Latest / Identity at the Center / #292 - Roadmaps and Realities: Developing an IAM Strategy

Transcript

#292 - Roadmaps and Realities: Developing an IAM Strategy · Identity at the Center

0:16
Well, if I had anything to say before you take us out, it would
0:19
just be thank you to our listeners, people who've been
0:22
listening for five years or five episodes.
0:27
I mean that we wouldn't do this without our watchers, our
0:32
listeners. And we keep trying to make this
0:36
thing better for you all because it means so much to us, like
0:42
Jeff said, where people come up and actually know who we are and
0:46
listen to the podcast or just connect to us on LinkedIn.
0:50
It's it's why we do it. It's why we've been able to like
0:53
do this for five years. And I think, look, we've
0:56
recorded a lot of episodes on like Saturdays and Sunday nights
1:00
to get them out on Monday. And you, you have the all the
1:04
humans work after that to like, you know, do all the editing.
1:09
It's a lot of work, but it's worth it.
1:12
I don't think we've ever questioned whether or not it's
1:14
worth it. Yeah, yeah, it's a labor of
1:17
love. And definitely thank you to
1:19
everybody who supported the show, listeners, people who come
1:22
up, you know, even sponsors who are now getting involved with
1:24
stuff. Yeah, definitely.
1:27
Thank you. This is identity at the center
1:37
if it has anything to do with IAM.
1:40
This is the go to podcast now your hosts Jim McDonald and Jeff
1:46
Stedman. Welcome to the Identity at the
1:54
Center podcast. I'm Jeff, and that's Jim.
1:56
Hey, Jim. Hey, Jeff, how are you?
1:58
Oh, not so bad yourself. Doing good, man.
2:01
It wouldn't be a episode. This is a special episode, but
2:04
it wouldn't be an episode if I didn't bring up some thought
2:08
that I've been having. That's been like eating away at
2:10
my brain. Whatever.
2:12
Is left just like that amoeba that I got in the lake last
2:17
summer, eating away at my brain? No, it's just going back to this
2:21
whole thing of centralized versus decentralized.
2:25
And it's kind of been one of the topics that's always been there
2:31
in the identity management world.
2:33
I remember doing an identity strategy at a big university in
2:38
the US and someone said, well, if we go to single sign on and
2:44
have all these apps wrapped into one user account per person,
2:50
what if they lose that account? Won't the person have access to
2:52
all their applications? It's like contrast that with
2:58
that person having different accounts for all those
3:01
applications and having to try to coordinate their passwords.
3:04
I think in the long term, where where I was easy, where I easily
3:09
came down was that the the benefit of having just one
3:15
account from an end user perspective and to just have to
3:18
manage one password, one MFA and B having one place to set the
3:23
policies outweighs the risk of potentially losing that account
3:29
and that one account giving access to all the applications.
3:34
But there are also other scenarios where like for
3:37
example, I was working with the client today and they have all
3:42
of their network configurations for all of their locations
3:46
around the world in like an online application where you can
3:53
go and kind of monitor all the equipment and change
3:56
configurations. And if one account were to get
3:59
compromised, game over, game over, you can like just change
4:05
all the configurations you wanted.
4:07
And so I mean, constantly have to kind of go back and forth on,
4:13
OK, well, is that the right way to go?
4:15
Is that just putting too much risk, too many eggs in one
4:18
basket? And I guess that I guess I'm
4:21
coming down on this whole thing is, is not like the final
4:24
answer, right? I'm not giving, you know, this
4:27
is what everyone should do, But I think you have to keep
4:30
reevaluating and questioning things that you may just accept.
4:34
It's kind of like, well, everybody just accepts that one
4:37
username and password per user is better than 400.
4:43
OK, but is that, is it a problem to question yourself and make
4:47
sure that you can truly articulate why it's better?
4:50
I think that's key because that same question might come from
4:54
somebody who's an executive in your organization who says, OK,
4:58
well, what if that account gets hijacked?
5:01
Then what happens? Better be able ready to be at
5:05
the ready to answer that question and answer why it's
5:08
better to do it that way than the alternative way.
5:12
Thoughts. Consulting answer depends.
5:17
I mean yes, generally speaking right?
5:19
One account is easier to manage, but I think it should be a risk
5:22
based approach. I don't think you do one account
5:24
if it's only a password. I think we've all learned
5:27
hopefully by now that password alone is not good enough.
5:30
There should be appropriate risk based controls on that single
5:34
sign on account, MFA, conditional rules, adaptive, you
5:38
know, all kinds of stuff that can be done to really secure
5:43
that one account. If that's the strategy you're
5:44
going to follow. And a lot of companies do and
5:46
they do a great job with it. So you know, they they're
5:49
managing based on the risk. Do they put all of their network
5:53
infrastructure on the same account?
5:54
Probably not. They probably separate it out
5:56
into a different system, maybe different accounts, you know,
5:59
different Mfas, even different different MFA methods.
6:03
So I think there's options out there and you have to weigh the
6:09
risk versus the reward, the usability versus, you know, the
6:12
potential for red tape that might get involved and people
6:15
finding ways around it. So yeah, I'll stick with
6:17
depends. That's my that's my answer.
6:21
So yeah, depends a good answer because you know, I, I do think
6:24
that the single sign on that large, that was probably solved
6:29
a long time ago. I kind of went through like how
6:32
I, my mind evolved to answer that question.
6:36
But then take a scenario like a password vault.
6:39
What if you are, should you integrate your password vault to
6:42
your IDP? Now what if the account gets
6:45
compromised or somebody gets into the IDP and does like a
6:49
lateral movement and then is able to log into your password
6:52
vault now has hundreds of service account passwords.
6:56
That's a real sticky situation. So I think that there's there's
7:01
one of those places where you really need to ask yourself that
7:03
question. Well, if you've architected your
7:05
vault in a way where everything is literally in one spot and
7:08
requires only one set of credentials and maybe one
7:10
permission group to get to it, yeah, maybe.
7:12
That's probably not the best way to architect it.
7:14
There are ways to, you know, create blast doors in between
7:18
things. So if you think about it like a
7:20
submarine, you know, if one compartment gets breached, the
7:24
whole thing doesn't go down. Hopefully they seal the doors
7:28
and yes, there's going to be damage and things are, you know,
7:30
bad things are going to happen in that one area.
7:32
But the whole idea is to contain that, you know, that that issue.
7:37
And so I think if you have enough doors to close on your IM
7:40
submarine, you know, I think you've got a better shot.
7:43
I think that's what most organizations try to do, right,
7:45
is you want to limit sort of the, the breach impact, the
7:49
scope of what could happen and, and things like that.
7:51
I mean, that's why a lot of organizations will separate like
7:54
PCI networks from their regular networks or their operational
7:57
technology stuff away from other stuff, because they want to have
8:00
a very, you know, very clear line as to who can get access to
8:05
what and what it takes to get access to those things.
8:08
That's that's putting a blast door in between things.
8:11
Yeah, that's, that's a really good analogy.
8:14
The I am submarine, You better go, you better go, you know, put
8:20
the the copyright on that one and.
8:24
That'll be our next podcast, the I Am Submarine.
8:27
I don't know if there's any like positive though puns on that
8:29
one. I feel like submarines just go
8:30
down. We want to be uplifting here.
8:33
I mean, it's our five year anniversary, man.
8:35
We've been doing this show for five years.
8:38
And this is, let's see, what's this, episode 292?
8:42
I mean, that's absolutely nuts. Yeah, it's, you know, when we
8:47
first set out on it, I never could have imagined five years
8:50
later we'd still be doing it. But here we are.
8:53
And it's pretty much every Monday we drop an episode we
8:57
have taken off like Christmas and New Year's because who's
9:00
going to listen them anyway? But then there have been weeks
9:04
where we dump five to seven episodes in a week to two weeks.
9:09
So I think we've more than made-up for it.
9:13
In fact, we have another Pat Yourself on the Back episode
9:16
coming up where it'll be episode 300 here in the near future.
9:20
Yeah, other milestone. It would be cool if they kind of
9:22
tied together, but no, let's spread out the good vibes across
9:25
a couple episodes here. But yeah, I mean, it's crazy how
9:28
much this thing has grown and, you know, the community has has,
9:31
you know, caught on to it. And we thank everybody who
9:34
listens and subscribes and shares and stuff like that.
9:37
I get, I tell you, I get such a thrill when I, you know, talk to
9:40
people and it's like, oh, I've heard your podcast and you know,
9:42
it's like, oh, OK, that's cool, 'cause I feel like podcast is
9:45
sometimes a little like a dirty word, like everybody has them.
9:48
But we've, we've been consistent.
9:50
We've tried to put out content that is timely, at least the
9:53
time, right? It's a time capsule.
9:54
This is what we know right now. But try to be helpful and kind
9:58
of get out there and show some of the personality I think that
10:01
I am has, you know, not everybody is a, is a robot.
10:04
And we like to have fun with it. I, I especially like to have fun
10:06
with it. So any time that I can, you
10:08
know, sneak in a movie reference or make a joke, you know, I'm
10:10
all about that. Yeah, right.
10:12
I think we call it edutainment, right?
10:14
It's a mixture of education and entertainment.
10:17
Usually the guests provide the education and you and I provide
10:20
the entertainment. Try to It's subjective.
10:23
Obviously not. We don't entertain everybody and
10:25
that's fine. Not everyone gets my sense of
10:27
humor, and I'm OK with that. Yeah, absolutely.
10:31
Yeah. So I was wondering, I was
10:32
actually going to ask you high points and low points are some
10:38
high highlight memories or low light memories from the podcast?
10:41
What do you have? Let's see highlights.
10:44
I think I, I don't know if I can point to any specific like
10:49
thing. It's, it's just general idea of
10:51
all the people that we've been able to meet along the way.
10:55
You know, really the who's who of the identity industry has
10:58
been on this show and we've had the opportunity to talk with
11:00
them for 30 to 60 minutes and maybe a little bit more and
11:05
really pick the brain of the smartest people in the industry.
11:07
And I hope that that continues, right.
11:09
And I hope we talk to new people and, you know, people that that
11:13
are coming up in this space as well.
11:15
And I really do enjoy that. I, I especially like when I talk
11:19
with people who are doing it in the real world, you know, real
11:23
identity practitioners. Tell me about your IM program.
11:25
How's it working? What's not working?
11:26
Share your story with us and with the rest of our audience so
11:30
that we can learn from that. I think there's a real benefit
11:33
to learning what works and sometimes, just as importantly,
11:37
what doesn't work so we don't repeat the same mistakes.
11:40
I think we're very fortunate that identity is not really
11:43
secret sauce. You know, security, most
11:46
organizations are not competitive when it comes to
11:50
this type of security. Everybody's doing it.
11:52
We're kind of all in this together.
11:54
It's not a trade secret or anything like that.
11:56
And obviously, if you're a product company in the space,
11:58
sure, there are methods and ways that things get done that, you
12:02
know, probably are a little more sensitive in in that area.
12:04
But for the most part, people who are doing identity, we're
12:07
all in it together. And I think for me, that's been
12:09
a real highlight. It's just meeting people.
12:11
And then, you know, just the fans, the people who listen and
12:13
I, I, it's such a weird word for me to say fans of the show, but
12:17
people who follow and listen and walk up and, you know, say hello
12:20
and introduce themselves. I think it's awesome and you
12:23
know, if I feel like every time I go to a conference, there's
12:24
just more and more people coming up, which is which is always
12:27
very, you know, very well appreciated by me.
12:30
What about you? What are some of your
12:31
highlights? Yeah, I'm actually glad to have
12:33
a highlight that's different than what you just said, even
12:35
though I totally agree with. Everything so you don't care
12:37
about the listeners is what I'm hearing.
12:38
Oh, no, no, no, I totally agree with everything you just said.
12:41
The listeners, the guests that we've had, the the people are
12:45
the highlight for sure. But some of the greatest
12:49
memories for me have been being on stage with you and being at
12:53
conferences with you and doing this podcast that we love doing
12:59
the industry events that we used to just go and attend because
13:03
they're fantastic learning opportunities.
13:06
And now we're going and we're part of the event.
13:09
I think, you know, authenticate last year where we're on stage
13:14
and we did the, you know, we're part of the keynote.
13:17
Like I'll just never forget that.
13:19
And also being on the Gartner stage with Henrique and Becky,
13:24
I'll never forget that. I mean, those were highlights
13:27
for me. And you being so sick and it's
13:31
and you're very white shoes. You know we can't forget the
13:33
white shoes at Gartner. Absolutely ran I I took it as an
13:37
opportunity to go out and buy some some new dress clothes and
13:40
be a little extra fancy as far as low light.
13:44
I I really had to dig for one, but the one that always jumps
13:47
out at me is not always our guest.
13:50
Sometimes it's me on the rare occasions you and you're at a
13:53
hotel, it's the bad network connections.
13:57
Man. I think that you do such a good
14:01
job with the editing of this podcast that people don't even
14:04
realize most of the time. But we've done some video
14:07
podcasts where we had to just turn them into audio only
14:11
because the then bandwidth was so poor.
14:15
Now the recording platform that we're on is nothing like the way
14:19
we did things five years ago, where it was like, basically
14:22
we're just recording a Teams meeting.
14:24
So for anybody who's thinking about doing a podcast, it's not
14:27
a good place to start. Oh no I disagree, I think it is
14:30
a good place to start. It's a low barrier entry.
14:32
You probably have a license through your work or it's cheap.
14:36
Look, it was fine for what we started.
14:38
We graduated and decided, hey, you know what?
14:40
Really, you know, I think it's well documented that I am
14:43
extremely focused, let's call it particular, yes, on the quality
14:49
of the show, right? Both especially audio since that
14:52
we're doing and now that we're getting into video on YouTube,
14:55
you know, having that sort of production to it, not
14:58
necessarily overly produced, but just good quality audio and
15:02
video. So it's not distracted with the
15:04
conversation we started on Zoom. A lot of people do still do
15:07
things on Zoom and there are things that Zoom can do that it
15:10
couldn't do even four or five years ago.
15:12
So like original audio sound is like a higher fidelity now is as
15:17
good as a paid platform like this, which is a little more
15:19
expensive. No, but I think it's a good way
15:21
to start. If you're interested, give it a
15:23
shot. I mean, that's how we did it.
15:24
I mean, it's, you know, if you listen to episode one and you
15:27
listen to this episode, yes, there's clearly a difference.
15:30
As long as the as long as the recording doesn't distract from
15:33
what you're trying to say, have fun.
15:36
Go at it, give it a shot. What do you have for low lights?
15:40
It's I mean, it's definitely the the technical issues that come
15:43
up, especially when like we have things kind of set up and we're
15:47
ready to rock and you've planned and planned and planned.
15:50
It's like, all right, You've thought of every possible
15:52
scenario, the little finger school of thought, fight every
15:55
battle everywhere, never be surprised.
15:57
And then just something comes out of the blue.
15:59
Like I remember one time I was like, all right, we got
16:02
everything set up and then my power went out in the middle of
16:04
a, of a, of a recording. Is that OK?
16:06
Well, I guess guess what I'm going, I bought on Amazon the
16:09
next day was a UPS power supply, which I still have here sitting
16:12
off to my side that powers everything that I'm recording
16:15
through to prevent that. You know, I mean, stuff like
16:18
that where it's just kind of like, you know, why did that
16:22
happen? And that's real life, I think is
16:24
you try to plan it for as best as you can.
16:25
And then if something goes wrong, you analyze and say, OK,
16:28
well let's what can we do to solve for that in the future?
16:32
Yeah. And I think, you know we started
16:34
the sponsor spotlight this year. I was in year five, we started
16:39
that, but I think after a lot. Of demand A.
16:42
Lot of demand, but there's also a lot of expense in getting to
16:45
this point like you bought that UPS that's one of many, many
16:49
expenses and on top of all the I didn't even.
16:51
Include that my totals so maybe I.
16:53
Should you didn't even include that?
16:54
All right. So yeah, your, your, your total
16:57
was definitely 5 figures, right and then some.
17:02
So, yeah, but I guess the big question is, do you think we'll
17:07
be doing this five years from now and they have a 10 year
17:12
episode. I hope so.
17:13
I mean, I like doing it. I think, you know, you and I
17:15
will keep doing it as long as we're having fun doing it, you
17:19
know, will people stay engaged? I hope so.
17:20
I think as long as we continue to evolve and stay current with
17:24
the times, hopefully people do. And yeah, at some point we might
17:29
get too tired, too old or, you know, whatever it might be to
17:32
kind of do it more consistently. But I'm going to ride the wave
17:35
as long as I possibly can. And I and I and I, we'll just
17:40
look to the future and we'll go as far as we can.
17:43
I'm enjoying it. I'd like to be here five years
17:45
down the road, 10 years down the road for the 15 year episode,
17:50
but let's go for 10 first. Actually, let's just go for five
17:54
years plus one. Let's go one episode at a time.
17:57
Exactly. You know, it's just like the old
17:58
sports attitude, right? We're, we're all just, we're all
18:00
day-to-day. Keep it, keep it going.
18:03
Yeah, exactly. You and I were talking kind of
18:06
like, well, what are we going to do for five years?
18:08
And you actually had the brilliant idea of why don't we
18:12
go back and start with episode one and kind of redo it.
18:17
This is something that you and I have talked about and it's kind
18:18
of like, oh, you know, should we re record it or like remaster it
18:23
or somehow or kind of improve the auto quality?
18:25
It's like I've kind of pushed it off for now.
18:27
It's like, no, it kind of shows the journey of the show, but I
18:30
think it's time maybe to refresh how we, how you and I in our
18:35
real lives, you know, develop IM strategies.
18:38
What's our framework, what's our process?
18:40
So today's episode is really focused on you and I, you know,
18:44
what we do all the time for our actual, you know, real life jobs
18:48
and how do we develop an IM strategy?
18:51
That's really what we're going to talk about.
18:52
So you can listen to episode one for what we thought back in July
18:56
2nd, 2019. So almost, let's see, five years
19:00
ago, well, it'll be about 5 years by the time this thing
19:03
that by the time this publishes and see what's changed because
19:07
just like anything else, right, things will evolve.
19:09
You have to think about what has changed in your organization,
19:13
what's going to change next year, etcetera.
19:14
So why don't we start with that and then we're going to kind of
19:17
do this in a four hour. I'm going to ask you a bunch of
19:19
questions. You're going to give me your two
19:20
cents, I'll pile on my two cents and we'll just kind of keep
19:23
things moving. So I guess the first question is
19:26
why do we need an IM strategy? Because there's a lot of people
19:30
are like, oh, isn't it just a piece of paper?
19:31
It just says here's what we're going to do and that's it.
19:34
Why do we need this? Well, I think, I think the big
19:37
purpose of it's not just strategy, it's the strategy on a
19:40
road map. And it's kind of like if you
19:43
decided to drive back to Chicago, you you might be able
19:48
to do it by memory. If you just jump in your car and
19:50
start driving, intuition may get you there, but probably it's not
19:56
going to get you there as quick as if you chart a course that
19:59
takes you in the most efficient way from where you are today to
20:03
where you're going. In fact, I picked Chicago as an
20:07
example because you know, you want to go to Chicago, you know
20:10
you want to go back to maybe where you lived in Chicago, but
20:13
sometimes you don't even know where you're going.
20:16
You don't know where you want to go.
20:17
Sometimes you pick a place on the map and say that's where we
20:20
want to go, and then you map the course.
20:23
And so I think having a strategy and a road map is the most
20:26
efficient way to get from. Where you are today to where you
20:29
want to go. Yeah, I mean, what's your
20:33
destination? It's like you said, you know,
20:34
when I get in the car, if I'm going somewhere that I don't
20:37
know how to get there, what's the first thing we all do?
20:40
I'll get their GPS, right? Google Maps, Apple Maps,
20:43
whatever it may be. Very.
20:44
I don't think any of us really rely on the old.
20:47
If you're an old timer like we, you know, AAA and they're
20:50
triptychs that they used to have where you'd actually go to like
20:52
a AAA store and like get this paper weird, right?
20:56
They had like step by step, turn by turn directions on how to get
20:59
there. I remember using that in a drive
21:01
from, you know, Chicago area to Florida for years.
21:05
You know, I would drive down for the summer and stuff like that
21:07
and spend there, spend time there.
21:09
Now you've got a road map built into your pocket.
21:12
You just need to tell the destination where you want to go
21:14
and it creates that road map for you based on a whole bunch of
21:18
information that it's already been collected by whatever
21:21
mapping service you're using. So I think I totally agree with
21:24
that. You asked me at one point, do I
21:26
think AI will replace us? And I'm going to use the analogy
21:30
now, which is if you just said, I want to go back to my old
21:34
address in Chicago and type that address into Apple Maps, it
21:39
might say, well, if I take you this way, it's going to save you
21:42
2 minutes. So we're going to jump off the
21:44
highway and drive through this like, crowded area to get you
21:48
there to save 2 minutes. Experience tells you even if it
21:52
saves me two minutes, it's not worth the headache, right?
21:56
So I don't think AI is going to replace this because I do think
22:01
AI won't really have the experience of having, you know,
22:05
gone through this. That's not to say that people
22:08
can't develop their own road map.
22:09
I just don't think we'll be replaced by computers overnight.
22:13
Not overnight, but I, I, I do think stuff like this will
22:17
become easier to replicate, especially if you're looking to
22:21
take like a standard space approach.
22:23
Oh, we follow NIST to the, you know, to the letter and there
22:27
are no deviations from it. Great, fantastic.
22:30
I sure hope the rest of your organization is on board with
22:32
that. And there are 0 variables that
22:34
you have to worry about. Good luck.
22:36
So I think the experience part will definitely be there.
22:38
But you know, I, I think it's just anything else.
22:41
AI is going to iterate and evolve the way we do things, and
22:46
people will just need to adapt us, include it as we go through
22:48
this process. So next we've got why we do
22:53
this. Who is typically involved when
22:56
we're setting up an IM strategy and a road map?
22:59
Yeah. I mean that's a great question.
23:01
I think the most important people to be involved probably
23:04
are the people who are doing IM on the day-to-day basis, the
23:08
manager as well as the team who are hands on doing the IM
23:12
because they know what's working well, what's not working well.
23:15
They have ideas for wow. If we could just do this thing,
23:20
it would make life so much better.
23:22
And the contributions of those ideas is really what is going to
23:26
tell you. You know, here's what your
23:29
strategy needs to be. But I also think you have to
23:31
include other groups, especially groups like human resources,
23:35
which are, you know, the folks who should be in charge of who
23:39
works here, the identities. Now that's an assumption that
23:42
you're talking about, you know, workforce identity.
23:45
If you're talking about customer identity, it's a different group
23:48
of stakeholders. But I, I guess what's most
23:51
important is like people who are either going to impact your IM
23:54
strategy or be impacted by your IM strategy, you need to be
23:58
involved at the appropriate level, right?
24:01
You're not asking somebody to come from human resources or
24:04
your chief marketing officer to come and tell you what
24:07
technology to employ or how to set up your disaster recovery
24:10
plan. You need to involve them
24:12
appropriately, but you know they should be involved because
24:17
here's my perspective is that if you're not invited to a seat to
24:22
the table to contribute to the problem, you won't be bought
24:25
into the solution. Yeah, absolutely.
24:28
I think this is an opportunity to bring the organization
24:31
together and really work together to solve problems.
24:35
You know, I think the past is the past.
24:36
So I think a lot of things that you and I like to do is we don't
24:38
like to do audits. That's not the way we like to
24:41
approach it. We like to approach it as a
24:43
conversation, Right? Sure.
24:44
Mistakes remain the past. How do we get better?
24:46
How do we get smarter? That's fine, right?
24:48
Those things are in the past. Let's figure it out.
24:50
But yeah, having those conversations and sometimes
24:52
those conversations are political in nature.
24:54
You know, maybe it is a greasy wheel within, you know, within
24:57
the organization that you're a squeaky wheel, I should say, you
25:00
know, and the conversation might be the grease that kind of helps
25:02
smooth things out. I think having enough
25:06
representation is, is really the art and the balance because I
25:12
see a lot of organizations struggle with too many people
25:15
involved and it becomes, well, we want to get down to this
25:19
level of detail on all 1300 of our applications.
25:23
And that is not realistic, not for a strategic, you know,
25:28
initiative. This is strategic, it is not
25:30
tactical, which means you're trying to look at the big
25:33
picture. You're trying to look at how
25:35
dots connect and you're playing, you know, hopefully 4D chess,
25:39
while the rest is the organization's doing 3D chess,
25:42
right, or things like that. So I think there's that balance
25:44
in having enough representation to get a sense of what's going
25:48
on and where you're trying to go, what's your destination.
25:51
Yeah. And the point that you brought
25:53
up that I think was right on which was like the level of
25:57
depth of the strategy. So you mentioned the 1500
26:00
applications and whether or not all 1500 could be integrated and
26:05
how they should be integrated. And that's not a strategy.
26:09
It's like a project plan or a detailed integration document.
26:14
A strategy has to be at the right level.
26:16
So if you're planning a trip from New York to San Francisco,
26:20
you don't need to map out every rest stop that you're going to
26:24
hit along the way. And we're going to stop at 9:00
26:26
AM to go to the bathroom here, and then we'll stop at noon over
26:30
here and have lunch. I mean, if you're driving.
26:32
Electric you need to find out your stops.
26:35
If you're driving, lecture. You do.
26:36
You can tell you that for sure. Yeah.
26:38
So I mean, the strategy's got to be at the right level and that's
26:43
kind of more of an art than the science.
26:45
But you're building a strategy, not a detailed project plan.
26:50
Detailed project plan is kind of the next step.
26:53
And even that I would say you don't want to get into the
26:55
detailed project plan for the next two to three years, like
27:00
plan out your projects at that detailed level prior to those
27:04
projects happening. How long does it typically take
27:08
to create a strategy and a road map?
27:11
Yeah, I mean, this is a good question as well.
27:13
I'd say, you know, based on my experience and you and I do this
27:18
together all the time. So it's like anywhere from like
27:20
6 to 10 weeks. Obviously, we can do it down to
27:24
31 in less time. It can take longer if you throw
27:27
in doing some detailed requirements analysis and
27:30
documentation as well. So, but that's kind of our sweet
27:34
spot. Again, we're kind of starting
27:35
with all of our templates in place with a process that has
27:39
been tried and true. Like I think the framework of
27:42
the process, somebody goes back in this since five years,
27:45
they're not going to find like these guys have completely
27:49
reinvented how they do strategy and road map.
27:52
No, it's still kind of follows that same structure.
27:55
And so we have templates that we use and we don't kind of have to
28:00
ponder, like when we come out of the assessment phase, we want to
28:04
make sure that we're making things memorable.
28:07
We're talking about like three major headlines or four major
28:11
headlines. Like if that's not there then we
28:14
kind of skip the step. Yeah, I mean, I think it's the
28:20
timeline. The innovations are really
28:23
small. They're micro.
28:24
They're like the little stuff that happens behind the scenes.
28:26
The framework is the framework as they work through it.
28:28
You mentioned the, you mentioned the step of assess and that's
28:31
kind of the first step as we go through our journey here as part
28:34
of the framework. What is assessing and why do we
28:37
do this? Yeah, I think the assessment
28:40
kind of leads assessment is the foundation for the strategy in
28:45
the road map. So you start with the assessment
28:47
to understand where are things at today, what's working well,
28:50
what's not working well. And then it's also kind of a, a
28:54
gap fit to some extent, to use kind of a industry term, the
28:58
idea that you're here, you're trying to get there, what is the
29:03
difference between that? And that's what ought to come
29:06
out of the assessment. Like how we get to the
29:09
assessment. I think that's, you know, first
29:13
starts with the questionnaire, right?
29:14
We want to try to gather information in a written form
29:18
because it's a very efficient way to do it.
29:21
And part of this process when we start working with an
29:25
organization is education. Now, if you're AI am program
29:28
manager and you're kind of taking this on for yourself, you
29:31
might not start with a questionnaire or maybe you do
29:34
use questionnaires to start to engage some of your stakeholders
29:38
and it's just an efficient way to get information.
29:41
But typically, we then shift to workshops.
29:44
So we get people in, we talk about a specific topic.
29:47
It might be authentication. How's the authentication set
29:51
system where systems set up today?
29:54
Is there multi factor authentication?
29:56
Are you doing kind of conditional authentication?
29:59
Are you doing Fido authentication, etcetera,
30:02
etcetera. And in those workshops, it's
30:06
less about telling people the way things should be and
30:10
listening to the way things are and also getting people's ideas
30:13
for how things could be better. You know, if maybe you do have
30:17
multi factor authentication today, but people are finding it
30:21
very difficult to use because it's asking them to re
30:24
authenticate all the time. It's like different things kind
30:27
of leak out in some of those meetings and they can be
30:29
impactful for the strategy. I think you know one, most
30:33
organizations when they bring in an outside consulting firm or
30:37
people like me and you, they want to know how they stack up
30:39
against their peers. They want to know overall, like,
30:42
you know, within the industry, where do we stand?
30:45
Like you guys work with, you've worked with hundreds of
30:48
companies doing this. So you got an idea of like where
30:51
we sit in that hierarchy, are we doing very good?
30:55
Are we doing very poorly? It's really broken down by
30:57
capability area. But then I think more
31:01
importantly is you're given all the factors that that come up
31:06
with, what are their requirements?
31:08
So they may have a regulatory compliance need, they might just
31:13
have a need from a user experience standpoint, et
31:17
cetera. They might have some very
31:19
serious security issues, maybe some that have shown up in
31:22
audits or resulted in breaches or maybe they're just very
31:26
concerned about that happening. And all that should lead to, you
31:31
know, here's the capability maturity score.
31:34
We use a framework called CMMI as like the model upon which we
31:38
base that. Yeah, pretty heavily customized
31:42
specific to identity, except you, you and I have been doing
31:45
this for together for almost nine years, maybe nine years.
31:47
I don't remember long time. And we've it's that that cadence
31:52
and that rhythm, right. And I think there's a lot of
31:55
ways to collect information. You mentioned questionnaires,
31:57
you mentioned, you know, meetings, discussions.
31:59
And so it is it's discussions, it's not presenting, it's not
32:04
instructing or teaching. It's listening.
32:07
It's a discussion. It's a two way conversation.
32:10
Tell me about this. Why do you do it that way?
32:13
How does that work? What's working, what's not
32:15
working right? Things like that.
32:17
I think. And that's, and you know, it's,
32:19
it's that again, this is not an audit, right?
32:22
We, we, we harp on that when we go through this process a lot
32:24
with, you know, with our, our clients.
32:26
It's like, oh, OK, this is a safe place, right?
32:28
Nobody here is to get in trouble, right?
32:30
This isn't going to be end up on an audit report finding and then
32:32
you're going to have to write a management response and then
32:34
it's going to go up a place and I've written those and they suck
32:36
and I don't want to do that. So we, we definitely take it
32:39
from a conversation standpoint. So now that we've kind of
32:44
assessed how things are going, really gotten a sense of like,
32:47
OK, kind of get the, the way of the land here.
32:50
The next step is we typically start to develop
32:52
recommendations. How do we come up with those
32:56
recommendations as we're moving through?
32:59
Just finding out we've just kind of gone out of the phase of, OK,
33:02
starting to get an idea of how things are working here.
33:05
Now let's come up with some ideas on what can we do to
33:07
improve it. How do we how do we work through
33:08
that process? I think the biggest key is at a
33:12
high level, the the recommendations need to tie off
33:14
to the assessment observations. So you know, you find a bunch of
33:19
things that stand out that the organization.
33:23
Usually it's not just that, you know, we used the consultants
33:26
came in and said, oh, you're not doing a good job in these areas.
33:29
Usually they're like, we're not doing a good job in these areas.
33:32
So we're going to point you to the areas where we've got some
33:36
dysfunction or we have some growing to do.
33:39
So those things usually come out loud and clear, but the
33:41
recommendations ought to tie off to the observations.
33:44
And then there's usually some key themes.
33:46
And I think what's important about identifying those key
33:49
themes, So let's say one of the key themes is that the
33:53
governance and organization, there's a lot of development
33:58
that needs to take place. Maybe the the policies need need
34:02
to be matured. Maybe the organization is like
34:05
way too small for the scope that they're managing.
34:09
Maybe there's, you know, some centralized areas that doesn't
34:15
fit the entire scope of all the identity that's taking place.
34:18
And so there's other teams that are working on different areas,
34:21
etcetera, etcetera. So a major theme might be that
34:26
there needs to be more formalization and inclusion when
34:29
it comes to the IAM program, right?
34:32
So however we come up with that, that that's going to be one of
34:36
the major themes. So I, I like to be at the level
34:39
of like three or four major themes because ultimately those
34:45
are going to go into how you communicate your strategy.
34:48
These are the major four things or major three things.
34:51
I'd like 3 especially. Here's the major three things
34:54
that we need to do. There's science behind three.
34:57
Like that's the magic number for people to remember.
35:00
I agree. I agree.
35:02
I mean, that's, you know, I've always felt three was the best
35:05
number. And then you start to subjugate
35:08
those recommendations under that.
35:11
And then the idea, I think the best idea is that you start to
35:15
group those recommendations into actual projects.
35:18
So this is when you're going to be able to fix those things and
35:23
it's in logical grouping. So they could be people process
35:26
technology. A lot of times with IM, there's,
35:29
you know, a heavy emphasis on, you know, you need to improve
35:33
the process and implement the technology and that's going to
35:36
happen in this project. And that should solve these
35:38
different things. A lot of times the governance
35:40
and organization has nothing to do with processor technology.
35:44
It's just people. It, it might be a process, but
35:47
it's less about technology. It's having the right people in
35:51
the right place to people knowing what they're responsible
35:54
for and what other people are responsible for, and then having
35:58
good process policy, etcetera. You're kind of getting into the
36:02
road map section, but I want to ask you a question.
36:04
Can you have too many recommendations?
36:08
I think so. I think it's, I think it's
36:10
possible. I mean, you know, if you start
36:13
getting into a recommendation like, you know, you should
36:17
change this configuration of this type of user to this, I
36:22
mean, you're going to end up with hundreds of recommendations
36:26
and then it's going to like freeze people.
36:29
It's not that this thing shouldn't be recommendations,
36:31
it's just they shouldn't headline.
36:33
I think that those things you don't want to lose track of
36:36
them, but generally in terms of the strategy, they shouldn't be
36:41
headlining. Maybe they should be part of
36:43
the, you know, like a summary recommendation.
36:47
Hey, some configurations need to be changed and then you start
36:50
listing off the configurations and then you might find a
36:54
project where it's like, OK, we're going to take on this
36:57
configurations or maybe they get split.
36:59
You don't want to lose track of that detail if it comes up, but
37:03
you don't want to headline with like, hey, our IM strategy is we
37:07
got to change all these different configurations and I'm
37:10
going to list them off to you. No one's going to care.
37:13
Yeah, I think this goes back to the word strategy.
37:16
This is not a tactical project. This is something where we're
37:19
talking about the broader picture.
37:21
If you're getting down into, well, we need to go into the
37:23
Azure Control Terminal or Control Panel and go into this
37:26
menu and click this and that, I think you've lost the plot.
37:30
Let's go. Let's go back and think about it
37:32
from a strategy perspective again, it's important.
37:34
Yes, you need to do that, but let's state the strategy has to
37:37
be digestible because you need to understand it for your
37:42
organization because you're going to have to communicate to
37:44
others and nobody is going to care, you know, about the
37:48
specific menu in whatever platform you're using and the
37:51
configuration variable that you change.
37:53
Nobody cares. It's about the outcome.
37:55
What is it that did? Why is why is that better?
37:58
I think it's where auto produces struggle.
37:59
Is that that communication aspect of it?
38:03
You talked about grouping things together, right?
38:06
Different projects. That kind of sounds like a road
38:09
map to me, and maybe it's the very beginnings of it.
38:12
What goes on a road map? What's the process to create
38:15
one? Yeah.
38:16
I think if here's the way I always talk about it is like if
38:19
you get the assessment right, in other words, you've identified
38:22
the areas that need fixed and then the recommendation is
38:26
here's how you fix all those things slash.
38:30
So your strategy is going to be do all those fixes.
38:33
The road map says how you're going to do all those fixes
38:37
more. Importantly, not how maybe, but
38:39
what order they're being done. In Yeah, that's, that's right.
38:43
So, you know, are you going to do a series of projects over
38:46
time? And I always say the road map is
38:49
not only the Gantt chart, it's also the resource plan.
38:52
It's also the budget, but it is also the Gantt chart.
38:56
It is also because that's the thing that people kind of
38:59
gravitate to. When are you going to fix these
39:02
things? When am I going to see this
39:04
happen? Well, we're going to do these
39:06
projects. We're going to implement an IGA
39:08
system. We're going to select the
39:10
system, we have the requirements, we're going to
39:14
implement the system phase one, and then we're going to do some
39:17
additional phases. And all these recommendations
39:20
are going to happen in these various projects.
39:24
Now the question becomes, OK, how much money do you need and
39:28
who are the resources that you need?
39:30
How's it going to impact the rest of the organization, things
39:33
like that. So now you've got the big
39:34
picture of when are these things going to happen, What's it going
39:38
to cost? How many resources do you need
39:43
not only to implement but also to operate?
39:46
And how's it going to impact other people in the
39:49
organization? Yeah, there's a lot that goes
39:52
into it. I think what questions that I,
39:55
you know, typically think about as well.
39:57
Can I just download a road map? I mean, it's the it's, it's
40:01
identity. It's all the same thing, right?
40:02
And I think this is where it really needs to be discussed.
40:07
What can you tolerate from an organization standpoint?
40:10
How much change can you tolerate?
40:11
How many things can you work on at once?
40:13
Can you work on more than one, more than one thing and at once,
40:16
right, things like that. Because what you don't want to
40:18
end up with is. Like this Boyer plate wall, you
40:23
know, I downloaded this from just pick any source, right?
40:26
The Internet and this is what we're going to follow.
40:30
Yeah, I I almost guarantee that for 99.9% of the organizations
40:35
out there, they're good ideas. What's missing is the
40:38
prioritization. You know what's best for your
40:40
organization. You know how your processes work
40:43
or don't work, you know how it takes to get how long it takes
40:47
to get through a legal review. You know if you're working
40:49
through a contract or how long change management processes take
40:52
place. Or you know, what is your
40:54
organization's preferred style of communication when it comes
40:56
to end user training, right? I think that's where you as the
41:00
expert within your organization, and maybe it's not you, maybe
41:03
it's other people in your organization really need to come
41:05
together and say what's realistic.
41:07
Because I think there's a difference between a standard
41:09
road map that you just download and a no, this is the road map
41:13
for XYZ organization because it has our DNA, you know, built
41:18
into it. It's how we operate.
41:20
It's how we do things. And it's realistic for us as an
41:24
organization, which is the most important thing coming out of a
41:26
out of a road map in my perspective, is it has to be
41:29
realistic. Don't just say, yeah, well, see
41:32
this three boxes, right? This one box right here.
41:33
Well, that's IGA and that's a three month thing.
41:36
OK, Good luck. You know, most IGA, you know,
41:39
implementations take way longer than that.
41:41
Maybe that's phase one, right? Or maybe standing up part of an
41:45
IGA platform. And I'm sure there's other
41:47
things like that that are out there.
41:48
You really have to think about, OK, what's realistically how
41:51
long it's going to take to do this task or set of tasks?
41:55
And then try to align that with what do you have from a resource
41:57
standpoint? What are your assumptions?
41:59
You know, do you have the people do it?
42:01
Do you need to go out and get people to help you do it right?
42:03
Those sorts of things. Yeah, I think you just did a
42:05
really good job of articulating something that I find somewhat
42:10
hard to explain, which is why can't you just, you know, why
42:14
can't you just copy a road map off the Internet?
42:17
And there's just so many reasons why I think you just said it at
42:22
a high level because I think we often say, OK, you're not a
42:27
snowflake, right? You're not like completely
42:30
individual, but every organization is individual
42:33
enough and does have its own factors enough that you can't
42:38
just kind of take something from another organization, copy it
42:42
over. What doesn't belong on a road
42:46
map? Well, I think that, you know,
42:50
one of the themes of since we've been talking here is like too
42:54
much detail. I don't think the road map
42:57
should be a detailed project plan.
43:00
I think that is what some folks tend to expect.
43:03
But this is your strategy. What you're trying to
43:05
communicate is big picture. What are we going to address for
43:10
the next and the road maps, usually two to three years.
43:13
Here's what we're going to address over the next two to
43:15
three years. You try to tell the whole story
43:18
in the Gantt chart, you're missing, you're going to miss
43:21
the big picture. And so that's what I think
43:24
should not go on the road map. I also think things that should
43:27
not go on the road map are a tremendous amount of detail in
43:31
terms of what other teams are doing.
43:34
I think it's good to recognize like, hey, new HR system is
43:37
being implemented and you know, recognize that on your road map,
43:41
especially if that's a dependency.
43:43
So new HR systems going in, in June, we're starting our project
43:48
in April, our expectations, the HR systems going to come online
43:52
that way if you get to that point, it's like, oh, the HR
43:55
team just pushed back their implementation to December,
43:58
right? That's going to impact your
44:00
timeline either going to have to build tech dead to connect back
44:03
to the old HR system where you're going to have to push
44:06
your project out. So I do think projects that have
44:11
a big dependency belong on there.
44:13
And it could just be the fact that it's taking everybody's
44:17
attention. New ERP system is being
44:19
deployed, that's taking everybody's attention.
44:21
It's going to be very hard to implement a whole bunch of
44:24
identity technology, which is at best going to take second
44:28
fiddle. What are your thoughts?
44:31
I, I think you hit around the head, what are some tips for
44:33
prioritizing things? Because I think you mentioned
44:35
one, right? It's like technical dependency
44:37
on something else or maybe other organizational initiatives that
44:41
might take resources away. What are other ways or other
44:45
other things you can think about that might be helpful for people
44:47
as they're looking at their road map and saying, OK, well, how do
44:50
I prioritize this? Yeah.
44:52
I, well, I think one thing that nobody wants to hear that
44:56
everybody intuitively knows is that there aren't going to be
44:59
foundational elements. So your executive team might be
45:03
saying we need RBAC because they heard about RBAC in somewhere
45:08
that the. Identity at the Center podcast.
45:11
They've been listening to the Identity Center podcast, and
45:13
we're sure that RBAC is going to solve all the problems.
45:17
But you don't even have an IGA system in place.
45:22
You, you know, there's a dependency.
45:24
You got to get it in place. You got to start bringing in the
45:27
identities in the accounts and entitlements and start making
45:30
sense of it. Just turn on our back.
45:32
That's just how it works. Just turn on the everybody push
45:34
the our back button. It's.
45:35
Super easy. It's why everybody does it.
45:38
We're trying, yeah. So I mean, so there's
45:42
foundational dependencies. I think another priority that I
45:49
think I alluded to a little bit earlier, which is like if you
45:51
had a a breach or if you've had an audit finding those things
45:56
are going to automatically. I mean this is probably obvious,
45:59
but those things are going to rise to the top and drive your
46:02
priority if. I can tell you first hand if you
46:05
get an audit finding and you're in charge of writing the
46:08
management response and you've got the support to say, OK,
46:11
yeah, we're going to do something about this and involve
46:12
some sort of technology. I don't know how many times, you
46:15
know, I've written something that's like, OK, we're going to
46:17
address this via the implementation of XYZ
46:20
methodology and technology by X date, which puts a lot of
46:25
pressure on your organization to get.
46:28
Something to the next state then, right?
46:29
Yeah, exactly. I.
46:32
Think there's probably some other obvious ones.
46:35
The one that like jumps out of my mind is if you're not using
46:39
multi factor authentication or password list.
46:42
But let's just say you don't even have multi factor
46:44
authentication like that's. Stop listening and go do that
46:48
right now. Come back, we'll be here.
46:50
Go turn on your MFA like right now.
46:52
Don't tell anybody you listen to the podcast until you have it in
46:56
place. No, that's, you know, that's
46:59
obviously got to move right to the top.
47:01
So as you're prioritizing things, I think where you get
47:05
the, you know, the low hanging, I don't think we'll call it low
47:09
hanging free because sometimes it's very difficult to implement
47:12
and the implementation will cause a little bit of heartburn.
47:15
These people don't like change and it inconveniences people,
47:19
And if they don't kind of understand the value of the
47:22
security that it's bringing is just the extra headache.
47:26
Oh yeah, that would. You call it important.
47:28
Hanging fruit, maybe? Important hanging fruit there
47:30
you go but it it's got to be done and then I think you know
47:36
your privilege access you've got to be mindful of that you you
47:39
need to have kind of the basics for privilege access in place.
47:44
You can't, you know, have your most key administrative accounts
47:49
get compromised. So go ahead and put.
47:53
And we talk about like those best practices and leading
47:56
practices, if you will, all the time on this podcast.
47:59
So you have to kind of educate yourself on that.
48:02
And it's not always, everybody's not always in agreement, but you
48:07
don't want to have like you don't want to be overexposed.
48:10
So I'd say those are probably things that are going to jump to
48:13
the top of the priority list. Yeah, take a risk based approach
48:17
to it, right? It's OK.
48:17
Where is our biggest risk? What can we solve quickly?
48:20
What are precursor steps or dependencies that get to solving
48:24
another part of risk or whatever it may be?
48:26
But yeah, I totally agree with you.
48:30
We usually wrap this up with communication, right?
48:34
It doesn't do any good to develop a strategy and a road
48:37
map and have it sit somewhere on someone's cloud drive or if
48:42
they're old school printed out and on their desk.
48:45
You have to communicate this as other people.
48:47
And that's typically where we would have a conversation with
48:51
whoever needs to hear the message, you know, to say, hey,
48:55
here's what our strategy is. Here's the way that we're
48:57
approaching some of the issues that we heard.
49:00
Here's how we're how we've planned to address these.
49:04
Does this make sense? Are we all on the same page?
49:07
You do that first, right? And then you take that message
49:10
to a broader audience. Maybe it's an executive
49:11
audience. What are some of the other
49:14
reasons why we communicate the way we do around the strategy,
49:21
around the road map? Yeah.
49:22
I I mean, I think the biggest thing is on, you know,
49:26
finalizing getting buy in. Ideally, even as consultants, we
49:32
don't want to just create a deliverable that's like, hey,
49:36
here's what we would do if we were you go have fun.
49:40
We want our clients to be able to take that strategy and say
49:44
this is our strategy. So our expectation when we go
49:47
into kind of that executive presentation is we're presenting
49:52
along with the kind of the key contacts that we've had from our
49:56
clients to say, yeah, here's your strategy.
49:59
It's not the Jim and Jeff. Strategy.
50:00
Here's our strategy, your strategy, right?
50:02
Yeah, yeah. Your strategy, our strategy,
50:04
however you want to look at it. And so I think that's an
50:08
important. And a lot of times what you'll
50:11
hear CIOs or Cisos say is OK, what's next?
50:17
What do we have to do? I'm by you.
50:20
It's. A while.
50:21
Show me the math, right? Where'd you come up with this?
50:23
You need to know your subject matter and you need to be able
50:26
to go back to what you've already done in a previous
50:28
phase, right? When you work through the
50:30
assessment and you said, OK, here's what we heard.
50:32
Is that correct? Right.
50:34
Sometimes those conversations come up.
50:36
So I think if you're talking with your CSO or CIO or whoever,
50:39
when you're presenting this strategy, think about those
50:42
sorts of things. Anticipate the questions that
50:45
you think that they might ask and what's important to them.
50:48
Again, this is an area where you might know your organization or
50:51
that person the best. Try to get ahead of it and and
50:54
think about what they would be interested in too.
50:57
Yeah, I'd say also don't make that the last thing you do after
51:01
you have that presentation and the project is done.
51:04
Keep going, keep presenting it. Present it, we're done,
51:07
everybody's in agreement with the strategy and magically
51:11
things will just happen behind the scenes.
51:12
Right. No, yeah, keep keep presenting
51:15
that, keep keep telling the story to whoever will listen and
51:20
keep working on, you know, I think funding is probably the
51:24
the biggest thing that holds folks up from moving forward
51:27
this strategy. So do the things that are
51:30
necessary to get that funding, even if it's maybe not in year
51:35
one. Everything you hope to get, get
51:36
some of it, get the most important things done.
51:39
Adjust your road map. That's the thing with the
51:41
strategy of road map also is that it should be a living
51:45
breathing document, especially the road map part.
51:48
You're going to get some of it done.
51:50
You're not going to get all of it done as it was originally
51:52
forecast out. So re forecast.
51:55
Yeah, you're going to want to revisit it.
51:57
Things will change and that's fine.
51:58
I think most people recognize that.
51:59
In fact, you probably should build into your road map a
52:04
refresh. Maybe it's a year, maybe it's
52:06
every two years or whatever it may be because things will have
52:09
changed, practice will change, the business will change,
52:10
etcetera. People might have changed, you
52:12
know, those sorts of things. So I think it's important to
52:16
make sure you keep communicating as well, just because, you know,
52:19
if there's there's nothing that hurts my hurts my heart, or then
52:23
you and I, you know, work with a great client, having a lot of
52:26
good times and we've developed this rock solid strategy.
52:28
Yeah, makes sense. Everybody's gung ho coming out
52:31
of the, you know, executive meeting that we presented to
52:33
with them. And then it sits, it sits, it
52:37
sits. 3 months go by, 6 months go by.
52:40
All that work that you did, things might have changed and
52:43
now you've kind of got to go back.
52:44
Maybe maybe parts of the strategy are still good.
52:47
Maybe all of it's good. Maybe all of it's thrown out the
52:49
window because you waited too long or the will to move
52:53
forward. Inertia is very powerful and you
52:57
need to find ways to keep momentum.
52:59
So the transition point from talking about it, you've
53:04
developed a strategy, you've talk, talk, talk.
53:06
You've communicated it. Great.
53:08
When do we start actually doing things?
53:09
It's that, it's that in between part, they've got to make sure
53:12
that you keep momentum going, keep pushing forward.
53:16
That's one of the things I I like to do is front end a road
53:21
map with projects that don't cost money spent outside.
53:25
So it's like the day after you present the strategy and get the
53:30
standing ovation or the week after you can start some project
53:34
to, you know, refresh the policies or start a cleanup of
53:38
your Active Directory groups and accounts and start doing things
53:43
with the resources that you have, with the dollars that you
53:47
don't have, you know, in other words, like without spending any
53:50
money because that way you can start to build a build some
53:55
momentum. If you clean up your Active
53:57
Directory, even if you never do anything else, it won't be for
54:01
naughty. Yeah.
54:04
And that's it. That's how we develop a strategy
54:07
and robot. Super easy, right Jim?
54:09
Anybody can do it. It doesn't.
54:10
I don't think it takes. I think it takes experience and
54:13
understanding kind of the methodology goes behind it and
54:15
be able to ask questions. But I think anybody can kind of
54:18
take this approach, sit down with their organization and
54:21
maybe it goes faster, maybe it goes slower depending on, you
54:23
know, the conversations. But I don't think that this
54:27
should be rocket science. I don't think they're a secret
54:29
sauce in developing a strategy. Everybody needs it.
54:33
How you do it the you know, the little tips and tricks you might
54:35
know Sure that kind of comes with experience and, you know,
54:38
maybe work in a different, you know, folks are on the.
54:40
Way if it was rocket science, you and I wouldn't be doing.
54:44
That this is, this is true. But I like doing it, you know,
54:47
it's, it's one of the most entertaining things for me is to
54:51
sit in a room with a bunch of people and talk and say, OK,
54:54
tell me about that. Why do you do it that way?
54:56
Because I learn something every time.
54:57
No corporation or organization or anything that I've worked
55:02
with ever does things exactly the same.
55:04
There's always just this enough difference to be like, OK,
55:07
that's interesting. I see what you're doing there
55:10
and Maima's like, oh, OK, well, you know, maybe I bring my
55:13
experience to the table just like you do or others to say,
55:15
oh, well, have you thought about this?
55:17
Sometimes it's that outside perspective that helps.
55:20
I hate to say it. Sometimes it's the, you know,
55:23
quote UN quote experts that you hired to come in and say the
55:26
exact same thing that you've been telling the organization.
55:28
But for whatever reason, the only move forward when they have
55:31
consultants come in and tell them that.
55:33
I hate to say that's, that's one handle, that's one angle.
55:36
Another angle is sometimes it's more effective.
55:38
Just sit in the room and not say anything and let have the
55:42
consultants come in and conduct the meeting.
55:43
And you, you're either one of the group or you're able to stay
55:50
completely silent. Because if like if you're doing
55:53
all the questioning, people are starting to wonder, OK, what's
55:55
your agenda? What are you trying to push
55:57
here? Or are you just kind of getting
56:01
trying to get the answers that you've been looking for?
56:06
Yeah, We'll have ulterior motive.
56:07
Give us a little bit of insulation between that
56:09
sometimes, yeah. Totally.
56:12
Yep. OK, what else?
56:15
Or should we wrap it up? Five years, man.
56:18
See if you got to like put the episode one and episode what is
56:23
this 292? 292, I think it'll be, yeah.
56:27
Yeah, that's a. Little inside baseball for us.
56:29
I used to say what episode we were on, and then we started
56:35
recording things sometimes out of order, or something would
56:38
happen and we'd have to release and it would cause me a lot of
56:41
problems when I'd say, oh, it's this episode, I'd say it and
56:44
then I'd have to call it something else.
56:46
So I have not said what episode we are unless we're very sure,
56:50
like, yeah, this is going out Monday, right?
56:54
Or or something like that. Well, this one doesn't go out
56:56
Monday. I don't know what's going on
56:57
Monday. It's going to be this one, I'll
57:00
tell you that right now. So why don't we wrap up with, I
57:05
don't know, the funniest or most interesting behind the scenes
57:09
thing that has happened on the podcast so far?
57:13
I'm not. I'm thinking of hundreds and
57:15
dozens, but like, what do you have for that topic?
57:18
Yeah. So what I have for the topic is
57:19
more of like an inside baseball thing.
57:22
And I'm going to joke on you a little bit.
57:24
So if someone saw our show notes, every show note, we have
57:28
preparation. And my little note that I made
57:32
to myself, I was going to say Jeff's 13 point checklist.
57:36
And actually looking at it now, there's a 15 point.
57:39
Checklist. And it's like all of our guests,
57:42
they come on and we're like, OK, silence your phone.
57:44
Oh, yeah, make sure you have headphones that make sure you
57:47
have something to drink, not in a crinkly bottle.
57:50
Breathe up. You're too close to the
57:51
microphone. Oh, move back from the
57:53
microphone. And then they it's like, don't
57:55
move. They're like usually do it to
58:00
me. Product man.
58:01
Yeah, well, don't. Don't move too close to the
58:04
microphone. Now I just sit there and gay
58:05
always like I see this happening to other people.
58:07
I'm like you say I shouldn't see thinking of personally.
58:10
All those times had nothing to do with me.
58:12
Has to do with you and your desire to put out the perfect
58:17
quality. I have a maniacal focus on
58:19
quality and I want this to sound good.
58:21
I want it to look good. It hurts my soul when either of
58:25
those things doesn't happen and I want to be able to enjoy my
58:29
life outside of this. I mean, I spend a lot of time on
58:31
it. So the more I can do upfront and
58:32
look, people come on the show. We want them to be comfortable.
58:36
We want them to present well, right.
58:38
Nobody wants to come on and be like, oh, that guy, you know,
58:41
sounded like crap and, you know, really didn't make a good
58:44
impression. My job as the producer is to
58:48
make sure that people show their best, whether it's audio or
58:52
video, whatever. We yes, I have a 15 list, 15
58:56
points on this list and they are rare for a reason because just
59:00
like the the the label on your shampoo says don't drink it,
59:03
somebody drank it at some point. So yeah, silence all your.
59:07
There's meaning for all of them. Like #13 if you're on the Mac,
59:11
turn off camera emoji. That's a new one.
59:13
Yeah, don't do this on a Mac because you'll get the little
59:16
thumbs up emoji and I don't want to see that on the camera.
59:18
I just had that happen on my phone on a FaceTime call the
59:21
other day. So it's a real thing.
59:24
But here's what happens. It's like you start telling the
59:26
guests and they're like smiling. And then you get about halfway
59:29
through and they're like, I'm not going to remember all these
59:31
things. How much does it remember all
59:34
these things? Yeah, I mean, it's just, hey,
59:36
think about it, right, The way you're on camera and, you know,
59:40
or audio, Look, we want this to sound good.
59:43
I can do a lot of stuff behind the scenes to fix things.
59:45
And I have done a lot of really butchering episodes to try and
59:51
save bad audio. That's really one of the things
59:53
that that comes up, you know, inside, you know, here's here's
59:56
my thing for for this episode. My teleprompter went dark and I
1:00:01
lost connection despite the, I don't know, thousands of dollars
1:00:05
that I've spent to put together a rig that is extremely
1:00:07
resilient. So during the middle of this
1:00:10
episode, I'm in the middle of talking and all of a sudden
1:00:13
things just crash. I don't know what it is.
1:00:16
That's going to be my weekend after I edit this episode is
1:00:18
trying to figure out what the heck happened and trying to
1:00:20
figure out a way. Is there a piece of technology
1:00:22
or something that I need update? But stuff like that drives me
1:00:26
absolutely crazy. Well, you, you know, I do is
1:00:30
look back on episode 291 and the little segment intro if you look
1:00:35
on YouTube was me talking and my monitor went black and I'm like,
1:00:40
and and it must not have affected my camera because.
1:00:43
Yeah, we. Could see you.
1:00:45
On camera, Yeah, yeah, yeah. That was our intro.
1:00:47
You know, it's your, it's on YouTube.
1:00:49
It's also in the audio. It's the same thing.
1:00:50
It's just one has video and the other one doesn't.
1:00:52
But yeah, like I, I don't think, I think it's fair to say most of
1:00:56
the technical issues are usually on your side, Jim.
1:01:00
It's pretty rare for me to. Thousands on your rig and I've
1:01:04
spent nothing. Yes, but it shows, right?
1:01:08
Even no matter how much you spend, there's always something
1:01:10
that could pop up. So.
1:01:12
But yeah, that was kind of fun. I think there's a lot of little
1:01:15
things like that where it's like, OK, you know, how am I
1:01:18
going to rescue this episode? Really bad audio or connection
1:01:22
or uploads or downloads, incomplete stuff like that.
1:01:25
That's kind of a lot of things that kind of happens, you know,
1:01:27
behind the scenes for me as. I think we've also done a good
1:01:31
job. We never name names.
1:01:32
We never embarrass people, right?
1:01:34
Because like, even when I brought up bad network
1:01:36
connections, I was thinking of specific episodes, like kind of
1:01:39
like name names, people I see at conferences all the time.
1:01:43
But no way would I ever do that. I love our, It's not about that.
1:01:46
It's, it's really either the, it's, it's, it's what keeps it
1:01:50
fresh, right? You and I have conversational
1:01:52
time and there's always something that goes, I mean,
1:01:55
we've had a really bad just technology streak for like the
1:01:57
last, I don't know, four weeks, 5 weeks, six weeks now.
1:02:01
And anytime I travel and have to be on a hotel, you just never
1:02:06
know with hotel Wi-Fi. And you know, we just try to
1:02:10
make it work, but there's lots of variables.
1:02:12
But the technical stuff, as usual, it bugs me and it's like,
1:02:14
all right, how am I going to fix this?
1:02:17
And there's times where like, I'll text you Jim and like, it's
1:02:19
like, here's what I'm dealing with.
1:02:21
Let me I'm going to have to see what I can do to like fix this.
1:02:24
And you know, I've gotten better over the years.
1:02:26
I think our earlier episodes, you know, from an audio quality
1:02:29
suck compared to now, But that's that's kind of behind the
1:02:33
scenes. If you're watching this episode,
1:02:35
you're listening to this, just know that at some point during
1:02:38
this episode earlier, obviously my thing crashed.
1:02:44
And if you spot the edit, let me know.
1:02:48
I'll try to hide it as best as I can make it, you know, probably
1:02:50
easier to spot on video maybe versus the audio.
1:02:52
But you know, we had technical difficulty and I will, I will be
1:02:56
addressing that with my 4K capture card.
1:02:59
I think is the culprit, you know, after this.
1:03:04
Well, if I had anything to say before you take us out, it would
1:03:07
just be thank you to our listeners, people who've been
1:03:10
listening for five years or five episodes.
1:03:15
I mean that we wouldn't do this without our watchers, our
1:03:20
listeners. And we keep trying to make this
1:03:24
thing better for you all because it means so much to us, like
1:03:30
Jeff said, where people come up and actually know who we are and
1:03:34
listen to the podcast or just connect to us on LinkedIn.
1:03:38
It's it's why we do it. It's why we've been able to like
1:03:41
do this for five years. And I think, look, we've
1:03:44
recorded a lot of episodes on like Saturdays and Sunday nights
1:03:48
to get them out on Monday. And you, you have the all the
1:03:52
humans work after that to like, you know, do all the editing.
1:03:57
It's a lot of work, but it's worth it.
1:04:00
I don't think we've ever questioned whether or not it's
1:04:02
worth it. Yeah, no.
1:04:04
It's a labor of love and definitely thank you to
1:04:07
everybody who supported the show, listeners, people who come
1:04:10
up, you know, even sponsors who are now getting involved with
1:04:12
stuff. Yeah, definitely.
1:04:15
Thank you. You know, hit that like and
1:04:17
subscribe button. Keep sharing it.
1:04:18
We'll keep doing it. And yeah, happy five year
1:04:21
birthday to us, Jim. Let's see what else.
1:04:24
I think that's it. We're on the web, IDC
1:04:28
podcast.com. We're on YouTube, youtube.com
1:04:32
slash at IDC podcast, which just seems kind of weird, but that's
1:04:35
what the URL is. Mastodon IDAC podcast at infosec
1:04:39
dot exchange. Jim mentioned it.
1:04:41
Connectors on LinkedIn have lots of people reach out with, you
1:04:44
know, ideas for shows, ideas for guests, feedback, what you like,
1:04:47
don't like. We read it all and we take into
1:04:50
consideration as we move things forward.
1:04:51
So here's to another five years. And with that, we'll talk with
1:04:56
everyone in the next one. You've been listening to
1:05:01
Identity at the Center. We hope you've enjoyed the show.
1:05:05
Make sure to like, rate and review, and we'll be back soon.
1:05:09
But in the meantime, hit the website at
1:05:12
identity@thecenter.com. See you next time on Identity at
1:05:18
the Center.