Latest / Identity at the Center / #245 - Taking IAM to the Bank with Dave Middleton of Bank of America

Transcript

#245 - Taking IAM to the Bank with Dave Middleton of Bank of America · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:22
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff.
0:26
How are you? Not so bad yourself.
0:28
Good. Just got back from a couple of
0:31
conferences and at the Octa conference Octane, I recorded a
0:35
lot of video interviews. I think I've told everybody this
0:39
and I've uploaded all those now to a cloud drive and you've had
0:44
an opportunity to review them and what do you think?
0:48
I appreciate the intent. You know, some of them were very
0:51
good, some of them were not very good, mostly technical issues.
0:54
So like the quality for conversations that you had with
0:57
some of the folks like Mike Pastori and let's say Daniel
1:01
Gabriel and trying to think who else?
1:04
Oh, Andres Aguilar, like those all came out, you know, pretty
1:07
well. I'm not a fan of the microphone
1:09
that you used. I'm just straight up.
1:10
I'm just telling it. Being I've had cocktails that
1:12
cost more than that, that microphone.
1:15
And it shows. Or that shows, but you can hear
1:19
it, that's for sure. I've done what I can to try and
1:22
fix it, but I texted you after I was done putting together like a
1:25
rough cut and I said you need to throw away that microphone and
1:27
never use it again. So that's probably $17.00 that
1:31
you'll never get back, but you got $17.00 worth out of it but
1:36
not great quality. But it's coming together.
1:38
You have like 2 hours of footage and I'm like Oh my gosh, OK,
1:41
Like this is gonna take me forever to kind of go through
1:43
and put it together. It was one of those things that
1:45
didn't feel like two hours and and that I mean it's just so
1:49
fortunate that people were willing to spend the time with
1:52
me and kind of give their views on how the conference was going
1:56
and what they're working on. And you know, so heartfelt
2:00
thanks to all those who participated and I'm, I
2:04
apologize in advance that you know the audio quality was so
2:08
poor and I shot the whole thing on my iPhone.
2:11
So I'm I'm sure most of the people I was interviewing were
2:13
like this is not gonna be, this is gonna be low quality, this is
2:17
like the low rent Idak podcast. You know for the first time
2:21
doing it. Not bad.
2:23
Yeah. I'm giving you notes as a as a
2:24
director at this point it not bad.
2:28
Like the the quality of the content is good.
2:32
The production values around if it's really need some help but
2:35
that's why it's a learning experience.
2:37
I'm gonna I I think you should also apologize to Eric Olden and
2:41
Steven Strong. Because those interviews did not
2:44
work at all. There was no audio.
2:46
So the conversations you have with them are lost to everybody
2:49
except your except the two of you guys.
2:51
When you were talking and interviewing with those guys.
2:53
Yeah, I feel really bad about that.
2:55
But I I think I warned everybody that, hey, I'm doing my best and
3:01
this microphone cost 17 bucks free shipping.
3:05
So what do you got to? Do.
3:09
Yeah, so I you have like 2 hours of footage.
3:11
I did some ruthless cuts to it and it's still almost an hour
3:16
long. This video, there's probably
3:18
gonna be some more ruthless, even more ruthless cutting.
3:21
But I was like, cutting out. Nope, that doesn't matter.
3:23
Nope, that doesn't matter. Just trying to whittle away,
3:26
like whittle away big chunks of things that are like, you know,
3:30
not necessarily, like, not interesting or entertaining, but
3:32
really don't add value right to kind of like video.
3:35
And it's still like an hour long man.
3:36
So. Yeah, it'd be hard to get it
3:39
down to 10 minutes, isn't it? Oh.
3:40
There's no way, there's absolutely no way to be 10
3:42
minutes unless you want everyone to sound like chipmunks and they
3:45
have it on like 10 times speed. And there's like, yeah, there's
3:49
like 3-3 different things. It's like hello, goodbye, see
3:51
ya. You know, stuff like that.
3:53
I am stands for Identity Access Management.
3:56
OK, Great job. Right.
3:58
And then the identity to the center logo spins and then we're
4:00
all good and we're clear. No, it's it's the first time
4:03
we've done that. So it's kind of cool to kind of
4:05
put something together like that and.
4:07
And see what we can do in that vein.
4:09
We did try to do live streaming. What is it almost two years, two
4:12
years ago, I guess at this point, and we just couldn't find
4:16
a good time to do it. That was like consistent and
4:20
maybe this is a way we can do that in the future.
4:23
Yeah, for sure. Well, we're back to our audio
4:25
format. We got a fantastic guest.
4:27
You want to go ahead with that? Yes.
4:29
So let me read this disclaimer and then we'll get going.
4:31
This podcast is for informational purposes only.
4:35
The content should be regarded as general information and serve
4:37
as a springboard for your own independent investigations.
4:41
All perspectives expressed hereafter are my own.
4:44
When you say my, that means our guest, Dave Middleton.
4:46
He's the Senior Vice President at Bank of America.
4:49
He's responsible for I Am and Cryptography Product management.
4:52
Welcome to the show, Dave. Hey, Jeff.
4:54
Hey, Jim. It's with pleasure and plights
4:57
to have me on today. Thanks for protecting me by the
4:58
way, with that disclaimer. Well, yeah, you know, part of
5:02
the family. We want to make sure we take
5:04
care of our, you know, our our friends, our family and the
5:06
people who take the time out to, you know, be on this, you know,
5:09
podcast that we do, which is pretty cool.
5:13
You know, it's it's interesting when we have these conversations
5:16
and we always kind of like to find out what people work on,
5:19
but. I wanted to make sure you're
5:21
covered. So we've got the disclaimer out
5:22
there, pains in your own. We were kind of joking around
5:24
before we actually hit started. It was like, this is probably
5:26
something we probably should have already for us anyway, Jim
5:29
and I, 'cause we run this as sort of a little bit of pirate
5:31
radio outside of our day jobs, but so far we've gotten away
5:35
with it. So I'm not a fan of like, you
5:37
know, red tape and think rules that we don't need unless we
5:40
have to have them. And so maybe we'll keep riding
5:42
that that wave as long as we can, but now that we've got sort
5:46
of the formalities out of the way.
5:48
Welcome to the show. We met actually earlier this
5:51
year at Identiverse, I think for the first time.
5:54
We did and and that was a lot of fun.
5:57
It was great meeting you there. We went and did the karaoke
6:01
thing that night and you actually got on stage and sang,
6:04
which was awesome. I haven't told many people about
6:07
that one. I actually serendipitously met
6:10
Jim last year at Gardner. He sat down at the B of A table
6:13
for breakfast. So.
6:14
We've had a couple different run insurance together at this
6:16
point, but karaoke that one was top of mind, but now it was back
6:19
of my head. Hey Dave, we we have, we have
6:24
video. There is video that is for sure.
6:27
We have not. I, I, I, you know, we we protect
6:29
the people that we like and so that video has not gone out.
6:32
So stay on our good side. So you've got some history with
6:37
us, you know, outside the podcast, but for folks who
6:40
aren't familiar with Dave Middleton.
6:43
Tell us a little bit about your origin story when it comes to
6:45
identity. How did you get into the world
6:47
of identity and access management or digital identity
6:49
or whatever the heck we're calling it these days?
6:51
Is it something that you chose or did it choose you?
6:54
It's a great. Question.
6:55
My origin story really starts 1213 years ago, back at
6:59
University of Michigan, where I identified a problem in the
7:02
healthcare space in fact, and I would argue that identity found
7:06
me intrinsically at that time. Electronic health records, they
7:10
were paper based, often lost, didn't support things that
7:14
researchers and doctors needed. And really our persona and the
7:17
target users that we were after at that time, what their need
7:20
was, was to conduct research out in the field in developing
7:23
countries like Haiti. So the challenge they're in is
7:27
being the data was manually recorded.
7:29
The delivery analysis was delayed back to the onshore
7:32
doctors and researchers and that of course reduces and
7:34
decelerates not only the insights but the care for some
7:37
of those that are most in need in developing countries.
7:40
So we took that idea, we actually ran it through
7:43
University of Michigan startup incubator, won several
7:45
challenges along the way, did all the fun jazz at a startup
7:48
includes built and deployed a product that I would argue was
7:52
ahead of its time because this was back around 2010.
7:55
And in short, the solution what it actually entailed was.
7:58
HIPPA compliant Google Excel databases, so AWS on the back
8:03
ends but configurable front end to make it super simple for
8:07
researchers to stand up. Forms make it easy for the
8:10
actual folks to position the responses they're in, but I
8:14
still have some some nightmares from those days where.
8:19
Researchers and doctors back in 2010, they would point in the
8:22
literal clouds in the sky and say so my data is going up there
8:25
and we would talk to them about cloud databases.
8:27
So fortunate to say no longer a big challenge across the
8:30
industry these days, or not so much but.
8:33
That was certainly an interesting time, and why I
8:35
argue Identity found me is because you can't really solve
8:39
that particular challenge without managing the full
8:41
identity life cycle, both from a client as well as an
8:44
administrator perspective. I feel like there's like that
8:47
that meme, right? Old man yells at cloud.
8:49
Because you're trying to like, where's this data coming from
8:52
now? You're a real person doing real
8:55
identity things in the real world, right?
8:57
So you work for Bank of America and you're a product manager
9:00
doing identity things. I always love hearing you know,
9:03
what is your day like, your day job like, right?
9:05
For people in the business because there's so many
9:07
different ways that people can get into identity and do things
9:10
in the identity world. Tell us a little bit about your
9:12
role. You know, I guess, what does a
9:14
product manager do? Yeah, product managers, it's
9:17
still one of those roles that is still trying to find its, its
9:21
space and identity even within cyber broadly speaking, it's a
9:25
little difficult to answer black and white.
9:26
So I'll answer it in a simple perspective, which is.
9:31
My role really binds together the business architecture,
9:34
technology teams, lines of businesses, and even risk
9:37
functions toward unified common objectives that ultimately
9:41
reduce risk but also customer friction along the way that
9:44
result in just better security controls as an outcome.
9:47
That sound very much like a Wikipedia entry.
9:50
Take me through your your daily, I don't know, like what'd you do
9:55
today? You have meetings, You're
9:56
working with the business, solving problems.
9:59
Take Take me a little bit more behind the scenes.
10:00
Yeah. My, my, my day-to-day is a bit
10:03
more prescript than that. So what I love about the job,
10:06
it's a lot of voice of the customer extracting different
10:09
requirements and use cases. We have our hands in the pot
10:12
when it comes to initiative planning, strategy, both from a
10:15
business and technology perspective.
10:17
So a lot of the fun comes into dispositioning.
10:20
Are we going to build versus buy a product?
10:22
Are we going to invest versus divest?
10:25
And a lot of that in order to make informed decisions there
10:28
in, it does require a significant amount of things
10:30
like vendor research, external exposure, evangelism into our
10:35
internal customer workforce, IE the enterprise and workforce
10:38
itself. But it's often times a balancing
10:41
act and that's what I really enjoy about the job.
10:44
But it's a lot of calls and a lot of meetings every single day
10:47
in order to produce a lot of the artifacts that we need in order
10:50
for the bank to be successful as an outcome.
10:52
What do you think makes for a good product manager in the
10:55
identity space? Communication, I would argue is
10:59
#1, being able to break down a lot of technical concepts and
11:02
put them into business legible terms.
11:06
So just kitchen English in short.
11:08
But if someone has the skill sets of being a very strong
11:11
communicator. If you are organized and
11:14
fast-paced and you really like to work on technology but not be
11:18
code crushers like some of our developers and the smartest
11:20
people of the bunch. You can always be an effective
11:24
product manager, but I'd argue, Simply put, be an effective
11:27
communicator. Be organized.
11:29
You still need to be a little technical, but you don't always
11:32
even need to even write. Code.
11:33
Yeah, I love that the way you describe that, because I feel
11:36
like that is AI, don't know, missing link sometimes for a lot
11:39
of organizations where they got really smart technical people
11:42
and then there's no one to help them with their message, right.
11:45
So like OK that's great. You know we still need to talk
11:48
about change management and how are we going to you know?
11:51
Communicate these these changes to their customers or whatever
11:53
it may be, you know whoever your customers are internal or
11:56
external, whatever whatever that is.
11:59
I know that Jim, you and I have been spending a lot of time at
12:01
conferences the last month or so and I feel like my conference
12:06
season is over at least. Are there anything else that
12:09
you've got kind of on your radar for conferences, Dave?
12:12
I do. There's a a couple smaller
12:15
events that are coming up here in December, so identiverse.
12:19
They have a A2 regional events. One is on December 1st in New
12:23
York City, the other one is December 5th in Chicago and I'll
12:27
be in attendance in the Chicago one.
12:29
Hopefully we'll have a pretty big presence.
12:32
So I would love for some folks to come out there, meet us and
12:35
we can talk through some of the fun jazz of what I am as.
12:38
So Dave, one of the things that you mentioned was you know was
12:42
the 12 years ago you're working on that project at U of M And I
12:46
know just from you know our relationship that one of the
12:49
things that you're pretty passionate about is working with
12:53
young people who are coming into the industry, coming in and and
12:57
probably learning probably I am is choosing them.
13:01
But I'm wondering you know can you talk to us a little bit
13:04
about why that's important to you?
13:06
And then also, are the universities doing a good job
13:09
to, you know, get people prepared for the types of
13:13
challenges that we see in in identity?
13:16
So a fantastic question, You're totally right, Jim.
13:19
Cultivating young talent is very important to me.
13:22
A couple different angles I'll actually take with that.
13:24
So one being disadvantaged youth, these are these are
13:30
younger the the younger generation that just simply
13:32
didn't have the same opportunities as many of the
13:35
rest of us. So the bank does actually
13:37
partner with some really good programs out there, one being
13:40
year up. Europe is a program that
13:42
actually partners with a lot of large companies, even in the
13:45
cyberspace. But here in Chicago, there are
13:48
lots of companies involved. B of A is one of them.
13:50
We work hand in hand with lots of top cyber colleges like
13:54
DePaul here in Chicago, and what that allows us to do is actually
13:57
bring in a lot of this younger generational talent that doesn't
14:00
even have any experience in the workforce.
14:02
But they held a lot of promise in high school.
14:05
These are folks that may not have been able to pay their way
14:07
through college, but they're highly intellectual.
14:10
They join a cyber program for six months and then we try and
14:13
pluck them into a a year long internship or so here at the
14:16
bank. And we've been able to roll
14:18
successful talents into our workforce using programs like
14:21
that and mechanisms there in. So that's one program year up in
14:25
particular that I'd recommend that everyone at least takes a
14:28
look at just for some talent pipelines.
14:31
Addition additionally there the other way is just college
14:35
interns and the bank is also hugely committed to that.
14:38
We had our largest global technology cohort this
14:41
particular summer in fact. So your questions quite timely
14:44
there Jim. And therein, to tail off the
14:47
second part of your question, what I love about college
14:50
programs these days is that there are actual dedicated
14:53
cybersecurity degrees. Even more so you can actually
14:57
like get a degree in authentication or even something
14:59
that's pretty weed level and even. 1015 years ago, back when
15:03
I was in college, that was not even on people's road maps.
15:06
So I think it's fantastic now that there's technical degrees
15:09
that people can get. I had a wonderful intern myself
15:12
that's studying cyber this year and she'll be joining us next
15:15
year at the bank. But both of those particular
15:18
pipelines and why young generational talent is super
15:22
important is because a lot of us, we've been sipping the
15:24
kool-aid for a lot of years here.
15:27
So it's always interesting. Hearing a lot of just the newer
15:31
generation coming into the workplace and seeing what they
15:34
have been taught and also challenging them in creative
15:37
ways, like how can they actually apply it after learning about
15:40
the ecosystem and building up their own institutional
15:42
knowledge, yeah, that's that's really awesome.
15:44
I think there's a lot of dual benefit, you know, benefit for
15:48
the person who's interning or doing some kind of
15:51
apprenticeship, but also for the bank you just mentioned your
15:54
intern's going to come back and work for you at a later date.
15:57
So it's hard to find really good talent these days, especially
16:02
with there's more jobs than there are people.
16:05
I wanted to kill something else that Jeff said, which was, you
16:09
know, I, I am more digital identity or whatever you're
16:12
calling it. And we we had an episode where
16:15
we asked some of our identity friends what's the difference
16:21
between digital identity and identity and access management,
16:25
one of the most popular episodes.
16:27
And I'm going to pose that question to you.
16:28
What's the difference between Digital identity and identity
16:32
and access Management? I love this question.
16:34
I'll give you a more verbose answer on the first one being
16:37
digital identity. So to me, Simply put, digital
16:42
identity is the thing. Or entity that is protected
16:46
ranging from a person, organization, application,
16:49
device, or more. I also agree with many others on
16:52
this particular show that these questions are contextual.
16:55
So within the context of human digital identity, to me that
16:59
means being able to piece enough piece together enough
17:02
information or data to reconcile it back to one person.
17:06
And I truly believe that that's mission critical for us,
17:09
especially now that we see 2/3 of cyberattack anatomies
17:12
involving credential compromise. So with surety we need to know
17:16
who's interacting with our systems, ensure they have
17:19
minimum access to do their job, but no more than that.
17:22
And I actually tried to come up with a little bit of a metaphor
17:26
to this. Jim, I anticipated this question
17:28
just giving you, you ask it to a lot of your other folks that
17:31
come on this show to present. And the the one thing I wanted
17:34
to share with this group, we'll see if it sticks.
17:36
But if you think about a fingerprint in the physical
17:40
world, it's. Much easier to lift that
17:43
fingerprint from substances like steel, more difficult from
17:48
substances like wood, and almost impossible from water.
17:52
But if we translate that into a digital world, there's a careful
17:56
balance where between that we're trying to balance all the time
18:00
between security and user interaction and user interaction
18:04
points in the technology world. If they're tough like steel,
18:08
they might provide better security.
18:10
But at the expense of being harder for the user to use, and
18:14
while users want to interact more fluidly, hopefully we can
18:19
try to strive for something like wood and less for something like
18:23
water, because water is far too volatile for us to wrap any
18:26
security controls around. But what I argue is that it's
18:29
our job as security professionals to find the right
18:32
balance within our own respective risk tolerances.
18:36
And maybe we throw some talcum powder around the wood.
18:39
And ensure we can recover enough substance to link it back to a
18:43
specific person without too much friction.
18:46
That's that's really cool answer.
18:49
You know Dave, I've been thinking with you know what are
18:52
the challenges that you know Dave probably faces that a lot
18:57
of folks don't face. And I kind of thought, you know
19:00
what's unique, one, not completely unique but very
19:05
influential in your environment is the scale, the number of
19:11
employees at your organization. And for organizations that are,
19:18
let's just say much smaller, maybe up to like 4050 thousand
19:23
users even or maybe smaller than that, at least the attitude used
19:27
to be user experience for internal employees doesn't
19:31
really matter. You know, we pay them, they're
19:34
going to deal with whatever dog food we throw at them.
19:38
So my question to you is because I think it's got to be a lot
19:42
different for you. You know, I I would imagine user
19:45
experience is such a much more important factor.
19:51
So my question is, what are your thoughts on the balance between
19:55
security and usability when you're designing your IM
19:58
solutions? Yeah, there's a a careful
20:02
balancing act there. And I'd actually say like
20:04
between security, the way that I like to simplify this is, is
20:08
really a triangle like on one aspect we have security, another
20:12
points we have privacy and the third one we have user choice.
20:16
The reason for that is it's really difficult to find that
20:19
right balance. And to your point, Jim, we can
20:22
get away with more when we're trying to introduce additional
20:25
security controls on our enterprise and workforce like
20:28
security can become more paramount.
20:30
But we still cannot strip the usability and thus the user
20:34
choice away from the employees too much.
20:36
And especially at large financial institutions like
20:40
ourselves, if we are able to bottle up all of the regulatory
20:45
concerns, it does allow us to really push the bleeding edge of
20:49
technology. So what I really like about the
20:52
bank, at least it we can push a lot of innovation.
20:55
And when we think about usability, a lot of our, the way
21:00
that we make decisions today come back to ROI because we know
21:03
from a security standpoint we're pushing a lot of the most
21:06
innovative technologies there are.
21:08
So it allows us to actually strive more toward that
21:11
particular user choice perspective and thus the
21:14
usability aspect of the triangle more than we have before and the
21:18
better that we can be from a a process, people and technology
21:22
perspective. And that's by the way, my answer
21:25
to what I am is it's the collection of those three
21:27
things. It it's it's Once we get the
21:31
security aspect right, then we can start to have a lot of fun
21:34
from a usability standpoint. Yeah, use the term earlier,
21:37
kitchen English. And I thought, I I mean, I
21:40
always use the term plain English, right?
21:43
But the idea is that rather than throwing techie terms at your
21:48
people who they just don't have time for it.
21:50
I like the kitchen. You don't want to understand it.
21:52
It makes it sound delicious. Yeah, maybe.
21:56
Maybe I'll steal that term. English I I'm, I'm probably
21:59
gonna steal that, just FYI. And I'm not gonna give you any
22:02
credit. Yeah, please do add it to your
22:05
production. I love love to hear it.
22:07
So when you're creating the souffle of your Identity Access
22:12
Management system, what are your thoughts on that?
22:14
I mean, you know, I think I've made my thought pretty clear.
22:17
Like, people just don't wanna deal with these.
22:21
Technical terms and don't want to understand it.
22:23
Yeah, let me share an example. Perhaps SO11 is around Really
22:29
when you think about Kitchen English, I think one age-old
22:34
industry challenge we have an IM is permission descriptions and
22:38
to just break that down a little bit, I know that's a lot of
22:41
these terms can be easily conflated.
22:43
But when I say a permission, it's really the logical
22:46
representation of how we secure the physical asset itself.
22:50
And then we think about it, especially at a lot of
22:52
companies, what goes into promoting business comprehension
22:56
so people can make more informed access control decisions, like
23:00
when someone orders access, when they approve it, certify it, a
23:04
lot of the, a lot of the basics when it comes to access
23:08
management. But how do people actually make
23:11
that decision today largely revolves around permission
23:14
descriptions. And if you think about a
23:16
permission description, they are almost always very human and
23:21
manually intensive. Free form novels of text
23:25
immediately go out of dates all the time and it's our best hope
23:29
is to hopefully we're helping promote business comprehension.
23:33
But the challenge that a lot of us deal with is that business
23:37
permission descriptions, while we strive to resolve that
23:40
particular pain point for the business from a control
23:43
perspective, permission descriptions don't do a lot
23:47
right. Like you can't drive really cool
23:50
sophisticated controls with a free form text field, but it
23:54
hopefully we're helping out the business there.
23:56
So that's a good example I would say in terms of trying to strive
23:59
for something that's kitchen English, but it it's something
24:03
that is almost a a cycle of insanity I argue but what what
24:07
are your two thoughts? And just like permission
24:08
descriptions, broadly. I mean permission descriptions.
24:12
I think it's ultimately important, I think, having
24:14
metadata around your entitlements, your groups, your
24:17
roles. Naming them properly is #1.
24:22
And then having good descriptions and then
24:25
identifying the owners. To me that's the, you know,
24:28
that's the if you don't have those things lined up and you
24:32
want to move on to something like role based management, it's
24:35
like clean up your, clean up your house before you you put it
24:39
up for sale because this isn't going to work this way.
24:42
What do you think, Jeff? I like building Access catalogs.
24:47
I probably you're super weird in that regards.
24:49
Now I'll tell you what I don't like is I don't like the trying
24:53
to figure out, you know, the combination of roll base, access
24:56
control and things like that. I think that is extremely
24:58
tedious. But the reason I like building
25:00
an Axis catalog is because it's one of the few touch points that
25:03
an IEM system, especially in an enterprise setting, actually
25:07
touches the end user from a experience perspective.
25:13
The number one complaint that I was here when we're talking
25:15
about IGA specifically is, oh, I'm being asked to do this
25:18
access review for this entitlement or this permission.
25:21
I have no idea what this thing does.
25:24
And it's, you know, it's like some gobbledygook AD user.
25:28
Yeah, group name that was created, like, I don't know, the
25:31
90s or whatever first came out. And it only makes sense to like
25:34
the person who created it who hasn't worked there in 20 years,
25:37
right? Or whatever it is I feel like.
25:41
My my strategy when I go off and build an Axis catalog is it is a
25:44
customer facing product of the IEM program and that means I can
25:50
impose very strict standards for data quality and usability in a
25:56
kitchen English format To to steal a phrase from somebody I
26:00
know to make it easier for my end users to be able to use the
26:05
services that I'm providing to the enterprise.
26:09
You go in, there's keyword searches, the searches make
26:12
sense, there's tagging, and it's very easy on the screen.
26:16
It's like, oh, if I select this thing, here's what that
26:19
permission does, or this bundle of permissions does, like for an
26:22
individual, I like doing that. And that's because it goes back
26:26
to this product mindset of I love to treat I am as a product
26:30
for an organization. So call me weird, but I like
26:33
that part of it. Not necessarily sitting through
26:35
reams and reams of, you know, CS VS or sequel tables or whatever
26:39
it is, right? Trying to like, you know,
26:41
actually put it together. I mean, I've done it.
26:43
Not, not, not the great, you know, not not my favorite thing
26:45
to do. But I understand there's
26:46
certainly a value for it. But I love the idea of
26:49
productizing an Axis catalog and you have to have it be usable
26:53
for that to work. Really appreciate both, both
26:55
both of your perspectives there and I I would say like what if
26:58
as an industry we moved and and started to de emphasize
27:02
permission descriptions in favor of things like metadata
27:06
cataloging and empowerment. So like more metadata is better.
27:10
We can use that metadata to your points Jeff to drive things like
27:14
control planes or even from a usability perspective allow
27:17
people to click on a label that exposes relatable items.
27:21
But even more so, there is a state that we can achieve in the
27:24
future by gathering all the metadata, gathering it in a
27:28
standardized capacity, and then almost leveraging a system to
27:32
try to piece it all together into a maybe even just to catch
27:35
an English sentence. But what a lot of that requires
27:38
would be a robust metadata cataloging, tagging as much as
27:42
we can about the things that we care most about, right?
27:45
Like what? What?
27:45
What are the attributes that the physical assets that are heavily
27:50
reliant upon the target system they're in figuring out Like
27:53
what are the most sensitive things that we care about as
27:55
from a technology perspective to do really cool control plane
27:59
behavior, but also from a business perspective what do
28:02
they need to make the most informed decision?
28:05
I feel like this is a little bit of a big data problem almost
28:08
because you've got so many different points of information,
28:12
none of them are standardized. They might be standardized
28:14
within an application, but application A is going to have a
28:17
different set of entitlements and application B.
28:20
They might not even use the same structure.
28:21
They may not even use a structure at all.
28:23
It just might be on or off and that might be it.
28:26
I'm curious to see where things like potentially a large
28:31
language model might help sift through that and make it more
28:35
user friendly to say, here's what I'm trying to do, I want to
28:37
be able to, you know, update the customer relationship management
28:41
platform so that I can tag a new opportunity.
28:45
I don't need to know that that's like.
28:47
This row in the Salesforce matrix that does, you know this,
28:51
this, you know, specific task, right.
28:54
Somewhere, I think there's like this marriage of this data model
28:58
and figuring out how to make that usable in a kitchen English
29:02
interface to say, hey, this is what I'm trying to do, you know
29:05
how do, how can we, how can we make that better for people?
29:08
Yeah, I feel like it's it's got to be the answer to use some
29:12
level of automation, some level of.
29:16
Big data and artificial intelligence, because people are
29:20
just not good at at this. And here's the real challenge, I
29:25
think when you get to like access catalogs or you know,
29:29
when you have over 100,000 employees, like how many Active
29:33
Directory groups must you have? Probably at least 100,000,
29:37
right? And just because you know your
29:41
metadata. Doesn't seem to know what that
29:45
group is used for because maybe it's not assigned to an ACL
29:50
somewhere that it's it's reverberating and scanning.
29:54
Does that mean you can just go ahead and delete it?
29:57
Good luck with that approach. A little scary right?
30:01
But you know, following on with, you know, things that humans
30:06
really can't do and that you need machines to do.
30:09
This whole idea around risk based.
30:12
Access governance, you know and and maybe giving people access
30:17
based on the risk that they have or creating access
30:21
certifications based on unacceptable risk levels.
30:25
Dave, is that something that you're incorporating into the
30:29
way you do things? Yeah, I would argue and I'll
30:32
help bridge the gap there to wrap up the previous thing
30:35
there. So I'm on board with that's like
30:38
metadata consolidation and almost trying to treat a next
30:43
hop like away from the target systems to consolidate that.
30:46
I think that that could help us empower things like gathering
30:50
natural language models, build a legible description for our
30:53
users. But to feed that into your
30:55
question, Jim, call me crazy, but I'm, I've always like to
30:59
think this is also another great part about product management.
31:02
We get to think years into the future and when I think about
31:05
even some of the terms like identity, governance and
31:08
administration today, I really like to think about what's next,
31:13
What does the industry next have in store.
31:15
And I would love for us to philosophize on things like risk
31:19
based access, governance that's having humans again doing less,
31:23
having machines doing more, trying to leverage some of the
31:27
innovative technologies that are coming out today in order to
31:30
move us more toward things like prescript policies in the
31:34
future. And one of my thoughts on this
31:36
is thinking about well I'll assume for a second most most
31:40
folks are aware on this show of of things like access policies
31:44
that's you nailed some regarding role based access policies or
31:48
even birth rights. But it is our duty and this is
31:52
something that we all need to strive for is breaking down a
31:55
lot of the the technical gobbly gook of what a developer has to
31:58
codify in the form of a policy because ultimately it's the
32:01
business that owns that risk and their their appetite.
32:04
So we're only as good as being able to have a business person
32:08
come over the fence and tell a technologist what they're trying
32:11
to do. And when I think about risk
32:13
based access governance broadly, I really like to play around
32:17
with this topic around the form of access imperatives.
32:21
So it tries to move us away from the standard policies but more
32:25
toward imperatives. These are the the foundation of
32:28
how a business can ultimately interact.
32:31
I think I have a few different types of of forms of imperatives
32:34
we can play around with, but any thoughts from from either one of
32:38
you on that? I don't know for sure yet
32:40
because I think there's so many answers to this question and
32:42
none of them feel right other than I know everyone struggles
32:46
with role based access control and they're like, yeah, we want
32:48
to be role based and it takes forever.
32:50
It's hard work and then it's immediately out of date as soon
32:53
as you created it. So now you're like, OK, well
32:56
that was a great exercise. How are we going to keep this
32:57
thing going? I'm a fan of a more layered
33:00
approach taking things like attributes and policy based
33:03
access control and to do that you do need the data, you do
33:06
need to have good quality data that is you know, mastered and
33:10
stored in places that are kept up to date, those sorts of
33:14
things. So I, you know, I I think guess
33:17
we should be moving towards it, but I think the real world has a
33:20
nasty habit of getting in the way of where of where we want to
33:25
be. I I think there are certainly
33:27
some. Some initiatives out there like
33:30
open policy and other things that are like that where they're
33:34
trying to define the authentication side of things
33:38
because I feel like we've done a good job as an industry of
33:40
tackling authentication. I'm sorry, did I say
33:42
authentication and authorization, Authentication,
33:45
We have SAML, we have Open ID connects, right, things like
33:47
that. We even have scam for, you know,
33:49
provisioning. What we don't really have is a
33:52
standard for authorization. And I think there are things out
33:56
there like open policy, I think AWS has Cedar, you know there's
34:00
there's a few different things that are kind of out there.
34:03
But I'd love to see a standardized way of approaching
34:06
authorizations within an application versus everybody
34:11
does it their own way. When I think about like P back
34:13
and A back, I think there might be a way for us to wrap that in
34:16
things like imperatives in the future.
34:18
And I'll, I'll, I'll, I'll describe imperatives for a
34:22
second. So four different types, type
34:25
one would be something like must have, must have is something
34:29
that just would never go away. It's birthright policies to the
34:33
book. If we pair that with something
34:35
like should have, should have is something that we wouldn't hold
34:38
forever. But do we need to really send it
34:41
for an approval? And that's really like a
34:44
theoretical question to its core right with the third one being
34:48
can have, what can have is something that if you just think
34:51
about the default posture of IGA systems and vendors today that
34:55
where triggers an approval workflow sometimes several
34:58
sequences there in that is where we are at today as an industry
35:01
which leaves us with must never have.
35:04
So that's stuff that's like Dave's, Dave's in a product
35:07
manager role. Yet if I have found that I have
35:09
developer access to something in production, it's like why, why
35:13
do I have that make it go away immediately.
35:15
But I think a lot of this, in order to achieve things like
35:19
access imperatives that actually forces us to toward striving for
35:24
a lot of the different principles that we hear about in
35:26
the wild, like 0 standing privileges.
35:28
Because in order to make something like this truly
35:31
effective without creating a whole bunch of risk, we almost
35:35
have to pair it with something like.
35:37
By default All Access is least like LEASED, not least
35:43
privileged, but you just lease it and then after a certain time
35:46
duration it goes away. But that then goes back to the
35:49
earlier conversation of the importance of usability.
35:51
You'd have to make it super simple for someone to go back in
35:55
or reorder the access and retain it, but it would actually help
35:58
us strive for a a a smaller attack surface in due time
36:03
through the course of playing around with just Access
36:05
imperatives. And those are just examples for
36:07
us to toy around on a bit. I love the idea of least access
36:12
and meaning in your definition, right?
36:14
As in, it's temporary for a certain amount of time.
36:17
'Cause I think a lot of organizations do have that
36:20
imperative of least privilege. Oh, that's what we're trying to
36:23
be. And then they kind of blow it
36:24
away by making other decisions. It's like, OK, we want to be
36:27
role based and we want to be least privilege.
36:30
Well, they're not the same thing and you can't.
36:31
Those things are diametrically opposed sometimes, so you gotta
36:34
pick one. But this idea of least access
36:37
mostly is probably associated with something like 0 standing
36:40
privileges for sure, I would think I think examples of how
36:44
the. How would this work in the real,
36:47
in the real world? Because I'm trying to translate
36:50
this from, you know, theoretical talk to, OK, here's an idea,
36:53
right. And you kind of went down this
36:55
idea of birthright or mandatory access.
36:58
The should have access, the can have access, and the cannot have
37:02
access, which cannot. Sounds an awful lot like
37:06
segregation of duties to me, mostly associated with financial
37:09
apps, but does not have to just apply to that and can apply to
37:13
anything that you say. Well, I can't do X&Y.
37:16
So now we're talking about that combination.
37:17
Or maybe there is just, you know, the the negative rule.
37:21
Meaning, I don't know, negative standing privileges where yes,
37:25
you you cannot have that access. You will never have that access.
37:27
And by virtue of some other attribute, you cannot have that.
37:31
You cannot be a domain administrator and also X group
37:37
within something else, right? Things like that.
37:39
Give me some ideas on how we can.
37:43
Contextualize this for people out there.
37:45
Is it something like when you say should have access?
37:49
If they should have access, wouldn't that be part of a
37:51
birthright? Or is there some other driver
37:54
that would say, well why? Why is it only should?
37:57
Is it time based? Is it role based?
38:00
Is it something else? And then the stuff that's like
38:03
can have access? I guess same question right?
38:05
I mean, if they can have access, why not just give it to them or?
38:09
Yeah, it's like a lunch menu. OK, well, you can have access if
38:11
you want. We don't really care.
38:12
Or is it something else that you're thinking of?
38:14
Like, OK well here's an example of what you know, what a can
38:17
access might look like. Yeah, so when we think about a
38:22
game like, I think to make something like this truly
38:24
effective, like we would have to reach a state of of 0 standing
38:26
privileges where access just automatically expires.
38:29
So playing off of that however the should have that's something
38:33
where we would be able to not triggering approval potentially
38:38
right Because what we truly need and this is important not only
38:41
from a regulatory standpoint for large financial institutions
38:45
where we need to tee off with regulators, internal audit, all
38:48
of our risk arms. We always have to be able to
38:50
prove out like what is the system logic that goes into
38:53
this. But we always try to ensure that
38:56
the business is making the right decisions because they have to
38:59
be the ones that structure these types of imperatives or policies
39:02
in the wild. So pairing should have to
39:06
something like do we need to trigger an approval that's a
39:09
game like something that's philosophically opposed.
39:12
But some of that also goes back to things like metadata, because
39:15
if we can start to accumulate a future world where we can then
39:19
identify and say this is low risk access.
39:22
We know it is such because it is a low risk system and it's going
39:26
to be accessed or it's been going to be ordered by someone
39:28
who might be eligible for that particular role or even
39:33
permission. That's when it there's some
39:36
discretion at play there of course, right.
39:38
But we can actually empower some of our systems to try to make a
39:42
better decision to again go back and reduce some of the user
39:45
friction of. We're not in the business of
39:47
procedural risk management. I don't want us to approve
39:51
things and certify them if it can automatically just expire.
39:55
And we can always ensure that yes, this particular permission,
39:58
Dave doesn't always hold it, but when he needs it for his job.
40:02
He can go in and order it and will automatically go away.
40:05
So that's how that's my opinion and perspective on something
40:08
like should have versus something like can, can would be
40:11
like if I'm trying to reach outside of my particular day job
40:15
at the bank. But it's like it's a little
40:18
bespoke maybe I'm trying to get some data that I I don't always
40:23
use on a day-to-day basis, but I'm technically within my
40:27
allotments of reason. So it's not toxic, It is not a
40:31
segregation of duties break to your point Jeff, but it's more
40:33
so around I can't have this access, but again, I don't
40:36
always hold it. So when I try to order something
40:39
like that, just treat it once in the same as we do today, trigger
40:42
all the various approvals that we need, run it through the
40:44
whole gamut. But again, like a lot of this is
40:47
trying to reduce the cognitive tax on our practitioners today
40:52
so they can actually care about what matters.
40:55
Where does risk persist? Inside of the environment So we
40:58
can start to plot apply better governance on these types of
41:01
access imperatives in due time instead of just asking humans to
41:05
leverage things like descriptions to make the right
41:09
decision all the time, which we are all and burdened by today
41:12
across the industry. So in the spirit of
41:14
bipartisanship and finding common ground, where do you
41:19
think the business is in taking on that responsibility of
41:24
allowing or making those decisions?
41:26
Because I feel like. Historically, a lot of
41:29
organizations, the business kind of tosses things over the IT
41:32
wall and says, oh, you guys deal with it and they haven't really
41:36
been part of the design of IEM services.
41:42
I think that's changing. It's getting better.
41:44
I think the business don't realize it's, you know, their
41:46
data and ultimately they're the ones that are at risk, at least
41:49
you know, they should be. From my perspective, where do
41:53
you feel like the business is in this because you've mentioned
41:55
the business a couple times? And have you had success getting
41:58
the business to be part of this process and really kind of own
42:02
their part of this to make sure that the risk is reduced, the
42:06
usability is there, right? All those things bringing the
42:09
business along for the journey is Paramounts.
42:12
And I think it just helps under score the importance of product
42:14
management because in the dearth they're in, who's going to help
42:18
bridge that gap. So as all of us try to have the
42:20
business actually manage their own risk because they know the
42:23
users at the end of the day. And it's interesting because you
42:27
flip that in a dichotomous fashion.
42:29
Our technologists know the technology and target systems.
42:32
But when you think about who actually knows the business
42:34
users, typically it is the business.
42:37
Whenever we're thinking about building out strategies, it's
42:41
important to bring everyone, not just the business, not just
42:43
technology, but bring along architecture, bring along risk,
42:48
bring along governance. That way we can mature, step,
42:51
lock all of our processes are people, train them properly and
42:55
prepare them for more innovative technologies.
42:58
And it's and when when I think about a lot of the struggles
43:02
they're in, it's I've never been a fan of, of large information
43:05
security functions. If you just write a standard and
43:09
you're like you must do this, that typically doesn't go over
43:12
very well in practice. People will do it, but are they
43:16
happy doing it It? Came from a mountain.
43:18
And of course people follow those rules.
43:20
That's right. It's the ivory tower approach.
43:23
Yeah, I wanted to kind of close out the conversation on a
43:26
lighter note or not a lighter note but like more of a we will
43:28
do the lighter note by the way, but more of like a lightning
43:30
round. And the first one we had on the
43:32
list was 0 standing privilege. I feel like we we got that one
43:34
wasn't necessarily lighting round, but it was really good
43:36
discussion real quickly. How do you feel about things
43:39
like UBA or user behavior analytics or analysis, Where's
43:43
your head at right now? Yeah, user behavioral analytics
43:47
is interesting because of the horizontal potential.
43:50
I feel it's one of those things that can certainly help us out
43:53
on authentication planes. When it comes to when we're
43:58
trying to detect, I'll throw another acronym in there,
44:01
identity threat detection and response.
44:03
So there's mosaic of people, process technology and that's
44:08
really our ability to figure out what is the baseline behavior
44:12
for when Dave comes to work versus if I log in from a
44:15
machine in Hawaii, that's anomalous.
44:18
But user behavioral analytics allow us to actually capture the
44:21
baseline behavior of that particular account or user.
44:25
But we can actually apply that same type of mental model
44:29
towards something like the actual access itself or the
44:32
target system that they're trying to use.
44:33
So it's in short, trying to monitor the behavioral patterns
44:37
of a user or an account throughout its entire
44:40
interaction basis. And then that way we can try to
44:43
accumulate anomalies and then again focus our attention on
44:46
resolving the anomalies therein. I feel like that was a little
44:49
bit of like my own personal old man yells at cloud because I
44:52
feel like it used to be called UBA or UEBA User and Entity
44:57
Behavior Analysis and then ITDR at any threat detection response
45:01
has kind of like been the thing for like the last year or so.
45:04
I feel like. I feel like Gartner last year,
45:06
2022. Started to kind of hit on it and
45:09
I feel like it's like this is the evolution of that.
45:11
It's like back in my day we used to call ITDRUBA, right?
45:15
Something like that. I think that that's exactly
45:18
where it did graduate from. It was like UEBA was like, we
45:22
can spot these anomalies. Great.
45:24
What are you going to do about it?
45:26
We spot it. We just, we're aware that
45:28
they're. With we spotted it.
45:30
Yeah, we threw it on a dashboard.
45:33
Now go figure out what to do about that, all right?
45:35
Why don't we end things on a lighter note, 'cause I'm
45:37
actually kind of, I'm kind of looking forward to this, be
45:40
honest, who cares about the identity stuff?
45:41
I want to ask my lighter note question.
45:43
I've come up with a special one for today and Dave, you've only
45:47
had about 45 minutes or so to think about this.
45:50
That's kind of this is how we do it.
45:52
We do a lighter note. We usually save it till right
45:54
before we hit record. So it's a little more of a gut
45:56
check, but I wanted to have a little bit of thought around
45:58
this one and I'm going to ask each of you guys the same
46:00
question. I want you to pick one of these
46:03
universes to live in. You can live in The Walking Dead
46:07
universe, the Game of Thrones universe, or the Matrix
46:13
universe. Which one do you pick and why,
46:17
Dave? You get to go first as the guest
46:19
of honor, or you can pass to Jim if you'd like a man to think.
46:23
I think I'll take a stab. My wife might be upset with me
46:26
with this answer because her answer would be Walking Dead for
46:28
sure. After giving it a little bit of
46:31
thought, I think I will choose Game of Thrones and the why that
46:35
goes into that is I'm I'm a little odd.
46:39
I I actually like the politicking game.
46:41
So the politics involved but also just the the fantasy and
46:46
everything else like Dragons like that'd be super cool.
46:49
So it's almost trying to remove ourself from some of the things
46:52
that I feel at someday are actually attainable and like The
46:54
Matrix, but from just the fantasy aspect alone.
46:58
And I would say that piques my interest, but also just the
47:01
political navigation of like trying to figure out the power
47:04
game that's involved to try to influence people, but in a
47:07
positive manner. I don't want that to come off
47:09
negatively. I made it from just a
47:11
motivational perspective. What can we all do to push
47:14
people in the right direction? I do wish we could change the
47:17
ending though, so I won't leave it at that.
47:21
And Jim, do you have any thoughts on your side or Jeff?
47:24
I was gonna call you Littlefinger, and he was like
47:26
the guy in every. Battle everywhere all the time,
47:28
right? You're never surprised or
47:29
anything. I'm thinking it was like, hey,
47:30
do you identify with Littlefinger more or is it more
47:33
of like a Tyrion or maybe even like a Jon Snow who's like this
47:37
idealist but you know he gets stabbed for for that.
47:40
Sorry spoilers. I would probably land myself so
47:43
So it's interesting. Like pragmatically I'd I'd
47:45
choose one of the others, but I would probably be more like Jon
47:48
Snow in practice and end up getting my head chopped and I'd
47:53
be off. So there are worst, worst.
47:56
People, you can be in that show, that's for sure.
47:58
There are. So do you want me to take all
48:00
the fun out of this question or what?
48:02
You start off, they start to show off on a downer, so you
48:04
know. Let's let's have it.
48:06
So I didn't do that today, right?
48:08
I'll bring it down now. Well.
48:09
You did want to bring up. Here's the problem.
48:11
And I was like, come on, man. I mean, like, the guy is like
48:14
right around my age. Yeah, that's incredibly sad.
48:18
And keep. Keep us going down the.
48:20
Incredibly sad, it went. Further down the the the
48:22
doldrums. I didn't.
48:23
I didn't bring it up. You did OK.
48:26
But in either one of these worlds, I'd be in a lot of
48:29
trouble because I depend on several medications to survive.
48:34
And you know, I think here's the thing.
48:37
Well, here. No, no, no, no, no.
48:38
This is my this is. I too found out about this
48:42
question 45 minutes ago. So I haven't had a whole lot of
48:45
time to think. And I do have the answer.
48:48
So in Game of Thrones, I probably would be dead already.
48:52
OK. But in in The Walking Dead, you
48:56
know, I might have teamed up with Rick and then we could have
48:58
like. You know, crashed Acvs or
49:01
Walgreens. I could have gotten my
49:03
medications. I might have gotten them for
49:04
free. Imagine getting your
49:06
prescriptions for free. So I guess you go with The
49:09
Walking Dead and then think about this like, you know, you
49:14
turn into a zombie. If you if you're unlucky and you
49:17
get turned into a zombie, then you're just like, you're still
49:21
kind of alive, right? And.
49:22
I don't know. Is that the life you want to
49:24
live as a zombie? Not really, But I mean, it's
49:28
your it's your Plan B. You've seen The Walking Dead,
49:30
right, Jim? I think we, we actually, we kind
49:32
of talked about it right there. Like the zombies are not the
49:34
story, the zombies are the backdrop and the story really is
49:37
about the human civilization and sort of the degradation of human
49:42
civilization when things happen. Do you think what if you had met
49:46
Negan first before meeting Rick? See, I think I'm I'm the kind of
49:51
person who gets along with everybody, so I probably would
49:53
have wound up getting. Sucked into his little thing
49:58
posse. I wouldn't have been like the
50:00
top guy, I don't think in any of these groups, but I could
50:02
probably be like the number two guy.
50:04
I I, you know, I look at that as like any of these historical,
50:08
you know, backdrops, you know, or not only historical, that's
50:12
not really historical, but I always kind of like picture
50:15
myself, where would I have fallen into this picture?
50:18
And I always think that's probably where it would be.
50:20
You'd be happy there, Jim. No, no.
50:26
But I never saw The Matrix, so that really wasn't one of my
50:29
choices. And like I said, in Game of
50:31
Thrones, I'd be dead already. So there you go.
50:34
Well, I think we're we're picking all different ones
50:35
'cause I would pick the Matrix because I feel like it's the
50:39
closest thing to I guess, current times that we get.
50:44
Yes, you might be a battery for for a robot, but.
50:48
There's also the option where theoretically you break free
50:51
from some level of The Matrix. I don't want to spoil the Matrix
50:54
for gym because you really should see it.
50:56
In fact, you know, I don't think we can actually run an Identity
50:59
Center podcast for people who have not seen The Matrix.
51:01
So that's homework for everybody.
51:03
One of my favorite movies of all time.
51:04
I think it's so original, but I think the environment that it
51:08
pulls together is most close to current times with the potential
51:14
for. Improving or getting better
51:17
somehow the the society, which is really kind of what Neo was
51:20
trying to do. Not all fun and games, but
51:25
there's a scene where in the first one, yeah, Cipher is
51:29
talking with one of the agents and he's like I'll ruin the the
51:32
quote. But it's basically paraphrasing
51:34
is you know he's having a steak dinner with Agent Smith and he's
51:38
talking to the agent and he knows that it's fake.
51:41
And he talks about this and he says.
51:43
You know, I I see this steak and I take a bite and my mind tells
51:49
me it's this and it's delicious and you know, whatever, all that
51:52
good stuff. But he knows he's actually a
51:54
battery somewhere in this giant facility with a whole bunch of
51:57
other humans for batteries living and sort of, you know,
51:59
whatever. And he basically says ignorance
52:01
is bliss. And so, you know, I think
52:05
there's, I think it's really cool kind of how they'd done
52:07
that. And I think that would be
52:09
interesting to see from a perspective of.
52:13
Yes, I'm in the Matrix. But you know, everyone has like,
52:15
those deja vu moments, right? It's kind of like, oh, that's
52:18
kind of weird. Like is there something more?
52:20
Not to be like a conspiracy person, 'cause I'm not normally
52:22
that, but I think that's kind of where my head's at right now.
52:25
Now, I might change tomorrow, but I, I, I was kind of thinking
52:28
of this question actually last night.
52:29
And I was like, that'd be an interesting one to ask.
52:32
And so I put it on on virtual paper.
52:34
That's a good question. Have you heard of the
52:36
multiverse? I mean, no.
52:39
What? Multiverse.
52:42
I don't know. I mean, I only just heard of a
52:45
recent, like, I heard about it, but then I'm like, I don't know
52:47
what that is. But I've gotten sucked into this
52:50
YouTube rabbit hole, which always happens to me.
52:54
But the YouTube rabbit hole I've been into has been like the
52:59
observable universe, which is way bigger than we ever knew.
53:04
But now that the Hubble's telescope is getting out there
53:06
and seeing all these galaxies and there's like.
53:09
Billions of galaxies within each Galaxy.
53:12
There's billions of stars and potentially billions of solar
53:16
systems throughout the Galaxy. So it's like, you wonder like,
53:20
OK, how could there not be intelligent life?
53:23
Yet we don't, you know, absolutely have the proof that
53:26
intelligent life has visited Earth.
53:30
But then the travel between these galaxies is like, nearly
53:34
impossible. Like at least by the.
53:36
I don't think that's a multiverse though.
53:39
Anyway, I think that's just scaling.
53:41
The idea of the multiverse was that within these, like our
53:45
universe, which is the container for all these galaxies and
53:48
everything, it's like, well, maybe there's many universes.
53:51
See, I look at it more of possibilities.
53:54
So it's this idea of a branching tree is the way that I've always
53:57
thought of The multiverse is what if?
54:00
Basically. So we're having a conversation
54:03
on identity center right now. What if?
54:06
And another branch of whatever this universe is or was or could
54:10
be, there is another universe that is a different branch of
54:13
the timeline where this podcast doesn't exist.
54:16
Or maybe it does and it's the Joe Rogan show.
54:19
And for whatever reason you got a really nerdy audience.
54:22
I like millions of people are listening to it and it's like,
54:24
oh, OK, interesting. So I think of it as it's kind of
54:27
like the it's like possibility. It's almost like theory crafting
54:31
or you know, simulation theory where.
54:34
It's a bunch of different things that are kind of running
54:35
potential at the same time. Now I'm I'm talking like, I know
54:38
something. I don't know.
54:39
I'm thinking it more from like the Marvel perspective of, like,
54:42
you know, Doctor Strange looking to the different futures and
54:44
saying, OK, of all these different events and the
54:46
multiverse, here's the only one where you know they beat Thanos.
54:49
Like, that's what I know of the multiverse.
54:50
I wonder if they're biased, because my perception was this
54:53
about the same as yours, Jeff, so.
54:57
But I I also love Marvel so. Yeah, OK.
54:59
So, so your perception. Was correct all.
55:01
Right. And we'll just leave it right
55:02
there. Let's go ahead and wrap it up
55:05
for this week. Dave, thank you so much for
55:08
joining us. I'm going to have a link in our
55:09
show notes so you can connect with Dave on LinkedIn.
55:13
I also looked up europe.org, so we'll have a link to that.
55:15
So you can check out some of the stuff that Dave's been working
55:17
on there as part of that organization and giving back to
55:20
the community, which is, which is always awesome.
55:23
What else? Let's see.
55:24
We're on the web, idacpodcast.com.
55:27
We're on Twitter. X Whatever it is at IDAC
55:29
Podcast. I'm Mastodon at IDAC podcast at
55:33
infosec dot exchange. I have been working diligently
55:37
to get as many of our episodes up onto YouTube as well.
55:39
So if you go to our website idacpodcast.com, click the
55:43
little YouTube corner button in the corner, you'll starting to
55:47
see more of our old shows go up there.
55:49
Eventually it will catch up and then it will be, you know,
55:52
hopefully part of the normal release cycle that we've got.
55:55
But give us a like and subscribe there.
55:57
Help us out on the podcast apps like and subscribe there.
56:00
Dave, I know you're a listener. Thank you so much for listening
56:02
and thank you for being on the show again.
56:04
And yeah, we'll head and go ahead and and stop it right
56:07
there. So thanks for listening and
56:09
we'll talk with everyone in the next one.
56:10
Thank you so much for having me. You've been listening to
56:14
Identity at the Center. We hope you've enjoyed the show.
56:18
Make sure to like, rate and review and we'll be back soon.
56:22
But in the meantime, hit the website at
56:25
identity@thecenter.com and find us on Twitter at IDAC Podcast.
56:32
See you next time on Identity at the Center.