Latest / Identity at the Center / #356 - Mr. NHI, Lalit Choda, on Securing the Exploding World of NHI

Transcript

#356 - Mr. NHI, Lalit Choda, on Securing the Exploding World of NHI · Identity at the Center

0:00
I created the Non human identity management group on LinkedIn
0:04
back in May last year. I've been very surprised that
0:09
we're now close to 2000 members. A lot of people in the industry,
0:14
consultants, a lot of practitioners, pretty much the
0:17
who's who's now in them in that group.
0:20
And we've started to post a lot of content there.
0:24
But then I realized that's not really going to work.
0:27
Whilst you'll be able to disseminate kind of news, what's
0:30
going on in the industry, if someone wants to learn, they're
0:33
not going to go through a feed of hundreds of NHI posts from me
0:36
and others in the industry. And then I thought, look, let's
0:39
create a portal. And that's when NHIM g.org was
0:43
formed. And my mission was purely at the
0:47
time, all about education, evangelizing.
0:50
I was in a job and this was kind of a side hobby, a bit like what
0:54
you guys do at Idec. And it just sort of flourished
0:58
from there. I wrote more white papers, more
1:00
content, and there was a lot of good, you know, feedback.
1:06
I started talking to sort of folks in the market to say,
1:09
would you like to kind of share content as well?
1:12
And then that's really what I've been doing for the last 12
1:15
months and since January decided to go into this venture full
1:20
time and the mission hasn't changed.
1:23
It's to educate, evangelize. It's the kind of help the
1:26
industry come together. And I guess along the way,
1:30
someone, one of the vendors kind of just, and maybe a LinkedIn
1:33
post was said to me kind of verbally, Mr. Nhi.
1:38
And I started using the name and it's now now stuck with me
1:43
unfortunately. But maybe it's a bit better than
1:46
Mr. Sox. Yeah, Mr. Stocks kind of kind of
1:50
sounds like a Quentin Tarantino character for Mike Reservoir
1:52
Dogs or something like that. Or cat, a cat name.
1:57
Yeah, that's true spoiler right. If you're watching a video, I've
2:00
got a couple DJ cats in Amsterdam behind me.
2:02
So if you're if you're not watching a video, you're missing
2:04
out that that glorious scene. This is identity at the center
2:14
if it has anything to do with IAM.
2:17
This is the go to podcast now your hosts Jim McDonald and Jeff
2:24
Steadman. Welcome to the Identity at the
2:32
Center podcast. I'm Jeff, and that's Jim.
2:33
Hey, Jim. Hey, Jeff, how are you?
2:36
Oh, not so bad yourself. Doing great.
2:39
I feel like we're living in this weird time work kind of thing.
2:43
We're recording before Identverse.
2:45
It's going to be dropped after Identverse, but I want to talk
2:49
about Identverse. I mean, we're going to be doing
2:51
the identity squabble game while we're there.
2:54
I guess technically it's in the past, but hopefully we'll be
2:57
able to drop it as an episode. It's going to happen in the NHI
3:01
Pavilion at the Expo Hall. Really excited about what we're
3:05
doing at Identverse. Yeah, it's a very cool thing.
3:08
I I'll be honest, I'm a little bit nervous on how this will
3:12
come off. I dentist squabble as we're kind
3:14
of calling it. It is an extension of the Fido
3:16
feud that we did at the Authenticate conference last
3:19
year. But we are doing it all on our
3:21
own basically, right? No help.
3:24
We don't have like an AV team. It's going to be me setting up a
3:26
bunch of cameras and me figure out how to try to mic it up.
3:29
So, you know, we are a couple days away from that and
3:33
hopefully by the time people hear this, it turned out well.
3:37
I hope people, you know, are entertained.
3:39
You may not learn anything, but I hope they're entertained as we
3:42
go through that. So.
3:43
Yeah, I'm going to. I'm going to give my thank you
3:46
in advance to the CRA for I mean, look, we're doing so much
3:50
there. You and I are each hosting a
3:52
panel and we're going to be recording a bunch of podcasts
3:58
and have an opportunity in the actual hall to meet people, give
4:02
out stickers. I'm excited for the whole thing.
4:05
Yeah, definitely been a great experience.
4:07
Shout out to Shirley for for helping us out with this.
4:09
So if you see Shirley roaming the halls from CRA, give her an
4:12
identity at the center. Fist bump of gratitude.
4:14
How about that and just a fist bump.
4:15
Don't do anything else. Yeah, no, just fist, not fist to
4:20
any other part of poor Shirley. I think the other thing that
4:26
would be great is like if people got to meet us, people got to
4:29
and are listening to the show, go out, give us a a review on
4:34
whatever podcast platform you listen or give us a thumbs up
4:38
and subscribe on YouTube. It definitely helps get the word
4:42
out because I mean, the podcast has grown significantly over the
4:46
last six years and it's grown organically, right?
4:48
We don't run any ads. It's people telling people about
4:52
the podcast, people liking the podcast or giving us five star
4:57
reviews and kind of like working it up in terms of the algorithm,
5:02
yeah. No advertising.
5:04
The only advertising is what I see behind you, all the
5:06
different plaques that you've taken from, you know, the, the
5:09
different cocks we've been at. But definitely very cool.
5:12
And we are going to hit a couple milestones this year.
5:15
We're going to be celebrating 6 years, I think pretty close by
5:17
the time this one comes out. And you know, I'm going to
5:20
preview we're, we're probably going to hit 1,000,000 downloads
5:23
sometime later this year. So pretty pretty crazy.
5:28
Yeah, there's big, there's big numbers.
5:30
They keep coming. They keep coming quicker than I
5:33
expected them to come. So but that's, that's not a
5:37
credit to me and you, Jeff. That's credit to all the people
5:39
who listen. And I think the practitioners
5:43
out there who you know, let us know all the time that you know
5:47
how they feel about the content. 99% positive this.
5:52
That's a shout out and a credit to them.
5:54
Yeah, we like doing it and like the conversations we're able to
5:57
have. And, you know, that's that
5:59
what's that's what leads us to the conversation we're having
6:01
today, you know, especially like around, you know, NHI, which is,
6:03
you know, so hot right now if I want to steal something from
6:06
Zoolander. But why don't we pivot into our
6:08
conversation here with Mr. NHI himself, Lylett Choda.
6:12
He's the founder and CEO of the Non Human Identity Management
6:16
Group. Welcome, Lylett.
6:19
Thanks Jeff and Jim for inviting me to your identity of the
6:22
Center podcast. Real pleasure to be here and
6:25
talk all about NHIS non human identities or some will say
6:29
machine or workload identities whichever camp you're in.
6:33
Yeah, we're going to get totally into that.
6:35
I want to start though, with your background, because this is
6:37
tradition around here is the the identity origin stories for the
6:40
people in the space. So tell us a little bit about
6:43
your identity background. How did you get into this?
6:45
Is it something that you chose or did identity choose you?
6:49
It's probably the the latter. So I started my career 30 years
6:54
ago in investment banking, came out of university straight into
6:59
Morgan Stanley, was there for 18 years.
7:02
I moved into sort of the equities division running order
7:05
management systems. And I guess that was my first
7:08
exposure to sort of regulatory audit and sort of identity when
7:14
the infamous Sarbanes-Oxley Sox Act came and we had to make sure
7:20
our systems were Sox compliant, I was the only one in my
7:22
equities division that really took the Sox control seriously.
7:27
And ever since then, I was tagged in those days with a
7:30
different nickname, Mr. Sox. And ever since then, sort of for
7:34
the last 25 years, anything that was his regulatory order, you
7:40
know, compliance, operational risk, you know, I was involved
7:45
in. So I've run a number of large
7:47
feds and other large regulatory programmes for, for, for various
7:52
investment banks and then slowly went more and more into the
7:57
identity space doing human regulatory programmes, Pam and
8:02
I've done a number of NHI programmes along the way as
8:07
well. And when I did SOCKS 25 years
8:09
ago, that was actually my first time I actually had to deal with
8:12
Nhis or in those days we would call them technical accounts or
8:17
service accounts. So it's a little bit of my
8:19
background in terms of my identity journey until I became,
8:24
I guess, Mr. NHI. So how did you, how were you
8:28
awarded that title of Mr. NHI? Is this a, you know, something
8:31
that somebody gave you? You know, is it something that
8:34
you've kind of adopted as a moniker?
8:35
Tell me about that. Yeah.
8:38
So about a just a year and a half ago I decided one weekend
8:43
to write a white paper on how to manage non human identity risks.
8:48
I was just running in the middle of a very large regulatory
8:52
program at a large investment bank fixing the NHI issues.
8:58
And I thought, look, it might be worth writing some insights on
9:02
what we did, the challenges. And I probably said on LinkedIn,
9:06
I wasn't really a big LinkedIn follower or contributor.
9:11
And what surprised me was within a few weeks, you know, I was
9:15
getting pings from some pretty big industry heavyweights.
9:20
I'll drop a name, for example, you know, head COVID said
9:26
Silverthorpe pinged and said, love your white paper.
9:29
Let's chat. And after writing that white
9:33
paper, kind of a lot of doors started to open.
9:36
I started to talk to a lot of folks in the industry and I
9:39
realized what was going on. There'd been a huge growth in
9:43
startups and a lot of discussion around the non human identity
9:47
problem. And I then started to realise,
9:51
well look, if you're a customer you want to learn about the
9:56
problem, where do you go to understand about the risks, the
10:00
challenges, where'd you get guidance and advice?
10:03
And really there was nothing in the industry about just over a
10:08
year ago. And again, just one weekend I
10:11
thought, look, why don't I start and create like Anhi community.
10:15
So I created the non human identity management group on
10:19
LinkedIn back in May last year. And I've been very surprised
10:24
that we're now close to 2000 members.
10:28
A lot of people in the industry, consultants, a lot of
10:31
practitioners, pretty much the who's who's now in them in that
10:35
group. And we started to post a lot of
10:38
content there. But then I realized that's not
10:42
really going to work. Whilst you'll be able to
10:44
disseminate kind of news, what's going on in the industry, if
10:48
someone wants to learn, they're not going to go through a feed
10:50
of hundreds of NHI posts from me and others in the industry.
10:54
And then I thought, look, let's create a portal.
10:56
And that's where NHIM g.org was formed.
11:00
And my mission was purely, at the time, all about education,
11:05
evangelizing. I was in a job and this was kind
11:08
of a side hobby, a bit like what you guys do at IDAC.
11:12
And it just sort of flourished from there.
11:14
I wrote more white papers, more content, and there was a lot of
11:20
good, you know, feedback. I started talking to sort of
11:24
folks in the market to say, would you like to kind of share
11:27
content as well. And then that's really what I've
11:30
been doing for the last 12 months and since January decided
11:34
to go into this venture full time and the mission hasn't
11:38
changed. It's to educate, evangelize.
11:41
It's the kind of help the industry come together.
11:44
And I guess along the way, someone in one of the vendors
11:48
kind of just in maybe a LinkedIn post was said to me kind of
11:51
verbally, Mr. Nhi, and I started using the name and it's now now
11:58
stuck with me, unfortunately, But maybe it's a bit better than
12:02
Mr. Sox. Yeah, Mr. Sox kind of sounds
12:06
like a Quentin Tarantino character for Mike Reservoir
12:09
Dogs or something like that. Or cat, a cat name.
12:13
Yeah, that's true spoiler right. If you're watching a video, I've
12:16
got a couple DJ cats in Amsterdam behind me.
12:18
So if you're if you're not watching a video, you're missing
12:20
out that that glorious scene. But let me talk a little bit
12:24
here with you about NHI, which is why we're here.
12:28
I know we want to get probably a definition from you of what is
12:31
NHI. But before I get to that, it
12:32
seems like NHI is kind of having a moment right now, kind of like
12:36
identity at large is having a moment as like, hey, there's a
12:39
spotlight identity and people are trying to take notice of it
12:42
even though we've been here for years.
12:43
And I would argue the same thing for NHI.
12:45
But why do you think NHI is such a, a big deal right now?
12:49
Because it seems like every conference that we've gone to
12:51
over the last six months to 12 months has really started to put
12:55
more focus on NHI. And I'm curious, you know, if
12:58
you see the same thing and and if so, why do you think that is?
13:02
Well, there's only one answer. It's because of me and our group
13:05
and all the noise. No, that's not true.
13:09
Look, I, I think, you know, I do get asked this question a lot
13:13
about why now when you talked about identify earlier where our
13:17
groups are actually going to be hosting a big NHL workshop next
13:20
Tuesday and the pavilion you refer to we're hosting.
13:23
So it's going to be great to have you there.
13:26
Look, I think what's changed is the last four or five years
13:31
where, you know, this was always a problem, right?
13:33
As I said, I was dealing with this 25 years ago as part of Sox
13:36
controls to cycle NHI passwords and in those days, but before it
13:41
was all about an internal issue, right?
13:44
But with kind of the hyper fragmentation that we've now got
13:48
in the environment with you know, the multi cloud kind of
13:52
environment, SAS integrations, containerization, micro
13:56
services, you know, API based interfaces.
14:01
And I guess now, you know, more growth we're going to see with
14:04
Gen. AII guess all these kind of non
14:07
human identities, they're much more easy to compromise and
14:11
discover. There's a great start by a
14:15
company that produced a report in 24 saying that there were
14:20
24,000,000 secrets found in public GitHub repos.
14:25
So look, people have not implemented good controls around
14:32
managing NHIS or secrets. They're all over the place.
14:37
You know, we've got generally very weak controls around
14:39
managing the NHIS. So we're seeing, you know, a lot
14:43
of issues, breaches that are occurring.
14:47
That group recently published a 52 breach report to celebrate
14:52
our 52 weeks since we were formed.
14:54
And we're seeing breaches now occurring on a weekly basis
14:58
where threat actors are discovering these credentials in
15:02
repos, API keys, tokens. And it's an easy way to get in,
15:07
right? They don't longer need to, you
15:09
know, kind of compromise a human's credentials.
15:12
They just can get access to these NHI identities.
15:15
And you're in, right? And given, you know,
15:18
environments are so distributed with cloud and SAS, we're much
15:23
more significantly exposed than we were, you know, many years
15:26
ago. So I think just the explosion
15:29
and you know, and the micro fragmentation that we've had in
15:32
the environment has just now caused this this huge problem.
15:38
Lalit, so feels like you come to this with from the practitioner
15:44
perspective, and that's a big reason why Jeff and I wanted to
15:47
have you on this podcast because we've got a lot of folks who
15:52
come on with kind of the vendor perspective.
15:54
And you know, this is, and no way to disparage what they do.
15:59
They're out there building solutions, right?
16:02
But overall we're I, we're hoping to get out of this
16:06
conversation as kind of a framework for the practitioner
16:10
to wrap their brain around this NHI problem and how they can
16:15
solve it, right? Where do they use their existing
16:18
tool sets like IGA privilege, access management, single sign
16:24
on? Where do they need new tooling
16:28
or new approaches? And I'm going to start you with
16:32
a really simple question because I, I kind of feel like we need
16:37
to define NHI and you made a statement earlier.
16:41
Some people might call it machine identities.
16:44
Is that, is that what it is? Is NHI equal machine identity?
16:50
Yeah, look, there is still a lot of debate in the industry around
16:54
what's the the official term for this, this topic we're covering.
17:00
Obviously you know, which camp I'm in, which is the non human
17:04
identity camp. You know, I guess our friends
17:06
are gonna, you know, talk about machine identity is kind of the
17:10
descent of the universe. And then under there they talk
17:14
about, you know, where workloads and devices, where we started
17:18
non human and then talk about workloading devices under that.
17:23
Look, I think it's going to take a while for things to settle on
17:27
what you know will be the common term.
17:30
I think hopefully what may happen is that these become
17:34
interchangeable terms. You can to me non human machine
17:38
workload, it's all really the same thing.
17:41
And I think they can in some respects be used somewhat
17:44
interchangeably. But I guess to your question,
17:47
Jim, you know, what is a non human identity?
17:50
Look, it's a digital identity or a credential that represents,
17:54
you know, a machine, an application, some automated
17:57
process or a service that's used within your IT infrastructure
18:01
stack. And these non human identities
18:04
allow those machines and software workloads to securely
18:08
authenticate, you know, operate and perform tasks automatically,
18:12
including kind of, you know, authenticating to other
18:16
machines, processes and services without any kind of human
18:19
interaction. So that these are the
18:22
identities, the accounts they used to run all software, you
18:26
know, all around the world, you know, including IoT devices and
18:30
other devices, you know, in an automated way, right.
18:33
So it's what runs everything we do.
18:36
So they are pretty important from an identity standpoint.
18:40
So if you were back at Morgan Stanley or your advice for a
18:45
practitioner out there, right, they get stuck in a long
18:49
elevator ride with the CIO and he happened to hear about these
18:55
non human identities and like, hey, I'm in the elevator with
18:59
the identity guru. I'm going to ask Lala, what are
19:05
we doing about non human identities?
19:07
What's the right answer if you're a practitioner?
19:10
Like, how do you even think about that question?
19:13
Look, it's the we could talk for hours on this.
19:17
Doing an elevator pitch on NHIS. It's quite challenging.
19:22
You know, when we started an NHI program at a more recent
19:26
investment bank, my CSO said to me that why can't we fix this in
19:31
a year? And we then had an incident that
19:34
occurred a little bit later, which I can talk about if we've
19:38
got time. But look, the real fundamental
19:44
issues at the moment with NHIS is there's so many of them out
19:51
there, right, that the stats that will quote NHIS are number
19:54
human identities 25 to 50 X. Some will even quote 100X and
20:00
these numbers will go up, you know, significantly more as
20:03
we've got identic AI coming in. But generally non human
20:07
identities are unmanaged, right? They have very weak controls.
20:12
They're kind of the forgotten problem chart.
20:14
You know everyone focused on human controls and Pam and
20:18
protecting your barriers but managing non human identities
20:23
and the secrets that are associated with them.
20:26
Were typically not, you know, always an afterthought.
20:29
You know, focus was on just delivering software as quickly
20:33
as you can and security was an afterthought.
20:37
So you have a lot of issues, right?
20:39
With secret sprawl, you have a lot of weak control.
20:42
So look, some of the issues you're going to get with NHIS,
20:46
they're easy to discover. You'll find them hard coded in
20:49
source code repositories, Confluence, SharePoint, Slack
20:53
channels, you know, understanding how many you have,
20:58
right. There have never really been any
21:00
ways to kind of fully manage and inventory, you know, NHIS that's
21:07
very hard to do. You know, a lot of these
21:09
accounts are static in nature and that's kind of the core
21:13
issue with kind of NHIS. Whilst we can talk about what we
21:17
can do more strategically and zero trust maybe later in the
21:20
discussion, the vast majority of NHI stays static, right?
21:24
So they've been created, They have in most cases no ownership.
21:30
They may have been created 1020, thirty years ago.
21:32
People don't know what they are. Are they still used?
21:36
We've worked to organizations where 5060% of the accounts that
21:40
we've uncovered have not been used.
21:43
And clearly that increases the surface area of risk.
21:46
You know, you have humans that are using these accounts and
21:49
bypassing controls. We saw that when we turned on
21:53
Pam controls at a, at a bank, they said, look, we don't like
21:57
the Pam Corolla controls. So they started using NHIS as a
22:01
way to bypass, you know, entry to, to production.
22:04
You know, NHIS typically, right, because they're running your
22:07
crown jewel apps, they're going to have high privileges.
22:09
So again, these are targets for both internal and external
22:13
threat actors. And there's many other issues
22:16
that you have, you know, with with NHI.
22:18
So unfortunately, you know, they've always had these issues.
22:22
And now with all the hyper fragmentation that we've talked
22:25
about, the problems just kind of exploded exponentially.
22:30
So look, it's a huge elephant in the room.
22:32
I would say it's probably one of the toughest challenges you'll
22:36
face in your career in terms of solving much, much complex than
22:40
solving kind of the human identity problem, which is much
22:44
more mature. And a lot of the tool sets to a
22:47
point you made earlier just aren't fit for purpose or at
22:51
least the traditional tool sets. And we can talk about that if we
22:54
want to dig deeper to to meet the requirements around sort of
22:58
NHI life cycle processes. OK.
23:02
I think we're on the 1st floor now.
23:04
They've come all the way down on that elevator ride.
23:08
I kind of feel like the original NHIS, at least that I dealt
23:14
with, were service accounts, right?
23:16
So you had these service accounts and I, I kind of feel
23:19
like the life cycle is not probably managed all that well
23:27
in a lot of organizations, But you know, privileged access
23:31
management can do a good job of discovering and rotating
23:36
passwords. It still doesn't have MFA, but
23:40
you know, privileged access management probably knocks out
23:43
some. We could probably use the
23:44
governance processes in IGA to a certain extent.
23:48
I know there are some tools out there, but service accounts
23:51
isn't the whole ball game, right?
23:53
And and what you pointed out with like GitHub repos, you
23:58
could probably scan them and find these things like you could
24:02
put controls around them with existing tools or maybe adding
24:07
to your portfolio some. But I kind of feel like we're
24:11
entering or we've entered this era now where there's this new
24:15
crop of non human identities, whether they are device specific
24:23
or they are more or less like these ephemeral identities that
24:27
get created with like and infrastructure as a service type
24:32
platform where it's not going to create the identities to roll
24:37
out the cloud infrastructure that it needs and then
24:41
potentially deactivate those identities.
24:43
But you have to have your arms around it to some extent, right?
24:47
And maybe it's not just those things.
24:49
I mean, you just take in, take the whole cloud into scope and
24:56
man, there's just tons of identities there.
24:59
And I wouldn't think that the traditional privilege access
25:03
management tooling is going to do a good job at that.
25:08
So one thing, So OK, so that's one thing, which is that I think
25:15
there's all these new types of identities.
25:19
The other thing is, and this is what I've always kind of said,
25:22
would it be nice if we manage non human identities the same
25:28
way we manage humans, which is we have some source of record
25:32
like an HR system or something. That's where you start by
25:35
creating the identity there and then it gets provisioned, you
25:40
know, through automation, ideally to the point where you
25:44
wanted it. It can be checked on, the
25:46
password could be rotated. You no longer need it.
25:49
You're the source of record. Shut it off and it shuts it off
25:52
anywhere that's being used. But it's not really like that,
25:55
right? I mean, people spin up a server,
26:00
they either manually or by automation create accounts to go
26:04
and do those things, server or database or whatever they're
26:08
spinning up. So the approach to managing
26:12
these non human identities is not like linear where you start
26:18
the process here point A and then the end of end of life is
26:23
point Z. It's you're finding these things
26:27
and then you have to wrap them up in layers of security
26:33
management so that they are more secure.
26:37
And I don't think it goes from like not secure at all to 100%
26:41
secure. But to me, that's the the big
26:45
thing is that, hey, there's these new identities and they
26:48
are not easily managed and the tools you have today don't do a
26:53
good job of managing them. And that to me, that's like why
26:57
it's hot. It's like all of a sudden we're
27:00
inundated with all these places that are now creating identities
27:04
and none of the tools that we have traditionally do a great
27:09
job at managing them. Did I get that right?
27:13
Yeah. Look, I think you've summarized
27:15
that very, very well. Look, even if you look at the
27:18
human space where you've got all the cloud tools that are out
27:22
there, right, that have come along because sort of, you know,
27:26
move beyond sort of the traditional IGA and Pam even for
27:29
just kind of the human use case, but with kind of non human
27:34
identities. You know, there isn't a single
27:36
source of truth like you might have with human identities.
27:40
You know, there's going to be many places where they get
27:42
provisioned, you know, in the cloud on your, you know, on Prem
27:46
environment, you can have a lot of local accounts, maybe on
27:49
legacy databases, Active Directory, you're going to have
27:53
many, you know, ID PS Right. So there's going to be like, you
27:57
know, 10s of places where a typical organization is going to
27:59
have these NHIS kind of provisioned.
28:03
But generally they get provisioned.
28:05
You know, they typically come if they're static with some keys
28:10
and passwords. They get shared around, you
28:13
know, maybe in an e-mail or in some other communication
28:16
channel, in a ticket to the requester.
28:19
So there you go. You know, problem one already,
28:22
right? The credentials are known by
28:24
humans. And then they'll, you know,
28:27
they'll take the easy route. They'll just put them into
28:30
source code, hard code, the credentials.
28:32
So you've got all the challenges around, you know, vaulting,
28:36
removing hard coded credentials. Look, so yes, a Pam solution can
28:40
help with some of that, but a Pam solution isn't really going
28:43
to solve your whole inventory problem.
28:46
And discovering all these identities that are out there,
28:52
you know, once you've discovered them, you need to understand
28:54
who's the owner, what's the level of permissions, how broad
28:58
is the access right? And classify them, you know, and
29:02
then you can start doing things like posture management, you
29:05
know, have they got excessive permissions, misconfigurations,
29:09
what's inactive, you know, what's shared.
29:12
And clearly, you know, with, you know, the growth in cloud, the
29:16
number of privileges that you can get in the cloud, just kind
29:20
of a crazy rather 10s of thousands of difference of
29:23
combinations. So people take the easy path out
29:26
and say, look, rather than following least privileged
29:28
principles, let's just go with, you know, an Uber kind of
29:32
privilege. So you see a lot of, I think the
29:34
clouds kind of encouraged kind of more excessive privileges to,
29:38
to these identities. So you've got, you know, them
29:41
all out there. And you, you talked about
29:43
scanning. You know, that's another area
29:45
that traditional tools would not have done right is to scan and
29:48
look for these credentials in source code, in repos and other
29:52
places. And then, you know, the big task
29:55
is once you've found all the things, yes, you can do some
29:58
hygiene, some clean up, but you're then going to secure the,
30:01
the, the secrets if they're hard coded.
30:05
You know, had a previous org that I wrapped up last year, you
30:09
know, we had to secure over 100,000 NHIS that we were
30:15
uncovered in source code. And our initial scan that we did
30:18
found over a million potential hard coded secrets passwords.
30:24
So you can see the size of the problem and then to make those
30:27
changes, move those credentials into a vault, you know, the
30:31
amount of changes you need to make to your code to remove
30:34
those credentials, the operational risk.
30:37
And then you talk to him about cycling right and rotating these
30:41
credentials 1 is securing them. But reality is people still know
30:45
the, the, the, the passwords, the secrets.
30:49
And as people leave, you know, and then with Cloud API keys,
30:53
you know, you can take that information with you, right, to
30:56
another organization or compromise those accounts, you
31:00
know, even if you've left an organization.
31:02
So rotation becomes something that you need to do.
31:05
And whenever there's a breach, right, the first thing is rotate
31:07
your keys. But again, you know how those
31:11
credentials used in many places in your code, How do you know
31:15
when you rotate? You know that all the code, you
31:18
know, is using the same, you know, vault solution to source
31:23
their password. If you miss one of those
31:24
dependencies out, you could end up causing operational impact.
31:29
And we've seen that so much have many orbs where you didn't
31:32
realize a credential was, you know, used.
31:36
You missed a piece of code or you found, oh, some other app
31:39
you've given the credential to, you know, like to another team
31:42
that needed to connect to your database.
31:44
You give them the password and they're using it as well.
31:48
So there's a lot of legacy that's been created and that's
31:51
why a traditional IGA or a Pam tool is not going to solve these
31:55
problems. That's why you've got a new crop
31:58
of pure NHI products that have come into the market.
32:03
And then also now we're seeing a lot of movement with the
32:05
traditional IGA and Pam players that are now investing
32:09
significant sums to build, you know, NHI capabilities.
32:14
So it's definitely the existing tool sets just could not support
32:20
these use cases. It's much, much more complex
32:23
then what we talk about for humans, you know, and then
32:27
you've got to think about monitoring, you know, if someone
32:30
inappropriately using your, your NHIS coming from some unknown IP
32:36
addresses that are human using them.
32:38
And then they are already being compromised.
32:41
And then you get into the, you know, what's the target state,
32:44
right, which is kind of ephemeral just in time zero
32:47
trust. You know, our previous org, we
32:50
also implemented prevent controls.
32:52
When you check in your code, we're actually looking runtime
32:55
to see, have you checked in an API key or a password to an NHI
33:00
credential? And we actually block the check
33:02
it. So if you look at the overall
33:04
life cycle, we've published one of these on our portal.
33:08
It's a huge, huge problem to solve if you want to try and
33:13
tackle the whole thing holistically from a life cycle
33:16
standpoint. So from an organizational
33:18
standpoint, I think you're going to take a balance, which is try
33:22
and do some things more strategically.
33:24
You know, do kind of dynamic ephemeral secrets with your
33:29
workloads. You know, more of a zero trust
33:31
model, maybe with your Genentech staff or your grand duels as you
33:35
re engineer. But you've also got to deal with
33:38
your existing kind of state that's out there, which is
33:41
static in nature, and you've got to get that under control.
33:44
So you're going to have to always think of a hybrid
33:47
approach to dealing with the NHI problem, you know, a lot of
33:50
legacy and figure out how you kind of strategically kind of
33:55
stop the bleeding, you know, over time as well.
33:58
So listening to a couple of points.
34:01
It certainly did, but it opens up some questions for me because
34:03
I'm listening to the two of you talk here and now I'm wondering,
34:07
you know, whose fault is this? Where does the blame lie?
34:11
Because I feel like this is where privileged access
34:14
management was supposed to have been the solution for this.
34:18
We've been sold this bill of goods by Pam vendors for decades
34:20
that hey, this is where you go to manage your non human
34:24
identities. We didn't call it that.
34:25
We called IT service accounts. We called it keys, right, All
34:28
that kind of stuff. But listening to the two of you
34:31
makes me feel like, OK, well, OK, what do you mean?
34:35
I thought Pam was supposed to do that and it's not doing it.
34:37
And that has opened up the door for these new vendors to come in
34:40
and specialize in this version of Pam 2 point O or three-point
34:45
O or whatever you want to call it.
34:46
But I almost have a feeling of a little bit of remorse here.
34:50
It's like, all right, well, Pam was supposed to do this.
34:53
Why isn't it doing it? And I don't know if that's a
34:55
fair assessment based on the conversation so far or just kind
34:58
of my my experience with Pam solutions, but I'm curious.
35:01
I'll like to see. Look, I think it's different.
35:04
Sorry to interrupt. No, please go ahead.
35:07
Look, I think, well, if I if you asked me did was Pam designed to
35:14
solve NHI, I would say partly. Like my background in dealing
35:20
with Pam was really driven from kind of a human standpoint where
35:24
you had like core admin accounts, ROU accounts, service
35:28
accounts, right, that I needed to operate, you know, your your
35:32
infrastructure, your software, you know, So the definition we
35:36
gave on NHIS, but usually the Pam element there was around
35:43
humans and controlling people that needed to elevate their
35:47
privileges, right to impersonate pseudo become that account, you
35:52
know, to maybe deploy the software or maybe when there's a
35:55
support issue, go in and, you know, become that account so
35:59
they could then deal with support issues.
36:02
So yes, it was there to protect kind of your keys to your
36:06
Kingdom, like your most privileged accounts.
36:10
But I think non human identities are much, much poorer than just
36:13
Pam, right. I think you know, like, you
36:16
know, if an application's got an account that it uses to connect
36:18
to a database, is that a privileged account that's really
36:22
just an account that that process needs to operate and
36:26
communicate with other services. Yes, it has privileges, but is
36:32
it a privileged account like in the traditional Pam sense?
36:35
I'm not sure it is. But yes, the the the the idea of
36:39
what Pam tools did, you could argue could cater for some of
36:44
the life cycle processes for an NHI.
36:47
But you know, again, like take a vote like Hashi, all they do is
36:52
capture the secrets, right? They don't deal with the life
36:54
cycle processes. They don't natively deal with
36:57
cycling or scanning or inventory or ownership.
37:02
So many of these existing tool sets only deal with a really
37:06
small part of the overall life cycle of Nhis.
37:11
Yeah. And I think that's go ahead,
37:14
Jeff. I say.
37:15
So I think the the important distinction here then is the
37:19
first word of Pam privileged, Does privilege connotate non
37:24
human identity? And then does non human identity
37:27
equate to privileged? Right.
37:28
I think that's kind of what I got from your answer was not
37:31
every, not everything is equal. You can have a non privileged
37:35
non human identity. I'm kind of thinking about what
37:39
maybe you can give me an example of what that might look like.
37:41
Because if I think of non human identity, I'm thinking of
37:45
something that's sitting behind the scenes.
37:46
It's a service account, it's a script, it's an API.
37:49
It's, you know, some sort of thing that is accessing a data
37:53
or a resource. And you know, I guess maybe it's
37:56
like what the cafeteria menu or or something like that.
37:59
I don't know what would be an example of a non human identity
38:03
that is not privileged. Well, I think every non human
38:08
identity will have privileges, you know, permissions, you know,
38:12
to whatever identity it needs to operate.
38:17
But I guess the privilege when I when I think of the Pam, it's
38:21
really, you know, where you're trying to elevate and you know,
38:24
get sort of higher privileges and what you had today as a
38:28
human right to perform some elevated role from your basic
38:33
credentials as you know, a human identity.
38:36
So I, my always view of Pam was around how you elevated, you
38:40
know, the human use case to, to, to, to get access to those non
38:45
human identities versus Pam being the, the, the thing that
38:50
managed everything, every NHI that's out there.
38:53
I'm not sure I've quite answered your question.
38:57
Well, I like how this I like how this conversation is going,
39:00
because I think we've as least privileged people as identity
39:06
people, lifers, if you will, we want everything to be done
39:11
great, But we know that the reality is that we have to take
39:17
some kind of a risk based approach.
39:19
And so it's all about setting priorities.
39:22
I was going to ask the question a more, you know, from the
39:25
beginning, like a huge elephant. I mean, when you talk about non
39:29
human identities and you talk about the the pure scale, even
39:34
in like a small to mid sized organization, we talk about a
39:37
large enterprise. You could be talking about
39:40
literally millions of identities.
39:45
How do you wrap your arms around that?
39:47
Where do you start? And I think it's got to be based
39:50
on risk you got to look for. And so when we talk about
39:54
privilege, I mean, of course, like every account has some
39:57
privileges, but we've got to go for those ones where it's like,
40:02
oh, that's. That's one or maybe it's the
40:05
type of an account where like, hey, if these got compromised in
40:10
our Active Directory, what? And like, I'm sure there's some
40:15
people out there scoffing at the Active Directory, but normally
40:18
when companies get completely ransomware and completely shut
40:22
down, it's because the hackers got the Active Directory.
40:27
They have control of the Active Directory and they can basically
40:30
turn off your business and make it so you, you know, your e-mail
40:33
doesn't work, People can't log into their laptops, can't get to
40:37
their files. I'm sorry, that's lights out.
40:40
And so whether or not you like Active Directory, hear me out.
40:46
Those kind of accounts have got to be like at the, the top of
40:50
your pecking order. And then I think it would be
40:53
applications that are, you know, the quarter of your business.
40:58
So do you agree that like that's how you go about prioritizing?
41:03
And I'm, I'm assume whether you agree or disagree, how do you
41:09
then choose your technology stack to solve that?
41:15
Because to your point earlier about Hashi, great, great vault
41:21
technology and maybe that, you know, you say I'm going to take
41:25
on risk #1 and that's what I need.
41:29
But then you can't be doing that evaluation each time you go.
41:33
Like what is your technology approach to make sure that you
41:38
have the right number and the right strategic alignment of
41:43
technologies in your portfolio so that you can manage your NHI
41:48
problem? Hey, look, it's a great
41:50
question. I get to ask this a lot and I
41:52
recently talked about this at AIC and next week I'll be doing
41:57
a seminar talk at Identiverse, A practitioner's guide to NHIS.
42:02
So look, when I ran my last NHI programme at a large investment
42:07
bank, you know, we took took step back first and took a
42:11
holistic approach and clearly our mantra was you're going to
42:15
take your risk based approach. You can't tackle the elephant in
42:17
the room. So some of the things Jim you've
42:20
talked about you have to look at where are your clearly your
42:23
highest risks. So you have to go after your
42:26
most privileged, you know, accounts like your admin
42:28
accounts, your domain controllers, you know, etcetera,
42:33
your root accounts on servers, databases.
42:38
And you know, the other thing you're going to need to do is
42:40
look at what controls you have around those accounts per
42:44
platform. Now, you may have interactive
42:47
logins enabled on your Windows service accounts, which we all
42:51
know is really, really bad, right?
42:54
So you can then interactively get in and start to become that
42:58
account, sort of. There's lots.
42:59
You do first need to understand what your control maturity looks
43:03
like. You know, where do you have
43:04
strong controls or processes? And maybe you know, your Linux
43:09
state might be very well secure because you don't have
43:12
interactive logins. No one knows the password for
43:15
any of the counts, but your Windows ADS, right, where
43:18
everybody knows the passwords and never cycled and they're
43:20
interactive, right? So you know, you need to
43:23
understand kind of your control levels across your tech stack.
43:27
You clearly need to go for your highest risk accounts, right?
43:31
You need to look at things like lateral movement, right?
43:34
Because typically folks will first find some non prod
43:37
environment and then laterally move.
43:39
You know, we see a lot of service accounts that don't have
43:42
environment segregation and that applies to any NHIS where the
43:46
same account has access to prod and non prod.
43:50
So once you're in, you can laterally move.
43:53
So you really need to understand all your controls and then come
43:57
up with more of a holistic approach of how you're going to,
44:01
you know, go for, you know, the areas that have got the biggest
44:04
risk exposures. Like at a previous org, we felt
44:07
the database estate was our biggest risk, right?
44:10
Because you can't turn off interactive logins there.
44:14
As long as you know the credential, the password, you
44:16
can log in and you know, you know, you can do anything once
44:20
you're once you're in. And then there's a lack of
44:22
monitoring of what you're doing. The other thing I think is
44:26
really important that people forget is you've got to really
44:30
look at this top town from a management standpoint.
44:33
Look at kind of your policies, your standards, your controls,
44:38
and make sure you educate folks. And look, you may not have all
44:41
the best tech stack out there. You may not even have a vault,
44:44
you may not have scanning in place, but you need to let
44:47
people know. Look, security first development
44:51
is the way to go, right? They have SEC OPS.
44:53
And while some of the automation through your CICD pipelines and
44:57
integration to your vaults and other controls may come over
45:01
time, they need to know that this stuff is unacceptable,
45:04
right? So we're checking in hard coded
45:06
credentials into source code. And you know, they need to
45:10
realise that our previous org, you know, we basically said to
45:13
folks, if you continue to repeat the mistakes of the past, you
45:17
know, you will be disciplined and even, you know, lose your
45:20
job. So we had those things top down.
45:23
Education training is really, really important.
45:27
And then it's about defining controls.
45:29
Like what is the bar that people need to adhere to?
45:32
You know, it was shocking. At a previous org, there was no
45:36
requirement to cycle passwords for NHIS.
45:39
As long as the password was 15 characters in length and
45:42
complex, that was it. No requirement to cycle.
45:45
And a regulator comes in and says, do you cycle passwords?
45:48
No bang, huge regulatory point. So you have to start with the
45:53
basics and to a point, Jim, you made earlier, a lot of the
45:56
controls are very similar from a human standpoint as well around,
46:02
you know, the life cycle processes, what is the way you
46:04
provision? How do you deal with the
46:06
provisioning? So always focus on the basics.
46:10
Make sure you've got the basic control processes in place and
46:14
then people process technology. Continue to mature out your
46:19
processes and then continue to mature out your tech stack.
46:22
And it may mean then you buy a solution and it may mean you
46:25
supplement your existing IGA products and Pam products or do
46:30
something in the middle, right? It really depends where you are
46:32
in your organization and the complexity of your environment.
46:38
So, you know, I think with anything, it's just start with
46:40
the basics first, right? The fundamentals.
46:44
I love the idea of the basics because it gets overlooked so
46:46
often. And it's, you know, the
46:48
fundamentals need to be there. You want to build on a solid
46:51
foundation. And if you skip that step,
46:53
you're probably going to have a bad time down the road.
46:56
And you can't just buy a product and say, well, this is going to
46:58
solve my problems. You know, there's a lot of, you
47:01
know, governance and the people in the process that go along
47:03
with that to actually address the issue.
47:07
I mean, I'll give you a great example.
47:08
Hashi, right? We used some of the previous
47:10
organization. Yes, you can put passwords into
47:13
a vault for service account and any other kind of NHIS, right?
47:17
But if you don't think about when you onboard that to the
47:20
vault, if you don't set up the right metadata, what is the
47:23
account name? Where is it used?
47:25
What database or server is it used on?
47:29
If you don't provide that metadata, I mean just Chuck in
47:31
the password and give it A tag like password 1, password 2 when
47:36
you don't need to move on to cycling.
47:38
Oh, I've got something in a vault, you know, I know the
47:41
password, but I've got no idea what it is that it's actually a
47:44
database account on server XYZ, right?
47:47
So again, you've really got to plan this stuff end to end.
47:50
And maybe some of this stuff is basic.
47:53
You think you would do that, but you won't believe the number of
47:56
groups that have just chucked stuff into a vault without
48:00
having proper metadata when it's really burnt them, you know,
48:03
later on. So you really need to think
48:05
about this from a strategy and architecture standpoint and
48:08
design your whole solution around NHIS end to end is is
48:13
what we would recommend. So why don't I ask you a little
48:17
bit of a deep question and then we'll end on a lighter note to
48:20
kind of get us out of the deep water.
48:22
And here's my deep question. Is there anything that scares
48:26
you about NHI? Look everything excuse me about
48:29
NHI. That's why anything that doesn't
48:31
I'm. Doing.
48:32
How about that? Maybe that's a better way to do
48:33
it. Look, but the problem that
48:39
scares me is, you know, the fact that this problem has been there
48:42
for 2530 years, ever since computers existed.
48:46
And we haven't really moved the needle that much, right?
48:50
And it's only really been in the last few years where some of the
48:54
vendors and the focus from everyone has been in the space.
48:58
And yes, there's vendors that deal with governance and posture
49:02
management. How do we deal with kind of zero
49:05
trust based architectures? You know, there's a lot of good
49:09
standards, spy, spy whimsy that are coming, right, that are
49:15
helping define how you can build kind of scalable workload
49:19
dynamic based kind of architectures for managing your
49:22
workloads and follow zero trust principles.
49:26
But all that stuff is still not baked.
49:29
But I think the one thing that's really scary, right, is kind of
49:32
obviously you're probably going to guess what I'm going to say
49:35
like a gentic AI and, and the ramifications for NHIS, given
49:40
that they're so weakly managed already, right?
49:43
So if you continue to use the same processes for your gentic
49:46
AI, they're probably going to be even more privileged, right,
49:49
than regular Nhis that are used. And as they become
49:53
interconnected and can elevate their privileges dynamically, if
49:58
you don't apply, you know, sort of strong zero trust privileges
50:02
around that, it's scary what could happen, right, with people
50:06
compromising AI agents, which obviously under the covers using
50:09
NHIS. So I think we've got a long way
50:12
to go that the agentic AI stuff is just moving so fast.
50:16
But I just don't think at the moment we've got the right
50:19
controls and solutions to solve NHIS fundamentally anywhere at
50:23
the moment, let alone, you know, the fast moving pace of agentic
50:27
AI. So that probably the thing that
50:30
worries me the most and probably is the most hotly discussed
50:33
topic at the moment in the kind of agentic AI and NHI space.
50:38
I mean, I can see a, a, you know, a scenario say, well, we
50:40
just built an agentic AI product to solve our agentic AI product.
50:44
OK, so you know, we're in this, you know, dog chasing its tail
50:48
type of scenario. I don't know.
50:49
All right, let's shift to a little bit wider note because I
50:52
know that's if for people who aren't watching this on YouTube,
50:56
you have a very impressive vinyl collection behind you of I don't
51:01
know how many thousands of records you might have.
51:03
First of all, let's talk there. How many, how much do you have
51:06
behind you? Let's start there.
51:09
I guess I've been collecting vinyls since I was a student at
51:12
university, so that's over 30 years.
51:14
So you can probably guess my age now.
51:16
But yeah, I've probably got somewhere in the region of about
51:18
2000 kind of LP's, 12 inch records.
51:23
So it's been a lifelong ambition to grow my collection.
51:29
It's all soul, swing, sort of hip hop, R&B.
51:35
The genres mainly in the sort of 70s, eighties, 90s kind of is
51:43
where most of my collection comes from.
51:46
I feel like vinyl's having a little bit of a resurgence here
51:48
the last, you know, few years, but it seems like it kind of
51:51
went away when C DS and, you know, the laser discs I think
51:54
were were part of that as well. But was there a lull in that
51:57
collection where it's like, man, it's just getting harder to
51:59
find, you know, modern artists putting out their content on
52:04
that format of vinyl? Yeah, good question.
52:07
I've not really been buying a lot of newer stuff.
52:10
It's mainly in that sort of 70s to 90s kind of era.
52:16
I did probably stop buying stuff for quite a few years as I was
52:21
working in investment banking. But then as kind of the last few
52:25
years, I started to grow my collection again and bought a
52:30
lot from, you know, the collectors on eBay.
52:34
And there's a great story where I ordered a batch of albums from
52:39
someone that I got to know very well.
52:42
And I was just going through them cleaning some of the
52:45
records, record cleaner and out popped out about 150 lbs in
52:51
very, very old British notes. So I went told the guy that I
52:59
purchased them, that I found this money in his in one of his
53:02
record sleeves. I went to the bank, got the
53:06
money converted because it was not legal tender anymore and
53:09
send the money back to him. So maybe tells you a little bit
53:12
about me that what I'm like if I'm in that kind of dilemma that
53:16
I would definitely give the money back to the the rightful
53:18
owner. But that was a big shock to find
53:21
money. And apparently he does quite a
53:22
lot hides money in his. He has 10,000 plus record
53:26
collection. So you might start buying more
53:28
albums from him and then any more money in all the secret
53:31
stashes. Now, yeah, I guess I probably
53:32
need to go through my 2000 now and see if there's any more I
53:35
can find in there. You never know, there might be a
53:37
few more looking out there. So of that 2000, I'm going to
53:41
ask you to pick your first what, what's the one that you remember
53:44
first getting? What's your best album or record
53:48
or vinyl, I guess? And then what's your favorite
53:51
one out of that set? Yeah, I'm not sure I can
53:54
remember my the first one, but it would probably be something
53:59
like Luther Vandross, Freddie Jackson, Marvin Gaye, probably
54:04
something in that kind of sort of era.
54:10
I think in terms of like kind of my most cherished kind of
54:15
favorite album for 12 inch is probably from a British band
54:22
called Loose Ends. Have a lot of great records out
54:29
there. And I had the fortune to sort of
54:32
see them play in a bar a couple of years ago and a big fanatic
54:40
of their music. I took all my kind of albums,
54:43
LP's with me and I was waving them around on the dance floor.
54:47
And then at the end of the night the bands, I said look, come and
54:51
join us. And then they signed all my my
54:55
albums, both on the outside and the inside.
54:57
So that was a real special moment for me.
55:03
So what was the other question you've asked her?
55:06
Is there a best 1? And I guess maybe best not the
55:08
same as favorite bike? Do you have something that's
55:10
like, oh this is a real find in in the space of vinyl?
55:15
I don't know if it's something rare maybe or something has a
55:17
lot of value other than sentimental.
55:20
There was one tune by a singer called Tammy Payne, and she
55:26
sings a song called Free that probably very few people have
55:31
heard, but it's just one of those classic sort of soul
55:36
songs. That first time I heard it, I
55:39
just felt I've got to have this and it's always been in my top
55:42
five. And it took me a year to sort of
55:46
source this when I was at university and as a kind of poor
55:49
student, I think I paid about 3040 lbs for it, which was a lot
55:54
of money in in those days for just one record, but it was from
55:59
a specialist kind of reseller. And then a few weeks later, I'm
56:03
rumbling through a sort of a record shop and I found another
56:08
copy of this same thing that I paid 3040 lbs for.
56:12
And it was on for like 50 P or a pound.
56:15
So I was guided that, you know, just in a week I played over the
56:19
odds. But you know, but that's the one
56:22
I probably cherish the most because it was the one I wanted
56:24
to to get for a very, very long time.
56:27
And it took me ages to find. But then I found two quick
56:31
succession. So you have one for playing and
56:33
then one for like display or you know, keeping, right?
56:38
Jim, I want to pay it over to you.
56:40
What is your first, best and favorite album?
56:45
I guess I'm not sure I know. I'm pretty sure you don't click
56:47
vinyl, but give me a first, best and favorite.
56:51
So I'm going to mention three and interestingly none of them
56:56
were vinyl. So the first one was 8 tracks.
57:00
And so get this, I don't know if you remember, but in the 80s,
57:06
early 80s to put in magazines, Columbia Records would put these
57:11
inserts where you can tape a penny to It was like a postcard
57:18
and mark off a bunch of albums that you wanted and you get them
57:22
in a track format or vinyl format.
57:24
So I ordered like, I forget it. I think it was like 6 for a
57:29
penny. I thought, look, this the best
57:30
bargain ever. I was like 6 years old and I got
57:35
Devo. You remember that song Whip it?
57:39
I got Michael Jackson, Thriller, and I got Led Zeppelin 4,
57:47
Stairway to Heaven and I loved it.
57:50
My mom was not happy because then she had to buy like 5 more
57:54
albums at full price, which I think was like $30.00 an album.
57:59
So anyway, yeah that was a funny story.
58:02
So that's first I think best I'm going to say.
58:07
So I had, you know, I was into hip hop music before they even
58:13
called it hip hop music. It was Beastie Boys licensed to
58:17
ILL on cassette. I played that thing and flipped
58:21
over my tape deck so many times that all of the ink on it was
58:26
worn off. So I mean, it must have played
58:28
that so many times. I think eventually the cassette
58:32
player ate the tape. Remember, that used to happen,
58:34
like, get garbled up. And then as far as favorite, I
58:40
think I'm going to go to my college days on CD.
58:43
I'm going to pick Pearl Jam 10 because I must have played that
58:49
a million times. And that was such like an anthem
58:54
of that grunge era. And I've loved music ever since.
58:57
And I've had other things. But those three events stick out
59:01
in my mind as first, best, favorite.
59:04
Jeff, your turn. Well, those are good ones and,
59:08
and I got into music probably much later than both of you.
59:12
I don't think I got my first album until I was probably
59:17
either senior in high school or just out of high school.
59:20
I just, it wasn't a thing that I did, but I very remember, very
59:24
much remember getting CDs. That's how I started.
59:27
I I mean, I had cassettes and stuff like that, but it was all
59:29
just like, you know, you'd tape it off the radio, you know, that
59:32
kind of thing. But the first C DS I bought were
59:34
two. It was Offspring, the smash
59:37
album and Green Day's Dookie album.
59:40
Those are the first two things that I ever bought.
59:43
So that's the first. Let's see.
59:45
The best is probably a box set from Metallica called Live Blank
59:53
Binge and Purge. And they had a double CD of a,
59:57
of a live show that they did. I think it was in Mexico.
59:59
It had a video performance. Yeah.
1:00:01
Just a great, just a great thing.
1:00:03
But it was like a full box set and it had like a, you know,
1:00:05
chest or whatever. And I don't know if I
1:00:08
necessarily have a favorite album.
1:00:11
I feel like there's so many good ones out there.
1:00:14
And my listening patterns have changed into more of a hunt and
1:00:19
Peck. You know, pick one song from
1:00:22
this artist and then go to this other song from another artist.
1:00:25
There's a lot of really good albums.
1:00:27
But you know, maybe it's actually, you know, maybe I'm
1:00:29
going to go with Korn. I love the Untouchables album.
1:00:33
I think it's fantastic. So I'm going to I'm going to go
1:00:37
with that as my final answer. Jim Korn.
1:00:39
You are a hard rocker, man. I got to give you that.
1:00:42
Give that to your three choices. We're all basically heavy metal.
1:00:47
It was a choice between, you know, rock.
1:00:49
There's some electronic albums I like too.
1:00:51
But yeah, I just remember playing the Untouchables album
1:00:55
over and over and over and over again in the car.
1:00:58
And, you know, that was on my, I think at the time I had like one
1:01:02
of those CD discman things, right, that you'd have in your
1:01:04
car and use the cassette tape adapter to get it into your
1:01:08
stereo and, you know, all that good stuff.
1:01:10
But I don't know allow it does does any of the stuff.
1:01:13
Just a final joke. Yeah, Yeah, I was just about to
1:01:16
say those are a set of non human identities that I don't
1:01:19
recognize and have not discovered.
1:01:23
You could argue, you could argue that all those things, vinyl, CD
1:01:28
are all potentially non human identities as well.
1:01:32
Identity, right? They won't have a code.
1:01:33
So. We got to hit stop and record a
1:01:36
new one where we argue about that for the next half hour.
1:01:41
But we want to establish provenance, right?
1:01:42
It's like also the same thing too.
1:01:44
It's like, what is the the provenance of this album?
1:01:46
Is it legit? Is it, I mean, at some point
1:01:48
it's going to be is this AI or is this X band right doing the
1:01:52
real thing? So that'll be interesting when
1:01:54
we start talking about non human identities for non human
1:01:57
identities. All right, this has been in just
1:02:02
a fascinating conversation. All that.
1:02:03
I'm glad you were able to get you onto the show.
1:02:05
I feel like kind of finally this happened.
1:02:07
So that's great. I'm looking forward to seeing
1:02:09
you on Identiverse next week. And for the time, people of
1:02:12
times listen this, you know, your workshop will have been
1:02:14
overdone have been done at that point.
1:02:16
So would encourage people to go check out the Identiverse.
1:02:19
I think things are going to be recorded.
1:02:20
I'm not sure if your workshop is going to be well let.
1:02:22
Do you know if that's if that's the case?
1:02:25
Yeah, workshop will be recorded, but the pavilion sessions won't.
1:02:31
But yeah, I'm looking forward to seeing you both there with some
1:02:37
crazy things that you're going to do at the Pavilion and
1:02:40
looking forward to spending some time with you next week.
1:02:44
Yeah, that's going to be a lot of fun.
1:02:45
So we'll go ahead and wrap it up for this week.
1:02:47
I'll have links in our show notes to while it's a LinkedIn
1:02:50
page, as well as the non human identity management group and
1:02:53
HIM g.org. You go check out there For more
1:02:56
information, which has a lot of good content.
1:02:58
So, you know, hats off to you for a while for really kind of
1:03:00
spearheading this and and taking the mantle of of Mr. Nhi.
1:03:05
So I'm not sure what the next step is past Mr. Would it be?
1:03:08
Do we just go to different languages like Senor NHI?
1:03:11
Do we go to like professor or doctor like have you?
1:03:14
Do you have a graduation strategy for Mr. NHI?
1:03:17
Someone's already started to call me the father of NHI and
1:03:21
then the Godfather of NHI, so maybe that's the natural
1:03:24
evolution. Godfather sounds nice.
1:03:26
I meant to ask, when you were in Germany, were you hair NHI?
1:03:31
No, that didn't come up, thankfully.
1:03:33
All right, next time. Well, thank you so much for
1:03:37
being with us here and yeah, spending your time and, and
1:03:40
helping us understand the space a little bit more.
1:03:42
We'll go ahead and wrap for this week.
1:03:44
You can find us on the web, IDC, podcast.com.
1:03:46
Do all the things that Jim asked you to do earlier in the
1:03:48
episode, like subscribe, share with your friends, share with
1:03:51
your enemies, share with your agentic AII don't care.
1:03:53
As long as people listen, that's all that matters.
1:03:56
So with that, thanks for watching and or listening and
1:03:59
we'll talk with you all in the next one.
1:04:04
You've been listening to Identity at the Center.
1:04:07
We hope you've enjoyed the show. Make sure to like, rate and
1:04:11
review, and we'll be back soon. But in the meantime, hit the
1:04:15
website at identity@thecenter.com.
1:04:19
See you next time on Identity at the Center.