Latest / Identity at the Center / #234 - Identity Week America 2023: Jeff Reich of the Identity Defined Security Alliance

Transcript

#234 - Identity Week America 2023: Jeff Reich of the Identity Defined Security Alliance · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with I
• 0:10
  Am, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Steadman. Welcome to the Identity at the
• 0:23
  Center podcast. I'm Jeff and I'm by myself this
• 0:26
  week. Well, not really.
• 0:27
  I'm at the Identity Week America conference having conversations
• 0:31
  with different folks we've had in the past on the show.
• 0:33
  New friends, family, compatriots, whatever you want
• 0:36
  to talk about it. So I'm going to be joined here
• 0:39
  in a minute by Mr. Jeff Rich. He's the executive Director of
• 0:42
  the Identity Defined Security Alliance.
• 0:44
  Welcome to the show. Thank you very much, Jeff.
• 0:47
  Jeff It's like a mirror. It's a Jeff and Jeff show.
• 0:49
  It's. Going to get a little confusing
• 0:51
  because like which Jeff was said what?
• 0:53
  First of all going to compliment you.
• 0:54
  I love the suspenders looking sharp.
• 0:56
  Thank you, Sir. So we're here at Identity Week,
• 0:59
  America, having conversations and just kind of picking the
• 1:03
  brains of people from an identity standpoint at least
• 1:06
  around things have been going on.
• 1:08
  Before I get to that, I just want to give a shout out to
• 1:10
  Molly. She's been super helpful and
• 1:12
  getting this show and you know. Organized and helping us, you
• 1:17
  know, get this together. So big shout out to Maui and
• 1:19
  thank you for that. I guess it's been a few months
• 1:23
  since the last time you were on the show, Jeff.
• 1:24
  It was April. It would have been episode #206.
• 1:28
  I'm not sure what number episode this will be, but it's been a
• 1:31
  few months. What's been going on with the
• 1:34
  identity to find Security Alliance or IDSA since we last
• 1:38
  chatted? So a lot's happened in the past
• 1:41
  six months or so. We have changed our look and
• 1:46
  feel. If you go to a website, there's
• 1:48
  a there's a whole new reskin on it and we're excited about that
• 1:51
  actually. We think it looks great.
• 1:52
  It does. I noticed it right away.
• 1:54
  I was pulling it up today for preparing for this conversation
• 1:56
  is like, oh, there's a new website.
• 1:57
  Yeah, Well, thanks. It's yeah we we think it looks
• 1:59
  good fix it looks great actually and we have added a new category
• 2:05
  of membership called partner which deals with our consultant
• 2:10
  agencies or advisors. You know, they aren't
• 2:13
  necessarily selling security or identity products, but they may
• 2:16
  advise on it. They can do some consulting.
• 2:18
  So that's there. We are focusing now on getting
• 2:23
  more enterprise or companies that aren't identity vendors or
• 2:27
  partners. Consumers of identity stuff.
• 2:30
  Yes, exactly. And you're going to see a focus
• 2:34
  on that probably hearing a bit more about it over the next
• 2:37
  couple of weeks actually. With a goal to bring you more
• 2:40
  than in because we know they can benefit from it, they tell us
• 2:43
  they can benefit from it. So we are tweaking how that
• 2:47
  membership works just a bit. We're almost done with that so
• 2:50
  that we can appeal to more and really bring value to them
• 2:54
  because the more of the enterprises and consumers, as
• 2:57
  you say, of the identity products we have, the better.
• 3:01
  Voice we have with the identity vendors and with governments so
• 3:05
  that we can start getting a consistent view of what identity
• 3:08
  means, how we should work and what sort of things we should
• 3:11
  start avoiding maybe. So for people who aren't
• 3:14
  familiar with IDSA, what's the 32nd?
• 3:17
  I'm riding to the top of the Marriott Marquis elevator ride
• 3:20
  to the to get a Coke or something from the MM Club
• 3:23
  Lounge. What do?
• 3:25
  You do if first of all, if you want to coke, I can get it for
• 3:27
  you downstairs, but more importantly.
• 3:30
  We are a nonprofit that focuses on education and free resource,
• 3:33
  free education, free resources for raising the awareness of
• 3:37
  identity, security and to secure identities and we which which we
• 3:41
  look at as two separate functions, although they're
• 3:43
  related. That's really in a nutshell what
• 3:45
  we do, we have members that support our our mission and
• 3:49
  through membership dues at our fees.
• 3:53
  We take no money from vendors specifically because of that.
• 3:57
  They may be a member. And our goal is to spread the
• 4:01
  word and get it as far as possible.
• 4:03
  And over the next few minutes, I think we can talk about how
• 4:07
  we're going to maybe do that even more.
• 4:08
  Yeah. So we're in October and it's
• 4:11
  Cyber Security Awareness Month. I know you guys have done stuff
• 4:13
  in the past with that, but what's what's ideas they got
• 4:16
  going on this month? So we have a few things to get
• 4:19
  information out to the world, especially our members.
• 4:22
  We have a couple webinars scheduled this month, one from
• 4:25
  sent that Sentinel ones going to be providing.
• 4:27
  And another one that that we are hosting that is going to take a
• 4:31
  look at the I Digital Identity Research survey that we've done
• 4:35
  that we published this a little bit earlier this year and
• 4:38
  compare that to a similar one that Cyber Ark did this year And
• 4:42
  not endorsing either one, but taking a look at, we're asking
• 4:45
  similar questions, different audiences, different cohorts,
• 4:49
  where do things line up, what's consistent, where are there gaps
• 4:52
  as one example. This is something that I found
• 4:56
  amazing, but with a survey we did because I have yet to
• 4:59
  reconcile it. A overwhelming majority of
• 5:03
  organizations said that they were doing a good job managing
• 5:06
  identity and breaches, and over 70% of them said they had a
• 5:11
  breach in the past year. Yeah, they're pros and they had
• 5:13
  so many. Exactly, yeah.
• 5:16
  They're they're good at responding to breaches.
• 5:19
  But that's something we're working on to the book we do to
• 5:22
  resolve that because there is a there is a gap there.
• 5:24
  We want to help everyone close that gap.
• 5:27
  Yeah. And there's a lot of, I feel
• 5:28
  like, you know, just every new cycle, there's just who got
• 5:31
  breached this week, what happened.
• 5:33
  You know, there's Vegas has had some issues recently, for
• 5:36
  example. And it's tough because they
• 5:38
  think how do you, how do you reconcile stuff?
• 5:40
  It's like, Oh yeah, we're doing a good job.
• 5:42
  And I think sometimes that shows up in budgets or initiatives and
• 5:44
  things like that, that I know the clients that I talk with for
• 5:47
  example, my day job right is. Well, you know, we're already
• 5:50
  spending X number of dollars on identity.
• 5:52
  Why do we need to spend more? But it's, you know, how do we
• 5:56
  reconcile doing good? We think we're doing good versus
• 5:59
  well. People are still in the news for
• 6:01
  the wrong reasons. You know, and first of all, I
• 6:03
  don't have the magic answer to that.
• 6:05
  If if I did, I wouldn't be here. I'd be out telling the magic
• 6:08
  answer, right? But more importantly, I think
• 6:11
  when? When I when I get that question.
• 6:14
  My answer is always, and it's not very different from answers
• 6:17
  around security that I've been giving for the past 50 years.
• 6:20
  And that's if your response to a problem is throw money at it and
• 6:24
  that should fix it, your successor will come up with a
• 6:27
  better answer. And I say that not to be funny,
• 6:30
  but it's true and I've been in it.
• 6:33
  That's been me at times, right? Anyone that's been a See So or
• 6:36
  equivalent in the past 30 years has been the recipient of pain.
• 6:42
  That resulted from a breach or a security problem, whether they
• 6:46
  caused it or not or whether they let it happen or not.
• 6:48
  So simply throwing money at the problem won't do it.
• 6:50
  Simply buying software won't do it.
• 6:52
  In fact, I will offer, and there are great software vendors here
• 6:55
  at this show, great products. But if you buy the most
• 6:59
  expensive product because you have the budget for it and you
• 7:02
  say Hooray and you install it, that does nothing.
• 7:05
  It's like buying a steel door for your the front of your house
• 7:09
  and leaving it unlocked. Well, I I think that sometimes
• 7:13
  something that does happen, right, is people say they'll
• 7:15
  look at, you know, not to pick on Gartner, but we've had this
• 7:17
  conversation with folks from there as well.
• 7:19
  It's like, oh, well, I only buy upper right Gartner, Magic
• 7:21
  Quadrant, okay, well, great. What else are you doing though,
• 7:25
  Because it's a combination of people, process and technology
• 7:29
  is how we address a lot of these issues.
• 7:31
  And you know, I've been very fortunate to talk with a lot of
• 7:34
  identity people. And when I'm talking with
• 7:36
  organizations, one of the first things that typically stands out
• 7:39
  to me. When they're struggling,
• 7:41
  something is just the sheer amount of what I call I am
• 7:45
  heroics. They're taking place behind the
• 7:47
  scenes that people probably don't know about and the
• 7:50
  organization itself probably doesn't know about and that's
• 7:53
  the only way that they're getting by.
• 7:55
  It's not scalable. It's very difficult position to
• 7:58
  be in. It's very precarious.
• 7:59
  I'm curious, in the conversations that you've had
• 8:01
  with maybe, you know some of the membership and other folks
• 8:03
  you've talked to in your role, do you see the same thing with I
• 8:06
  Am Heroics kind of really being? How things actually get done in
• 8:09
  the? Real world?
• 8:10
  Yep. They better hope I don't use
• 8:13
  that out that word very often. That their problem doesn't occur
• 8:16
  when that individual's on vacation because the heroics
• 8:19
  can't happen that week as and and it's it's it's sad but that
• 8:24
  is how it's working and and the main cause of that I believe is
• 8:29
  identity and access sprawl. You can ask anyone How many
• 8:34
  identities do you think you have?
• 8:36
  And most people say 05/10. And I don't care who you are,
• 8:41
  that's nowhere near close I have now.
• 8:43
  I'm I'm a bit extreme. I have 897 all right.
• 8:48
  Now I'd like to think most people don't have that many, but
• 8:51
  most people are deep into double digits.
• 8:56
  I think you and I are both on the extreme side, but just for,
• 9:00
  I guess, commiserating in public with you.
• 9:04
  I just opened up my pastor vault and I have 1200 accounts.
• 9:08
  Okay, that's one person. And that I was I'm a consumer
• 9:10
  and I I probably not the normal person.
• 9:13
  In fact, I would guarantee I'm not a normal and a number of
• 9:16
  trust. Me, Jeff, But yeah.
• 9:18
  But it is a problem that that sprawl you talk about and even
• 9:22
  within an organization, I think this concept right of, oh, we'll
• 9:24
  do single sign on sounds great and a lot of people have taken
• 9:27
  advantage of those types of technologies, but they haven't.
• 9:31
  Fully taken advantage of it because they get caught in two
• 9:33
  worlds, they get caught in well. This is a legacy application and
• 9:37
  it doesn't play well with our current modern single sign on.
• 9:40
  Or there's some some shadow it taking place and there's a whole
• 9:43
  bunch of accounts out there that it may or may not know about and
• 9:46
  hasn't may or may or may not have done something about you
• 9:50
  got sprawl all over the place. Yep, and it's sprawl that they
• 9:54
  just simply not manage. Now I I had at one point I had
• 9:58
  1700, but I I've had over like a four month period of purposeful
• 10:03
  effort to say I'm dumping this one, I'm going to deactivate it.
• 10:07
  You can't just delete it from your password mag, right.
• 10:09
  You have to go deactivate it, which actually, that's even
• 10:11
  worse. Let me abandon it, right?
• 10:13
  But yeah, I had to get it down to my goal was to get it under
• 10:16
  1000 for for whatever that's worth it.
• 10:19
  There's no magic to that number. Most people shouldn't have that
• 10:22
  many. You and I are outliers,
• 10:24
  definitely, but most people have more than they need.
• 10:27
  Most people have closer to 50 than to five.
• 10:31
  So I would offer that's the number one gaping hole that
• 10:36
  organizations have in managing identity and access because all
• 10:42
  it takes is one of those to crack and it's a way in.
• 10:46
  Yeah, especially if you were using passwords, then that's
• 10:49
  pretty much the way it goes in, I mean, I guess.
• 10:51
  The benefit of having so many accounts is theoretically you're
• 10:55
  using a different password for each one, but everyone's human,
• 10:59
  and some people follow that advice and some people don't.
• 11:04
  Yeah, and even when you do, I'm saying, oh, I have a password
• 11:08
  manager, but I'm not going to, I can't bring it up now.
• 11:12
  So I'll go, I'll just reuse this password and I'll generate one
• 11:14
  later. And you never do.
• 11:15
  Yeah, it ends up somewhere in a table and blah blah blah.
• 11:19
  What else is ideas they've been working on?
• 11:22
  So, so we talked about you know our look and feel our our
• 11:25
  membership is different. Those are two really big things
• 11:27
  for us. We have some activities going on
• 11:30
  with cybersecurity Awareness Month, always in support of the
• 11:33
  National Cybersecurity Alliance. Obviously we work with them as
• 11:36
  well as with our they work with us in Identity Management Day,
• 11:41
  which is the second Tuesday of every remiss, not to say second
• 11:44
  Tuesday of every year of April of every year.
• 11:46
  April 9th of 2024, we're looking forward to having everyone have
• 11:50
  that come to a screen near them. It is an online event.
• 11:53
  We had over 1100 attendees last April and we're looking for even
• 11:57
  more going to have great speaker lineup.
• 12:00
  We still have some openings for speakers.
• 12:02
  That call will go out soon and still some openings for
• 12:06
  sponsors. So anyone who wants to be
• 12:07
  involved in that, just let us know.
• 12:10
  Identity Center Fun fact, the Identity Management Day is the
• 12:14
  only link. On our own website
• 12:17
  idacpodcast.com that we have put so far it's from from getting
• 12:22
  awareness out right with other organizations for that so we
• 12:24
  have a whole page. Thank you.
• 12:25
  We just get a fifth bump on that.
• 12:26
  Thank you. So if you go on our menu at the
• 12:28
  top, there is, it might be a little bit buried right now
• 12:31
  because there's a few things in there, but it's the only
• 12:33
  external page that we've got that links back to Identity
• 12:36
  Management Day. Thank you.
• 12:37
  We think there's a lot of value in that and we've heard that
• 12:40
  from the attendees as well. So I I think that's a lot of
• 12:44
  what we have going in on now something else we have going on
• 12:46
  that we're very excited about is we are announcing this week a
• 12:51
  Memorandum of Understanding that will be in place between us, the
• 12:55
  IDSA and the SIA, the Secure Identity Alliance which is based
• 13:00
  in Brussels, Belgium and and their footprint, they focus
• 13:03
  really more on standards and government work as opposed to
• 13:08
  mainly commerce and enterprise which we do.
• 13:11
  So there's a good compliment there, both with an I and an E
• 13:15
  for each organization and by having this memorandum
• 13:19
  understanding where we're going to have collaborative efforts,
• 13:22
  we're going to have some common working groups and a few other
• 13:24
  projects that we work on together that gives each of our
• 13:28
  organizations and both of our organizations more of a
• 13:31
  worldwide footprint. Our goal here isn't world
• 13:34
  domination. I don't know.
• 13:35
  Maybe someday. But that's an awesome podcast.
• 13:38
  Yes. But, but more importantly, we
• 13:41
  want to be able to say what does identity mean to any individual
• 13:46
  around the world and it should mean the same.
• 13:48
  Now we're not saying put everything in this one app and
• 13:51
  it either works or it doesn't because that first it doesn't.
• 13:54
  So we'll get that question out of the way, but to have some
• 13:57
  consistency, maybe even accepted standard so there can be an
• 14:01
  exchange so that my identity here when I want to use it in
• 14:06
  France. There is a straightforward way
• 14:09
  to make that happen, rather than a bureaucratic way that requires
• 14:12
  a piece of paper. It sounds very complimentary
• 14:14
  missions. If the third focus more in the
• 14:16
  government sector versus the sectors and IDSA focuses on
• 14:20
  today, it seems like that's sort of a, I don't know, a good
• 14:23
  Tetris fit. It is and and they also do, you
• 14:26
  know, we do some work on looking at standards.
• 14:29
  They do a little more work on, although we've had some input to
• 14:32
  standards as well. They're a little more focused on
• 14:34
  that. So once again, another another
• 14:37
  complementary factor. So we think that this is a
• 14:39
  really good opportunity to have two good organizations working
• 14:43
  in the same space but doing different things, joined forces.
• 14:46
  That's good. I think we've got listeners all
• 14:48
  over the world. So if anybody from Secure
• 14:50
  Identity Alliance is listening, let's come on the show.
• 14:53
  Reach out to me or maybe you can make an introduction.
• 14:56
  We can kind of talk about that, but I'd love to get the
• 14:57
  awareness out of our around that.
• 14:59
  I'll be happy to do that. In fact, I'll offer that at
• 15:01
  Trust Tech in Paris at the end of November.
• 15:04
  I think it's a 28th and 29th. I will be there and an Sia will
• 15:09
  be there as well. In fact, I think they're one of
• 15:11
  the organizers of the of the conference and at the end of
• 15:15
  that we will have an invitation only identity interoperability
• 15:19
  summit. I'm.
• 15:20
  I actually got that out. I've worked on that phrase to
• 15:24
  really see what we can do to help drive this home.
• 15:26
  So yeah, anyone that wants to come on your podcast that that
• 15:29
  either knows me or meets me there, I'll be happy to do the
• 15:31
  hookup here. Yeah.
• 15:32
  That'd be great. Look to we love having an
• 15:34
  international flavor because you know it's tough.
• 15:36
  What not tough, but it's familiar when we're talking US
• 15:40
  centric because, well, I live in the US and Jim lives in the USA.
• 15:44
  Lot of stuff that we work on is you know North America based for
• 15:47
  example. But it is interesting to see how
• 15:50
  other countries around the world and other organizations are
• 15:52
  operating. So we're here at any Week
• 15:56
  America, what do you get out of a conference like this?
• 16:00
  And I think there's two hats you're probably wearing.
• 16:02
  One is as a member or sorry, as the executive director, as
• 16:06
  representing IDSA, but also from an individual level, like what
• 16:10
  do you get out of being here at something like this?
• 16:13
  Yeah, thanks. And I am both the leader of IDSA
• 16:16
  and a practitioner. So yeah, I look at both things,
• 16:20
  you know, first of all, but I look forward what's new that's
• 16:23
  out there and there are some good products, there are some
• 16:26
  nice products that have worked well that are better now that's
• 16:30
  good to hear. There are some products out
• 16:31
  there that I I will allow someone to try to convince me
• 16:35
  what they're going to do and how that's better.
• 16:37
  But, but that's like every conference you're going to get
• 16:39
  that. Hear some good speakers, which
• 16:42
  you may be hearing in the background.
• 16:43
  Some of them actually are. Many of them actually are very
• 16:45
  good. I'm.
• 16:46
  I'm going to be on a panel on Wednesday with me.
• 16:49
  Yes, I had to stop and think like, who's monitoring that?
• 16:52
  Oh yeah, you are. And and I'm looking forward to
• 16:56
  that. So as a practitioner, I'm
• 16:58
  looking for what else is out there, what's going to be
• 17:00
  better? What are we going to be talking
• 17:02
  about next year? Because I have my thoughts about
• 17:04
  that, but there are others who are smarter than me that have
• 17:07
  probably a better idea. What problem were we talking
• 17:10
  about? Next year?
• 17:11
  We're not going to be talking about MGM next year.
• 17:13
  We're going to be talking on something bigger.
• 17:14
  Whatever. Happens then, or closer than I
• 17:17
  should say what I haven't heard too much of and and shout out to
• 17:20
  my friend Teresa who was on the show recently.
• 17:23
  We did an episode on quantum computing and post quantum
• 17:27
  computing. I don't see any of that here.
• 17:28
  And she, I, I I saw she was like one of the first people I saw.
• 17:31
  I walked in and then started talking about it.
• 17:33
  You know the episode, and there's nothing about Quantum
• 17:36
  here yet, but. I imagine it's got to be coming
• 17:39
  at some point. It will be because the price
• 17:40
  point has to get there. Now you may not know this, but
• 17:43
  my background is in physics. So if you want to talk about
• 17:46
  quantum and post quantum, we can have another whole session about
• 17:49
  that. I'd love to the and that's
• 17:52
  going, that's clearly going to happen.
• 17:54
  And for everyone that says, oh, it's too out there and, you
• 17:57
  know, no one understands what an entangled pair is and everything
• 18:00
  else, that's OK. Because 15 years ago when you
• 18:05
  said cloud computing and most people said, oh really, you're
• 18:07
  going to have something that doesn't really exist and it's
• 18:09
  going to compute for you. And well, everyone gets that now
• 18:12
  and Quantum's going to follow the same path just like client
• 18:17
  server did. People.
• 18:18
  I I remember having a discussion with someone I worked with and
• 18:21
  we were we are a full mainframe shop.
• 18:23
  This is back in the early 80s and talking about client server
• 18:27
  which eventually became more localized PC's.
• 18:32
  And he said no, that none of those, that equipment will never
• 18:36
  show up in any shop I manage. And I said, I'm picturing you
• 18:39
  with the reverse imprint of a train on your forehead because
• 18:43
  you are standing on the track saying no, no, no, and you are
• 18:46
  not going to stop the train. Same thing happened with cloud
• 18:48
  computing. The same thing is going to be
• 18:50
  happening with Quantum. What's going to really be good
• 18:55
  for us though is that identity is going to be tied into
• 18:58
  quantum. You can't do it without a
• 19:01
  confirmed. Validated identity just like
• 19:04
  zero trust which is something you are here people are talking
• 19:07
  about and you say or what what's with zero trust whether you get
• 19:10
  or not, what's pillar one identity, if you skip that there
• 19:14
  the others the other six don't matter.
• 19:16
  So identity for zero trust for quantum is going to be
• 19:20
  foundational of what we do going forward and I think that's good
• 19:22
  for us and good for the world. That's all we call the show idea
• 19:25
  in the center, right? It's not, not, not by accident
• 19:28
  that we did that. I think one of the things I've
• 19:30
  noticed in just the brief hour or so that I've kind of been
• 19:33
  here on site is a lot of biometrics devices out on the
• 19:37
  show floor. What are your thoughts on that?
• 19:40
  Good. Bad.
• 19:41
  Yeah. So the good thing about
• 19:43
  biometrics is it gives you a more frictionless way because
• 19:47
  that's the word that most of them use for your users to be
• 19:51
  able to authenticate themselves for more secure applications and
• 19:54
  environments. It's not foolproof.
• 19:58
  You get false positive, you get false negatives.
• 20:00
  You have to be able to fine tune that.
• 20:03
  And even when the product works white right, the operator needs
• 20:06
  to fine tune it continuously as well because it can be easy,
• 20:10
  easily enough compromised. So I'm not.
• 20:13
  I have no statistics, I've done no research on this.
• 20:16
  However, if you look at generative AI, yet another term
• 20:19
  that we have yet to bring up in this conversation.
• 20:21
  So if you're looking for buzzword, bingo, we're filling
• 20:24
  the card. But with generative I, I and
• 20:27
  deep fake, it is really, really tough to say that's not me.
• 20:32
  And what are you going to do when that happens?
• 20:35
  So biometrics are great, but they're not a panacea.
• 20:40
  And boy, they're better than passwords.
• 20:43
  Hands down, yes, yes, let's get away from passwords.
• 20:46
  We've been saying that for, well, for 50 years.
• 20:49
  I've been saying it, I actually think.
• 20:52
  And they're cheering the background for us.
• 20:53
  Yeah, the world cheers when we say get rid of passwords.
• 20:56
  I actually think it's now popped over the horizon and we can see
• 20:59
  it. Yeah, definitely.
• 21:01
  I've seen passwords really take off in the last year or so.
• 21:04
  Pass keys was a big a big thing I think for a lot of
• 21:08
  organizations. You know, no small effort by,
• 21:11
  you know, Fido crew with getting Apple, Google and Microsoft to
• 21:15
  sit down and come to agreements right on how this would work
• 21:18
  because obviously them being the major platform vendors.
• 21:20
  Have a lot of say in how that would work and that
• 21:22
  interoperability is that certainly good.
• 21:26
  So if I may you just point and you're going to be going to a
• 21:29
  conference very soon talking about that.
• 21:31
  You just pointed out one of the large benefits of nonprofit
• 21:34
  alliances like the Fight Alliance or IDSA or SIA when you
• 21:38
  get the right members involved, which is why we're working on
• 21:41
  expanding our membership to different types as well as
• 21:43
  different companies, You become the voice for that function to
• 21:49
  government, to the big application providers, to
• 21:52
  Microsoft and Google and Amazon. And when you say here's a voice
• 21:58
  of all of these members that all want the same thing, they'll
• 22:01
  more, they're more likely to listen than even if one large
• 22:05
  company said we want this. So.
• 22:07
  And I think Fighter Lines deserves a lot of credit for
• 22:10
  that in this in this vein, and we're looking to be able to do
• 22:14
  the same thing in support of it, not in competition with them.
• 22:19
  It seems like there is a lot of government attendance here and
• 22:23
  obviously we're in Washington, DC, so I guess that's not to be
• 22:26
  too shocked around that. What's been your experience with
• 22:30
  government in general? Getting involved with identity
• 22:33
  security So governments know that identities are vitally
• 22:37
  important. They deal with it.
• 22:39
  If you're a government employee, you have a CAC and and that is,
• 22:43
  that's at the core of your identity.
• 22:45
  When you say Common Access card, thank you, sorry, I should not
• 22:48
  have used, I should have not used the acronym.
• 22:50
  But if you're a government employee or a contractor, you
• 22:52
  have one or you can't do anything, which is good.
• 22:55
  That the foundation of without identity you can't get anywhere
• 22:58
  else is a good thing. But it's more than that now only
• 23:01
  because of how the applications work where they're distributed
• 23:05
  do they want single sign on you know ID dot me is that going to
• 23:09
  work. Everything combined is now
• 23:11
  raised the profile to the federal government the US
• 23:14
  federal government who I'll offer is might be a few steps
• 23:17
  behind most other western governments on how do we
• 23:22
  digitize that. It's great that this came out
• 23:25
  with 800-63 and and associated standards around it.
• 23:29
  I I think there's only two agencies that are committed or
• 23:33
  required to follow it right now. So it's a start.
• 23:37
  We're going to get there. I think the fact that the
• 23:41
  federal government has visibility to the employees that
• 23:44
  are here, have visibility to all of this and can go back and say
• 23:49
  hey, you know other stuff to make this work is a really good
• 23:52
  thing. So I'm looking forward to that.
• 23:54
  It's I think, for what it's worth, not that I was hoping for
• 23:58
  government shutdown, but there were a few government employees
• 24:01
  I talked to. They said, hey, I'm very likely
• 24:02
  to be able to go into the conferences, but aren't now
• 24:06
  because because they're working. That's good.
• 24:08
  I'm glad the government didn't shut down.
• 24:09
  I'm going on record saying that. But it it all it raised, the
• 24:14
  interest is there we we have, we're no longer the shouting in
• 24:20
  the wilderness at the government anymore.
• 24:22
  The government now has to focus on now not what to buy, but how
• 24:26
  to do it. And that's their next challenge.
• 24:29
  And I think there's a lot of companies here they're going to
• 24:31
  help them do that. You're you're you're in one of
• 24:34
  them and and we need to help them get there, yeah?
• 24:37
  It'll be interesting to see how. So essentially when I when I
• 24:40
  attend a conference like this and I see what's coming next and
• 24:43
  sometimes what you see the conference like this is the next
• 24:47
  year, sometimes it's the next two to three years.
• 24:50
  I feel like government tends to move a little bit slower than
• 24:51
  that. So maybe it'll be five years or
• 24:53
  so before it gets more prevalent.
• 24:54
  But. Do you share the sort of my
• 24:56
  thought process that like we're seeing things here that will be
• 25:00
  in the zeitgeists at least for U.S.
• 25:03
  Federal government over the next one to five years or do you
• 25:07
  think it's further or more immediate?
• 25:09
  Well, I think there's some of each.
• 25:11
  There's there's biometrics you if you trip in one of the aisles
• 25:14
  you'll you'll fall into a biometrics.
• 25:16
  Don't worry, they'll know who you are.
• 25:17
  You'll be able to get this facial recognition will tell you
• 25:20
  here's you are, I know your medical history and here's what
• 25:22
  we can do, right. So biometrics, although you know
• 25:27
  biometrics has been part of, you know, like getting into a skiff,
• 25:30
  a Secure compartmentalized Information facility, you know
• 25:33
  the acronym here. But most other federal agencies
• 25:40
  and access didn't require necessary biometrics.
• 25:42
  I think you're going to see more of that now and I think that's
• 25:44
  current. I think that's things that
• 25:46
  they're going to be able to start acquiring and using.
• 25:50
  So let's go forward from that. We we can talk about both
• 25:54
  encryption and identity and both of them fit into the quantum and
• 25:59
  what many people call the post quantum world.
• 26:02
  I've yet to define what post quantum means since we're not
• 26:04
  even actually even there yet. But both of those will come
• 26:08
  together and and I think in two to five years you're going to
• 26:14
  start seeing that will become more commonplace just like
• 26:18
  biometrics are now. Biometrics will then become more
• 26:22
  accepted. Some will fall off the table,
• 26:24
  others will certainly have legs and they may already.
• 26:29
  And I believe what you're going to see with quantum encryption
• 26:33
  and identity all being tied together, I predict five years
• 26:37
  from now, come back and come back and find me then.
• 26:40
  And I I think in five years that will start becoming available
• 26:45
  and actually almost commonplace. And I know that's difficult for
• 26:48
  many people believe because most people don't even know what
• 26:50
  quantum means, and let's not get into it here.
• 26:53
  But I do believe that's what you're going to see on the next
• 26:56
  horizon. All right.
• 26:58
  Well, let's start to wrap things up.
• 26:59
  We were talking about how we want to end on a lighter note.
• 27:01
  And I'm going to give you credit for coming up with the question,
• 27:05
  not know if the right way to ask it is, but what is the best
• 27:11
  worst thing happening in identity?
• 27:13
  Hopefully that makes sense. Yes.
• 27:15
  Or it could be the worst best, the worst best thing.
• 27:17
  Yeah. It it either one works and and I
• 27:19
  think the worst best thing and I I I think the definition really
• 27:22
  holds is we've had more significant breaches now Now for
• 27:28
  those of us in the industry we're actually jaded by it like
• 27:31
  yeah big deal, another big breach, right.
• 27:33
  You know who's next? Yeah.
• 27:34
  And and actually we need to stop doing that, all right, because
• 27:38
  that part of the problem. But for the consumer who by the
• 27:43
  way who are the ones affected by this identity, it either goes to
• 27:47
  a silicon chip or it's an artificial identity or it's a
• 27:49
  carbon based unit, The carbon based units are beginning to pay
• 27:53
  attention. I have received really since the
• 27:58
  since the last large casino hack.
• 28:01
  All right. Which was reason or whenever
• 28:04
  you're listening to this, go see what the most recent hack was
• 28:07
  and whatever it was, that was it.
• 28:10
  People are now asking me, hey, isn't that what you work on?
• 28:14
  Well, yeah, it is. What can I do to help protect my
• 28:18
  identity? And I get giddy over that I
• 28:21
  giggle because they're asking the question I want everyone to
• 28:25
  ask every single provider they work with, not only say what can
• 28:29
  I do to help protect it, but why aren't you doing this to help me
• 28:32
  protect it. Those questions are going to do
• 28:35
  from the bottom up, drive this industry where it needs to be
• 28:38
  and I think that's a really good thing.
• 28:41
  Sad how we got there, but that needs to be the result of it.
• 28:44
  Yeah, drives awareness for sure. That definitely.
• 28:46
  And pain. Paint pain is a is a great
• 28:49
  motivator and. Not wants to go through that.
• 28:52
  No, not where I want to go first.
• 28:54
  But here we are, yeah. I would agree with that.
• 28:57
  I think I've seen a lot. You know, it used to be, well,
• 28:59
  what do you do? I've been identity for 20 years.
• 29:02
  How do I describe this? Right.
• 29:03
  It's like, OK, well, that. But yeah, you're right.
• 29:05
  With people getting more, I don't know.
• 29:08
  Awareness around what's happening in that space.
• 29:10
  Breaches typically are it. I mean I I was just hosted
• 29:13
  family at my at my place a few weeks ago and kind of talked
• 29:17
  about Oh well you know, what can I be doing to keep my accounts.
• 29:20
  That's not a question I would have expected my 50s, sixties
• 29:24
  and 70 year old members right to be asking, but they were asking
• 29:29
  it and so it definitely has gotten more top of mind for
• 29:32
  folks out there, which I think is great.
• 29:35
  It is the best worst thing or worst best thing.
• 29:37
  However you want to exactly, Jeff, what you do now is sexy.
• 29:40
  See. Well, you know, I always knew it
• 29:43
  was. In fact, I think episode #2, I
• 29:45
  think of this show was like getting into the sexy world of I
• 29:48
  am a little bit of a joke, but hey, I'll take it.
• 29:51
  Here we are. It only took a couple years, but
• 29:52
  we're there. Yeah, exactly.
• 29:53
  We're ahead of the game. Exactly.
• 29:55
  All right. Let's go ahead and wrap things
• 29:56
  up. Any final thoughts or takeaways
• 29:59
  being part of this discussion? Yeah, yeah, I would just offer
• 30:03
  think about what you're doing. You know, participate in
• 30:06
  Cybersecurity Awareness Month. More importantly, don't only do
• 30:09
  it in October, do that. You know, don't stop your
• 30:12
  activities on November 1st. Keep it year round.
• 30:15
  I I really want to encourage that.
• 30:17
  Secure the world is a new theme and it's a new Evergreen theme
• 30:20
  and that's why, because it's not really supposed to stop.
• 30:23
  In addition to that, I would say ask your family members, do you
• 30:27
  care about your identities And see who's asking.
• 30:31
  See who's responding and get the word out.
• 30:33
  You don't have to be an expert to make people aware and that
• 30:36
  would be the focus. Good tips.
• 30:39
  We'll have a bunch of links in our show notes for people to
• 30:41
  follow, but you can find more about the Identity Define
• 30:44
  Security alliance@idsalliance.org, so go
• 30:48
  there. For more information, you can
• 30:49
  find us on the web. We're at IDAC podcast.com.
• 30:53
  We're on Twitter or X or whatever.
• 30:54
  We're calling it this week at IDAC podcasts.
• 30:58
  We're on Mastodon at IDAC podcasts at infosec dot
• 31:01
  exchange. Every time I say that it just
• 31:04
  cringes me saying that it's like I like the idea of it, but it's
• 31:07
  gotta get more user friendly. The whole massive I.
• 31:09
  When people ask me about that, by the way, I say it's if you
• 31:12
  consider merging Twitter. And discord?
• 31:15
  Yes, like, absolutely. And and LinkedIn the whole.
• 31:21
  Yeah, it's it's an interesting thing that they're doing there.
• 31:24
  But we also started a LinkedIn page as well.
• 31:28
  So we finally on LinkedIn. An actual Identity Center page.
• 31:31
  So. I've been tagging that out of my
• 31:33
  account. So we've got a new YouTube, not
• 31:35
  you new to new YouTube, but starting to put our episodes up
• 31:38
  on YouTube as well. So we will check that as well.
• 31:41
  So do all the social media things like subscribe, right.
• 31:45
  That's how you can help us out here and helps us be at these
• 31:47
  conferences and meet in person when you can.
• 31:49
  This has been great. Yeah, this has been great.
• 31:51
  So always enjoy connecting with you Jeff and looking forward to
• 31:54
  the next time. We'll go ahead and leave it
• 31:55
  there for this week. Thanks everybody for listening.
• 31:57
  Jeff, thanks for being here. Give you the fist bump of
• 31:59
  gratitude here in a minute and. We'll talk with everyone in the
• 32:03
  next one. You've been listening to
• 32:07
  Identity at the Center. We hope you've enjoyed the show.
• 32:11
  Make sure to like, rate and review and we'll be back soon.
• 32:15
  But in the meantime, hit the website at
• 32:18
  identity@thecenter.com and find us on Twitter at IDAC Podcast.
• 32:25
  See you next time on identity at the center.