
Aspen for that. What else we got going on this
4:23
year? We got a lot going on with.
4:25
So, we've got some upcoming conferences.
4:27
We've got the gardener, I am Summit in March will be there.
4:32
Are you looking forward to that I am.
4:34
This is a big one because we're actually going to be on stage.
4:38
Bringing the identity at the center podcast show to a live
4:42
studio audience. It will be something.
4:44
It will be very cool, very different.
4:45
I think hopefully for from a Gartner, a perspective we're
4:48
going to have Henry K on. I think we're going to have
4:51
Becky as well. Who knows what else is gonna
4:53
happen? But the idea is that we're going
4:55
to actually have and the episode style present, not presentation,
5:00
just assigning a fireside chat because there's never a fire on
5:02
the pill on the stage is based are just going to bring Lake
5:06
hopefully not okay. No fires.
5:08
Yeah the only fire will be how hot the show is, right?
5:11
But yeah, the idea is to bring it up, you know, basically,
5:13
Really treat one of the sessions like an episode and we'll have
5:17
some questions and stuff that we'll be asking the analysts
5:20
we've been told that we can ask pretty much whatever we want so
5:23
we might get some tough questions.
5:25
I think we'll probably solicit from our listening audience.
5:28
If there's any questions that you would love to ask a Gartner
5:30
analyst, you don't send it to us on LinkedIn, Twitter, Mastodon,
5:34
whatever. Maybe we're.
5:37
If you want me to see if you want me to see, do don't like
5:40
then? Yeah, exactly.
5:41
But I linked it so, yeah, it's gonna be very exciting.
5:44
That's Africa. We were kind of their
5:45
unofficially last year and they took notice which is very cool
5:48
and reached out. And that's why I think one of
5:50
the big things that we're working on over the break is to
5:53
get that worked out how to finalize the cell.
5:55
Very cool to Enrique is invited us as well as the rest of the
5:58
Gartner crew and yeah, hopefully put on a rock and show and make
6:02
it a thing. So that was in March.
6:04
I Denver's is in May. Yeah.
6:09
Will almost surely be there? We don't have any fixed plans at
6:13
the moment, but But I did notice.
6:16
Yeah, it got the hotel booked, but that, yeah, that's that's
6:20
step one. So we'll have more info on that
6:22
coming out in the future. I'm sure what I did notice is
6:26
that the call for speakers is already open.
6:29
So if you got an idea for a presentation, you're interested
6:33
in, you know, presenting it at, I Denver's get out to their
6:37
website and submit that presentation.
6:40
I also saw friend of the show, Vittorio Bertucci put out Post
6:45
on LinkedIn saying that anybody who needed help putting their
6:49
idea into the, right format for a call for speakers, he would be
6:54
more than happy to help. So I would take him up on that
6:57
offer. He's a great guy and be crazy.
6:59
Make that connection if you don't already have it plus, I
7:02
mean, he speaks at every conference I think he knows what
7:04
he's doing when it comes to getting his papers accepted.
7:08
He's a real Pro, but the Tory is good people.
7:10
I always enjoyed my conversations with him and, you
7:13
know, he gives the A lot back to the community, he's got his own
7:15
podcast. He does all these speaking
7:17
engagements. He's very active on social and
7:20
Ida Pro stuff like that. So shout out to Vittorio.
7:23
He's one of the MVPs definitely for the identity space.
7:26
Yeah, absolutely. And then the, the last one that
7:29
I wanted to mention was the European identity and Cloud
7:32
conference in May and we have a great guest on for that today in
7:38
Martin cooping her. But certainly, if you're in
7:42
Europe or you can get Approval to travel to Europe who wouldn't
7:46
like to do that. Certainly, that's one of the top
7:50
conferences available as well. And I think we're to get into
7:54
that with Martin, so we'll talk to him in a moment about see, I
8:00
see, yeah, it's a great segue, why don't we go ahead and
8:02
introduce Martin Cooper anger. He's the founder and principal
8:05
Analyst at coopering ercole analysts.
8:07
Welcome back to the show. Martin welcome, try from trim.
8:11
Pleasure to be back. Yeah.
8:13
So it's been a while. I'll look see, this is episode.
8:15
I think will be 194 you were with us back on episode 106,
8:20
which would have been August in 2020 once about a year and a
8:22
half or so. I'm not going to ask you to go
8:25
through sort of like your origin story.
8:27
Like we always do with our first time guests because this is now
8:29
your second time with us, but what has been happening in your
8:33
world since that you know, that that last year or so what's been
8:37
going on in the world of cooking or coal and Martin Cooper near
8:40
specifically? Yeah so we Growing, I'll touch
8:45
ya. See in a minute, I am able to
8:48
concentrate more on my research account, which is refund, got
8:52
rid of some of the management tasks.
8:54
And that is really, really great things.
8:56
I really can focus on what is most time to me, which means
9:00
doing things like podcasts, writing, research, and thinking
9:04
about identity management and working on some, some ideas,
9:10
some aspects, how we will publish a lot of tough around
9:14
that. And with all the evil you've
9:16
been going on, the identity is based, there is, there's a ton
9:19
of stuff to think about it, as well as cybersecurity.
9:22
I also trust, finishing a piece on data quality data
9:26
integration, which seems to be a bit away from Identity.
9:31
But at the end, it isn't because at the end we have identity
9:34
management. We have access governance is
9:36
part of it and access governance is also very close to data
9:40
governance of the things I'm doing in the data space where we
9:42
are doing it today, space. Have a lot to do with data
9:45
governance like catalogs. If you don't know where the data
9:47
is, you can't govern it. You can't protect that, you can
9:50
secure it. So reaching out of branching out
9:53
a bit but still always around our our core topic.
9:57
So this is what we are doing basically and I trust, spend a
10:01
week skiing in Switzerland, had snow in contrast to I think many
10:05
of the errors ski resorts in Switzerland, so the weather
10:09
conditions weren't wearing that girl snow conditions weren't
10:12
that good and Ours. Still not good in the Alps, but
10:16
we were lucky and could ski all days.
10:19
So it was a lot of fun and few people because most didn't come
10:23
for skiing. It's got to be nice to have a, I
10:27
mean, first of all, to get out there and go skiing but when
10:29
it's not crowded, right? And he get sort of like the out
10:32
on the mountain or the past sort of to yourself maybe a little
10:35
more than maybe you're used to. That sounds pretty cool.
10:38
You know, you guys put out so many good pieces of research
10:42
articles That the different reviews that you guys do and
10:46
Analysis of the space. I guess I'm not going to try and
10:50
even articulate, what Google does.
10:54
But for those who I guess, maybe are living a rock.
10:56
I can't imagine people who are listening to the podcast, maybe
10:58
aren't aware but for those who aren't, I guess, what is like if
11:02
you had to describe Coomer cool analyst to somebody who is not
11:05
familiar with the work. How would you describe that to
11:07
somebody? So I think what makes us a bit
11:10
unique are two things. The one is, we are one of the
11:13
very few European analyst companies, which means we look,
11:19
we've all globally, we take a club or perspective, but we
11:22
surely have a bit more inside, maybe sometimes than into your
11:26
office and then other regions. Yeah.
11:29
Uh, turkey at our point is we are, we are a boutique and
11:32
listen to sense of it. We're still very focused.
11:34
So our topics, our identity, and cybersecurity and some parts of
11:38
the data's in AI space. As long as they relate in the
11:41
one other way, was identity. For cybersecurity.
11:45
So this makes us I think a bit but unique with this focus on of
11:49
covering everything but being really targeted at these areas
11:54
and doing this for close to two decades right now.
12:01
Yeah so that's that's what we do at the end.
12:05
Is there a favorite piece of I don't know research or type of
12:09
output that you put out there because I know there's a lot
12:12
that you do, I think of things like, you know, Better analysis
12:15
or, you know, future kind of think pieces.
12:17
But is there a spot that you really like to be in?
12:20
So if any of us a lot of very much like the leadership combust
12:24
format, which is our way to look at market, segments to compare
12:29
the vendors, and their offerings to rate them.
12:32
So this is, I think surely one of the most valuable for maxim.
12:37
I frequently hear that this that people like to sort of the
12:40
density and the amount of information sources These are 50
12:44
70 or sometimes even longer more pages.
12:48
Documents are really, really large documents with a lot of
12:51
detail, but I think it was a very, very valuable is to listen
12:56
to the audio podcast of Matthias, my colleague, who runs
13:00
our own equipment, call Alice podcast, where he talks was an
13:07
analyst so it's more could be a cold.
13:10
People talking was Kubiak old people, but I think still still
13:13
in Interesting. These are some of the pieces of
13:18
writing. There's a lot of the block and
13:19
we use section as well. What are you?
13:24
Yeah, let me let me add to that. That I want to give a shout out
13:27
to Matias and his podcast. I think it's one of the best
13:32
offerings out there right after identity.
13:35
Its Center, of course, but now he does a fantastic job.
13:38
I've heard you on the podcast several times, and it made me
13:41
also think about the comment you made of Unloading some of the
13:45
management tasks so that you can focus more on being like the
13:48
chief analyst, if you will, which I think is fantastic.
13:52
Because I think are the things that the identity space, Maybe
13:59
maybe all areas of it but it's like, you build all this
14:02
expertise in this in this area of subject matter I didn't
14:08
access management and then the career path becomes that you do
14:12
more management tasks and then you get further and further away
14:14
from things but it seems to be everybody who does that.
14:18
It just has a yearning to get back in there and like and live
14:22
that stuff. I was wondering what your
14:25
thoughts were on that comment but Also, you know, specific to
14:30
hey, you've got all these analysts, who write the, the
14:34
white papers, and the the briefings, what is your, what is
14:40
the role that you take, in terms of of those writings?
14:43
Do you edit them to are you like Hands-On and creating them or
14:48
how does that work? So I have right?
14:50
Some of the stuff myself and I like doing that.
14:56
I also take a roll so we call it a bit mentorship for for the
15:02
younger analysts. So, to regularly meet with them
15:05
and talk about what is on their desk and how to do it best and
15:09
giving them sort of sort of transferring my experience and I
15:15
think editing and stuff like that, as this distributed across
15:18
a lot of shoulders. But about it's also part of me
15:21
specifically, for younger analysts.
15:23
I'm known for providing a A lot of detailed feedback at the
15:28
beginning, but not in the sense of this is wrong.
15:31
But in a sense of I would do it that way because of, and I think
15:35
this is very important this explanation of why I would do
15:40
that way or that way, or some discussion and accepting that
15:43
some say, okay, maybe that's there are better ways because
15:46
there are better ways. And so this is, this is part of
15:49
my role here. So, talking with a lot of
15:51
people, but also writing some stuff, supporting my team.
15:57
And yeah that feels my day. Yeah yeah.
16:01
So I mean you guys are known for the leadership Compass.
16:05
You're known for the EIC but I'm not sure how many people know
16:10
about some of the other webinars that you do that are wouldn't
16:14
call them ad hoc but I mean you always have a list of like hey
16:17
here's upcoming webinars that are free.
16:20
So I'm kind of coming from the The Bargain Hunter Cheapskate
16:23
angle of like hey there's a bunch of free.
16:25
Content that you guys put out there.
16:27
We want to make sure that our listeners know about that.
16:31
What's the best way for them to go out there and find those you
16:35
know, these free webinars. Yeah, so first just go to our
16:40
website at www.breckwell.com. There's the webinar section,
16:45
there's in the event section where you find a lot of things
16:48
and then it doesn't sound like bargain-hunting, but I think
16:51
it's still still the best one of the best ways to do it.
16:54
If you go to the upper, Or right Edge, there's become a client.
16:58
But there's also the basic option, which is you can
17:00
register, for instance, 41 months, for certain level of
17:05
free access and stuff like that. And that allows you to get get a
17:08
lot of information. And you also will end up, and I
17:10
think this is always every one of us has mixed feelings about
17:14
the mailings you receive. But register for these mailings
17:17
because you'll get the information about upcoming
17:19
events upcoming webinars to try for free, maybe maybe go to one
17:24
of the platforms. To subscribe to Matias podcast
17:28
stuff like that. So there's really a lot of
17:30
information which is freely available and just click on the
17:35
upper right Edge and check the website there's various ways to
17:39
find quite quite a good number of free content.
17:43
Okay great. So what did you jump into a
17:46
couple topics today? If we could spend a few minutes
17:50
on each one, that would be fantastic.
17:52
The first one is, yeah, I follow you on.
17:55
On LinkedIn. And for some reason, LinkedIn,
17:59
prioritize your posts, because I like them a lot.
18:03
And recently, you appeared in interview talking about cyber
18:08
security, awareness, training, and I thought you had a really
18:10
interesting take maybe it's Unique.
18:13
Take, can you tell us about that?
18:15
Yeah, you know, I think that thing started with me receiving
18:20
one of these mailings from from a German magazine and I lost his
18:26
the humanist, the weakest link and security headline.
18:30
And I wrote back to the Editor in Chief has that, you know,
18:35
Peter is his name. I have fully disagree with this
18:40
statement because this is really discouraging.
18:43
So if you tell people you're, you're making the mistakes,
18:46
you're the weakest links, that weakest link.
18:49
This isn't that motivating at all?
18:53
And it's not fair because you know we always say okay.
18:58
Oh what why did you fall trap to this phishing attack and gave
19:03
your password away? The right question to ask would
19:06
be why was there still a password?
19:11
If there's no password used and no password to give away, the
19:16
human can't make the mistake. And so, to some certain extent
19:20
it's blaming all the people in our organizations for things.
19:26
They are not really guilty for or at least what they did.
19:31
Follow crap to a phishing attack isn't the root cause because the
19:35
root causes, oh, we're not yet passed for Less, we are not yet.
19:39
Strong MFA everywhere. Six like that or we don't have a
19:43
good email filter, email security solution.
19:48
So that there are way too many stay always will be some.
19:51
There are way too many malicious links still ending up in the
19:56
inbox of the people. Yeah.
19:58
No, I think that's really interesting.
20:00
Take, you know, I I feel like at least I've become, you know,
20:07
really good at sniffing out fishing attacks by email.
20:13
And so I wonder is that partially due to the fact that,
20:19
you know, the companies I've worked for I've done a really
20:22
good job of you know, making me aware like every time they send
20:28
these like phishing emails, or things like that, I'm incentive
20:35
incentivize or disincentivize to click through to them in other
20:39
words, if I get caught clicking on one, I get this email.
20:43
Like, hey dummy, you clicked on a phishing email, or do you
20:48
think it's just that everybody in society is now getting better
20:52
at spotting these these fake emails?
20:56
You know, I think how does technology so you know when I
21:00
look at my inbox them frequently it's a Oh you really receive
21:05
emails from let's say chairman Jeff or whoever.
21:10
And and then this helped me alerting it and I think then
21:15
people also are sometimes probably a bit more scared and
21:20
more educated. So if you've my mother sometimes
21:23
as that, there's a strange email in my inbox.
21:27
What should I do? Because she she probably
21:31
wouldn't wouldn't know what a team.
21:33
The term fishing means, but she knows that there's, they could
21:36
be something wrong and I think that this is, It's a, I think
21:42
it's especially in business. It's a mix of measures.
21:45
We need training awareness training.
21:48
Yes, we need this, these approaches, where you get mail
21:53
sent, and then become informed, okay?
21:56
You've clicked one, you should have click but he also needed
21:59
technology to, to reduce the amount of stuff that dance in it
22:04
in our inbox or that that where we can do things wrong.
22:07
So it's a mix of the rioting. But back to the interviewer
22:14
discussion I had in that a while ago, the point is really, I
22:19
think we should encourage people to understand that they are part
22:23
of our defense. Humans are the first line of
22:25
defense or power of the first line of defense and and do it.
22:30
More motivating them. Yeah, they call him the we think
22:34
it went great. Yeah.
22:36
Yeah, definitely following you on that one.
22:39
Okay. Second topic, one of the things
22:42
that we chatted about prior to, you know, getting on, was that
22:47
what is it? That could shake up the IGA.
22:49
So I think a lot of our listeners, they're the identity
22:53
practitioners of the world. While them either are focused on
22:57
deploying, IGA running IGA or at least that's somewhere in their
23:01
job. Responsibility.
23:03
And the IGA space has been pretty static.
23:07
I feel like for the last few years but I think that is due
23:10
for a shake-up. So I'm wondering is it is a
23:13
convergence that will shake up, IGA?
23:15
Or is this something else? It does the space if you need to
23:20
be shaken up. How much time did you say we
23:23
have for this pain? I've heard of ours.
23:27
Okay, there's there's there's a lot of stuff to talk about and
23:30
maybe doesn't that is the part where I It could quickly him on
23:33
the ICA, May 9th to 12th Berlin. Greatly is very Central to the
23:38
town. So people have to be moved their
23:41
last year to Berlin and the venue is really a great one.
23:46
So don't miss it be there. It's it would be really fun and
23:49
we'll talk about a lot of things where we feel identity
23:53
management must change or is about to change nothing in some
23:57
areas. We already see the.
23:58
So we see this Cloud infrastructure, entitlement
24:01
management. Or we call it during Dynamic
24:03
resources, Island, access management stuff really
24:07
impacting the traditional Pam, the British access management
24:10
Market, we see the delivery from the cloud.
24:14
We have this concept of identity Fabrics.
24:16
I think we started talking about is three four, five years ago
24:20
already and wrote quite a lot of stuff and we see this picked up
24:24
being picked up more and more as a umbrella as a holistic
24:28
perspective on. It does this mean that we need
24:32
Sort of technically, conversions of all Solutions in 21 other.
24:35
And with the others, I'm a bit reluctant, because we have seen
24:39
so many big monolithic Tools in many areas of it's--, which
24:44
didn't really succeed over time and I'll sing in an age of micro
24:49
services and container-based. Deployments and modern
24:51
architectures, we and apis. We can do it at different and
24:55
better. So, having something where we
24:58
can put together various elements into a the common
25:03
framework with a consistent UI with consistent sets of apis
25:08
etcetera. One of the big things I believe
25:10
is, which is coming back. By the way, is policy-based
25:13
access controls. So, when you look at the success
25:16
of opa, open policy. Hm.
25:18
Then this is a clear indicator for that.
25:22
And so I think we will see changes.
25:25
We need changes. Also look at IGA, I think
25:28
everyone struggles with Roland Rose and recertification, so,
25:32
Need to change something, no doubt about it, but all of that
25:36
would be probably topics for separate sessions.
25:40
Happy to be back here and go into Deep dive on some of these.
25:45
Well it's an open door obviously whenever you want to come back
25:47
with us, you know. And it struck me when you
25:50
mention, apis and moving more to an API based approach or
25:54
microserver, microservices based approach.
25:57
I still feel like, you know, as I talk with, you know, our
26:00
clients in the real world, what work Stuff is they struggle just
26:03
getting this stuff deployed and this is one of my predictions
26:07
that I have last year at the end of 2020 to was.
26:09
I think, like a lot of organizations are gonna take a
26:11
step back to try to get back to basics a little bit when it
26:15
comes to Identity. And IGA is one of those basic
26:18
foundational technologies that if you do it, right, it's
26:23
awesome, right? It helps so many different
26:25
things but it's very difficult to get deployed and to get the
26:28
pulley, right? And think, one of the things
26:30
that I'll point a finger At the vendors in this space is they
26:34
distract quite a bit with bells and whistles that are great to
26:39
have but are more like a year three year five of the
26:44
deployment and it hasn't been enough Focus.
26:46
Paid on getting the basics right?
26:48
Humble yeah off-boarding things like that.
26:51
Yeah I think that's part of it and I think we the toys also
26:56
when you start doing IGA right today then you need to do it
27:00
right for the next decade. Or so.
27:03
So I think it's done. So thinking about how Masters
27:06
look for the next 10 years. Known how not, how how did it
27:09
look for the past 10 years and everything?
27:11
You brought it up to the bells and whistles and they dared a
27:15
lot of things which are saying, okay, I help you dealing better
27:19
with rolls. I help you doing recertification
27:23
more efficiently but I think it's time that we step back and
27:25
say how can we sort of Cure the root call, the cause not the
27:33
symptoms and illnesses really dealing with symptoms.
27:37
As I've said a huge topic here which probably could keep our
27:44
hours discussing and maybe we split this into some parts and
27:48
do it over the next couple of months.
27:50
Well, we definitely be open to that.
27:53
Let me move us on to the next question.
27:56
This area or the last one in the section which is really around
28:01
the cybersecurity Leadership Summit.
28:03
So that's the other event that you guys do in addition to you.
28:05
I see that maybe you can talk about for a second but many what
28:10
I noticed is that many of your speakers are cisos and my
28:15
thinking is that many, I am practitioners folks like myself
28:19
and Jeff. Aspired to be cisos is that I am
28:24
a good path for becoming a see. So, and what advice would you
28:28
give to? And I am practitioner that wants
28:31
to become a see. So, yeah.
28:33
So I think the thing first you should ask yourself, do I want
28:37
to become a sea? So it's a pretty hot chair,
28:41
isn't it? And you look at like look at it.
28:43
So that is truly one power of it and the other But I think this
28:51
is more promising. Where do you feel most
28:56
comfortable? Sorry, do you feel being a
28:58
manager? As I see.
29:00
So it means you do a lot of management stuff.
29:02
You you do a lot of things more about managing everything by
29:07
risk, a lot of reporting. So I think that's that's what
29:12
you need to be clear about it. So what do you want to achieve?
29:15
But if you want to become a seesaw, do identity, surely is a
29:19
good. Starting point, s, it can be
29:22
cyber security experience. I think the advantage of, of
29:26
identity, as a starting point is that you have a lot of stuff,
29:29
which is around governance, which is along around risk,
29:34
which is around working with the business, probably more than
29:39
when you're in some of the sort of the core areas of
29:44
cybersecurity, whatever, configuring fire, firewall
29:48
rules, or so. And you're further away, Away
29:50
from some of these core skills of a seasonal talking
29:54
communicating with the business governance risk aspect, is that
29:59
era? So identity surely can be a good
30:02
good starting point when you say okay see so is my career Target.
30:10
You know, you got to be cool pretty well-rounded and security
30:13
to be a Cecil, right? Can't just be focused on one
30:15
area. I think you bring up a lot of
30:18
interesting points about you know if you're looking to go
30:20
down that path, having those relationships with the business
30:24
is a huge part of being in sort of that, you know, leadership
30:28
management capacity is developing those relationships,
30:31
you know, learning how to work with people, you know, across
30:34
the aisle. So to speak, right?
30:35
Or another business units, whatever it may be, I think the
30:39
The thing that sometimes can be a challenge as you have to know
30:41
which battles to fight. If everything is on fire, then
30:45
nothing's on fire. So you have to be able to
30:47
prioritize and say, okay this is when we can solve things because
30:51
most cisos do not have an unlimited, you know, budget of
30:55
money resources time. They've got to pick and choose
30:59
where where is the risk now? And do I need, do I need to
31:03
mitigate and work on now versus something that I can punch him
31:06
later? Which is, by the way, a lot of
31:08
the things I A lot of barbiturates optimizing your
31:11
tools portfolio, because the problem when you take facility,
31:16
broader cyber security perspective, is that there are a
31:20
lot of tools that a lot of these tools came in, because something
31:23
went wrong or something, went wrong in a company.
31:27
And there was an urge to acquire a solution to your throat, too
31:32
long at the problem, and hope that it helps, which means that
31:36
there are a lot of tools not very well integrated.
31:39
And I recommend to everyone step back and do really, a sort of an
31:43
assessment of your cyber 622 security, tools, portfolio,
31:47
which should include identity management.
31:48
And you can also do it for identity management.
31:51
What do you really need? Who should own it, what
31:54
contributes to the risk mitigation best at which price
31:57
at which total cost of ownership?
31:59
The problem in cybersecurity, surely is retiring, cyber
32:03
security, tools is a risk because if exactly in that area,
32:08
something goes wrong. Then you're in trouble.
32:10
On the other hand you frequently have overlapping capabilities
32:14
and reducing complexity definitely helps also in doing
32:19
more with your always tight budgets.
32:22
And so, I think this exercise is always worse time and money
32:26
spent is a really good points and I know where I'm going but
32:29
of time. So I want to get.
32:30
So maybe a little bit of a lightning round here.
32:32
Take advantage of a big brain and talk through maybe some of
32:36
these Buzz words that I keep hearing in the identities.
32:38
Based, I'm sure we're all starting to grow tired of it.
32:41
So the idea here is we're going to throw out a term and then
32:46
Martin and like 30 seconds to a minute.
32:48
Give us your thoughts on it and we're going to start with, with
32:51
the elephant in the room decentralized identity.
32:54
What are your thoughts on it? One of the most promising
32:59
technology areas that last year with you, I see, we started the
33:03
first time where you talking about, how can you improve your
33:07
identity broses as your existing Legacy?
33:09
I am. But integrating with these
33:10
varieties identity and I think there's a huge huge potential to
33:14
look out by saying I have something and identity.
33:18
I can use that for making decisions for improving my
33:21
onboarding process, think about work for Mary anywhere.
33:24
So there's a really huge potential in that Don't just
33:27
look at it as blockchain ID and something.
33:29
Esoteric it's there and you can use it to make it to really,
33:35
massively improve your I am. As of right now, January 20 23.
33:40
Is it a technology in search of a problem?
33:45
Whereas there are applicable use cases that people should be
33:48
jumping on just to start leveraging that decentralized
33:52
concept. I think onboarding of business
33:55
partners and to a certain extent, even I'm pleased, it's a
33:59
great area, a side of the typical consumer authentication,
34:04
use cases, but I think this is one of the the areas, which is
34:08
great A bit on the longer term because it needs a lot of
34:12
innovation in all. We do around identity
34:14
management. That would be if you have a lot
34:17
of proofs, think about it and using it for policy-based
34:23
authorizations. But that's probably the second
34:26
or third. Step one boarding improving
34:29
processes. That area could be to lower
34:31
hanging fruit. Okay.
34:34
How about see IEM? Cloud infrastructure and title
34:37
it management. I feel like this is a area that
34:39
got pretty hot sort of like the beginning of 2022.
34:42
Maybe unto 2021. Where is it stands right now?
34:46
What are your thoughts on that space?
34:48
Yeah so I think the there's a huge challenge which will render
34:55
started to create solutions to address the switches we have.
35:03
devops we have sore at trial development of applications, we
35:08
run that also in a natural manner in some Environment,
35:14
which frequently is a public lot but not necessarily necessarily
35:17
it could be also whatever they could kubernetes environment in
35:21
our own Data Center and all this is not static anymore.
35:26
So historically, we sought about oh we have humans that are
35:29
managing servers right now. We don't have the service
35:33
anymore. We have workloads, they go up
35:35
and down permanently, change permanent changes, and we have a
35:39
lot of services that are managing that.
35:43
Which makes the problem more complex, more Dynamic, and we
35:45
need solutions for death. I think we should not restrict
35:50
it to Claude because it's every runtime environment that we need
35:55
to cover and it's modern infrastructure, it's sort of the
36:01
entire workloads across the stack.
36:03
So we need to think this even bigger, but not looking at it.
36:08
Surely is a huge risk because that's where I've seen some
36:11
interesting samples. That's where a lot of
36:15
organizations have massive, massive over entitle management,
36:20
management over excessive over entitlement.
36:25
So nothing about least privilege there and we need to address it
36:30
and you guys started to work through this process, a dream,
36:33
which you mentioned earlier, Dynamic, resource and title and
36:36
an entitlement, and access management had to get it right.
36:38
Thanks. We had a conversation with Paul
36:40
Fisher back in. I want to say March of 20:22, I
36:44
think is episode 1 36 which would be a good one to check out
36:47
for kind of people to get some more opinions on that.
36:49
Jim, I know that key Morecambe or whatever we're pronouncing
36:52
it, this week is near and dear to your heart.
36:54
What are your thoughts? Well I I think it's important of
36:58
important approach but I think it's just one piece of the
37:01
puzzle I think. Managing Cloud infrastructure,
37:05
security holistically, detective controls proactive, controls
37:12
machine. Accounts human accounts, it's a
37:16
big picture and I think Keem covers one portion of that.
37:20
And I find that what Enterprises are looking for is like that,
37:26
that one solution that covers it all.
37:28
And so overlaps with all the the software development life cycle
37:36
because actually, I think there are a lot of these changes come
37:39
in. So and also there we need a lot
37:41
of more. Solution.
37:43
So so we have a lot of pieces and bits and pieces for
37:47
protecting that or that or that part of the software
37:49
development. I'll apply cycle but we need to
37:52
bring these things together and that will be probably something
37:54
which keeps the vendors and the organization's busy for the next
37:58
year's. Yeah, exactly.
38:02
I posted on Twitter the other day and in memoriam image, about
38:06
the password password will die and it was you know 2012-2013
38:11
everything was struck out. What Your thoughts, you know, up
38:14
to this year like I feel like we've been saying for a decade
38:16
now that passwords are going to die.
38:18
This is the year is going to happen.
38:20
What are your thoughts on password authentication in the
38:23
year? 2023 is this is this the year
38:26
again but at that we start to see things move you know, I'm a
38:29
bit of Sonic I'm so so probably I would be more on the side of
38:34
it takes its time and what we see is, definitely a lot of
38:39
adopt O'er. Adoption Enterprises.
38:43
With different types, of password lessons, indication
38:47
that, that is a positive thing. But when you look at the reality
38:50
of when you're just using some services in the web, then in
38:56
most cases it's still username password only.
39:01
And so we have still a long way to go to the to go past follow
39:05
us. Everywhere.
39:07
In the Enterprises we see see a definitely not take A lot of
39:12
Technology available that everything is that path will
39:17
last as if this claimed to be, but I think we're on the right
39:22
way here. So, we're trending up in the
39:26
right direction at least, but I miss you, I think it does take a
39:28
while. Especially we start thinking
39:30
about, you know, this is a pretty seismic change.
39:32
I think it's the user experience its Investments that the
39:36
Enterprise level. And these generally take a few
39:38
budget Cycles to kind of work through.
39:40
I think we're starting I'm down that path but I think it'll be
39:43
five ten years by the time we see it become really prevalent
39:47
and if there's an interesting discussion about potentially
39:51
decoupling the authentication from from everything which is
39:55
sort of behind so that you sort of can use the same time so that
40:01
users are can use the way they want to.
40:03
Also indicate which changes every now and then because they
40:05
might change the devices you technology coming while the
40:10
backend systems are Have been segregated from that.
40:13
So sort of having a an authentication layer around
40:17
which is more consistent and which remain stable?
40:22
Even we feel whatever change from with the one access
40:25
management to the other access management product.
40:27
I think this is, this is an interesting way of thinking and
40:30
basically I think we need to continue what what a lot of
40:34
people are stuck. Have started to to talk about
40:37
and think about the various types of so to speak control
40:40
planes around identity. You to sort this out.
40:44
I think this this way of thinking is very helpful.
40:48
I have to admit. I'm not fully done with my own
40:51
thinking on that but I'm working on it.
40:54
What's the thing raise? You can always change opinions
40:56
and get smarter over time, right?
40:58
Yeah. Maybe we should ask the question
41:00
instead of. Is this the year that the
41:01
password eyes and ask is this? The decade that the password
41:05
guys who were at the final conference, right?
41:08
And you're starting to hear some very exciting.
41:11
He's from big companies, but even they're taking on some
41:16
portion of their total passwords.
41:20
And would you hear about, you know, Citibank knocking out
41:23
passwords for, you know, hundreds of millions of
41:27
customers? That's exciting.
41:29
But I also think you look at the KC leadership report on password
41:34
list for it and by Alejandro, right?
41:36
And there's like, 23 vendors, it remind you of like the early
41:40
west of almost every The tower within identity access
41:44
management starts with a lot of vendors that it shrinks down to
41:49
a smaller number of vendors. Then those vendors start losing
41:53
direction or stop keeping up with the product then all these
41:56
newcomers Rush In And then they push the L to either adapt or
42:01
die. And so I think we're still at
42:04
that kind of wild-west Phase 23 vendors like that's it's kind of
42:08
mind-blowing. Well I think it's weird.
42:11
A couple of more when you do, go to the windows to watch section,
42:14
then we probably end up as 50 or so.
42:17
Not only 23, but I would agree with you and I think that.
42:22
But is it a decayed where it dies?
42:25
I think. The problem is that it dies is
42:28
like wisdom Mainframe, you know, there's a place there will be
42:33
passwords probably forever. But in more restricted
42:40
scenarios, probably. So the Mainframe that were dyed
42:45
and password and I will die as much as people tried to kill it
42:48
is still alive. It's like, you know what is
42:50
dead, may never die for my Game of Thrones fans out there.
42:54
All right, we're running out of time, but I want to make sure
42:56
that we end on a lighter note and, you know, we could pick
42:59
Martin, we can pick your brain all day long for hours like you
43:01
said. So we'll definitely have to have
43:03
you come back on and get into some of the stuff, a little
43:05
more. Tail.
43:06
But before we go, it is the new year and I'm wondering if you've
43:10
made any New Year's resolutions, you know, I would dare to say I
43:15
gave up on that a bit, so it's wrapped really worked out.
43:22
So there are things I tried. And moreover the year, maybe
43:27
this year, probably, I need to get rid of some of the key extra
43:30
kilos, I have acquired but it's not letting you use resolution.
43:36
Your New Year's resolution was to not have a resolution and
43:39
she's just so to speak Buffon. Jim about yourself, any New
43:42
Year's resolutions. So I'm a big believer in setting
43:46
goals to better yourself. And I also think that New Year's
43:51
is a great time to do it, right? Because you get this break
43:54
before the end of the year. It's a really think about your
43:56
life and I come up with strategies and you know, plus
44:00
the calendars turning over right.
44:01
So but I did not set any resolutions this year.
44:06
That doesn't hold me back from setting up a new goal down the
44:09
road master. I would encourage everybody to
44:12
do. I mean, so how I've always
44:14
lived? My life is very goal-oriented.
44:16
So I've always got always got to be working towards something.
44:19
I want to talk to younger people like, you know, teenagers art,
44:23
I've got a couple of teenagers at home, you know.
44:25
I tell them they've got to live a goal-oriented life.
44:28
You can't just Meander through life and expect to somehow, you
44:32
know, achieve something important in this world.
44:35
You've got to be Oriented and you need to in your life, have a
44:39
mix of short-term, intermediate term and long term goals or I
44:46
mean in my book otherwise you will never achieve those goals
44:49
are not going to happen by accident.
44:51
You're not going to have Financial Fitness in your later
44:54
years. If you don't set those goals.
44:57
For example, you're not going to be healthy and fit if you don't
45:01
set short and medium and long term goals.
45:04
So I did not this year. Here.
45:06
But you know, I'm always setting goals.
45:10
I'm always there watching my girls, you don't wait for it.
45:13
Yeah, there you go. Well, that was pretty deep.
45:16
Let's quickly. Do you see, I think that's good
45:18
advice. Mine was just to be more more
45:21
more active on the social networks for the show.
45:25
Like, usually what we've been doing is, you know, post an
45:27
announcement on, you know, Monday's or whatever it is, we
45:29
put out a new show and that's pretty much it.
45:31
So, I'm trying to be better about that and be more In the
45:34
presence with some that stuff so hopefully you know, folks will
45:37
gauge with that. But yeah, I don't know how long
45:39
it'll last. I'm probably more with trim when
45:42
it comes to social networks, to be honest away from her but the
45:49
ice that's and the same way personally.
45:51
But for this podcast, I find it's a great way to interact
45:54
with listeners. Like we're very, you know, we
45:56
have really good listeners, they're always very supportive
45:59
and, you know, thousands around the world which is very cool.
46:01
So, having an opportunity like tap, you know that In Trust on
46:05
link that we have a crane filter, media manager, Marina in
46:08
our organization who really supports me on that.
46:11
And she, by the way, she also said, I should mention our
46:14
upcoming Casey open select offering, which will be launched
46:17
very soon. So I have a look at this asshole
46:19
at our website. This is really something which
46:21
helps you gives you guidance throughout the product selection
46:26
process. So how do you find the right
46:28
solution? We start with password Lancers
46:30
indication. That will be the first area we
46:32
cover and then we will add hours.
46:35
Oh, very cool. Maybe.
46:36
When it's time you can come back and kind of walk us through what
46:38
that looks like an end to get the word out.
46:41
Alright I know we're going a little bit longer than we wanted
46:43
to but I really do appreciate the time Martin.
46:45
I think you know one of the things that is always a struggle
46:48
for me as I listen to these conversations, I'm sitting here
46:50
like okay well I'm going to produce the episode get it put
46:52
together. What do we call this show?
46:55
Because I feel like it was like all over the place from an
46:57
identity perspective and my my thought process right now is
47:01
like something like, you know, picking Martin's brain or some
47:04
Like that. Do you have any suggestions for
47:06
what we should call this show? Yeah.
47:09
I recently at the CSL is conference, I had to do a
47:12
session of rituals called ask ask, ask me everything, or
47:16
something like that. Where people had the opportunity
47:19
to bring up their questions, we trust, by the way, very
47:21
interesting because we touch some, some some areas where I
47:25
sort of, maybe we should do something very different.
47:29
So, so some things I'll publish about soon.
47:33
So I like this. Franz because yeah, you ideas
47:37
come up when having these conversations lately like an
47:41
opportunity to be here so. Well, yeah, I mean, this is very
47:44
cool. So maybe something like a am a
47:46
right. Ask me anything.
47:47
I am a Martin Cooper or something like that.
47:52
Well, that's kind of come up with something but yeah.
47:54
Okay. Alright, let's go ahead and wrap
47:56
it up for this week is our first show back from break.
47:59
So I'm very happy that you're able to join us Martin.
48:02
I'll have a whole bunch of links in our show notes, You can
48:04
connect with. Martin on LinkedIn will have a
48:06
link to Cooper, your coals website, the European identity,
48:09
and Cloud conference, definitely want to check out for folks who
48:13
are able to make it out there as well as identify verse and the
48:16
Gartner Summit all things like that.
48:18
So we're on the web identity at the center.com.
48:22
We're on Twitter at IDC podcast. We're on Mastodon at idac
48:28
podcast at infosec exchange. That's going to get real
48:30
confusing at some point. So maybe there's a better way to
48:32
do that. But we're always happy to
48:35
connect and engage with, you know, our listeners and I'm sure
48:37
Martin's always happy to connect and engage with folks.
48:39
He's been very generous with his time.
48:41
Any final thoughts? You want to impart upon the
48:44
crowd? That is listening Martin for
48:45
this episode? I think one of the most
48:48
important things, I always tell people is take the time,
48:52
sometimes to step back and think about our, are you already
48:55
heading in the right direction? Is it threats in?
48:58
You're doing? Because we all are so, so
49:00
absorbed in our daily work that we tend to And continue and
49:05
continue a program. What you're doing?
49:06
But stepping back a bit of like the singer talk about with is it
49:11
a symptoms? We are dressing or the course
49:13
take that time. Always is very valuable.
49:16
Yeah, for sure, jump about yourself words of wisdom for
49:19
this first show back. You know, I'm just clearing out
49:21
the cobwebs, so, you know, I'm so, so on that vacation
49:25
hangover. But, yeah, I'm looking forward
49:28
to this year and I'm looking forward to all of our conference
49:31
line up and Jeff. We've got to Get approved to go
49:35
to the European identity conference.
49:37
I just feel like this should be the year.
49:40
Yeah. Daniel.
49:40
If you're listening. That's that's something we
49:42
probably got to coming your way in a little bit.
49:45
All right. Let's go ahead and leave it
49:46
there for this week, Martin. Appreciate the time.
49:48
Jim is always appreciate the time, happy New Year to all and
49:52
with that we'll talk with everyone in the next one.
49:59
Thanks for listening to the identity at the center podcast.
50:02
If you like what you heard, don't forget to subscribe.
50:04
Bribe and visit us on the web and identity at the center.com.