Latest / The Identity Blueprint / Planning Successful Identity Management Rollouts

Transcript

Planning Successful Identity Management Rollouts · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the Identity Blueprint, where enterprise identity and access management gets the depth it deserves.
• 0:06
  SPEAKER_00: I'm Ernie Prescott, Principal IAM Architect, and in episode seven, Jose and I are tackling the phase that determines whether everything built in the previous six episodes actually survives contact with a real organization.
• 0:20
  SPEAKER_00: Phase six, implementation planning.
• 0:23
  SPEAKER_00: This is where brilliant architecture meets human psychology.
• 0:27
  SPEAKER_00: And human psychology wins more often than anyone in enterprise IT wants to admit.
• 0:32
  SPEAKER_00: IAM programs almost never fail because the code is broken.
• 0:36
  SPEAKER_00: They fail because of poor planning, misaligned resource models, and a dangerous underestimation of the people who have to live inside the system every day.
• 0:44
  SPEAKER_00: Change management across four critical battlegrounds testing mechanics that read like science fiction, and the hard conversation about whether your current team is actually equipped to build what the architecture demands.
• 0:57
  SPEAKER_00: If you've ever watched a multimillion dollar rollout collapse on launch day, this is the episode that explains exactly why and exactly how to prevent it.
• 1:07
  SPEAKER_00: Let's get into it.
• 1:08
  SPEAKER_01: Imagine spending like$10 million to upgrade your company's digital security.
• 1:14
  SPEAKER_01: You've had consultants in for months.
• 1:16
  SPEAKER_01: You know, you've bought the absolute most expensive software licenses on the market.
• 1:20
  SPEAKER_00: Oh, yeah.
• 1:21
  SPEAKER_00: The top-tier stuff.
• 1:22
  SPEAKER_01: Right, exactly.
• 1:23
  SPEAKER_01: And the architectural diagrams, I mean, they look like modern art, but then comes launch day, Monday morning rolls around, and your entire sales team is just inexplicably locked out of their accounts.
• 1:34
  SPEAKER_00: A total nightmare scenario.
• 1:36
  SPEAKER_01: It really is.
• 1:37
  SPEAKER_01: By 900 a.m., the help desk phone lines have just completely melted down.
• 1:41
  SPEAKER_01: And by 10 a.m., you have these highly paid executives writing their new, supposedly ultra secure passwords on sticky notes and literally slapping them directly onto their monitors just to survive the day.
• 1:52
  SPEAKER_00: Aaron Powell I've seen it happen.
• 1:53
  SPEAKER_00: The entire business essentially just grinds to a halt.
• 1:56
  SPEAKER_01: Aaron Powell Yeah.
• 1:56
  SPEAKER_01: And that is the grim, just highly stressful reality of a failed identity rollout.
• 2:02
  SPEAKER_01: So welcome to the deep dive.
• 2:04
  SPEAKER_01: Today we are really tearing apart the mechanics of how massive corporate technology rollouts actually, you know, cross the finish line.
• 2:11
  SPEAKER_00: Aaron Powell And do it without bringing the company to its knees, which is the hard part.
• 2:14
  SPEAKER_01: Right.
• 2:15
  SPEAKER_01: So this scenario we just talked about, it plays out far more often than anyone in enterprise IT actually wants to admit, doesn't it?
• 2:22
  SPEAKER_00: Oh, absolutely.
• 2:23
  SPEAKER_00: I mean, you can have a flawless strategic vision on paper, but a vision doesn't actually provision a user account, right?
• 2:29
  SPEAKER_00: It doesn't secure a database.
• 2:31
  SPEAKER_01: Aaron Powell Yeah.
• 2:31
  SPEAKER_01: Theory versus reality.
• 2:32
  SPEAKER_00: Aaron Powell Exactly.
• 2:33
  SPEAKER_00: So if you're tuning in to understand how these sprawling multi-year initiatives actually get built, you are in the right place.
• 2:40
  SPEAKER_00: We are focusing intensely on phase six of the identity and access management program engagement blueprint.
• 2:47
  SPEAKER_01: Okay, so phase six.
• 2:48
  SPEAKER_00: Aaron Powell Right.
• 2:49
  SPEAKER_00: This phase is entirely dedicated to implementation planning.
• 2:52
  SPEAKER_00: It's um it's basically the unforgiving crucible where your theoretical architecture meets the really messy, unpredictable reality of a living, breathing enterprise.
• 3:01
  SPEAKER_01: And we are gonna get into the absolute weeds of how this works today.
• 3:05
  SPEAKER_01: We're looking at how you dissect those massive multi-year roadmaps into microscopic, actionable projects.
• 3:12
  SPEAKER_01: You do.
• 3:13
  SPEAKER_01: And we are gonna scrutinize who actually builds this infrastructure and frankly why your current IT team might not actually be equipped to do it.
• 3:23
  SPEAKER_00: Aaron Powell Which is a tough pill to swallow for a lot of directors.
• 3:25
  SPEAKER_01: Aaron Powell It really is.
• 3:26
  SPEAKER_01: And then we'll look at the incredible, like almost sci-fi levels of testing required to ensure you don't accidentally lock the CEO out of the network.
• 3:34
  SPEAKER_00: That's always a bad day.
• 3:35
  SPEAKER_01: The worst day.
• 3:36
  SPEAKER_01: And then we are going to spend a massive amount of time on what the sources unanimously agree is the ultimate boss fight of any tech rollout.
• 3:45
  SPEAKER_00: Aaron Powell Human psychology.
• 3:46
  SPEAKER_01: Yes.
• 3:47
  SPEAKER_01: Human psychology.
• 3:48
  SPEAKER_01: We'll explore the deep friction of change management across four critical battlegrounds, which are multi-factor authentication, life cycle automation, access reviews, and privileged access.
• 3:58
  SPEAKER_00: Aaron Powell And you know, the through line in all the research and the postmortems we've reviewed for this, it's really stark.
• 4:04
  SPEAKER_00: IAM, or identity and access management programs, they almost never fail because the underlying code is broken.
• 4:10
  SPEAKER_01: Aaron Powell, so it's not a software bug, usually.
• 4:12
  SPEAKER_00: No, rarely.
• 4:13
  SPEAKER_00: I mean, the technology, by and large, does exactly what it is programmed to do.
• 4:18
  SPEAKER_00: These multimillion dollar failures, they almost always stem from poor planning or misaligned resource models and just a dangerous underestimation of the human element.
• 4:28
  SPEAKER_01: Aaron Powell Which makes sense, yeah.
• 4:29
  SPEAKER_00: Aaron Powell So phase six is this highly structured framework, and it's designed to explicitly neutralize those specific risks long before a single production system is even altered.
• 4:39
  SPEAKER_01: Okay, let's unpack this.
• 4:40
  SPEAKER_01: Let's get right into the mechanics of that neutralization.
• 4:43
  SPEAKER_01: Because the first major hurdle the blueprint identifies is translation.
• 4:47
  SPEAKER_00: Aaron Powell Moving from the theoretical roadmap to the concrete reality.
• 4:51
  SPEAKER_00: Trevor Burrus, Jr.
• 4:51
  SPEAKER_01: Exactly.
• 4:52
  SPEAKER_01: So in earlier phases of an IAM program, you are essentially looking at like a painting of a beautiful horizon.
• 4:58
  SPEAKER_01: It's a three-year strategic vision.
• 5:00
  SPEAKER_01: But phase six demands that you figure out how to actually mix the paint, stretch the canvas, and hold the brush.
• 5:06
  SPEAKER_01: Trevor Burrus, Jr.
• 5:06
  SPEAKER_00: Right.
• 5:06
  SPEAKER_00: You need a sequence.
• 5:07
  SPEAKER_00: You can't just say build the house.
• 5:08
  SPEAKER_01: Aaron Powell Yeah, you have these initiatives on a roadmap that say things like uh deploy zero trust architecture or automate life cycle management.
• 5:17
  SPEAKER_01: But you can't just hand an engineer a sticky node that says deploy zero trust and expect a result.
• 5:21
  SPEAKER_00: Aaron Powell You absolutely cannot.
• 5:23
  SPEAKER_00: And that translation process, it's an operational contract.
• 5:26
  SPEAKER_00: A roadmap is aspirational, you know.
• 5:29
  SPEAKER_00: But an implementation plan is binding.
• 5:31
  SPEAKER_01: Aaron Powell Okay.
• 5:32
  SPEAKER_01: Aspirational versus binding.
• 5:34
  SPEAKER_01: I like that distinction.
• 5:34
  SPEAKER_01: Aaron Powell Yeah.
• 5:35
  SPEAKER_00: So the core objective of phase six is to take those massive multi-year initiatives and basically shatter them into highly specific manageable projects.
• 5:45
  SPEAKER_00: Each of those microprojects requires a brutally defined scope.
• 5:48
  SPEAKER_01: Aaron Powell Non-negotiable deliverables, I imagine.
• 5:50
  SPEAKER_00: Aaron Powell Exactly.
• 5:51
  SPEAKER_00: Deliverables and really rigorous timelines.
• 5:54
  SPEAKER_00: But the absolute most critical part of this breakdown, and honestly the place where most programs immediately derail, is the mapping of dependencies.
• 6:00
  SPEAKER_01: Aaron Powell I really want to dig into that because the sources we have, they just hammer the concept of dependencies relentlessly.
• 6:05
  SPEAKER_01: They sort of frame it as the silent killer of project timelines.
• 6:08
  SPEAKER_00: Aaron Powell Well, they frame it that way because it's true.
• 6:11
  SPEAKER_00: Identity systems, they do not exist in a vacuum.
• 6:14
  SPEAKER_00: By definition, IAM is the connective tissue of the entire enterprise.
• 6:19
  SPEAKER_00: It touches everything.
• 6:20
  SPEAKER_01: Aaron Powell So give me an example.
• 6:21
  SPEAKER_01: What does a dependency look like in this context?
• 6:24
  SPEAKER_00: Aaron Powell Let's look at a dated dependency, which is incredibly common.
• 6:27
  SPEAKER_00: Suppose your implementation plan calls for rolling out advanced identity governance features.
• 6:32
  SPEAKER_01: Aaron Powell Okay, so like a system like SalePoint.
• 6:35
  SPEAKER_00: Right.
• 6:35
  SPEAKER_00: Sale point is a great example.
• 6:36
  SPEAKER_00: So you want SalePoint to automatically provision access based on an employee's job title and their department.
• 6:44
  SPEAKER_00: The dependency there is the authoritative data feed coming from your HR system.
• 6:48
  SPEAKER_01: So like workday or SAP or Oracle.
• 6:51
  SPEAKER_00: Exactly.
• 6:52
  SPEAKER_01: Right.
• 6:52
  SPEAKER_01: Because if the HR data is garbage, the automated provisioning is just going to be garbage, right?
• 6:56
  SPEAKER_00: Aaron Powell That is exactly the problem.
• 6:57
  SPEAKER_00: If HR has, say, 30 different spellings for account manager.
• 7:01
  SPEAKER_01: Oh man, I've seen that.
• 7:02
  SPEAKER_01: Act MCR, account Mang, all of it.
• 7:06
  SPEAKER_00: Right.
• 7:06
  SPEAKER_00: Or if contractors are tracked in a completely separate manual spreadsheet that HR doesn't even own, your automated identity system cannot function.
• 7:16
  SPEAKER_00: It will provision the wrong access, or just no access at all.
• 7:19
  SPEAKER_01: Aaron Powell So it just breaks.
• 7:21
  SPEAKER_00: It breaks.
• 7:22
  SPEAKER_00: And if you do not catch that data dependency during phase six implementation planning, your engineering team is going to hit a brick wall during execution.
• 7:29
  SPEAKER_01: And that's expensive.
• 7:30
  SPEAKER_00: Oh, incredibly.
• 7:31
  SPEAKER_00: You will have highly paid integration engineers just sitting idle for weeks, burning through your project budget while you literally beg the HR department to clean up their job codes.
• 7:41
  SPEAKER_01: Aaron Powell Wow.
• 7:42
  SPEAKER_01: Okay, so that's a data dependency.
• 7:43
  SPEAKER_01: But what about the actual workflow of the business?
• 7:45
  SPEAKER_01: Because the text mentions process dependencies as well.
• 7:48
  SPEAKER_00: Aaron Powell Yeah, and process dependencies are often even harder to untangle because they involve corporate politics.
• 7:54
  SPEAKER_01: Aaron Powell Ah, everyone's favorite topic.
• 7:56
  SPEAKER_00: Trevor Burrus Right.
• 7:56
  SPEAKER_00: So imagine you want to implement a seamless automated access request workflow in a portal-like service now.
• 8:02
  SPEAKER_00: A user clicks a button, requests access to a sensitive financial database, and the system routes it for approval.
• 8:08
  SPEAKER_01: Aaron Powell Sounds great on paper.
• 8:10
  SPEAKER_00: It does.
• 8:11
  SPEAKER_00: And the technological implementation of that is actually quite simple.
• 8:14
  SPEAKER_00: But the process dependency is, well, who actually has the authority to approve that access?
• 8:19
  SPEAKER_01: Oh, I see.
• 8:20
  SPEAKER_01: Has the business actually defined the rules?
• 8:21
  SPEAKER_00: Aaron Powell Exactly.
• 8:22
  SPEAKER_00: Does it go to the user's direct manager?
• 8:24
  SPEAKER_00: Does it go to the application owner?
• 8:26
  SPEAKER_00: Or, you know, does it require a sign-off from the risk and compliance team?
• 8:30
  SPEAKER_01: Aaron Powell And if you haven't decided that before you start coding, then you are automating chaos.
• 8:35
  SPEAKER_00: If the business hasn't agreed on the workflow, you literally cannot configure the tool.
• 8:40
  SPEAKER_00: So phase six forces you to map every single one of those process dependencies and assign a clear owner to resolve them before the technical build even begins.
• 8:49
  SPEAKER_01: Aaron Powell Which brings us to the structure of the team itself.
• 8:52
  SPEAKER_01: To manage all this data cleanup, process definition, and technical integration, the blueprint outlines a highly specific team structure.
• 9:00
  SPEAKER_01: Trevor Burrus, Jr.
• 9:01
  SPEAKER_00: It does.
• 9:01
  SPEAKER_00: It's very structured.
• 9:02
  SPEAKER_01: It mandates a program manager, technical leads, work stream owners, and vendor resources.
• 9:08
  SPEAKER_01: But I mean, I look at this org chart and I see massive redundancy.
• 9:11
  SPEAKER_01: Well, wait, if a company already has a massive IT department like they have a chief information officer, they have legions of sysadmins, network engineers, database managers, why can't they just absorb this into their daily operations?
• 9:26
  SPEAKER_01: Creating an entire parallel organizational structure just for an identity rollout seems, I don't know, like bureaucratic overkill.
• 9:33
  SPEAKER_00: I hear that a lot.
• 9:34
  SPEAKER_00: It looks like overkill until you attempt to cross a departmental boundary, at which point it becomes your only lifeline.
• 9:40
  SPEAKER_01: Okay, explain that.
• 9:41
  SPEAKER_00: General IT simply cannot absorb a massive IM transformation into their daily operations because IAM is fundamentally cross-functional.
• 9:50
  SPEAKER_00: It is not just an IT problem.
• 9:51
  SPEAKER_00: Right.
• 9:52
  SPEAKER_00: When you automate employee onboarding, you are manipulating HR data.
• 9:56
  SPEAKER_00: When you set up quarterly access reviews, you are demanding time and attention from every single application owner and department head in the company.
• 10:03
  SPEAKER_01: You're asking for their time.
• 10:04
  SPEAKER_00: Yes.
• 10:05
  SPEAKER_00: And when you define segregation of duties like ensuring the person who writes a check can't also approve the check, you are working squarely in the domain of compliance and audit officers.
• 10:14
  SPEAKER_01: Okay, I see.
• 10:14
  SPEAKER_01: So a standard sysadmin managing like email servers has zero authority to tell the VP of finance how to structure their approval workflows.
• 10:23
  SPEAKER_00: None whatsoever.
• 10:24
  SPEAKER_00: If an initiative is just designated as its job, the rest of the business will not prioritize it.
• 10:30
  SPEAKER_00: HR will not prioritize data normalization for IT.
• 10:34
  SPEAKER_01: Why would they?
• 10:35
  SPEAKER_01: They have their own goals.
• 10:36
  SPEAKER_00: Exactly.
• 10:37
  SPEAKER_00: Application owners will ignore requests to map their internal permissions.
• 10:41
  SPEAKER_00: That is why phase six demands dedicated work stream owners.
• 10:45
  SPEAKER_01: So what does a work stream owner actually do?
• 10:47
  SPEAKER_00: A work stream owner's sole responsibility is to drive their specific piece of the puzzle across the finish line, regardless of organizational silos.
• 10:55
  SPEAKER_00: They're granted the executive backing to cross those boundaries.
• 10:58
  SPEAKER_01: So they have real teeth.
• 10:59
  SPEAKER_00: Yes, they hold other departments accountable, and they ensure that the non-technical dependencies are resolved at the exact moment the engineering team needs them.
• 11:07
  SPEAKER_00: Accountability cannot be a shared, nebulous concept.
• 11:10
  SPEAKER_00: It has to be a specific person's job.
• 11:12
  SPEAKER_01: Aaron Powell That makes total sense.
• 11:13
  SPEAKER_01: Okay, so that clarifies the leadership structure.
• 11:16
  SPEAKER_01: Right.
• 11:16
  SPEAKER_01: We know how to break down the work and we know who is accountable for clearing the roadblocks.
• 11:22
  SPEAKER_01: Right.
• 11:22
  SPEAKER_01: But that leads us to a fascinating dilemma that the blueprint brings up who actually builds the machine.
• 11:28
  SPEAKER_00: Aaron Powell The resource model.
• 11:29
  SPEAKER_01: Yeah.
• 11:30
  SPEAKER_01: The sources emphasize that deciding on your resource model, you know, choosing between your internal full-time employees, specialized contractors, vendor professional services, or managed service providers, is basically a make or break decision.
• 11:44
  SPEAKER_00: Aaron Powell It really is.
• 11:46
  SPEAKER_00: Assessing organizational readiness is where a lot of IT directors have to face some uncomfortable truths about their own teams.
• 11:53
  SPEAKER_01: Aaron Powell The Tex calls it organizational readiness.
• 11:56
  SPEAKER_00: The blueprint requires a brutal honest assessment of your current capabilities.
• 12:01
  SPEAKER_00: Do you have a dedicated identity team, or are you just tapping your general network operations guys on the shoulder and asking them to learn zero trust architecture on the weekends?
• 12:10
  SPEAKER_01: And more often than not, it's the latter, right?
• 12:12
  SPEAKER_00: Almost always.
• 12:13
  SPEAKER_01: The same person keeping the legacy servers running is suddenly tasked with leading an enterprise-wide identity transformation, which highlights a massive skill gap dilemma brought up in the text.
• 12:24
  SPEAKER_00: The skill gap is real.
• 12:25
  SPEAKER_01: You have these internal teams whose expertise is deeply rooted in legacy systems.
• 12:30
  SPEAKER_01: They might be absolute wizards at on-premises Active Directory.
• 12:34
  SPEAKER_01: They know protocols like Kerberos and NTLM like the back of their hand.
• 12:39
  SPEAKER_01: But now the blueprint is demanding a shift to modern cloud native identity.
• 12:45
  SPEAKER_00: We really need to pause and explain the sheer magnitude of that shift because it is not just learning a new software interface, it is a fundamental shift in how authentication works mechanically.
• 12:55
  SPEAKER_01: Okay, let's get into the mechanics.
• 12:57
  SPEAKER_01: Teach me about Kerberos.
• 12:58
  SPEAKER_00: Let's take Kerberos, which is the backbone of Legacy Active Directory.
• 13:01
  SPEAKER_00: Kerberos is essentially a ticketing system designed for a closed network perimeter.
• 13:05
  SPEAKER_01: So like an office building.
• 13:07
  SPEAKER_00: Right.
• 13:07
  SPEAKER_00: You log into your computer in the morning, the domain controller verifies your password, and it hands you a ticket granting ticket.
• 13:14
  SPEAKER_00: For the rest of the day, as you try to access file shares or internal printers, your computer just flashes that ticket like a VIP pass.
• 13:22
  SPEAKER_00: It assumes that because you are inside the castle walls and you have the ticket, you are safe.
• 13:28
  SPEAKER_01: It's like the bancer checking your ID once at the front door of the club.
• 13:31
  SPEAKER_01: Once you're in, you can go to the bar, you can go to the dance floor, nobody asks you for your ID again.
• 13:36
  SPEAKER_00: That is a perfect analogy.
• 13:37
  SPEAKER_00: But the modern cloud doesn't have a front door and it doesn't have castle walls.
• 13:41
  SPEAKER_01: Right, because people are everywhere.
• 13:43
  SPEAKER_00: Exactly.
• 13:44
  SPEAKER_00: Your users are logging in from coffee shops, airports, and home networks on devices the company might not even own.
• 13:51
  SPEAKER_00: So those legacy IT teams are suddenly forced to grapple with modern federated identity protocols.
• 13:57
  SPEAKER_00: We are talking about SAML, which stands for Security Assertion Markup Language and Open ID Connect.
• 14:03
  SPEAKER_01: And how do those fundamentally differ from the bouncer with the ticket?
• 14:06
  SPEAKER_00: Instead of a ticket that gets you free reign, these modern protocols act more like a continuous digital passport that applications constantly verify through cryptographic signatures.
• 14:16
  SPEAKER_01: Cryptographic signatures.
• 14:17
  SPEAKER_01: Okay, how does that play out for a user?
• 14:19
  SPEAKER_00: When a user tries to access a cloud application like Salesforce, Salesforce doesn't check their password.
• 14:24
  SPEAKER_00: It redirects the user back to the central identity provider, say Okta or Microsoft Intra ID.
• 14:30
  SPEAKER_01: Okay.
• 14:31
  SPEAKER_00: The identity provider authenticates the user, perhaps requiring a biometric scan or a hardware key, and then generates a highly specific digitally signed payload.
• 14:40
  SPEAKER_00: In OpenID Connect, this is called a JSON Web Token or JWT.
• 14:44
  SPEAKER_01: A JWT.
• 14:45
  SPEAKER_01: I've heard that term.
• 14:46
  SPEAKER_00: Yeah, JWT.
• 14:47
  SPEAKER_00: That token contains specific claims, who the user is, when they authenticated, and what their specific access level is.
• 14:54
  SPEAKER_00: The identity provider hands that signed token back to the user's browser, which hands it to Salesforce.
• 14:59
  SPEAKER_01: And Salesforce just trusts it.
• 15:01
  SPEAKER_00: Well, Salesforce mathematically verifies the signature to ensure it hasn't been tampered with and only then grants access.
• 15:07
  SPEAKER_01: Wow.
• 15:08
  SPEAKER_01: That is a wildly different architectural concept.
• 15:12
  SPEAKER_01: You go from assuming trust within a physical network to constantly verifying cryptographic tokens across the public internet.
• 15:19
  SPEAKER_00: Aaron Powell It's a completely different paradigm.
• 15:21
  SPEAKER_01: So if your team only knows Kerberos, asking them to instantly design dynamic conditional access policies based on OpenID Connect JWTs, I mean it's like asking a master bricklayer to suddenly design a suspension bridge.
• 15:34
  SPEAKER_00: It is a recipe for disaster, which is why the implementation plan in phase six requires a strategic blend of resources.
• 15:42
  SPEAKER_01: So how do you bridge that gap without just firing everyone and hiring new people?
• 15:45
  SPEAKER_01: Because you can't just clear out the IT department.
• 15:47
  SPEAKER_00: No, you cannot just fire your internal team, but you also cannot rely on them to build an architecture they don't understand.
• 15:53
  SPEAKER_00: The standard approach is to bring in vendor professional services or highly specialized contractors to do the heavy lifting and establish the initial foundation.
• 16:01
  SPEAKER_00: Aaron Powell The hired guns.
• 16:03
  SPEAKER_00: Right.
• 16:03
  SPEAKER_00: These are the engineers who have deployed these specific platforms 50 times before.
• 16:08
  SPEAKER_00: They know exactly how to configure the cryptographic trust relationships.
• 16:12
  SPEAKER_00: They know the undocumented bugs in the software.
• 16:15
  SPEAKER_00: They build the core engine.
• 16:16
  SPEAKER_01: Aaron Powell But there's a trap there too, right?
• 16:18
  SPEAKER_01: If you just let the high-priced consultants build the engine and then hand you the keys on their way out the door, you're left with a system nobody internally knows how to maintain.
• 16:27
  SPEAKER_00: Yes.
• 16:28
  SPEAKER_00: That is known as creating shelfware or an orphaned system.
• 16:31
  SPEAKER_01: Aaron Powell Shelfware.
• 16:32
  SPEAKER_01: Because it just sits on the shelf.
• 16:34
  SPEAKER_00: Aaron Ross Powell Exactly.
• 16:35
  SPEAKER_00: The consultants leave, the system inevitably hits a snag three months later, the internal team has no idea how to troubleshoot the JSON web tokens, and the system slowly decays into obsolescence.
• 16:46
  SPEAKER_01: Aaron Powell So how do we prevent that?
• 16:48
  SPEAKER_00: To prevent this, the blueprint mandates that your internal employees must simultaneously shadow the implementation.
• 16:54
  SPEAKER_00: They shouldn't be building the complex architecture, but they must be in the room watching the vendor build it.
• 17:00
  SPEAKER_01: Ah, so it's a transfer of knowledge.
• 17:02
  SPEAKER_00: Yes.
• 17:02
  SPEAKER_00: You are training your internal staff to eventually take over tier two operations, which is the day-to-day management and troubleshooting, and eventually tier three engineering for the steady state operating model.
• 17:14
  SPEAKER_01: It's the difference between having a mechanic build a custom race car for you versus having them build it while you hand them the wrenches and they explain every single part they're installing.
• 17:24
  SPEAKER_00: That's exactly it.
• 17:25
  SPEAKER_00: And that leads to a really profound piece of advice buried in the sources.
• 17:30
  SPEAKER_00: It essentially says, you know, you must match the complexity of the platform you are buying to your team's actual capability, not their aspirational capability.
• 17:39
  SPEAKER_01: Not their aspirational capability.
• 17:40
  SPEAKER_01: Ouch.
• 17:41
  SPEAKER_00: Buying more platform than the organization can reasonably implement or operate is consistently listed as a top failure mode.
• 17:48
  SPEAKER_01: That implies a massive ego check for IT directors.
• 17:51
  SPEAKER_01: You're saying they have to admit their internal team isn't ready for a Ferrari-level platform and intentionally buy a Honda instead just to ensure it actually gets driven.
• 18:00
  SPEAKER_00: It requires extreme pragmatism.
• 18:03
  SPEAKER_00: If your current IT team struggles to simply manage basic group memberships and remove access when people leave the company, you have absolutely no business buying the most complex, highly customized, AI-driven identity governance suite on the market.
• 18:18
  SPEAKER_01: It'll just crush them.
• 18:19
  SPEAKER_00: The tool will simply overwhelm them.
• 18:21
  SPEAKER_00: You need to implement a platform that relies on simpler, out-of-the-box workflows that do more of the heavy lifting, even if it means you sacrifice some of that granular customization.
• 18:31
  SPEAKER_00: You scale the technology to the reality of the humans who will be operating it.
• 18:36
  SPEAKER_01: That is a deeply grounded way to look at technology procurement.
• 18:40
  SPEAKER_01: Okay, so we've mapped the dependencies, we've hired the right mix of internal staff and vendor experts, and we've selected a platform that matches our capability.
• 18:49
  SPEAKER_01: We build the architecture.
• 18:50
  SPEAKER_00: Right, the build phase.
• 18:51
  SPEAKER_01: But you don't just take this massive new identity system, wire it up to the entire company, flip the switch on a Friday night, and hope for the best.
• 18:58
  SPEAKER_00: Definitely not.
• 18:59
  SPEAKER_00: That's how you make the news.
• 19:00
  SPEAKER_01: Exactly.
• 19:01
  SPEAKER_01: So how do engineers actually validate that this incredibly complex web of cryptographic trust doesn't accidentally bring down the entire business?
• 19:10
  SPEAKER_00: You build a crucible.
• 19:11
  SPEAKER_00: In phase six, your testing and validation strategy must be airtight and intensely systematic.
• 19:18
  SPEAKER_00: We are moving far beyond simple functional testing.
• 19:20
  SPEAKER_01: Aaron Powell Like just checking if a password works.
• 19:22
  SPEAKER_00: Aaron Powell Right.
• 19:23
  SPEAKER_00: Yes, you need to know if a password works.
• 19:25
  SPEAKER_00: But the modern enterprise requires layers of validation: security testing, user acceptance testing, and staged pilot rollouts.
• 19:34
  SPEAKER_00: The foundation of this is the identity sandbox.
• 19:37
  SPEAKER_01: Okay, the identity sandbox, the sources get really technical here, and I want to spend some time unpacking this because the mechanisms are fascinating.
• 19:43
  SPEAKER_01: They talk about using ephemeral credential pools within these sandboxes.
• 19:48
  SPEAKER_01: What exactly is an ephemeral credential and how does it work?
• 19:51
  SPEAKER_00: Well, ephemeral means temporary or fleeting.
• 19:54
  SPEAKER_00: Historically, when developers wanted to test an application's integration with an identity system, they would create static test accounts in the directory.
• 20:01
  SPEAKER_01: So like a dummy account.
• 20:02
  SPEAKER_00: Exactly.
• 20:03
  SPEAKER_00: They would literally create an account called test user one, give it a permanent password, and assign it high-level privileges so they can make sure the administrative functions worked.
• 20:12
  SPEAKER_01: Which sounds like a massive security vulnerability just waiting to be exploited.
• 20:17
  SPEAKER_00: It is one of the most common ways hackers breach a network.
• 20:19
  SPEAKER_00: They find an old forgotten test account with a weak password and domain admin privileges that some developer created three years ago and just forgot to delete.
• 20:29
  SPEAKER_01: Wow.
• 20:29
  SPEAKER_00: Modern testing in an identity sandbox eliminates this risk entirely using ephemeral credential pools.
• 20:36
  SPEAKER_00: Instead of a static account, the testing framework uses an API call to the identity provider to generate a temporary identity just milliseconds before the automated test runs.
• 20:46
  SPEAKER_01: Just milliseconds before.
• 20:48
  SPEAKER_00: Yes.
• 20:48
  SPEAKER_00: This identity is injected with the specific attributes needed for the test.
• 20:52
  SPEAKER_00: The test executes to verify the access controls.
• 20:55
  SPEAKER_00: And the moment the test concludes, another API call instantly destroys the identity.
• 21:00
  SPEAKER_01: It destroys it completely.
• 21:02
  SPEAKER_00: The credential exists only for the exact duration of the validation.
• 21:05
  SPEAKER_00: There's nothing left behind for an attacker to find.
• 21:07
  SPEAKER_01: That is incredibly slick.
• 21:09
  SPEAKER_01: It's like a digital burner phone that self-destructs the moment you hang up.
• 21:13
  SPEAKER_00: That's a great way to think of it.
• 21:14
  SPEAKER_01: But how do you test the complex logic of a massive organization?
• 21:18
  SPEAKER_01: Because the text mentions synthetic identity graph generation.
• 21:22
  SPEAKER_01: And I need you to translate that into plain English because it sounds like pure science fiction.
• 21:27
  SPEAKER_00: It sounds complex, but the underlying logic is brilliant.
• 21:31
  SPEAKER_00: A graph database is a way of storing data that emphasizes the relationships between things.
• 21:37
  SPEAKER_00: Instead of flat tables of rows and columns, a graph uses nodes, which represent users, devices, or applications, and edges, which represent the relationship or the access rights between them.
• 21:49
  SPEAKER_01: Okay, nodes and edges.
• 21:50
  SPEAKER_00: Right.
• 21:50
  SPEAKER_00: When you are testing a complex identity system, you need to know what happens when rules interact with each other.
• 21:56
  SPEAKER_01: So if someone is a manager in finance but also currently deployed to a temporary Task force in HR and they are logging in from a new iPad.
• 22:03
  SPEAKER_01: How does the system evaluate all those overlapping conditions?
• 22:07
  SPEAKER_00: Precisely.
• 22:08
  SPEAKER_00: If you only test simple linear scenarios, you will miss the conflicts that cause security breaches.
• 22:14
  SPEAKER_00: Synthetic identity graph generation involves algorithmically generating thousands of simulated, fake users.
• 22:21
  SPEAKER_00: Aaron Powell Thousands of them.
• 22:22
  SPEAKER_00: Yes.
• 22:23
  SPEAKER_00: But these aren't just blank slates.
• 22:25
  SPEAKER_00: The algorithms assign them complex, interwoven attributes that mimic the messy reality of a corporate structure.
• 22:31
  SPEAKER_00: You inject this entire synthetic population into the sandbox.
• 22:35
  SPEAKER_00: Then you apply your new dynamic access policies to the graph.
• 22:39
  SPEAKER_01: Aaron Powell And what are you looking for when you do that?
• 22:41
  SPEAKER_00: You can run automated queries to ask the graph things like, did any of these simulated users accidentally inherit access to the payroll database who shouldn't have?
• 22:50
  SPEAKER_00: You are essentially building a perfectly simulated fake corporation to mathematically prove that your security rules hold up under infinite variations before you push that code to the real world.
• 23:00
  SPEAKER_01: Building a matrix just to test the locks.
• 23:02
  SPEAKER_01: That's incredible.
• 23:02
  SPEAKER_01: And there is another validation technique mentioned that I think is even wilder.
• 23:06
  SPEAKER_00: Oh, the chaos engineering.
• 23:07
  SPEAKER_01: Yes.
• 23:08
  SPEAKER_01: Automated chaos engineering experiments.
• 23:10
  SPEAKER_01: The premise here is that you don't just test if the system works when everything is fine.
• 23:15
  SPEAKER_01: You test how it fails.
• 23:16
  SPEAKER_00: Chaos engineering and identity is all about proving resilience.
• 23:20
  SPEAKER_00: In the real world, networks drop packets, right?
• 23:23
  SPEAKER_00: Identity providers like Okta or Azure sometimes have regional outages.
• 23:28
  SPEAKER_00: Digital tokens expire unexpectedly.
• 23:30
  SPEAKER_01: Things break.
• 23:31
  SPEAKER_00: Things break.
• 23:32
  SPEAKER_00: If your internal application crashes, freezes, or worst of all, fails open and exposes sensitive data when authentication flow is interrupted, you have a critical vulnerability.
• 23:42
  SPEAKER_01: So how do you actually execute chaos engineering on an identity flow?
• 23:45
  SPEAKER_01: What is the mechanical action happening there?
• 23:47
  SPEAKER_00: The testing suite will intentionally inject faults mid-session.
• 23:51
  SPEAKER_00: For example, a user logs in, the identity provider issues a valid session token, and the user begins accessing the application.
• 23:58
  SPEAKER_01: Okay, normal behavior so far.
• 23:59
  SPEAKER_00: Right.
• 24:00
  SPEAKER_00: But while the user is mid-flow, the chaos engineering script reaches out to the authorization server and intentionally revokes the token.
• 24:06
  SPEAKER_01: It just pulls the rug out from under the application.
• 24:08
  SPEAKER_00: Exactly.
• 24:09
  SPEAKER_00: The application reaches back to verify the token for its next action.
• 24:12
  SPEAKER_00: And the server says, that token is no longer valid.
• 24:15
  SPEAKER_00: The test is observing how the application handles that sudden rejection.
• 24:19
  SPEAKER_01: Aaron Powell Does it panic, basically?
• 24:20
  SPEAKER_00: Exactly.
• 24:21
  SPEAKER_00: Does it gracefully redirect the user back to the login page?
• 24:25
  SPEAKER_00: Or does it throw an unhandled exception error that displays raw backend code on the user's screen?
• 24:30
  SPEAKER_00: Does it insecurely cache the data it was just looking at?
• 24:34
  SPEAKER_00: Chaos engineering embeds this hostile validation directly into the development pipeline.
• 24:40
  SPEAKER_00: It ensures the architecture fails safely.
• 24:42
  SPEAKER_01: Okay, so the sandbox, the synthetic graphs, the chaos engineering, all of that mathematically proves the code is resilient under extreme technical pressure.
• 24:49
  SPEAKER_01: Yes.
• 24:50
  SPEAKER_01: But at a certain point, you have to introduce actual humans into the equation.
• 24:54
  SPEAKER_01: The implementation plan pivots from the sandbox to the pilot phase.
• 24:57
  SPEAKER_00: Aaron Powell The pilot phase is the bridge between theoretical resilience and operational reality.
• 25:03
  SPEAKER_00: The blueprint heavily emphasizes that you never ever deploy a massive, disruptive, change-like enforcing multi-factor authentication across the board to 10,000 employees on a Monday morning.
• 25:14
  SPEAKER_01: Because that's how you melt the help desk.
• 25:16
  SPEAKER_00: Exactly.
• 25:16
  SPEAKER_00: You contain the risk through structured pilot testing.
• 25:19
  SPEAKER_01: The sources suggest, starting with the IT department, they give an example of testing a new MFA enforcement with IT for eight full weeks before rolling it out to the broader company.
• 25:29
  SPEAKER_01: I have to say, eight weeks seems like a really long time to just test an authenticator app on a group of people who are already technical.
• 25:37
  SPEAKER_01: Why so long?
• 25:38
  SPEAKER_00: Aaron Powell Because the pilot isn't just about verifying that the push notification appears on their phone.
• 25:43
  SPEAKER_00: That was proven in the sandbox.
• 25:45
  SPEAKER_00: Right.
• 25:45
  SPEAKER_00: The pilot is about validating the systemic impact.
• 25:49
  SPEAKER_00: During those eight weeks, your engineering teams are scrutinizing the back-end logs.
• 25:54
  SPEAKER_00: They are looking for silent authentication failures.
• 25:57
  SPEAKER_00: Maybe the MFA protocol works fine on Windows laptops, but it causes a bizarre loop on a specific model of Android phone used by your remote technicians.
• 26:06
  SPEAKER_01: Ah, edge cases.
• 26:07
  SPEAKER_00: Exactly.
• 26:08
  SPEAKER_00: Furthermore, you are testing your support interstructure.
• 26:11
  SPEAKER_00: You are tracking how many help desk tickets are generated by the pilot group.
• 26:14
  SPEAKER_00: You are actively collecting user feedback to figure out where the user interface is confusing.
• 26:19
  SPEAKER_01: So it's a dress rehearsal for the support team as much as it is a test of the technology.
• 26:25
  SPEAKER_01: But what happens if the pilot goes off the rails?
• 26:27
  SPEAKER_01: If the MFA app keeps crashing and the IT team is locked out of their own systems for a day, doesn't that derail the entire multi-year roadmap?
• 26:36
  SPEAKER_00: You have to fundamentally shift how you view success and failure in this context.
• 26:41
  SPEAKER_00: Catching a catastrophic failure during a pilot is a massive success for the program.
• 26:46
  SPEAKER_01: Because you just saved the CEO from experiencing that same failure.
• 26:49
  SPEAKER_00: Precisely.
• 26:49
  SPEAKER_00: If the system fails for 50 IT engineers, they can work around it, figure out the root cause, and patch the architecture.
• 26:56
  SPEAKER_00: A fail pilot means your early warning system functioned exactly as designed.
• 27:00
  SPEAKER_01: It did its job.
• 27:01
  SPEAKER_00: Yes.
• 27:01
  SPEAKER_00: It gives you the necessary data to refine your technical methods, rewrite your user guides, and train your help desk before you hit the broader workforce.
• 27:09
  SPEAKER_00: Catching it in the pilot contains the blast radius.
• 27:12
  SPEAKER_00: It saves the organization from millions of dollars in lost productivity and prevents massive, highly visible business downtime.
• 27:18
  SPEAKER_01: Which brings us to the pivot point of this entire deep dive.
• 27:22
  SPEAKER_01: Here's where it gets really interesting.
• 27:24
  SPEAKER_01: Testing in the sandbox proves the technology works.
• 27:27
  SPEAKER_01: Pilot testing proves the support system works.
• 27:30
  SPEAKER_01: But the absolute heaviest lift, the true boss fight of phase six, is change management.
• 27:36
  SPEAKER_00: The biggest hurdle.
• 27:37
  SPEAKER_01: Because change management proves that the humans will actually adopt the system without tearing the company apart.
• 27:43
  SPEAKER_00: The sources are unequivocal on this point.
• 27:45
  SPEAKER_00: Underinvesting in organizational change management is the single most common cause of IAM project failure, second only to those technical dependencies we discussed earlier.
• 27:54
  SPEAKER_01: Why is that?
• 27:55
  SPEAKER_00: You have to recognize the unique nature of an identity rollout.
• 27:58
  SPEAKER_00: If a company deploys a new, complex supply chain logistics software, it really only impacts the supply chain team.
• 28:04
  SPEAKER_00: Right.
• 28:05
  SPEAKER_00: But if you deploy a new identity system, it touches every single user in the organization.
• 28:09
  SPEAKER_00: It packs the CEO, the hospital nurses, the factory floor workers, the interns, and the third-party contractors.
• 28:16
  SPEAKER_01: So why is the human element so consistently underestimated?
• 28:20
  SPEAKER_01: Why is the friction so intense?
• 28:22
  SPEAKER_00: It comes down to cognitive load and muscle memory.
• 28:26
  SPEAKER_00: IAM is inherently about enforcing security, and security almost always introduces friction into a user's workflow.
• 28:34
  SPEAKER_01: It slows them down.
• 28:35
  SPEAKER_00: Exactly.
• 28:36
  SPEAKER_00: When you alter how a user logs in, how they request access to a shared folder, or how they are forced to reset their password, you are deeply disrupting their established daily routine.
• 28:47
  SPEAKER_00: Employees just want to do their jobs.
• 28:49
  SPEAKER_00: They don't want to navigate complex security gates or read technical manuals just to check their email.
• 28:54
  SPEAKER_01: It's like arriving at the office one morning to find management has completely rearranged every desk, changed the locks on the doors, and rewritten the labels on the filing cabinets in a different language, all without telling anyone.
• 29:05
  SPEAKER_00: That's exactly how it feels to the user.
• 29:07
  SPEAKER_01: Even if the new layout is objectively more efficient and mathematically optimized, the sheer lack of communication is going to cause absolute chaos.
• 29:15
  SPEAKER_01: People will just be furious they can't find their stapler.
• 29:18
  SPEAKER_00: A very apt metaphor.
• 29:19
  SPEAKER_00: And the danger isn't just that users will complain, the danger is operational risk.
• 29:25
  SPEAKER_00: If you do not proactively manage that psychological friction, if you don't explain the why and make the how incredibly intuitive human nature dictates that users will find dangerous workarounds.
• 29:37
  SPEAKER_01: And this is the genesis of shadow IT.
• 29:39
  SPEAKER_00: Yes, exactly.
• 29:40
  SPEAKER_01: Give me an example of what that looks like in the real world.
• 29:42
  SPEAKER_00: If the new secure file sharing portal is too complex or requires too many authentication steps, employees won't use it.
• 29:49
  SPEAKER_00: Instead, they will email highly sensitive, unencrypted patient data or financial spreadsheets to their personal Gmail accounts so they can work on them from home without dealing with the VPN.
• 30:00
  SPEAKER_01: Oh wow.
• 30:00
  SPEAKER_01: Yeah, I can see people doing that.
• 30:02
  SPEAKER_00: Or if the new password policy requires a 20-character complex string that changes every 30 days, they will write it on a sticky note attached to their monitor, entirely defeating the purpose of the complex policy.
• 30:13
  SPEAKER_00: Change management is not corporate fluff.
• 30:15
  SPEAKER_00: It is a critical security control designed to prevent users from bypassing the system out of frustration.
• 30:21
  SPEAKER_01: So how does phase six structure this?
• 30:23
  SPEAKER_01: What does the blueprint require to actually manage this psychology?
• 30:27
  SPEAKER_00: The blueprint demands a formal, documented change management plan built on three non-negotiable pillars.
• 30:34
  SPEAKER_00: Those are stakeholder communication, end user training, and adoption tracking.
• 30:38
  SPEAKER_01: Let's focus on that first pillar, communication.
• 30:41
  SPEAKER_01: Because honestly, IT departments are notoriously terrible at communicating with the broader business.
• 30:46
  SPEAKER_00: It's true, they often are.
• 30:48
  SPEAKER_00: The communication strategy must be ruthless in its clarity.
• 30:51
  SPEAKER_00: You cannot send a mass email that reads, Next week, IT will be updating the CML assertions and deprecating basic authentication on legacy endpoints.
• 30:59
  SPEAKER_01: Right.
• 31:00
  SPEAKER_01: That means absolutely nothing to an accountant.
• 31:02
  SPEAKER_00: Nothing.
• 31:03
  SPEAKER_00: The communication must strip away all jargon and answer four critical questions for the end user.
• 31:08
  SPEAKER_00: What exactly is changing?
• 31:10
  SPEAKER_00: Why is the organization making this change?
• 31:12
  SPEAKER_00: What specific actions do I need to take, and by when?
• 31:16
  SPEAKER_00: And finally, where do I go for help if I get stuck?
• 31:19
  SPEAKER_01: It has to be ruthlessly empathetic to the user's experience.
• 31:22
  SPEAKER_01: Which leads us perfectly into the specific micro battles of change management.
• 31:26
  SPEAKER_00: The four battlegrounds.
• 31:28
  SPEAKER_01: Yes.
• 31:28
  SPEAKER_01: The sources highlight four areas where this friction reaches a boiling point.
• 31:33
  SPEAKER_01: Let's start with the most visible one: multifactor authentication or MFA.
• 31:38
  SPEAKER_00: MFA is the front line of the identity experience.
• 31:42
  SPEAKER_00: It is something every user interacts with multiple times a day, which means the potential for frustration is astronomically high.
• 31:48
  SPEAKER_01: And there are massive, immovable, real-world pressures driving these rollouts right now.
• 31:54
  SPEAKER_01: The text specifically highlights that Microsoft Entra ID is implementing mandatory MFA enforcement for all Azure Portal Access by October 2026.
• 32:04
  SPEAKER_00: That's right around the corner.
• 32:05
  SPEAKER_01: Yeah, Microsoft is literally forcing the issue.
• 32:07
  SPEAKER_01: You can't opt out.
• 32:09
  SPEAKER_01: The change management plan for something like that has to be incredibly robust.
• 32:13
  SPEAKER_01: You need comprehensive end-user communication, massive enrollment support campaigns, and crucial exception handling processes for users with accessibility needs.
• 32:26
  SPEAKER_00: You cannot simply tell your workforce we are enforcing new MFA rules because Microsoft is making us.
• 32:31
  SPEAKER_01: Yeah, that breeds resentment.
• 32:33
  SPEAKER_00: It absolutely does.
• 32:34
  SPEAKER_00: You have to use this as an opportunity to educate users on the modern threat landscape.
• 32:39
  SPEAKER_00: You have to explain that legacy forms of MFA are no longer sufficient.
• 32:43
  SPEAKER_01: By legacy, you mean having a six-digit code texted to your phone via SMS.
• 32:49
  SPEAKER_00: Exactly.
• 32:49
  SPEAKER_00: Or receiving an automated phone call.
• 32:52
  SPEAKER_00: These methods are highly vulnerable to modern attack vectors.
• 32:56
  SPEAKER_00: Attackers now routinely use adversary in the middle or AIPM phishing proxies.
• 33:02
  SPEAKER_01: How does that work mechanically?
• 33:04
  SPEAKER_01: Because people assume if they type in the code from their phone, they are safe.
• 33:07
  SPEAKER_00: In an AITM attack, the hacker sends the user a phishing email with a link to a fake login page that looks identical to the real one.
• 33:15
  SPEAKER_00: When the user types their username and password into the fake page, the proxy instantly forwards those credentials to the real Microsoft or Okta login page.
• 33:23
  SPEAKER_01: Okay, so the proxy is like a middleman.
• 33:25
  SPEAKER_00: Right.
• 33:25
  SPEAKER_00: And the real site triggers the SMS code to the user's phone.
• 33:29
  SPEAKER_00: The user looks at their phone, sees the code, types it into the fake website, and the proxy forwards it to the real website.
• 33:34
  SPEAKER_01: So the hacker intercepts the code in real time?
• 33:37
  SPEAKER_00: Yes.
• 33:37
  SPEAKER_00: And the real website grants access by issuing a valid session cookie.
• 33:42
  SPEAKER_00: The proxy steals that session cookie, giving the attacker complete access to the account bypassing the MFA entirely.
• 33:48
  SPEAKER_01: That is terrifyingly simple.
• 33:50
  SPEAKER_00: It is.
• 33:51
  SPEAKER_00: There is also the threat of MFA fatigue attacks, where an attacker has a user's password and just repeatedly triggers push notifications to the user's phone at 2.0 AM until the exhausted user just hits approve to make it stop buzzing.
• 34:05
  SPEAKER_01: I have absolutely heard of people doing that.
• 34:07
  SPEAKER_01: So the communication plan has to explain these specific threats to justify why the company is moving away from text and push notifications toward what the text calls phishing resistant methods.
• 34:17
  SPEAKER_00: Precisely.
• 34:18
  SPEAKER_00: You have to explain why the company is investing in technologies like OctaFastPass, FIDO2 hardware keys like UB keys, or device-bound biometrics like Windows Hello or Apple Face8.
• 34:29
  SPEAKER_01: Let's do a quick deep dive on FIDO2 because it's a buzzword that gets thrown around a lot.
• 34:33
  SPEAKER_01: How does a hardware key actually stop that proxy attack we just talked about?
• 34:37
  SPEAKER_00: A FIDO 2 hardware key fundamentally changes the cryptography of the login.
• 34:43
  SPEAKER_00: When you register a FIDO2 key with a service, it creates a unique cryptographic key pair specifically bound to that exact domain name.
• 34:51
  SPEAKER_00: For example, login.microsoft.com.
• 34:54
  SPEAKER_01: Bound to the domain name.
• 34:56
  SPEAKER_01: Okay.
• 34:56
  SPEAKER_00: So if a user clicks a phishing link and goes to, say, login-microsoft-security.com, the hardware key will physically refuse to provide the authentication token because the origin domain of the website doesn't match the cryptographic binding created during registration.
• 35:12
  SPEAKER_01: Wait, really?
• 35:13
  SPEAKER_01: So the user couldn't log in even if they tried?
• 35:15
  SPEAKER_00: The user literally cannot be physed, even if they want to give up their credentials.
• 35:19
  SPEAKER_00: When you explain to users that a hardware key actually protects them from making a mistake and that tapping a key is significantly faster than waiting for a text message and typing in six numbers, the adoption friction drops dramatically.
• 35:31
  SPEAKER_01: That is a phenomenal way to frame it.
• 35:32
  SPEAKER_01: You aren't imposing security, you are offering a better, faster user experience.
• 35:37
  SPEAKER_01: And there was a highly strategic tip in the sources about how to prove the value of this massive rollout to the executive board.
• 35:44
  SPEAKER_01: They suggest explicitly benchmarking the help desk volume for password reset tickets before the MFA rollout begins.
• 35:50
  SPEAKER_00: It is a brilliant piece of program management.
• 35:53
  SPEAKER_00: Password resets are consistently the number one driver of IT help desk tickets, and those tickets are incredibly expensive in terms of labor hours.
• 36:02
  SPEAKER_01: Just people calling saying, I forgot my password.
• 36:04
  SPEAKER_00: Yes.
• 36:05
  SPEAKER_00: By establishing a clear baseline of ticket volume before you roll out advanced password lists MFA, you set yourself up to definitively prove the return on investment later.
• 36:15
  SPEAKER_01: Ah, I see.
• 36:16
  SPEAKER_00: When you move the company to biometric logins and your password reset tickets plummet by 60%, you have hard, unassailable financial data.
• 36:24
  SPEAKER_00: You can show the CFO that the IAM program isn't just an expensive security requirement, it is an operational efficiency engine that is actively saving the company money.
• 36:33
  SPEAKER_01: Okay, that covers the MFA battleground.
• 36:35
  SPEAKER_01: Let's shift to the second major change management hurdle: lifecycle automation.
• 36:39
  SPEAKER_00: The joiner, mover, lever process.
• 36:41
  SPEAKER_01: Yes, exactly.
• 36:42
  SPEAKER_01: When a new hire joins the company, when they move to a different department, or when they are terminated, an automated system is supposed to take over the provisioning and deprovisioning of their access.
• 36:52
  SPEAKER_01: Now I have to challenge this premise.
• 36:55
  SPEAKER_01: Automation sounds fantastic.
• 36:57
  SPEAKER_01: It removes tedious manual work.
• 37:00
  SPEAKER_01: Who on earth within an IT department would actively resist having less manual data entry to do?
• 37:05
  SPEAKER_00: This is a totally rational question, but it ignores the hidden political dynamics of IT departments.
• 37:11
  SPEAKER_00: The resistance to lifecycle automation is almost never about the workload.
• 37:15
  SPEAKER_00: It is entirely about the perceived loss of control and authority.
• 37:19
  SPEAKER_01: Loss of control.
• 37:20
  SPEAKER_01: Walk me through the psychology there.
• 37:21
  SPEAKER_00: Aaron Powell Think about how a traditional IT help desk operates.
• 37:25
  SPEAKER_00: Historically, system administrators and service desk analysts hold the keys to the kingdom.
• 37:29
  SPEAKER_01: Right.
• 37:30
  SPEAKER_00: When a manager wants to hire someone, they have to submit a ticket to IT.
• 37:34
  SPEAKER_00: The IT admin receives the ticket, manually creates the account in Active Directory, manually drops that user into specific security groups, provisions their inbox, and grants them access to the VPN.
• 37:44
  SPEAKER_00: The IT admin is the ultimate gatekeeper of access.
• 37:47
  SPEAKER_01: They are the ones actually pulling the levers.
• 37:49
  SPEAKER_00: Exactly.
• 37:50
  SPEAKER_00: But when you implement a sophisticated identity governance tool like SailPoint, you are fundamentally stripping that execution power away from the IT department.
• 37:59
  SPEAKER_01: How so?
• 37:59
  SPEAKER_00: The architecture of lifecycle automation dictates that the creation of an account should rely entirely on automated triggers flowing from an authoritative source, which is usually the HR system.
• 38:10
  SPEAKER_01: So it bypasses IT entirely.
• 38:12
  SPEAKER_00: Yes.
• 38:13
  SPEAKER_00: When an HR representative enters a new hire into workday, the identity system detects the new record, analyzes the user's job title and department, and automatically build all the necessary accounts and assigns the appropriate access roles without a single IT person ever touching a keyboard.
• 38:29
  SPEAKER_01: So the IT admin is suddenly completely cut out of a loop, they don't get the ticket, the system just does it.
• 38:35
  SPEAKER_00: Yes.
• 38:35
  SPEAKER_00: And if you do not actively manage that transition, the IT and service desk teams will resist the implementation fiercely.
• 38:42
  SPEAKER_00: They will feel obsolete.
• 38:44
  SPEAKER_00: They will argue that the automation makes mistakes.
• 38:46
  SPEAKER_00: They will try to find reasons to keep manual processes alive.
• 38:50
  SPEAKER_00: The change management strategy here must be heavily focused on the IT staff themselves.
• 38:55
  SPEAKER_00: You have to guide them through a massive shift in their own professional identity.
• 38:59
  SPEAKER_01: How do you do that?
• 39:00
  SPEAKER_01: How do you tell someone they aren't the gatekeeper anymore without making them feel useless?
• 39:05
  SPEAKER_00: You reframe their value.
• 39:07
  SPEAKER_00: You have to shift their understanding of their own accountability from execution to governance.
• 39:12
  SPEAKER_01: Okay, execution to governance.
• 39:13
  SPEAKER_00: You tell them your job is no longer to be a human typewriter typing in commands to create accounts.
• 39:20
  SPEAKER_00: Your job is now to monitor the automation engine.
• 39:23
  SPEAKER_00: Your job is to manage the complex exceptions that the algorithm can't handle.
• 39:27
  SPEAKER_00: Your job is to analyze and maintain the role-based access models to ensure they remain secure.
• 39:33
  SPEAKER_01: You're upgrading their role.
• 39:35
  SPEAKER_00: You are elevating them to a higher value, more strategic task.
• 39:38
  SPEAKER_00: But it requires very careful, intentional psychological management to get them to let go of the levers they've control for years.
• 39:45
  SPEAKER_01: Life cycle automation is like moving from a manual highway toll booth to an Easy Pass system.
• 39:52
  SPEAKER_01: You aren't just firing the person in the booth.
• 39:54
  SPEAKER_01: You have to install complex camera arrays, build an automated billing database, and retrain that toll worker to monitor the analytics and handle the drivers who try to speed through without a transponder.
• 40:06
  SPEAKER_01: It's a completely different job.
• 40:07
  SPEAKER_00: That is exactly what it is.
• 40:08
  SPEAKER_00: And if you don't retrain the toll worker, they will just try to put the physical barrier back down.
• 40:13
  SPEAKER_01: Which brings us to our final set of hurdles.
• 40:16
  SPEAKER_01: We are looking at section six of the deep dive material.
• 40:20
  SPEAKER_01: Access reviews and privilege access management.
• 40:23
  SPEAKER_01: Let's tackle access reviews first because the sources dedicate a significant amount of text to the specific failures in this area.
• 40:29
  SPEAKER_00: Access governance, the ongoing verification that users only have the access they actually need, is where many programs start strong but eventually lose all momentum.
• 40:38
  SPEAKER_01: I can completely understand why.
• 40:39
  SPEAKER_01: The sources identify a phenomenon called access review fatigue.
• 40:43
  SPEAKER_01: Let's look at it from the perspective of a business manager.
• 40:45
  SPEAKER_00: Aaron Powell A classic scenario.
• 40:47
  SPEAKER_01: You have a director of marketing who is stressed out trying to run a massive ad campaign.
• 40:53
  SPEAKER_01: Suddenly, they receive an automated quarterly email from the IAM system demanding that they certify the access rights of all 40 people on their team across a dozen different applications.
• 41:05
  SPEAKER_01: It sounds like an administrative nightmare.
• 41:08
  SPEAKER_00: It is an administrative nightmare.
• 41:09
  SPEAKER_00: And it leads directly to a highly dangerous behavioral pattern identified in the text, which is rubber stamping.
• 41:16
  SPEAKER_01: Define rubber stamping in this context.
• 41:19
  SPEAKER_00: The marketing director opens the portal and is presented with a massive spreadsheet of hundreds of complex cryptic entitlement names.
• 41:26
  SPEAKER_00: They see a role assigned to their employee called App Find BreadRight Group.
• 41:30
  SPEAKER_01: Which means nothing to them.
• 41:32
  SPEAKER_00: Exactly.
• 41:32
  SPEAKER_00: The marketing director has absolutely no idea what that database is or what that group does.
• 41:36
  SPEAKER_00: They don't have the time to investigate it, and they don't want to accidentally break their employees' access and prevent them from working.
• 41:42
  SPEAKER_00: So what do they do?
• 41:43
  SPEAKER_01: They just click approve.
• 41:44
  SPEAKER_00: They simply click the approve all button at the bottom of the screen and go back to their real job.
• 41:48
  SPEAKER_01: They blindly certify the access just to make the task go away, which completely defeats the entire security purpose of running the review in the first place.
• 41:56
  SPEAKER_00: It creates a false sense of security that is worse than having no review at all, because the compliance logs will show that management signed off on the access, even if that access is wildly inappropriate.
• 42:07
  SPEAKER_01: So how does phase six implementation planning solve for this basic human nature?
• 42:12
  SPEAKER_01: You can't just mandate that people care about cryptic database names.
• 42:16
  SPEAKER_00: Aaron Powell You attack the problem from two angles frictionless tooling and ruthless enforcement.
• 42:22
  SPEAKER_00: From the tooling perspective, the implementation team must ensure the data presented to the reviewer is translated into plain business English.
• 42:30
  SPEAKER_01: Oh, translation.
• 42:31
  SPEAKER_01: That makes sense.
• 42:31
  SPEAKER_00: Instead of app findbreadright, the portal should say ability to edit Q3 financial projections.
• 42:36
  SPEAKER_00: You have to provide the manager with context.
• 42:39
  SPEAKER_00: When did the user get this access and who else on the team has it?
• 42:42
  SPEAKER_01: Make it easy for them to make an informed decision.
• 42:45
  SPEAKER_01: And what about the enforcement angle?
• 42:47
  SPEAKER_00: This is where the change management communication has to be crystal clear.
• 42:51
  SPEAKER_00: The implementation plan must define strict service level agreements or SLAs for these reviews.
• 42:58
  SPEAKER_00: The best practice outlined in the blueprint is the policy of auto-revocation.
• 43:02
  SPEAKER_01: Auto-revocation?
• 43:03
  SPEAKER_01: That sounds aggressive.
• 43:05
  SPEAKER_00: It is entirely necessary.
• 43:06
  SPEAKER_00: The policy dictates that if a manager ignores the review emails and fails to certify the access within the designated window, say 14 days, the system automatically revokes all of the unreviewed access for their entire team.
• 43:21
  SPEAKER_01: Wow.
• 43:21
  SPEAKER_01: That is a policy with serious teeth.
• 43:23
  SPEAKER_00: The first time an entire sales team loses their access to Salesforce on the last day of the quarter because their manager ignored the automated warnings, you can absolutely guarantee the manager will never ever ignore an access review again.
• 43:35
  SPEAKER_01: I bet they wouldn't.
• 43:36
  SPEAKER_00: But and this is where phase six planning is critical.
• 43:38
  SPEAKER_00: You must communicate that policy and its consequences clearly and repeatedly before you enforce it.
• 43:44
  SPEAKER_00: If you turn on auto revocation without a massive change management campaign, you will have a full-scale corporate mutiny on your hands.
• 43:51
  SPEAKER_01: It's the ultimate stick, but you have to show them the stick before you swing it.
• 43:55
  SPEAKER_01: Okay, let's tackle the final and undoubtedly the most politically explosive.
• 44:00
  SPEAKER_01: Micro battle in the blueprint, privileged access management, or pay M.
• 44:05
  SPEAKER_00: The biggest fight of them all.
• 44:06
  SPEAKER_01: We are talking about managing the access of the most sensitive, highly technical population in the entire company, the IT and security administrators themselves.
• 44:15
  SPEAKER_00: Aaron Powell If we connect this to the bigger picture, privilege access restrictions are universally the hardest sell of any identity rollout.
• 44:23
  SPEAKER_00: You're dealing with individuals who are highly capable, deeply entrenched in their workflows, and who are culturally accustomed to having permanent God mode access to the network infrastructure 24 hours a day.
• 44:35
  SPEAKER_01: They have standing global administrator or domain administrator roles permanently attached to their personal accounts.
• 44:41
  SPEAKER_00: Exactly.
• 44:42
  SPEAKER_00: And the goal of PAM is to strip that standing access away.
• 44:45
  SPEAKER_01: Yes.
• 44:46
  SPEAKER_01: The core architectural principle of modern privileged access management is zero standing access.
• 44:51
  SPEAKER_01: The concept is that no human being should have permanent elevated administrative rights.
• 44:56
  SPEAKER_01: Instead, administrators must operate with standard least privilege accounts for their daily work checking email, browsing the web.
• 45:04
  SPEAKER_01: When they actually need to perform an administrative task, like reconfiguring a firewall or patching a server, they must formally request temporary elevation.
• 45:12
  SPEAKER_00: I can literally hear the senior systems engineer screaming from here.
• 45:16
  SPEAKER_01: Right.
• 45:17
  SPEAKER_00: If you tell a senior engineer who has had domain admin rights for 10 years that they now have to ask a portal for permission to do their job, they are going to actively fight the implementation.
• 45:40
  SPEAKER_01: You have to frame it entirely around the concept of the blast radius and protecting them from becoming patient zero in a catastrophic breach.
• 45:48
  SPEAKER_00: Aaron Powell Walk me through that conversation.
• 45:49
  SPEAKER_00: How do you explain the blast radius?
• 45:51
  SPEAKER_01: Aaron Powell You sit down with the engineering team and you outline the threat landscape.
• 45:55
  SPEAKER_01: You explain that if an administrator is browsing the web on their laptop and they accidentally download a piece of highly sophisticated malware, the malware operates with the privileges of the currently logged in user.
• 46:06
  SPEAKER_00: Aaron Powell Which is standard.
• 46:07
  SPEAKER_01: Right.
• 46:08
  SPEAKER_01: But if that admin has standing global admin rights, the malware instantly inherits global admin rights.
• 46:15
  SPEAKER_01: The attacker immediately owns the entire corporate domain, they can deploy ransomware to every server, and they can steal the database.
• 46:22
  SPEAKER_01: The blast radius is total destruction, and the administrator's account is the weapon.
• 46:27
  SPEAKER_00: Aaron Powell But if they have zero standing access.
• 46:30
  SPEAKER_01: If they have zero standing access, the malware only inherits standard user rights.
• 46:34
  SPEAKER_01: The attacker cannot spread laterally, they cannot deploy ransomware, the attacker gets virtually nothing.
• 46:39
  SPEAKER_00: That's a huge difference.
• 46:40
  SPEAKER_01: It is.
• 46:41
  SPEAKER_01: The admin's account is functionally useless to the hacker until privileges are formally elevated through a secured, highly monitored workflow.
• 46:49
  SPEAKER_01: You make Pam about insulating the IT staff from the devastating liability of a compromised account.
• 46:54
  SPEAKER_00: You make it about protecting them, not restricting them.
• 46:56
  SPEAKER_00: That's really smart.
• 46:57
  SPEAKER_00: But even with a great narrative, the technology still has to work.
• 47:01
  SPEAKER_00: If you take away their permanent access, how do they actually do their jobs when a server crashes at two in the morning?
• 47:07
  SPEAKER_01: That is the technical imperative of phase six.
• 47:10
  SPEAKER_01: If you remove standing access, the replacement mechanism, which is called just in time or JIT elevation, must be absolutely seamless.
• 47:19
  SPEAKER_00: You utilize platforms like CyberArc, Beyond Trust, or Interprivileged Identity Management.
• 47:25
  SPEAKER_01: Right.
• 47:25
  SPEAKER_01: And how does JIT actually function in practice?
• 47:29
  SPEAKER_00: When an admin needs to fix that server at 2 a.m.
• 47:31
  SPEAKER_00: a.m., they log into the PAM portal.
• 47:33
  SPEAKER_00: They request the specific role needed for the specific server, and they request it for a limited duration, say two hours.
• 47:39
  SPEAKER_01: Okay, two hours.
• 47:40
  SPEAKER_00: Depending on the risk level, the PAM system might require them to reauthenticate with a biometric scan, or it might require them to link the request to an active IT service ticket.
• 47:50
  SPEAKER_01: To prove why they need it.
• 47:51
  SPEAKER_00: Yes.
• 47:52
  SPEAKER_00: Once validated, the PAM software makes a rapid API call to the cloud infrastructure, like Azure or AWS, and temporarily assigns the elevated role to the user's account.
• 48:03
  SPEAKER_00: For the next two hours, every keystroke the admin makes is logged and recorded.
• 48:08
  SPEAKER_01: And when the time is up.
• 48:09
  SPEAKER_00: When the two hours expire, another API call instantly strips the role away, returning the account to a standard user state.
• 48:16
  SPEAKER_01: And what if the entire network is down and the PAM portal is unreachable?
• 48:20
  SPEAKER_01: Because that happens.
• 48:21
  SPEAKER_00: It does.
• 48:22
  SPEAKER_00: And that is why the implementation plan must include meticulously designed break glass emergency procedures.
• 48:28
  SPEAKER_00: These are highly secure, heavily monitored, offline credentials that can be accessed in a catastrophic failure.
• 48:34
  SPEAKER_01: Like breaking the glass on a fire alarm.
• 48:36
  SPEAKER_00: Exactly.
• 48:36
  SPEAKER_00: The JIT tooling has to be fast, it has to allow for pre-approved workflows for routine tasks, and it has to fail safely.
• 48:43
  SPEAKER_00: If the tooling introduces too much friction, the advins will simply create secret, unmonitored backdoor accounts to bypass the PAM system entirely, completely destroying your security posture.
• 48:53
  SPEAKER_01: Okay, we have covered an immense amount of ground today.
• 48:56
  SPEAKER_01: So what does this all mean?
• 48:57
  SPEAKER_01: We've looked at the painstaking process of translating visionary blueprints into granular dependencies.
• 49:02
  SPEAKER_01: We've explored the necessity of blending vendor expertise with internal training to bridge the massive gap between legacy Kerberos and modern federated identity.
• 49:11
  SPEAKER_00: That's a huge journey.
• 49:12
  SPEAKER_01: It is.
• 49:13
  SPEAKER_01: We've done deep dives into the sci-fi mechanics of identity sandboxes, using ephemeral credentials and synthetic graphs to mathematically validate access logic.
• 49:22
  SPEAKER_01: And we've spent a huge amount of time unpacking the psychology behind change management, the friction of MFA, the politics of lifecycle automation, the enforcement of access reviews, and the massive cultural shift of taking standing access away from IT administrators.
• 49:37
  SPEAKER_01: It really feels like phase six isn't just a technical exercise.
• 49:40
  SPEAKER_00: It isn't.
• 49:43
  SPEAKER_00: No.
• 49:44
  SPEAKER_00: Phase six is fundamentally the art of organizational surgery.
• 49:47
  SPEAKER_00: It's the practice of taking a brilliant, rigid, mathematically secure technological architecture and carefully strategically grafting it onto a messy, organic, living organization of human beings.
• 49:59
  SPEAKER_01: And doing it without causing the host body to violently reject the transplant.
• 50:05
  SPEAKER_00: Precisely.
• 50:06
  SPEAKER_00: The recurring lesson across all these failures is that if you obsess exclusively over the elegance of the technology, the organization will invariably reject it.
• 50:15
  SPEAKER_00: You have to focus with equal, if not greater, intensity on the capabilities of the people operating the system and the psychology of the people impacted by it.
• 50:24
  SPEAKER_01: And that leads to a deeply important question for you listening right now.
• 50:27
  SPEAKER_01: Take a hard look at your own organization's current or upcoming technology rollouts.
• 50:32
  SPEAKER_01: When you look at the project plan, are you treating organizational change management as an afterthought?
• 50:38
  SPEAKER_00: Is it just an email?
• 50:39
  SPEAKER_01: Right.
• 50:39
  SPEAKER_01: Is it relegated to a single jargon-filled email sent to the staff the day before the system goes live, or is it the core defining driver of your entire implementation strategy?
• 50:49
  SPEAKER_01: Because as the deep dive into this blueprint proves, the human element is the ultimate differentiator between a brilliantly designed system that is merely installed and a system that is actually adopted and secures the business.
• 51:00
  SPEAKER_00: It's the final barrier between theory and reality.
• 51:03
  SPEAKER_01: It really is.
• 51:04
  SPEAKER_01: Now, I want to leave you with a final forward-looking thought, directly inspired by the frontiers of the research we've reviewed.
• 51:11
  SPEAKER_01: We have spent this entire deep dive obsessing over how to manage the psychology, the friction, and the behavioral quirks of human users adopting these incredibly complex identity systems.
• 51:24
  SPEAKER_00: Right.
• 51:24
  SPEAKER_00: Human users.
• 51:25
  SPEAKER_01: We worry about their password fatigue, their hardware keys, their tendency to rubber stamp reviews, and their ego when losing standing access.
• 51:33
  SPEAKER_01: But the sources point out that the landscape is rapidly shifting beneath our feet.
• 51:37
  SPEAKER_01: We are accelerating toward a world of what is called agentic identity.
• 51:41
  SPEAKER_00: Aaron Powell The rise of autonomous AI agents operating within the corporate network.
• 51:45
  SPEAKER_01: Exactly.
• 51:46
  SPEAKER_01: We are moving toward a future where AI agents are acting on our behalf.
• 51:50
  SPEAKER_01: These agents will be researching data, moving files, executing financial trades, and writing code.
• 51:55
  SPEAKER_01: And to do that, they will require their own complex life cycle management.
• 51:59
  SPEAKER_00: Aaron Powell They'll need identities too.
• 52:00
  SPEAKER_01: Aaron Powell They will.
• 52:01
  SPEAKER_01: They will need their own cryptographic credentials, they will need dynamic access roles, and their actions will need to be subjected to rigorous access reviews.
• 52:10
  SPEAKER_01: When the day comes that the vast majority of your organization's users are non-human AI agents silently executing millions of transactions a second in the background, who exactly does the change management for the machines?
• 52:24
  SPEAKER_00: That is a fascinating question.
• 52:25
  SPEAKER_01: Aaron Powell How do you govern, review, and limit an entity that doesn't read corporate communication emails, doesn't complain about interface friction, but possesses the capability to laterally compromise a global network a thousand times faster than any human being.
• 52:39
  SPEAKER_01: It is a profound architectural challenge and something to deeply mull over as you draw up the blueprints for your own organization's future.
• 52:46
  SPEAKER_01: Thank you so much for joining us on this deep dive.
• 52:49
  SPEAKER_00: That's a wrap on planning successful identity management rollouts.
• 52:53
  SPEAKER_00: Phase six isn't a technical exercise, it's organizational surgery, grafting a mathematically secure architecture onto a messy living organization of human beings without causing the host body to reject the transplant.
• 53:07
  SPEAKER_00: And the closing question this episode leaves you with is one worth sitting with for a long time.
• 53:13
  SPEAKER_00: On our next episode, Jose and I tackle phase seven, the operating model that keeps everything running after launch day.
• 53:20
  SPEAKER_00: Episode eight.com forward slash IN forward slash Ernie Prescott, and subscribe now so you don't miss it.
• 53:33
  SPEAKER_00: Until next time.