Latest / Identity at the Center / #308 - The Business Case for IAM with IDPro Andre Koot

Transcript

#308 - The Business Case for IAM with IDPro Andre Koot · Identity at the Center

0:00
As I said, it's not very sexy in a security sense.
0:03
It's not the sexy profession, which is why it's still more or
0:07
less hidden to, yeah, invisible foundation in governance.
0:14
But it's. I think it is.
0:15
I think it's subtle sexy, Andre, Come on.
0:19
Subtle. Sexy.
0:22
You should write an article about that.
0:24
I, I think our second episode ever, I think I titled it
0:29
something like getting into the sexy world of I am or something
0:32
like that. So I just, it sprang into my
0:35
mind when you said that I was like, all right.
0:36
I think I remember like five years ago writing a show title
0:38
like that. Well, I, I try to get people to
0:42
understand that I am can be sexy.
0:44
So we're talking about zero trust and policy based access
0:46
control and all that new modern stuff, which makes really makes
0:49
it sexy. So there are there's new
0:51
developments and that has really helped getting towards the
0:54
Firefox. So that's the IT.
0:55
Will help. It will grow.
0:58
Well, if we, if we didn't have to worry about DRMI, would play
1:00
the right, said Fred. I'm too sexy for and then, you
1:03
know, fade out. So maybe that's what I'll do for
1:05
this one. This is identity at the center
1:14
if it has anything to do with IAM.
1:18
This is the go to podcast now your hosts Jim McDonald and Jeff
1:24
Steadman. Welcome to the Identity of the
1:32
Center Podcast. I'm Jeff, and that's Jim.
1:34
Hey, Jim. Hey.
1:35
Jeff, how are you? Oh, not so bad yourself.
1:38
Doing great. So I've been thinking a lot
1:40
about training and professional development lately, and I think
1:46
really there's a couple things right?
1:49
One is training and development for people who are just entering
1:54
the industry. There are a few really good
1:56
resources out there. Andrew Chan phone with his
1:59
YouTube channel, David Lee with what he's doing on LinkedIn.
2:03
I think those are fantastic outlets.
2:05
There's a lot of kind of one O 1 level information out there.
2:10
Obviously for the more advanced learner.
2:14
One website that I've become familiar with recently is
2:18
Pluralsight. So Pluralsight has a lot of
2:21
information. This is not an advertisement for
2:23
Pluralsight, but has a lot of good courseware and preparation
2:27
materials for certifications. Now, I can't say from personal
2:31
experience that they will properly prepare you, but it's
2:35
at least a starting point. And then of course, YouTube has
2:40
a ton of great content. And obviously if you're LinkedIn
2:44
with any partners usually or with technology vendors, they
2:48
have partner portals that have a lot of great information.
2:51
And don't forget, probably the best to for everybody is the
2:56
Identity Center podcast of. Course.
2:59
Wealth of Knowledge and the ID Pro body of knowledge and I
3:04
think we're going to talk a little bit about that today.
3:07
Yeah. So I guess free commercial there
3:10
for Pluralsight. Pluralsight, you want to
3:12
sponsor, hit me up. Yeah, I, I use Pluralsight to
3:16
actually pass the AWS certification late last year.
3:18
So yeah, obviously that in conjunction with other things,
3:21
but yeah, always, always be sharpening the saw, as Jim likes
3:25
to say, lots of good resources out there.
3:29
Yeah, I got nothing else to add to that.
3:33
Well, I think that you've been, you've been a fan of what
3:36
Andrew's doing for quite a while.
3:38
Yeah, he's he's, I just saw LinkedIn show he's doing some
3:41
stuff on LinkedIn again. So kudos to him.
3:43
That's pretty cool to to get on LinkedIn learning again.
3:46
I saw a picture, I think with him in front of like a green
3:47
screen or something like that, which is which is very neat.
3:49
So Congrats to Andrew on that. Another, another LinkedIn
3:53
learning class. So starting to rack him up, man.
3:59
So we got some conferences that are coming up here in the next
4:01
really couple of weeks. Time is running out a syndicate.
4:04
You and I are going to be there, Jim.
4:06
We are working on a exciting show that we're going to be
4:11
putting on this on the mainstage.
4:13
I'm not spoiling yet what we're going to be doing, but there is
4:16
a survey that has gone out to people.
4:18
And so I plead with people to answer the questions that they
4:21
might have received from the Fido Alliance for the Fido
4:24
Authenticate conference coming up here in a couple weeks.
4:26
It's October 14th, the 16th in Carlsbad, CA.
4:30
We have a discount code, Better, better, Better got it because
4:33
it's coming up. ID AC15 gets 15% off of your
4:37
registration. So we hope to see a lot of
4:38
people there. And thanks to those who've
4:40
already used the code that shows support for the show doesn't
4:42
cost you anything, doesn't doesn't cost anything but show
4:45
support that we can, you know, drive folks to attend.
4:47
But again, I will plead, if you've gotten a e-mail from
4:50
Fido, there is a link to a survey.
4:53
It asks you some questions. Please fill it out.
4:55
We are going to be using it. That is an identical center
4:57
thing that we're going to be doing with the Fido Alliance as
5:00
part of sort of opening ceremonies and kind of things
5:02
that will be happening that day. So.
5:04
We'll also be podcasting third, Jeff, so we're going to have a
5:07
little side. Do you know?
5:11
I don't want to call it. We'll be somewhere.
5:13
We're going to be somewhere. So we're going to record a few
5:16
episodes so folks who are in the tenders can kind of see the show
5:20
as we do it live. Yeah.
5:23
I think the plan right now is we'd be somewhere in like the
5:25
Expo hall era. It's a little more visible
5:26
maybe. Then kind of last year we were
5:28
kind of stuck in a in a back corner, which is great for like
5:30
sound quality, but it was very difficult I think for people to
5:32
kind of find. But we should be hopefully we
5:36
will be around somewhere podcasting.
5:37
So feel free to come up, watch, listen, and you know, get an
5:42
official fist bump of gratitude from from WAH.
5:45
Let's see the week after that, Jim, we're going from California
5:49
all the way to Florida. We're going to be at the Sale
5:52
Point Navigate conference. This is kind of a late breaking
5:54
one, but we actually have a discount code for that we just
5:56
got. So if you use the code IDAC and
5:59
you're planning on attending Sale Point Navigate October 21st
6:02
to the 24th in Orlando, FL, they get you $400.00 off.
6:06
That's another one that's coming up here pretty pretty quickly in
6:08
the next couple of weeks. So definitely on that.
6:10
But that's another one. Jimmy, you and I are planning on
6:12
doing some recording at that episode or that conference I
6:14
should say. And I think I'm, I'm doing some
6:17
sort of presentation with our friend Chad from RSM is RSM is a
6:21
sponsor there and they are employers.
6:23
So one of the benefits is, yeah, they get to bring us along and
6:27
expand the word. Yeah, and we'll be in the land
6:30
of the mouse, which I think is cool.
6:34
Yeah. I mean, I like Orlando, Jeff.
6:36
I remember being there with you in January.
6:39
It's 70°. Like, oh, my God, I'm so hot.
6:42
It was. Oh come on, be fair to me man.
6:44
It was 7° but like 85% humidity it's.
6:47
Gross. It was pretty muggy.
6:49
It was pretty muggy. But you know, if you travel from
6:52
the the great, the winter is north.
6:56
It feels good to get a break. From that, I disagree.
7:00
I would rather be cold than hot and humid.
7:02
But that's just me. What can I say?
7:04
I'm a strange bird, but I am looking forward to be in
7:06
Orlando. I'm looking forward to be
7:08
indoors in Orlando in that sweet, sweet air conditioning so
7:12
I stay nice and cool and dry, but I'm sure I'll still be
7:16
sweating because it's still short.
7:18
Yeah, and maybe we can find our friend of the show, Sean Odell.
7:21
Sean Odemity. I know he's an Orlando resident
7:25
as well, so shout out to Sean. Yeah.
7:28
And we're looking to get him back on the show.
7:29
We're going to give kind of an update I think maybe on like
7:31
Cape and SSF and some things in the future.
7:33
So that'll be coming up here. We're kind of working out
7:35
logistics on that. So yeah, looking forward to get
7:37
Sean and and Atul back on the on the show.
7:40
Yeah, it's getting really hot. I'm not talking about the
7:43
Orlando weather. I'm talking about the the whole
7:46
shared signals framework. Yeah.
7:48
So hot right now. All right, Why don't we talk
7:52
identity today? We've got the business case for
7:57
identity and access management. So there was an article that we
8:01
found on the ID Pro website. And Jim, you and I are members
8:04
as well as the author of that Andre Coat, he's the author of
8:08
the business case for IM. We'll have a link in our show
8:10
notes to for people to check that out.
8:12
But welcome to the show, Andre. Thank you, Jim.
8:15
Yes, I'm glad to be here. Yeah, thanks for taking the
8:19
time. You're joining us from the
8:20
Netherlands. So it's, let's see, local time
8:23
for me right now is 10:52 AM. What time is it in the
8:26
Netherlands? What's 4:50 in the afternoon?
8:30
So ready to did I later on after the show, we'll always.
8:35
Leave on a high note. So that's probably a good thing,
8:37
right? You're on the podcast here with
8:38
us. First time you've been on the
8:39
show. So tell us a little bit about
8:40
yourself. How did you get into the world
8:43
of identity and access management?
8:44
Did you choose it or did it choose you?
8:47
It, it didn't exist when they started.
8:49
So this, I've been in identity management 25 years and it came
8:53
from the security and you could say, and before that I, my
8:57
training started as in the financial accountant for the tax
9:01
department doing fraud investigations.
9:04
Well, and later on I learned fraud as of course, views of
9:07
authorisations. So you could say from, from the
9:09
school I'd be working authorisation management.
9:11
So indeed they exist as a profession.
9:14
It's a new profession and I, I, well, I got into it in the
9:18
Twitch system 25 years ago when it's still very much IT
9:21
oriented, much more about getting making accounts,
9:25
creative accounts and later on the identity stuff came to it.
9:29
So I've been there for quite a long time, first as an internal
9:33
employee staff or tax department, some insurance
9:37
companies, and later as a consultant working in identity
9:41
exit management. So that's my background.
9:44
Little 3 1/2 years ago, for almost four years ago, in midst
9:49
of Corona, I started my own company with two friends and
9:53
it's called solid B and we decided to specialize in
9:56
identity exit damage, but we didn't, I am, we specialized in
10:00
business calls oversea. So we stay away from technology.
10:04
It's the easy part. And that's why I I we got some
10:08
interesting use case for customers and, and that's where
10:12
also this article came from. So I couldn't say some more
10:16
about that, but that's where the article came from.
10:18
Every customer wants to know why should I do anything?
10:21
I am and what does ghost razzoo bring?
10:23
So in fact, this article and the other articles I wrote or Heidi
10:28
throw came from the well, my practice experience as the
10:32
consultant helping customers and try to share knowledge we have.
10:35
So that's to I'm back crowd little let me dive into it a bit
10:41
more. I joined ID Pro always from the
10:43
start and then I know we learned about ID Pro mission appraisers
10:51
sharing knowledge. The body knowledge came to exist
10:54
and I joined the body knowledge committee from the start.
10:58
And so I've been there four years now.
11:01
I'm not sure how they will know. So I've been to the in the body
11:05
news committee writing article 3G my article helping set up
11:08
this the direction of the embodied knowledge and just how
11:12
we know. Well, we're all about sharing
11:14
the knowledge, so that is great. And thank you for contributing
11:17
right to the domain of identity with this set of stuff.
11:20
This. So I think this is the perfect
11:22
time to have you on the show because we just released an
11:25
episode that kind of talked about building up an IM program.
11:28
What does it take to start an IM program?
11:31
And one of those things was getting stakeholder buy in and
11:34
it's very difficult to get stakeholder buy in without a
11:37
business case, right? Because they're going to ask,
11:39
OK, well, what do I, what's in it for me or my organization or
11:42
what do I get out of it? So I'm really glad that you're
11:44
on the show. So, you know, thanks for setting
11:46
the tide aside the time for us. Like Johnny and just visit this
11:52
relevant topic. And most of the times when we
11:55
started customers for any project, it starts at the IT
11:58
department. Most IEM projects or issues are
12:03
IT related are assumed to be IT related problems.
12:09
And well, we of course we know it's not.
12:12
It's always business oriented. So when the IT people start an
12:16
IEM project, they need to have a business, they need to have
12:18
funding for that. And This is why these article
12:21
came through. We need to find the ways to help
12:24
IT or business understand why, what are the costs and benefits
12:29
of doing IEM or not doing IEM. So it's it's come from our
12:34
mission for the company as well. We try to do business for Zelda
12:37
sheet. We should help businesses
12:39
understand the need for identity, especially access
12:42
management, governance and approach sense.
12:45
So yes, I can relate to what you said to that, Geoff.
12:48
So Andre, you're making a strong case around that this IM is, is
12:52
about business. So what makes a good business
12:57
case for identity access management investments?
13:03
This is the hardest question you could say.
13:05
Good to ask you, Jim. So what's a good business case
13:09
in the article we tried to find, I tried to find a few few ports
13:13
to look at investment need for especially the possibilities.
13:17
And the most important viewpoint in life perspective is not just
13:21
looking at a financial basis case.
13:23
So what does it cost? What does it bring?
13:25
What should the return of investment?
13:27
That's that should be simple to do, but it's very hard in IM.
13:32
There's a such second or let's say not the non financial
13:36
business case. It's about what does IM bring
13:39
you from a risk management and governance compliance
13:42
perspective on end user perspective.
13:45
And these are perhaps non quotifiable.
13:47
You cannot, well, I say calculate the money that had
13:51
cost and brinks. Whereas for financial basis
13:54
case, you could of course try to calculate the cost of investment
13:58
to cost support implementation, the cost of training, whatever.
14:01
But from a non financial point of view, costs are more
14:06
difficulties, mostly non financial.
14:08
I said. So the well said, the
14:11
disadvantage of doing IEM from a non financial perspective are
14:15
mostly like culture, like getting used to new ways of
14:19
working, losing a victim, losing ways to blame people because
14:26
you're automate automating stuff that's being done manually.
14:28
You can also blame someone who did it wrong.
14:30
But in in automating doing, IME you try to automate this, you're
14:34
losing that blaming perspective. So there's different way of
14:38
looking at it. So if you're doing a good
14:40
business case, you have to look both at the financial business
14:42
case. What does it cost?
14:44
What does it bring we get in that and later I guess in more
14:47
depth, but you know, should also look at what does it cost me my
14:51
organization to invest in IM what does it bring not from a
14:56
financial perspective. So do we get more better
15:00
governance? I'm not more compliant laws of
15:03
regulation such that makes it easier.
15:06
How about US convenience, which is also harder to calculate.
15:11
So there's a lot of things you have to look at for a good
15:14
business case. So a bad business case, in my
15:17
opinion, it's, it's only about cost.
15:20
If you just say, well, a tool like an identity of recession
15:24
tool, it'll cost 1,000,000 and it doesn't bring any money.
15:27
Well, that's a lousy visit pace. So I tried to make fun of this,
15:35
but big fancy business case, you will not make money of IEM
15:39
unless you're a vendor or consultant.
15:41
So businesses making a business case, financial business case,
15:46
right you, you better, you will not make money.
15:49
You can don't get profit by investing IEM.
15:52
Perhaps you may get a lot of financial benefits, so don't
15:55
reach out in profits. But that's the same if you're
15:58
investing in the ERP system phrases or CRM system, you will
16:03
invest a lot of money in the ERP system.
16:05
It will not give any profit and but that's for IEM.
16:09
It feels differently. It feels not the same investing
16:13
in ERP you have to because your your basic continuity depends on
16:16
it profits IEM that's hardly any business near or hardly any
16:21
native or not go bankrupt if you don't do IEM.
16:25
So that's difficult to say. So it's a good business case.
16:30
It should look at investments IEM most of them financial
16:35
perspective and from a non financial perspective right in
16:38
the article say quantitative versus qualitative.
16:41
Quantitative meaning you can calculate the cost and the
16:44
benefits and qualitative no calculation at all.
16:48
It's just go for it, believe in it.
16:51
It feels good. Feels good, yes.
16:54
Yeah. Well, I there was a lot that you
16:58
said there, Andrean, you know, I want to unpack a few things.
17:01
So you talked about the, the risk reduction versus, OK,
17:09
you're not going to make money off of IAM unless you're a
17:12
vendor. I kind of feel like there's a
17:15
difference for the workforce IM investments versus customer IM
17:22
investments where I do think they can be at least part of
17:27
driving the business revenue, right.
17:30
You can make a business case that hey, customer I am is an
17:34
enabler of doing some major digital transformation project
17:41
on the customer facing side where it increases revenue.
17:44
Do you agree? I totally agree.
17:47
And there are some more financial and perhaps no
17:50
financial bonuses from customer IE inferences which are not in
17:54
the employee or access management environments.
17:58
So for customer environment, I know it's a case for a customer
18:02
who has seven different portal, 7 different customer portals.
18:06
So converging is a big benefit to invest in new CIC on platform
18:12
to migrate all those different portals to one back end.
18:16
It'll definitely save money as partly because there's some old
18:20
technology left and some electrical depth.
18:22
So if you invest in new stuff, you can move ahead, you can be
18:26
more stalable, you can ditch all that old stuff which you don't
18:30
want anymore. Second, a semi perspective from
18:36
CM prices. If your competitor is investing
18:40
in new own bells a whistle CM product, well, we often see that
18:46
the competitors is drives to our customer to do the same.
18:50
So yeah, my competitors got a new bezel bells a whistle CM
18:53
product. I need it as well.
18:55
Or so there's there's some different business case.
18:59
Not, not really financial. It will not make a lot of money
19:03
except for crowds. It can save money by ditching or
19:06
stuff. It will not give a profit, but
19:08
it's it'll may be able to reduce cost in other domains.
19:13
Yeah. I feel like sometimes
19:18
intuitively a business may know it needs to do something like
19:22
digital transformation and identity as part of that, but
19:26
still want to see you go through the exercise of making a
19:31
business case that's compelling, that's going to grow the
19:34
business. Or I think one of the things
19:37
that you brought up earlier was manage risk.
19:40
So manage or reduce the risk of something catastrophic happening
19:46
to the business, Go through that exercise.
19:48
We know we need to do it, but make, you know, go through that
19:52
exercise of how's this going to help the business well.
19:57
Those risk communities are relevant.
20:01
For instance, data breaches, they're all over the place every
20:04
day. And data breaches of course are
20:07
in my opinion. Well, I may be overdoing it,
20:10
but. It's mostly running the student
20:14
access control. Too many people with too many
20:17
authorisations. A hacker need not have
20:20
authorisation. Why do they get access?
20:22
Because some other level active control is not valued methods.
20:26
So I am in that sense. It's really really basic to deal
20:31
with your item. You need to have access control
20:33
in a decent way to prevent accidents happening.
20:36
So it's a risk reduction process, risk deduction policy
20:41
you could say. So you have to identify those
20:43
risks. It's all about phrases, data
20:46
bridges is relevant, ransomware the same.
20:48
Why should any user have access to rights to a server and they
20:54
don't need to write. So it's it's all the same, too
20:57
many people have too many authorisations and that's that
21:02
is all concerned. Right I've I.
21:05
Read a lot of article in the middle village about previous
21:08
actually sentiment and I showed a nice example about too many
21:12
authorisation for too many people, which is a relevant
21:16
issue. There was the issue of some of
21:18
the old presidents posting tweets about sent me one Bitcoin
21:24
and I sent you 2 back. And as I explained in the
21:28
article, previous Actually Medical article, it's all due to
21:31
the fact that some criminal found the credentials to log
21:35
into the management system of Twitter to make it possible to
21:38
revoke authorisations and to post those messages.
21:42
So it's a silly risk, but you have to manage it.
21:45
So make sure that your authorisations are kept to
21:48
unveiled caps are maintained well that are only available to
21:52
people who need those authorisations.
21:54
And that's where identity access management is.
21:56
It's, as I said, it's not very sexy in a security sense.
22:00
It's not the sexy profession, which is why it's still more or
22:05
less hidden. Certain, yeah, infeasible
22:09
foundation in governance. But it's.
22:12
I think it is. I think it's subtle, sexy.
22:14
Andre, come on. Subtle.
22:17
Sexy. You should write the article
22:20
about. This I, I think our second
22:25
episode ever, I think I titled it something like getting into
22:28
the sexy world of I am or something like that.
22:31
So I just, it sprang into my mind when you said that I was
22:33
like, all right. I think I remember like five
22:34
years ago writing a show title like that.
22:38
Well, I, I try to get people to understand that I am can be
22:41
sexy. So we're talking about zero
22:42
trust and policy based access control and all that new modern
22:45
stuff, which makes really makes it sexy.
22:47
So there are there's new developments that has really
22:50
helped getting towards the car phones.
22:52
So that's there. It will help.
22:53
It will grow. Well, if we, if we didn't have
22:56
to worry about DRM, I would play the right, said Fred.
22:59
I'm too sexy for and then, you know, fade out.
23:01
So maybe that's what I'll do for this one.
23:04
You talked about risk and we talked about business case.
23:08
And I think one of the most important things that comes out
23:10
of this is the return on investment.
23:13
Everyone always wants to know what am I getting from my money,
23:17
my investment, my time allocation?
23:19
Because it's not just money, sometimes it's, hey, we're going
23:22
to invest people into this as well and their time.
23:25
And so how do we talk about return on investment as part of
23:29
this business case? I kind of want to break this
23:31
down in a couple ways that maybe we start the high level and then
23:34
you also mentioned earlier, you know the difference between
23:37
quantitative and qualitative or subjective benefits.
23:40
Sure, there are things you'll be able to measure right, but
23:42
there's also things where I kind of mentioned before, like it
23:44
just feels good we should be doing that and maybe to some
23:47
degree that's kind of where you were going with while our
23:49
competitors are doing it, we've got to keep up or something
23:52
along those lines. Maybe we can start with that
23:54
kind of macro question of how do we talk about return on
23:58
investment in a business case? Yeah.
24:00
Let me first explain return on investment topic.
24:05
It's an economical meaning it's at least if you invest 1,000,000
24:11
in edge of the year you you got to 11 really 100,000 in in cash
24:16
the return is 100,000 meaning if you've calculated 10% return on
24:21
investment, so your profit will be 100,000 or invested a
24:25
million, meaning it's 10% in this year of return investment,
24:29
your profits. And so that means that it, it
24:33
assumes that you can investigate, sketch can
24:36
calculate the investment, it'll calculate the return and that if
24:41
those two values are there, you can calculate the return on
24:45
investment. That's, that's relatively
24:47
simple. It's a simple model.
24:48
It's an old models can look a model and we can try to use it.
24:53
But in IEM there are a few different issues that make it
24:56
difficult to calculate the return on investment.
24:59
Honestly, things I wrote in the article makes this very
25:02
difficult issue, not just investing in coming up with the
25:09
investment sum you, you can calculate the investment you get
25:12
also from a vendor say, well, you got 11 million you got
25:16
implemented it and just in trading.
25:18
So the total investment goal is 2 million next year.
25:21
That's that's quite easy. But then you have to in fact, in
25:25
fact invested additional. Your employees have to get
25:29
training, so they cannot work. If they do training, you have
25:31
some errors to respond to, to fix.
25:35
You've got some other quality issues you have to fix.
25:37
So it will not be really 2 million, especially 3 million.
25:40
So the investment sum itself is quite difficult to calculate,
25:44
but even more difficult to calculate is to return.
25:48
And in for instance, if you've got the business that you sell
25:51
widgets or 1,000,000 and you, you get to the 100,000 as a
25:55
return. So you make nice profit on
25:57
widgets selling widgets, that's nice.
25:59
But in IM you don't sell identities, you don't sell
26:03
authorizations. So that means that you have to
26:05
get your investment in a different way mostly in the
26:08
order of savings. So savings will effect help you
26:14
get a return on investment. So if you do something, you
26:18
should have less to do less work is a is a benefit is a is a you
26:24
could say return on investment. So prices if you can automate
26:29
and join a move of lever process, whereas normally you'll
26:32
take one hour to create an account.
26:34
Now you can automate that. You just have to calculate the
26:37
number of accounts that are have to be created or removed times
26:41
the the the the hourly rate. Then you get the total sum of
26:46
cost that you can save, which you automate so that so that's
26:50
that's not too difficult to calculate, but there's another
26:54
issue crisis. Suppose you have a standard
26:59
calculation for is password resets.
27:01
It's the same issue password resets.
27:03
It takes half an hour and if you calculate enough has to have
27:07
password resets. You can in fact ditch your
27:10
service desk because all passwords can be automated, but
27:14
that never happens because if a services employee, it's not
27:18
resetting a password, it's doing other stuff, perhaps other stuff
27:22
that that needs to be on. So a backlog.
27:25
So in fact, you have a return of investment, which you cannot
27:29
calculate it because there's no return because no, you cannot
27:33
fire any employee because the the works are low there, people
27:37
will do other things. It's hard to calculate.
27:39
So you have to effectively try to investigate what are the
27:42
returns, all the investments to make it possible to calculate
27:45
the return of investment. So the the real value in IM is
27:51
partly virtual. And I in the article, there is
27:54
APDF in the article with a lot of tables in there.
27:57
And there are some, some formulas.
27:58
I tried to come up with some formulas about what is the
28:01
investment, what the return of the investments.
28:03
You have to well, I don't know how to call it in English, but
28:07
it's, it's take a big grain of salt.
28:10
The the formulas. So so there are some formulas
28:13
phrases the number of joiners times the not the time it costs
28:20
to make an account and times the rate of nebulae doing it.
28:25
It will give some idea about the cost savings of automating
28:30
joiner mobility process. Certainly your estimation.
28:35
Andre, I think what you're talking about is the difference
28:39
between hard, hard dollar savings and soft dollar savings
28:42
rate. So with soft dollar savings, you
28:46
are mostly getting those through efficiency, whereas hard dollar
28:51
savings come from, you know, the idea of like letting people go
28:55
or if you're an outsource model, it might be easier to measure.
29:00
I've always felt like that was something that, you know, if
29:03
you're paying a dollar amount for password resets to an
29:07
outside firm and you could actually reduce those numbers,
29:10
you actually achieve savings that's hard dollars.
29:14
But it's what you're talking about is using the help desk
29:16
example that you mentioned, you are making the help desk more
29:21
efficient than that soft dollars.
29:23
It seems like executives are always willing to listen to hard
29:27
dollar savings cases and the bar is also much lower.
29:32
But hard dollar savings are hard to achieve, especially when
29:35
you're talking about reducing risk for the organization.
29:39
I can hardly even think of an example where you reduce your
29:46
security risk, reduce the risk of a data breach, reduce the
29:49
risk that you're going to be on the front page of the New York
29:52
Times where you achieve hard savings by doing that.
29:56
But you do achieve savings in terms of wow, if that were to
30:00
happen, you know there is a dollar value to that.
30:04
So I guess I'm throwing two issues that you have once.
30:07
The 1st is hard dollars versus soft dollars, which I think you
30:10
talked about. The second is this idea of
30:15
dollarizing non savings type of benefits, so you'd have a
30:23
benefit of enabling or you know, making the organization more
30:30
efficient or reducing risk. Is there a case, is there a time
30:35
to try to turn that into, OK, we project $1,000,000 in savings
30:41
and here's how we achieve that calculation?
30:44
Or in your mind, is that just a waste of time?
30:48
It's it's not a real waste of time.
30:50
It will not be compelling argument to do the investment.
30:54
It helped enables investment decisions perhaps.
30:58
So you really have to try to come up with different saving
31:02
categories. So like in the articles, I think
31:04
some 50 or 80, I'm not sure. I didn't calculate it arguments
31:09
or motive, motives to do the investment.
31:13
So you can use this, this article to come up with your own
31:17
evaluation of the of the case. So we have to come up with the
31:21
business case, identify the qualitative and the quantitative
31:24
benefits. Of course, of course, for this
31:27
the topics. And it may not be jealous of
31:29
your organization, but it may help continues to the the
31:32
stakeholders who are decision makers.
31:35
And there are a lot of arguments to be made for investing in the
31:40
hard dollar for the soft dollar. It does effect help, although
31:45
again, you have to take them into game of swords.
31:47
For instance, one of the benefits will be risk reduction.
31:52
For instance, if you've gotten a supervisor agency, you're so
31:55
like a banking environment or the the European legislation,
32:01
right, GDPR, there is a total fine of 4% of the global
32:05
revenue. That's the maximum fine.
32:08
You could say, yeah, that's nice, but that's not the risk.
32:10
The risk here is the well discovery of the issue and then
32:15
the calculation. OK, we, we, we have discovered
32:18
we made a mistake. So we are finable, but what's,
32:21
what's the real risk? What do we, we don't, we don't
32:24
save the whole fine, the maximum it shall not be the risk that we
32:27
save that will not be the saving.
32:29
So there must be some, you know, you have to try to find out a
32:33
real saving potential saving of these events.
32:37
So it's hard to come with me for this hard dollar as calculation.
32:42
So it's it's not black and white, you could say, but it
32:46
will help convince decision makers that they're less likely
32:52
to be on the newest Times front page because there's an
32:55
incident, so less likely to have this event, less likely to be a
32:59
target. So all these arguments may help
33:04
convince decision makers to do an investment.
33:08
At the risk of getting to like inception level now I'm
33:11
wondering do we need to do an ROI?
33:13
On the ROI, how much time should I spend building right the the
33:19
ROI for the business case? And I'm curious like is there
33:23
are there levels of OK and maybe it's context, I'm talking to one
33:27
person and maybe it's hey, I think this is a good idea.
33:30
What do you think? And maybe a segment says, yeah,
33:32
why don't you go look at that a little bit more and come back to
33:34
do some high level numbers and then maybe it's like, OK, yeah,
33:37
that seems like we're direction correct.
33:39
Maybe now is the time to do like a full blown ROI, like to get
33:42
maybe project approval. Do you think that that's a
33:45
viable method to kind of start? Because it seems almost daunting
33:49
to say, Oh my gosh, I have to now figure out the risk of maybe
33:52
the discoverability of maybe us might, might get a fine and then
33:57
reputational damage. What how do you quantify that
34:00
kind of stuff? You think that's a viable
34:02
approach? No, it's.
34:05
It's not the final approach in my opinion.
34:07
So there are the the quantifiable components you can
34:10
try to come up with some kind of calculation so on.
34:14
We can save few other €1000 dollars per year because
34:18
automation. So efficiency, efficiency
34:20
benefits and all efficiency oriented benefits are hard to
34:24
quantify. You could say we we have some
34:27
less reputation damage if something happens, what's the
34:30
failure of that one? Not sure the pencil, the
34:33
reputation damage, say for the risk of fines or end user
34:39
satisfaction. How do you calculate the end
34:42
user satisfaction of automation? So it's it's hard to come up
34:45
with different issues. There are some hard non
34:49
quantifiable issues or so hard qualitative aspects, races,
34:55
audit findings. You know, if there's an audit
34:58
finding, obviously it starts with the colour yellow, dense
35:01
orange and then Reds and then, well, then it's too late.
35:05
You could say there's really a benefit of fixing audit
35:08
finances. Too many admin accounts, OK, or
35:11
too many authorisations in the financial system, OK, No
35:15
segregation of duties, OK. These are in fact non financial
35:19
but very strict findings that you have to fix.
35:23
Otherwise your, your accountant will come up with a negative
35:27
opinion about your going on. So there are some hard all
35:32
that's the different components that you can identify that you
35:36
have to fix and it will not bring any money.
35:39
It will give you some sustainability organization
35:42
perhaps. But if it will not make any
35:44
money, perhaps it will save money because you don't get a
35:46
fine or you get some other, I'm not sure about that, but you
35:51
could. These are less, these are hard
35:54
but not quantifiable components. So it's it if you say is it a
35:59
viable to come up with a calculation for an IOI then go
36:03
for the codifiable composers you can identify.
36:06
So like in the article that where the from readers are added
36:09
in the in the article, there are some codifiable composers you
36:12
could identify. But for the for the rest of the
36:17
sake, yeah, alas, no financial business case, but there are so,
36:22
so many other benefits. Hey, I've got a thought on this
36:26
as well, which is so when I was in Business School, we learned
36:31
how to do net present value calculations.
36:34
And the example was Boeing is building the 777 and started to
36:39
take 20 years to build, sell these planes.
36:43
And then at the end the, the, that plane is no longer, it's
36:47
reaches the end of life. They're going to stop building
36:49
them and they have a lot of expenditures in the first five
36:53
years and then the income starts coming in the revenue and so the
36:58
revenue gets discounted by year. It's a very complex calculation,
37:02
right? To do that, to spend $50,000 on
37:05
an enhancement to a privilege to, to send up a secrets fault
37:09
is absolutely crazy. But it also gets to be thinking
37:13
about two things. One is I think certain
37:17
organizations have a certain level of sophistication around
37:22
doing return on investment calculations.
37:24
Some organizations and it's not even the organization probably
37:28
has a lot to do with the size of the effort, but in some cases
37:33
the size of the effort requires you to do a break even analysis.
37:37
So OK, show us when we're going to get our money back.
37:40
And that's what I was talking about earlier with Andre with,
37:42
you know, trying to, you know, but don't run through the case
37:49
just so that you realize the value.
37:51
What is the return? I'm going to spend $50,000 or
37:55
$100,000. How is, how is that beneficial
37:59
to the organization? I think the other scenario is
38:03
where you want to spend multiple millions of dollars on
38:07
something. And, and that's where I, I do, I
38:10
still think it depends on, OK, what is the organization
38:15
expecting to see? Just because you're spending
38:17
$3,000,000 doesn't mean you have to do net present value
38:21
calculations, unless that's what your CFO or you know, the
38:25
ultimate decision maker on that investment is going to require.
38:30
Let me push back here for a second, though, because I think
38:32
we're talking relative terms here.
38:34
So for some organizations, $50,000 is a rounding error.
38:39
A drop in the bucket doesn't matter.
38:41
For some that is a lot of money. And so I think this is a little
38:45
bit organizational size and maybe scope and kind of driven
38:48
to say, look, we're going to spend 50,000 on this and maybe
38:51
we only have a budget of 100,000.
38:53
You're saying you want to use half of my budget to do this
38:56
thing. That's a very significant
38:58
decision for that organization. But I'm with you, I think you
39:01
have to kind of take this from an organizational approach to
39:03
say, OK, what are the thresholds?
39:05
How much rigor do we need to do to do return investment?
39:09
And, and a lot of organizations that I've been a part of and
39:11
seen worked with is they have maybe certain levels, if we
39:14
think the project is going to be $100,000 or more, it has to go
39:19
through this process and these types of calculations to be
39:21
done. If it's less than that, you
39:23
know, maybe there's less for it because again, they have a
39:26
little, maybe a little more leeway for a budgeting
39:28
standpoint. But I don't want to forget about
39:29
the small companies out there 'cause I work with a lot of
39:31
them. And, you know, for them, 50,000
39:34
might be their entire budget, maybe for security or for
39:37
whatever it may be. And we're talking, I think
39:39
we're, we just got to make sure that the, the Roy makes sense
39:44
and you're doing, you know, the right calculations that are
39:47
appropriate for the size of the organization.
39:49
That's a great point. I did want to bring out one more
39:52
point before I, I kind of start get off my soapbox, which is I
39:58
think one of the biggest ROI use cases that we have is whether to
40:04
insert something versus outsource something.
40:07
So then it becomes kind of a head to head.
40:10
I think as much as possible you want to make sure that you're
40:13
comparing apps to apples and oranges to oranges.
40:16
So we outsource, we get some not so good service or essentially
40:21
we in source and we get a not so good service.
40:23
But what I've seen a lot of times is people outsource and
40:27
they're not getting what they want and they make the decision,
40:30
OK, we want to in source. How do you make that case to the
40:34
business? It's usually we can do it for
40:36
the same budget and get a much greater service or we can even
40:40
do it for less than what we're paying now and get a much better
40:44
service, things like that. So I wanted to get Andre, are
40:47
you seeing that a lot in that, you know, head to head
40:50
comparison? Yeah, I'm.
40:52
Trying to look at that at first possibility calls our customers
40:56
wanted if they want to IGA environment.
40:59
The other discussion is do we install or outsource?
41:02
But there's another non is this case a maker issue about that is
41:07
farsity of people, for instance, Farsi knowledge so that that
41:11
often brings additional dynamics to the to the discussion at
41:15
involved with machines farsity. So outsourcing is more logical
41:19
for leather company companies without looking at the cost as
41:22
themselves because they don't have the resources available to
41:26
manage their own environment or they don't have knowledge to do
41:29
role modelling or having a secret management in place
41:32
because they don't acknowledge actually they're smaller
41:35
companies. Of course there's there's
41:37
there's also it looks like said no barrier to go to to SAS
41:41
environments. For instance, you had left to
41:43
IGA in the clouds, even ban in the cloud.
41:45
It looks like this the new way of the new normal for the bigger
41:49
companies. They have resources, but it's
41:51
still I am as a profession is still relatively small, non
41:56
succeeding per SE, non visible, but it's scarcity of employees,
42:01
scarcity of resources that's more pressing than the business
42:04
case such so, so far we didn't do a we do it.
42:08
It was was or twice a big comparison between insourcing,
42:11
outsourcing and then the financial issue wasn't the same.
42:16
It wasn't the the the trigger to make a decision mostly in
42:20
sustainability and having resources available knowledge,
42:25
experience to do it. So it's, it's a good question,
42:29
Jim, because this is relevant. People try to think, well, we
42:32
need to make an investment based on ROI or based on financial
42:36
information. But there are other dynamics
42:39
playing around having an having an impact on the decision
42:42
making. It can also be like culture, we
42:47
try to do everything ourselves. We want to do it ourselves or we
42:51
don't want to do it ourselves. It's another non financial
42:55
driver. That's that's what makes or
42:57
breaks decisions. So it's even though the business
43:01
case is relevant, every customer wants a business case.
43:05
Every of our customers is looking for what does it cost,
43:08
what does it bring and we have to manage it back to what does
43:13
it bring in the broad sense, not just the financial sense.
43:16
So the financial business case, it helped mostly because it can
43:20
help you make it planning for your investment.
43:23
And do I have to invest what for Beto 1, Beto 2 or Strange 123?
43:28
When are they coming? So you can prepare for the
43:30
expenditures, of course, but it doesn't make some decision about
43:36
investing or not investing the other parts to the qualify
43:40
quantify qualitative components are more important and they
43:45
should be more important because it's a business question and IT,
43:51
well, it's more focused on resort financial.
43:55
We need to have business days to do to buy new laptops versus
44:00
well that's a technical debt issue perhaps that for the
44:02
business you need to have the money available to to see the
44:06
value of investing in IM whether it's IGA or private access
44:11
management or consumer identity access management or zero trust,
44:15
the business should see the value of it and part of the
44:18
value of financial it's a lot a bigger part of the value non
44:21
financial might be. So we talked about really kind
44:25
of a bunch of quantitative and qualitative, right.
44:28
There's hard investment dollar save.
44:30
There is soft benefits like user experience or compliance, right,
44:35
or enabling the business, right, whatever you want to take from
44:38
those. I mentioned early on that we had
44:41
just done a show about setting up an IM program and we had a
44:43
question from one of our superior listeners, Chris Power.
44:48
He asked about the best metrics to track in order to prove your
44:52
ROI case. Are there?
44:55
So let me ask that explicitly, right?
44:56
What are the best metrics to track in order to prove ROI are
45:00
there like you should, your ROI should always have these 1-2 or
45:05
three numbers. Is there any guidance like that?
45:09
I. I'd say to ROI.
45:11
If you're looking for traditional ROI should have at
45:13
least all these components that you can identify what are the
45:17
savings? We know the costs, what what
45:20
saving components can we identify?
45:22
Can we because of automation get some more efficiency benefits or
45:27
that's, that's a concrete ROI case.
45:31
You could say that's that's one of the priorities that you need
45:33
to identify. So this efficiency benefits
45:37
should be calculated in the ROI. These are there are metrics for
45:40
that you could say in the article show some formulas.
45:43
As I said, think with the grain of salt, but these are formulas
45:46
that end up in result in a number and those numbers should
45:51
be calculated. It will not say that I don't
45:55
have a industry wide KPI for ROI investments.
46:01
I don't have that. I'm not sure if that's that's
46:03
there is available. There's one of those APIs
46:05
available. Perhaps you should come up with
46:07
those metrics. Perhaps in the body knowledge,
46:08
we can create a document metrics for IMF estimates, which at
46:12
least you should identify the different elements of the ROI
46:16
population. So rectify all, identify all
46:21
cost savings and all costs that's relevant.
46:25
And in your article I wrote about some 10 different cost
46:29
saving elements with calculation.
46:32
You should identify all those for your organization.
46:34
And as you mentioned before, just you said this is a small
46:37
organization, big organization. Yeah, that's that's that's a big
46:41
difference. Modesty.
46:45
Fun topics I found out in a long time ago was in the banking
46:49
sector. They have some regulations like
46:53
in Europe you got to Basel 4 and the Solbicee organization, I
46:59
believe the US has something similar.
47:01
And those metrics, they just those calculations metrics about
47:07
what are should your reserve as a bank B, how much is your
47:10
reserve? You cut your debt money.
47:13
How much debt money do you need for bad risks?
47:17
If you don't know your risks, you need to have a lot of debt
47:20
money. It's not not relevant.
47:23
You can't choose that. If you can, you reduce your
47:25
risk, you get less debt money. That money can be used
47:29
elsewhere. So if you can reduce your risk,
47:33
you can have more money available for doing business.
47:37
And I think identity access management can reduce the risk
47:41
of too many authorizations, wrong authorizations, wrong
47:45
identification of authorizations.
47:46
So identification, so you can reduce the effective right risk
47:51
thereby reducing the banks phrases the the reserve capital
47:56
requirements and make it possible for them to get more
47:59
money. So by saving like investing IEM,
48:03
you can get multiple way of the additional investment benefits
48:08
because you don't have to have that money and there's a
48:12
multiplier of one or 10 whatever.
48:14
So 1,000,000 capital can be used for 10 million investments
48:18
elsewhere perhaps not sure about those calculations, but so these
48:21
are also capabilities that you could should identify for your
48:25
branch, your industry. And so there's I'm not sure that
48:29
in industry wide KP is or success ratios or whatever we we
48:35
should identify all those costs and although it benefits the
48:38
financial ones to come up with anything that's called the RiRi.
48:44
But I'm not sure if we can say 10% or 2% of 100% ROI should be
48:49
calculated. So Andre, I think that, I mean,
48:53
even if your project is going to return 500% ROI, right, It seems
48:59
like, oh, that's an obvious one, we should throw money at it.
49:03
I feel like if you don't get the right buy in, the right support
49:08
organizationally is doomed to fail.
49:11
And I, I feel like there's a communication component to
49:17
getting buy in. So can you talk a little bit
49:20
about that? What's what are some best
49:22
practices for communicating and getting buy in for your project
49:28
and your return on investment or your business cases should say?
49:33
Yes, interesting that business case comes up in this hoping
49:37
because it's the most essential for starting any IM projects.
49:40
Like you discussed in the previous podcast, try to start a
49:46
project. There are different ways why you
49:48
should start a project and some of them are from IT department
49:52
like for some more efficiency or whatever.
49:54
So and they should have a way to communicate that need to the
49:58
business because you need the funding for an investor.
50:01
It's the IT project. So that we said we have to
50:03
follow the lower more communication lines in any
50:07
organization. So ITA should speak to a CTOCTO
50:10
should speak to the CEO. So to make possible to get at
50:13
least the awareness at the sea level where it's where the money
50:18
comes from. If the business case is start,
50:22
if the IM project started from FRIS as a compliance issue, this
50:26
compliance officer should stop with this cheap risk opera, for
50:29
instance. And they should speak with this
50:32
chief sickly of officials to make sure that there's awareness
50:36
about what we should need to do that breaks the money.
50:39
So don't try to directly communicate with one of the
50:43
stakeholders who has the money. Try to find a normal ways of
50:46
communication, try to find the relevant stakeholders that you
50:50
can influence because you cannot influence beyond your control.
50:55
So I worked another article about strategic alignments and
50:59
extra governance and there showed some models that you can
51:02
use for that too. And that and that help perhaps
51:06
find the the ways of communication between business
51:09
and IT. That's, that's the relevant
51:11
part. So even if IT thinks we're never
51:14
making a business case, they need to convince the business
51:17
that this is the business, that the business needs it.
51:20
So communication is key. And so if you want to start an
51:25
IM project or program, try to find out what's the driver,
51:29
what's the most important driver for that is the efficiency is a
51:31
compliance or a data breach or whatever.
51:34
What's the what's the issue? Perhaps competitors are doing
51:36
it. So that can be another issue.
51:38
I know for a fact that long time ago a lot of IGA tool for salt
51:43
on the on the golf course because well, they want CEO and
51:46
another CEO or the golfer play golf and discussing their own
51:49
investments. So he tried to find the the
51:52
right driver for the investments I am and they'll try to find how
51:56
can you influence the the correct stakeholders find the
52:01
right way of communication. Don't go directly.
52:04
That doesn't work. So I'm going to take that.
52:08
I know you wrote that other credo, it's called strategic
52:10
alignment and Axis government. So I'll put a link to that in
52:12
our show. It's well, it's probably a good
52:14
companion document, right, to read along with the business
52:17
case one. Look, I want you to get on with
52:20
your evening and I'm appreciative of your time spent
52:23
with us and kind of explain this.
52:24
And, and I think it was very helpful to talk through this
52:26
because it was super important for folks to really understand.
52:29
They've got to be able to articulate this.
52:31
They've got to be able to at least figure out some way to
52:34
communicate the value of the project typically, you know, or
52:37
the investment, I should say, typically a return on investment
52:40
calculation or even if it's just, hey, here's what we know
52:44
and here are maybe some unknowns and maybe here are some soft
52:47
benefits. And maybe there's a confidence
52:48
level that we could apply to say, hey, we're pretty sure
52:51
about this number. And maybe the further away you
52:54
get from that point, you know, there's a less confidence curve,
52:56
right? But I think that being able to
52:58
kind of articulate all that and pull it together helps show
53:01
you've done the homework. And yeah, whether it makes sense
53:05
or not is really going to be up to whoever's going to cut you
53:07
the cheque, right, right. For that spent.
53:10
Yeah. And like you said before, it's,
53:12
it's all, you know, creating awareness, communication,
53:15
creating awareness that we need this and it's not just a hobby
53:19
project for one of the project managers or whatever.
53:21
It's it's, it shouldn't really benefits the business.
53:24
That's why we need the business case to show that the business
53:26
needs it in whatever way. So I agree.
53:30
Jeff, I I think just to emphasize the last point that
53:33
Andrea was talking about with the stakeholders, I mean, if
53:37
you're going to go in there and say our identity project helps
53:41
enable these revenue growth, you better have somebody who's on
53:44
the revenue side of the house who is saying, yeah, those are
53:48
real numbers. I I agree with that because if
53:51
you come out of information security and talk about how
53:54
you're going to grow revenue, that's a not a good place to be
53:59
without that backup. Yeah.
54:01
Why is my CSO trying to figure out revenue?
54:04
I want them focused on risk reduction and you know, other
54:07
security related items. All right, we like to end shows
54:10
on a later note. Andre, we were talking before we
54:13
hit record about different languages and you speak multiple
54:17
languages. I can barely speak one.
54:20
Jim probably can speak it a little bit better than I can.
54:22
But talk to me about, first of all, what are the languages that
54:25
you speak and what are some of the differences maybe that
54:28
you've kind of noticed to say, OK, in English we do it this way
54:32
and in Dutch maybe do another or maybe other things like that.
54:34
Like what are some of your observations?
54:37
Lots of work phrase. I I have to speak a number of
54:40
languages. Dutch, of course, English a
54:42
little French, German. No, I think the goods has it has
54:47
at least as a tourist, I can make myself for it some Latin.
54:51
I had Latin on my high school a long time ago.
54:55
I buy some Frisian. So I speak, I know understand
54:58
Frisian. I don't speak.
55:00
It's just a few words. So quite a number of languages
55:02
and it's it's the the fun part is that Dutch and English are
55:08
quite alike because of the history.
55:11
A long time ago we got all those English speaking and Dutch
55:15
speaking sailors traveling the world.
55:17
So got a lot of words in common, but English language is a silly
55:21
language. So it's a lot of letters you
55:25
don't speak and where you write them and don't speak.
55:28
We got the same in spiritual. I'm not sure, but and what's
55:32
what's I, I think this difference is perhaps not just
55:36
the language within the people speaking the language.
55:39
There was just this stage this week, last week about our
55:43
Formula One driver, Max Firstaple.
55:46
He got the fines by the fear because he said that four letter
55:50
words that deemed well, not not nice in some English speak to
55:56
languages. Whereas in in Dutch language, we
55:59
just use that English words all of the time without it doesn't
56:03
mean anything. Just me.
56:04
So well, it's it didn't work out right, not as expected.
56:08
So that's the meaningless words. If you don't understand how we
56:12
use the words and how other people use the words, the same
56:16
word may end up being, oh, how do you say it?
56:21
Deal breaker since. And so it's, it's relevant that
56:25
we understand, not just speak of the word, also the context where
56:30
it's broken in. And so context is key in any
56:34
discussion. And so it's interesting to see
56:38
that, well, it looks simple, simple, but it's very complex.
56:42
Even if you can translate, translation doesn't bring the
56:45
cold text and doesn't give to real meaning.
56:48
So speak all those languages, it's sometimes it's difficult to
56:53
find the right words that's. Kind of funny because yeah, you
56:56
never know if you're, I might be saying something in English that
56:58
might be a swear words, right in another language or vice versa,
57:02
right? Is maybe you're saying something
57:03
it's like, oh, that sounds pleasant, and maybe it's not so
57:05
pleasant. We we use show verse all the
57:08
time for swearing so. You, so earlier you came you,
57:13
you mentioned and I guess it's, I don't know if it's an English
57:15
phrase like grain of sand, right.
57:17
What would be the Dutch equivalent, or maybe another
57:20
language equivalent of that idea of a grain of sand in that
57:23
context? A great yeah.
57:25
Grain of salt. Grain of sand, yeah.
57:27
A grain of salt, Yeah, sorry. Yeah, I'm sure I told Jacob
57:30
Speak one of. The language, I think even in
57:33
Dutch there are multiple ways of saying the same, having the
57:36
same, saying the same same same words.
57:40
It's hard to find it. I took right now I could work
57:43
with, but it's yeah, which which also say or can say something
57:50
like putting salt on the stale. So putting salt on a snail that
57:56
that's not good for the snail? Doesn't look so no, but it's all
58:01
we've got some other words that I cannot pronounce, but it's all
58:03
about putting too much things on detail or not one thing.
58:07
So like aren't rice and and if any wise out foolish is also the
58:12
same. So making small states
58:14
important, whereas other things are more important that are
58:17
neglected. So it's so with the same form.
58:22
It's creating those calculations.
58:24
Well, take those results with a grain of salt.
58:27
It's a result, but don't make it value too valuable.
58:32
You know, put too much value on the outcome of their
58:34
calculations. It's it may help, but don't
58:38
don't make it too important. So put the station perspectives.
58:44
Jim, what are you going to have your thoughts on this?
58:46
I'm sure 'cause you you've been to the Netherlands and you've
58:48
tried to read some of those Rd. signs, Yeah.
58:53
Yeah, I've tried to read some of the signs on the side of the
58:56
road and it's a lot of consonants shrunk together, so
59:01
sometimes I'm not sure how to say the words.
59:04
But one thing I found, well, almost everybody in Holland
59:09
speaks some English or speaks very good English.
59:13
That's throughout the country. So I stayed in the town called
59:16
Leiden for the most part. I visited Amsterdam, I visited
59:20
the Nord Z and, and there are a lot of words like that, like I
59:24
say, Nord Z, almost any English speaker can figure out that what
59:28
I'm saying is the North Sea, right?
59:31
And there are other words like the word for soup is SOEEP.
59:37
So you look at a menu like obviously, I think one of the
59:40
first things you do is you start to learn food.
59:43
Words. SOEP, was soup OK, I like.
59:47
Your You got to have your priorities, man.
59:49
You have to have your priorities.
59:50
Panacookins. Those were pancakes.
59:53
And like, you know, again, it's like it was surprising how much
59:57
like English, the Dutch language was now when?
1:00:02
Was I able to hold a conversation Dutch?
1:00:04
Heck no. But I could look at the menu and
1:00:07
figure out what I wanted and order it, and that's important.
1:00:12
This is where I pull out Google Translate on my phone and like
1:00:15
take a picture and like, OK, thank you technology 'cause I
1:00:19
bring you a very hungry boy. You can bring Jim.
1:00:23
There you go. He's he's my Google translator
1:00:25
if I ever go somewhere. Yeah, there you go.
1:00:27
We all get lucky, but we'll get pancake soup.
1:00:31
But that reminds me, of course, in In the Body Knowledge.
1:00:34
I tried to write English, but if you see the articles in Body
1:00:37
Knowledge, they're not what I've written.
1:00:40
We've got some good editors like Heather and Elizabeth, and
1:00:46
thanks to those people, the articles I would read otherwise
1:00:49
you would read my English, which is not not readable for you
1:00:54
guys. So all praise goes to those
1:00:57
editors. Am I happy with those?
1:00:58
Otherwise it would be my hobby work and you wouldn't understand
1:01:02
what I would mean. And you can't even just take
1:01:05
like the article and like paste it into Google Translate because
1:01:08
the context right, is not there. And sometimes the the
1:01:11
translation is just doing word by word by word versus let me
1:01:14
scan the entire document and try to infer context.
1:01:16
Maybe AI makes that better. I mean, we're seeing
1:01:18
improvements there, but who knows.
1:01:20
So we'll see. But thank you for writing the
1:01:22
article. I think it's been very helpful.
1:01:23
Again, I'll have a link in our show notes for both of the
1:01:25
articles that you wrote. There was the business case for
1:01:28
IM and then the strategic alignment and access governance
1:01:31
document that copes really well with that.
1:01:33
So and we'll also have a link to you in our show notes.
1:01:35
So people have questions, want to reach out.
1:01:38
It looks like it's KOOT in English.
1:01:40
I paroused it as Koot. It is Andre Koot.
1:01:44
So there we go, another language thing, but I'll have a link to
1:01:48
your LinkedIn profile so people can can reach out if they've got
1:01:50
questions. And yeah, thank you so much for
1:01:52
taking time with us today. We'll let you get on with your
1:01:55
your evening and enjoy the rest of it.
1:01:57
As far as Jim and I concerned, we're on the web IDAC podcast
1:02:00
dot dot com X and Twitter or whatever you want to call it at
1:02:04
IDAC podcast, the YouTube channel still going,
1:02:07
idacpodcast.tv. And then, yeah, connect with us
1:02:10
on LinkedIn, send us comments. Great question again from Chris
1:02:12
Power, really kind of getting into the show and and helping us
1:02:15
out with, hey, what are the things that people want to hear?
1:02:18
Let us know so we can ask our guests or we can find a guest
1:02:20
that maybe can kind of talk with more authority on that subject.
1:02:23
So it's very helpful for us. So with that, we'll go ahead and
1:02:25
leave it for this week. Thank you everybody for watching
1:02:28
and or listening and we'll talk with you all the next one.
1:02:33
You've been listening to Identity at the Center.
1:02:36
We hope you've enjoyed the show. Make sure to like, rate and
1:02:40
review, and we'll be back soon. But in the meantime, hit the
1:02:44
website at identity@thecenter.com.
1:02:48
See you next time on Identity at the Center.