Latest / Identity at the Center / #419 - Identity Management Day 2026 - IDAC Live

Transcript

#419 - Identity Management Day 2026 - IDAC Live · Identity at the Center

• 0:00
  Hello again, everyone, and welcome to the next session.
• 0:02
  This is a this is going to be going to be one of my favorite
• 0:05
  sessions in here. You just heard Enrique talk
• 0:08
  about actually a whole bunch of stuff.
• 0:10
  That was a fantastic session. And you heard a call out to
• 0:14
  identity at the center, not only because boy, they grabbed a
• 0:18
  great name back when they started doing this because it is
• 0:20
  what the what the deal is right now, but also about what a great
• 0:24
  podcast is. I know both of these.
• 0:26
  I've been on the podcast I think five times.
• 0:28
  It was one that dropped yesterday actually with me in
• 0:30
  it. I was.
• 0:31
  So go watch it and remind you to come to Identity Management Day.
• 0:34
  So please do that. Jim McDonald and Jeff Steadman
• 0:38
  are I love both of them, great podcasters.
• 0:42
  We're about to get into the first podcast.
• 0:44
  And so you know that it's their podcast.
• 0:47
  You are now going to see their video.
• 0:58
  This is identity at the center. Well, thank you for that intro
• 1:05
  and welcome to the identity of the Center.
• 1:07
  I'm Jeff. That's Jim.
• 1:08
  Hey, Jim. Hey, Jeff, how are you?
• 1:11
  Oh, not so bad yourself. I'm doing great.
• 1:14
  So here we are, another identity management day.
• 1:16
  Thoughts. Happy identity management day.
• 1:19
  Happy identity management Day. I had to, to stifle the urge to
• 1:22
  do like graphics on the screen and stuff like that.
• 1:24
  I was like, just keep it, you know, somewhat simple.
• 1:26
  You know, I've got new toys to play with and and that's where I
• 1:28
  was at this morning. Hey, new toys is always a good
• 1:31
  thing. Yes.
• 1:33
  And I am a gadget and doodad kind of guy.
• 1:35
  So this is our fifth identity management day.
• 1:38
  We've been doing this since 2021.
• 1:41
  We did our first episode way back, episode number 88.
• 1:44
  We talked with Julie Smith and Kelvin Coleman kind of learn
• 1:48
  what IDM day was all about. And you know it.
• 1:51
  It's the second Tuesday of April every year.
• 1:54
  If you haven't, if you want a good time capsule, go back.
• 1:57
  Listen to episode number 88. In that episode, Yeah, Julie and
• 2:01
  Kelvin were kind of talking about getting the basics right.
• 2:04
  And I think we're still there talking about the basics,
• 2:07
  especially as, you know, new shiny things kind of come along.
• 2:11
  And at the time, Jim, this is kind of kind of a good time
• 2:13
  capsule. Shiny things were blockchain and
• 2:16
  decentralized identity. Yeah.
• 2:19
  Well, and I know that I brought up consolidation in the market.
• 2:23
  A lot of platforms were starting to build more than just one of
• 2:28
  the major capabilities in terms of IGA, single sign on privilege
• 2:32
  access management, kind of that that multiplay approach.
• 2:37
  Yep. And we're still seeing, I think
• 2:39
  some consolidation taking place today.
• 2:40
  So I don't think that's changed too much.
• 2:42
  Basics are still important to get right.
• 2:45
  This is one of our earliest episodes, and we had already
• 2:48
  started our lighter note, which is kind of something we do at
• 2:50
  the end of every episode to kind of have a little bit of fun,
• 2:51
  show some personality, and hopefully be humorous.
• 2:55
  We did an Evangelist of the year for different things.
• 2:57
  And Jim, do you remember what you chose to be the Evangelist
• 3:00
  of the Year for? Evangelist of taking midday naps
• 3:05
  and you know, I actually realized that I've my nap game
• 3:09
  is not quite what it used to be. I used to be able to fall asleep
• 3:12
  quickly and that's my problem now is like I'll lay down and
• 3:15
  take a half hour nap or whatever if I have that space in between
• 3:19
  meetings and I can't fall asleep or fall asleep like 25 minutes
• 3:23
  into it. You got to prioritize, you got
• 3:25
  to you got to make the time to do it.
• 3:27
  I remember Kelvin picked, what was it dirty martinis and yoga,
• 3:31
  maybe not necessarily in that order.
• 3:33
  Julia was active travel and cycling.
• 3:36
  And of course, what did I pick? Gadgets, doodads, that kind of
• 3:38
  thing. So those are kind of evangelist
• 3:40
  of the years. Let me ask you a question kind
• 3:42
  of start off this conversation. Do awareness days like this move
• 3:47
  the needle or are we mostly preaching to the choir?
• 3:50
  You know the fine people in the chat which feel free to to drop
• 3:53
  stuff in. Jim and I will be reading as we
• 3:55
  go along here. Yeah.
• 3:56
  No, I mean, I'm going to answer a little bit differently than
• 4:00
  one of those two answers, which is I think it's an opportunity
• 4:02
  to sharpen the saw. It'll take the time to really
• 4:06
  think about what we do at a strategic level, you know,
• 4:09
  attend events like this or attend this event and really
• 4:14
  think about where the industry is heading.
• 4:16
  So I think it's an important way to build our professional book
• 4:21
  of knowledge, if you will. Yeah, I think, I think I'm, I, I
• 4:25
  think I mostly agree with that. You know, any advertisement is
• 4:28
  good advertisement. You know, good press awareness
• 4:31
  is always important. I think we still see, you know,
• 4:33
  dollar for dollar, security awareness training is still one
• 4:36
  of the best investments you can make, you know, for
• 4:37
  organization. And, you know, helping drive the
• 4:39
  importance of identity is kind of a big part of that.
• 4:42
  Who do you think this day is actually for?
• 4:43
  Is it for practitioners, people who are here, you know, taking
• 4:47
  part of this? Is it for executives that still
• 4:50
  need convincing? Is it for the general public?
• 4:51
  Like who do you think gets the main benefit out of this?
• 4:54
  Well, I, I think that everyone's welcome.
• 4:57
  I mean, I think that's true of all all things identity, but I
• 5:01
  think it probably attracts the practitioner the most people who
• 5:04
  are, you know, trying to solve real problems in the trenches.
• 5:08
  And so I think that's who's probably the make up with the
• 5:11
  audience, but I don't have this ability to who's actually in the
• 5:14
  audience. So I'd love to see that, you
• 5:16
  know, maybe after the fact. How about you?
• 5:20
  Yeah, I have a look. Hey, you know, this is and, and
• 5:23
  I'm one of you. I'm, you know, an identity nerd,
• 5:25
  literally eat, sleep and breathe this stuff.
• 5:26
  So, you know, I'm here supporting it.
• 5:28
  I think it's a great, you know, a great recognition that is
• 5:32
  typically overdue. We do a really bad job of
• 5:35
  celebrating wins, I think just collectively sometimes.
• 5:38
  And today should be a day about winning.
• 5:39
  And, you know, the great work is being done.
• 5:42
  Let me pivot the conversation into sort of the state of
• 5:45
  identity as it stands, you know, right now, you know, April 2026.
• 5:50
  What has improved over the last five years since we started
• 5:54
  doing this? I can think of things like pass
• 5:56
  keys and MFA, but what are you thinking about?
• 5:59
  Yeah. I mean, I think overall, like
• 6:01
  it's awareness outside of our industry.
• 6:04
  I think people now are starting to get how important identity is
• 6:08
  when they look at kind of the major breaches that occur and
• 6:12
  they tie back to kind of the basics of blocking and tackling,
• 6:16
  fishing, social engineering. I mean the, the word is getting
• 6:20
  out there and people are starting to understand that
• 6:22
  identity is is at the center. How about you?
• 6:26
  Well. I think it's a great name for a
• 6:28
  podcast, that's for sure. We should do something about
• 6:31
  that. Yeah, we should do something
• 6:32
  about that. Yeah.
• 6:33
  I look, it's still the basics. It's five years later.
• 6:35
  We're still trying to make sure that that gets done, not get
• 6:37
  distracted. I think, you know,
• 6:40
  authentication has certainly, I think gotten better COVID in
• 6:43
  those years really kind of forced to handle a lot of
• 6:45
  companies to introduce MFA if they hadn't done it already.
• 6:48
  It's kind of a forcing factor. We're seeing passkeys get a lot
• 6:51
  more adoption for, you know, major organizations kind of
• 6:54
  defaulting it. I logged into, I don't know what
• 6:56
  app it was this morning and it prompted me to create a passkey.
• 6:58
  It's like, OK, I'm in. And so stuff like that is
• 7:00
  helpful. What do you think about things
• 7:03
  that have not improved over the last five years?
• 7:06
  I think we're still chasing after a lot of things that are
• 7:10
  done for checkbox compliance. You know, we've heard access
• 7:15
  reviews or referred to as security theatre and they're not
• 7:18
  always that. But a lot of times it's you run
• 7:21
  into this identity management fatigue and it's where, you
• 7:26
  know, the end users just get piled on, piled on same people
• 7:30
  to make decisions that are low impact.
• 7:33
  And I think that's a disservice that we do to users and it
• 7:36
  results in, you know, I think that's one of the big things
• 7:39
  that people outside the industry don't understand is that, but
• 7:43
  it's a mix of technology, but it's also psychology.
• 7:46
  You know, when we have like recommendations that we don't
• 7:49
  need to change passwords 5 * a year anymore, it's because the
• 7:53
  psychology is, is that people make very incremental changes.
• 7:57
  They do things, they write down their passwords and things like
• 8:00
  that that kind of take away from if they did it once a once a
• 8:05
  year or once and forget it, then it's they tend to use stronger
• 8:09
  passwords. Yeah, I'm very happy to not have
• 8:12
  to change a password every like 90 days, 60 days, whatever.
• 8:15
  But I think there's still plenty of organizations that are
• 8:16
  following old guidance when it comes to that, where that used
• 8:19
  to be the guidance, right. Change your password, you know,
• 8:22
  breaking news from five years ago.
• 8:23
  You do not need to do that anymore.
• 8:25
  And you should have, you know, appropriate controls in place to
• 8:27
  to not have to change your password that often.
• 8:29
  You know, we're still dealing with things like credential
• 8:31
  theft, you know, identity sprawl, least privilege, like
• 8:34
  those are all still things that are taking place.
• 8:36
  Let me ask you another question here.
• 8:38
  If we had to grade the industry's progress on identity
• 8:42
  management over the last five years, what score would you give
• 8:45
  it and why? Well, I think in some respects
• 8:49
  we, we deserve an A because of kind of as quickly as things are
• 8:55
  moving along and I think things from an identity perspective
• 8:59
  have to support the technology. So it might seem like we're a
• 9:03
  little bit behind the technology as it moves.
• 9:06
  That's kind of built into identity.
• 9:09
  Identity has to support, you know, when we went to the cloud,
• 9:12
  it has to catch up and go to the cloud.
• 9:15
  Now with AI, it's like, OK, well, what's going to happen
• 9:17
  with AI? Identity needs to support that.
• 9:20
  I think in other respects, we get less than an A, you know,
• 9:23
  maybe AB or AC because you and I on the ground, we spend every
• 9:26
  day working with clients and we see like, OK, well, you know,
• 9:30
  you can only make so many investments on these are the
• 9:32
  areas where organizations trailed or maybe they had budget
• 9:36
  cuts and they're behind. So I think as an industry
• 9:39
  overall, we're probably at like AC in terms of if you take the
• 9:43
  totality, but I think it's an industry in terms of, you know,
• 9:47
  advancements are trying to keep up with all the changes that are
• 9:49
  happening. We probably deserve an A.
• 9:53
  How about you? I fall more in the sea.
• 9:56
  I think we're doing OK. I think, like you said, some
• 9:59
  things are better than others, but I think that's OK as well.
• 10:04
  You know, this is a long fight, a long path to maturity.
• 10:08
  Not every organization has, you know, billions, trillions of
• 10:11
  dollars to, you know, dump every single identity and access
• 10:14
  management tool into their programs and say, oh, that
• 10:16
  technology is going to fix it. A lot of the problems that we
• 10:19
  see are people and process. It's it's simple as that,
• 10:22
  really. Technology isn't so much the
• 10:24
  issue anymore. It's how do you govern it and
• 10:27
  how do you make sure that things are appropriate, you know, for,
• 10:29
  for people or things to have access to.
• 10:31
  I know we can't, we can't have a podcast or any talk about it any
• 10:35
  without talking about agentic and NHI and all that kind of
• 10:38
  stuff. So I would give it AC as well.
• 10:40
  But I don't think that that's necessarily a bad score.
• 10:42
  I think, look, we're moving along based on market, you know,
• 10:45
  and the way that the world is working.
• 10:47
  Could it be better? Sure.
• 10:48
  Could it be worse? Yep, absolutely.
• 10:51
  And, you know, that's kind of what I'm thinking about right
• 10:53
  now. Does that make sense?
• 10:55
  Yeah, you made a lot of great points there.
• 10:56
  Look, if an organization spends all their money on cybersecurity
• 11:00
  and goes out of business, their cybersecurity posture doesn't
• 11:03
  matter a whole lot because they're out of business.
• 11:06
  Yeah, well, that's true. Let's talk a little bit about
• 11:10
  things that don't have good answers today.
• 11:13
  And this is something that I'd love to see, you know, comments
• 11:15
  in the chat, you know, what is the single biggest identity
• 11:19
  problem that still does not have a a satisfying answer right now
• 11:23
  and why? So that's a question for the
• 11:25
  chat. We're trying to monitor it, kind
• 11:27
  of keep what's out there. So hopefully people will chime
• 11:29
  in on problems that they see that we just don't have a good
• 11:31
  answer for yet. For me, I think one of the ones
• 11:34
  that we are still grappling with is this whole thing around NHI
• 11:38
  non human identities. When we, you know, think about
• 11:42
  how we're going to govern them and manage them, it feels like
• 11:45
  we're sort of fighting against the current right now, right?
• 11:48
  There's so many of their being introduced into our environments
• 11:51
  and we're sort of playing whack A mole or maybe catch up with
• 11:53
  some of that stuff. So I'm curious what do you think
• 11:56
  about the NHI environment and and how that works for like a
• 11:59
  government standpoint? I think the first thing is like
• 12:02
  getting your arm around what is the scope of NHI in your
• 12:05
  environment? Obviously, we've always talked
• 12:09
  about service accounts, right? And I think All in all
• 12:14
  organizations have a decent position in terms of having
• 12:18
  their arms around service accounts.
• 12:20
  There is a period of time where we say service accounts, like do
• 12:24
  you have ones that were built in 1996 and you don't know what
• 12:27
  they do and you haven't changed the password?
• 12:28
  I think most organizations it feels like have gone at gone
• 12:32
  after that problem and fixed it. But then where's it go from
• 12:35
  there? You know, obviously a genetic AI
• 12:37
  is spinning up a new area for NHI, but there's a lot of other
• 12:43
  things like manufacturing systems and other systems within
• 12:47
  your organization. There's also, you know, workload
• 12:51
  accounts. So getting your arms around like
• 12:54
  what are you going to manage? And then having a good
• 12:57
  visibility over kind of the discovery of what accounts are
• 13:00
  out there. What is your plan for keeping
• 13:03
  visibility? And one thing that annoys me is
• 13:06
  when, you know, people discount the importance of visibility.
• 13:10
  I think visibility is the number one.
• 13:12
  After you identify the scope, which is a pen and paper
• 13:15
  exercise, how are you going to keep track of what accounts are
• 13:19
  in your environment? And even if you're not ready to
• 13:21
  automate the management of those accounts, knowing what's out
• 13:25
  there is important. What do you say?
• 13:27
  Yeah, look, you can't, you can't protect what you don't know
• 13:29
  about. And so having that visibility is
• 13:31
  important. You know, I think that's, you
• 13:33
  know, being echoed in some of the comments I'm seeing here
• 13:35
  around like, you know, visibility and understanding
• 13:37
  what is actually in your environment.
• 13:39
  For sure, that is a big problem. But this is not a new problem,
• 13:42
  right? Nhis have existed in one form or
• 13:45
  another for decades, millennia maybe, right?
• 13:48
  We've had service accounts, we've had privileged access
• 13:51
  accounts, we've had application accounts, right?
• 13:53
  All that stuff out there, but it's getting more and more
• 13:56
  important because now we've included this AI right into it
• 14:00
  and that's exploding the number of these accounts and it exposes
• 14:04
  a number of attack vectors because now you've got agents
• 14:07
  talking to agents and agents creating subagents and all this
• 14:10
  kind of stuff. And so the governance becomes a
• 14:11
  real challenge for it. But it's, I think, I think
• 14:13
  you're right, I think it still starts with visibility.
• 14:15
  You can't, you can't protect what you don't know about.
• 14:17
  What do you think about the governance side of things?
• 14:20
  And I, I think there has been some, some talks about like new
• 14:22
  frameworks and how do we approach it.
• 14:25
  My thought process is that a agentic AI sort of identity
• 14:32
  behaves a lot more similar to a human identity than to a service
• 14:36
  account. Because it's not maybe going on
• 14:38
  a predictable pattern of like calling an API and doing this
• 14:41
  thing. It might do some of that, but it
• 14:43
  also might go off the rails and do other things, you know, based
• 14:46
  on what the user has directed to or whatever it decides.
• 14:49
  You know, it's, it's instructions that wants it to
• 14:51
  do. So how do you feel about the
• 14:53
  governance side of things and in handling things like consent and
• 14:55
  delegation and things like that? Yeah, I think there's got to be
• 14:58
  policies in terms of what roles those accounts can play, what
• 15:02
  permissions they have. As much as you can enforce it,
• 15:06
  do it through automation in terms of hey, people have to
• 15:11
  request those counselors accounts get maxed out at a
• 15:14
  certain level of capability or certain level of entitlements.
• 15:18
  I just saw a question from Heidi in terms of how do you certify
• 15:22
  NHI? So this gets into the
• 15:24
  governance. I think all NH is need to be
• 15:26
  owned by by a person you know. Now then you start running into
• 15:31
  the issue like what if you have thousands of accounts all
• 15:34
  assigned to the same person? Well, how are you going to
• 15:36
  manage it? That's something you need to
• 15:38
  think through. That is the the crux of the
• 15:41
  issues. Like if you have thousands of
• 15:43
  accounts all assigned to one person, and that one person
• 15:45
  doesn't know what they're doing. But there's your problem.
• 15:48
  What, Somebody reviewing something they don't know
• 15:50
  anything about and just rubber stamping it?
• 15:52
  That would never happen in the real world, Jim.
• 15:53
  No, it would never happen for sure.
• 15:56
  Yeah, I think the question around like certifying,
• 15:58
  certifying NHIS. And this is kind of where maybe
• 16:00
  my head is at right now. And you know, this is this is a
• 16:03
  question where I don't have all the answers.
• 16:05
  And I think it's kind of a little bit of a group think here
• 16:07
  trying to figure it out. But yeah, do you certify an NHI?
• 16:10
  And I, I like the idea of establishing accountability for
• 16:14
  any account to a human somewhere.
• 16:17
  And then that human needs to certify whatever that looks like
• 16:21
  in, in your environment to say, OK, yes, this is my account or
• 16:25
  this is my sub identity, whatever we want to call it.
• 16:28
  And it's doing things that are on my behalf.
• 16:32
  Do you think you can do that manually or is, you know, a
• 16:35
  proper identity governance administration tool really
• 16:39
  required for that to scale effectively?
• 16:41
  Or is it? Just no, I, I don't think it's
• 16:44
  just a spreadsheet. I think IGA tools do a great job
• 16:47
  of, you know, providing the automation, providing hopefully
• 16:51
  the user friendliness. I mean, you know, presenting it
• 16:54
  in a way that the person can slice and dice the information,
• 16:57
  get to it from, you know, launch from an e-mail and go into a
• 17:00
  website, essentially audit and track all that information.
• 17:04
  So I think IGA has a role to play for sure.
• 17:07
  I think ultimately where it comes down to is if the data is
• 17:10
  not right, if you have thousands of accounts signed back to one
• 17:14
  person, the person may not be able to speak to it without
• 17:17
  enough descriptive information to say, hey, this account does
• 17:21
  this thing and that person says, yes, well, we need to do that
• 17:24
  thing. I need to have that account.
• 17:27
  That's where I at least as a starting point.
• 17:31
  So do we end up in a situation where we need an AI to keep
• 17:35
  track of the other AIS and run its own certification campaigns?
• 17:40
  I mean, you know, I, I'm thinking of a scenario where at
• 17:42
  some point in the future, and maybe it's distant, maybe not
• 17:45
  too distant, is we're going to have here's Jeff and then here
• 17:49
  is the dozens, hundreds, thousands maybe of agentic AI
• 17:56
  things that are associated with me for all the different
• 17:59
  services I use, both for a professional and for private.
• 18:03
  Trying to keep track of that is going to become impossible if I
• 18:06
  try to do that manually. So I need some sort of tool and
• 18:09
  and then it leads me to the to this idea of like, OK, well,
• 18:12
  I'll just have an AI certify my AI.
• 18:16
  I mean, I think that's where things are heading, right
• 18:17
  Whether we like it or not, the AI capabilities, they can they
• 18:22
  can do a lot of that. They can analyze data, they can
• 18:25
  put it in human friendly terms very quickly.
• 18:29
  And I see only more of that coming down the road.
• 18:33
  And because I can say one thing. So I've been in this field for
• 18:37
  over 20 years and it's always been about do more with less.
• 18:41
  There's never been a time of do the same amount, but we're going
• 18:44
  to give you more people. That's never happened.
• 18:46
  I don't think it's ever going to happen.
• 18:48
  It's going to be do more with less.
• 18:50
  And AI is a great way to enable that.
• 18:53
  Yeah, I mean it. Plus, you know, the speed and
• 18:56
  the complexity of this. You've got some things to see.
• 18:57
  A comment in the chat around containers, you know, that
• 19:00
  brings up the ephemerality, if that's a word, of these
• 19:03
  accounts, right? They might spin up and spin down
• 19:05
  in milliseconds. There is no way you can do that
• 19:07
  by hand. So you're going to need some
• 19:08
  automation to do that. And maybe it is a delegation of
• 19:11
  some sort of, you know, custom agentic AI that is helping you
• 19:16
  keep track of those. But ultimately, I think there is
• 19:18
  a governance factor for humans to be able to say, OK, I need to
• 19:22
  take a look at this. And, you know, maybe that's
• 19:24
  maybe that's a new product space that comes out at some point.
• 19:26
  Maybe it's something that people build and clawed or vibe code
• 19:28
  over the weekend, whatever that looks like.
• 19:30
  But there will have to be something to help the human
• 19:33
  because the human factor is still a big part of this.
• 19:36
  And we can't just keep blaming, you know, humans to say, OK,
• 19:39
  well, this isn't this isn't working.
• 19:41
  Why aren't you doing your thing? If we're not giving the humans
• 19:43
  in this the appropriate tool sets or capabilities to deal
• 19:46
  with that? What are your thoughts?
• 19:48
  Yeah, I my thoughts are that it's very hard to say when you
• 19:51
  spin up an account for a few seconds or milliseconds even to
• 19:55
  say, OK, we're going to tie that to a human and have a human
• 19:58
  review that what ultimately, why are you keeping the audit logs,
• 20:01
  right? Ultimately those accounts tied
• 20:04
  back to so let's say the platform is like a terraform,
• 20:07
  right? Somebody owns that terraform and
• 20:09
  is going to be able to say, yes, that is legitimate behavior.
• 20:13
  And to your point, to use AI as a tool to analyze the logs and
• 20:17
  look for anomalies, abnomalies, there you go.
• 20:22
  Anomalies and look for things that require special attention.
• 20:26
  Or maybe it's just have the AI summarize like this all looks
• 20:30
  like legitimate behavior and here's what why I can see that
• 20:34
  being very helpful. So let me shift the conversation
• 20:37
  a little bit away from managing the AIS to around this idea of
• 20:43
  AI being leveraged for attacks and potentially for defense as
• 20:47
  well. We still see phishing as a very
• 20:50
  popular and effective way for people to get cracked and data
• 20:55
  to leak, right? And all this good stuff.
• 20:57
  You know, this is something that's been a problem forever.
• 20:59
  I feel like we've sort of hit a little bit of a plateau where I
• 21:02
  think they'll let you know that most of the recent reports have
• 21:04
  it somewhere around 80% of breaches are tied to an
• 21:07
  identity. And the vast majority of those
• 21:09
  breaches are a compromise credential, which usually is
• 21:13
  done by phishing. And now we've got attackers who
• 21:16
  are, you know, much more capable to be able to craft custom
• 21:22
  fishing, fishing, you know, all the issuings that are out there.
• 21:26
  And you know, it used to be you could spot at least in the US,
• 21:29
  right, the poorly, you know, grammar English e-mail to say
• 21:33
  that I haven't paid my tolls yet, you know, and I need to
• 21:36
  click this link to, to pay for them.
• 21:38
  But they're getting much more sophisticated now and much more
• 21:41
  believable and realistic. What do we do about that?
• 21:46
  All right. You know, I think some of the
• 21:49
  age-old device still stands. You shouldn't click links
• 21:52
  directly in emails. And you know, that's that's the
• 21:56
  problem is that you get emails that somehow get through all the
• 21:59
  e-mail filters. They look like they're from the
• 22:03
  bank where you do your banking and there's there's phishing
• 22:08
  attempts. And so I think the e-mail
• 22:12
  filters need better AI capabilities that they can
• 22:16
  actually spot those. They look for links that don't
• 22:20
  look legitimate. But we're at a point in society
• 22:23
  right now where even legitimate emails, everybody seems to be
• 22:27
  suspicious. And it says people who are not
• 22:30
  really able to understand whether for whatever reason, not
• 22:34
  able to understand that, hey, I need to be suspicious or I get
• 22:37
  that text message that says, hey, how are you doing?
• 22:41
  Probably you're not your old friend from high school.
• 22:44
  You know, you have to be, you have to have your guard up all
• 22:46
  the time. And so as an industry, we need
• 22:49
  to make sure that we're continuing to educate people who
• 22:52
  are not as wise as us in terms of this specific area.
• 22:58
  And the technology has to continue to evolve because we
• 23:02
  had Joseph Carson on the recent episode and we talked about AI
• 23:05
  versus AI and there's like these AI war games in terms of
• 23:09
  cybersecurity. And you know, I just think
• 23:14
  that's going to continue to evolve.
• 23:15
  The the G fakes for example are getting better and better all
• 23:19
  the time. Yeah, I mean, we're you've
• 23:22
  you've the original answer you kind of focused on was sort of
• 23:24
  like the written trail, right? Emails and things like that.
• 23:26
  But now we're in a scenario where you don't know if this is
• 23:30
  really me, right? Could be AII could be doing a
• 23:32
  deep fake. It could be synchronized to, you
• 23:35
  know, lip sync and all that kind of stuff that used to be sci-fi
• 23:39
  where it was like, Oh my gosh, you know, you need to be Mission
• 23:41
  Impossible and Ethan Hunt and that whole team, right to to get
• 23:44
  that to pull off. Now you've got tools that are
• 23:47
  commercially available, widely available, that will let you be
• 23:52
  whoever you want to be. And that makes it much more
• 23:54
  difficult. You know, there's this idea of
• 23:56
  like, OK, well, is it really gym on that I'm talking to?
• 23:59
  Or is this AI gym or open gym claw, you know, depending on how
• 24:03
  far back you go with us. But what do you think about that
• 24:07
  whole idea of how do we protect ourselves from deepfakes and
• 24:10
  things like that? It's tough.
• 24:12
  I mean, I think there's a role for big tech to help us with
• 24:15
  those. I mean, I know open AI shut down
• 24:18
  their solar model, but that only get you so far.
• 24:22
  I think once the cat's out of the bag, there's other folks who
• 24:25
  are going to try to reproduce it who might not take that that
• 24:30
  kind of strong view. So I think there is a big tech
• 24:32
  role to play to dot that they're going to develop these tools,
• 24:37
  that they make sure they're used for good and that they block the
• 24:41
  use of not. I think also, as you know, as
• 24:49
  practitioners, we have to be looking for solutions that are
• 24:52
  going to help people. I, I don't know, I mean, when it
• 24:54
  comes to like identity verification tools, for example,
• 24:59
  they've got to be able to keep up with the technology in terms
• 25:02
  of identifying deep fakes. What are your thoughts?
• 25:06
  I think it, it's probably a combination of things.
• 25:09
  I think it's like, you know, like AI is like any other tool
• 25:11
  in my mind. It'll be used for good and for
• 25:13
  bad, but the only thing we can count on is that it'll become
• 25:15
  more capable over time. Whether that capability is used
• 25:18
  for good or bad is really kind of depend on the the hands that
• 25:21
  it's in. I would like to see some sort
• 25:23
  of, you know, watermarking system or something to be able
• 25:27
  to tell, you know, faked footage versus real footage.
• 25:31
  And I'm not even sure what that would even look like.
• 25:33
  I know I think like Adobe's working on something, Google is
• 25:35
  working on something, but it's not going to be effective unless
• 25:38
  like everybody's on board. And I mean, everybody around the
• 25:41
  globe is, is, has bought into the system.
• 25:43
  And so there's a lot of, you know, danger from a ramification
• 25:47
  standpoint if we can't figure out what is real and what is
• 25:50
  fake. And certainly from an identity
• 25:52
  standpoint, how are we even supposed to do identity
• 25:54
  verification if I can't tell that the person on the other end
• 25:57
  of that line, that e-mail, that video chat, that voice call,
• 26:00
  whatever it is, really is Jim or someone pretending to be Jim?
• 26:04
  Not that I would ever want anyone to do that.
• 26:07
  Well, I think you and I and the folks on this meeting are
• 26:11
  worldwide. Just be suspicious.
• 26:13
  But I see AI videos all the time.
• 26:15
  They're like, Oh my gosh, is that real?
• 26:17
  You know, someone reels in a 16 foot shark into their fishing
• 26:20
  boat. Like, Oh my gosh.
• 26:22
  So, you know, I think we're getting to the point where we're
• 26:26
  dotting everything, but I think there's a lot of people out
• 26:29
  there who don't. Yeah, I think there's also how
• 26:34
  it's going to be used. Your dog certainly agrees as
• 26:36
  well. You know, Jeff Rich asks a good
• 26:38
  question in the chat. It's like, and can you design a
• 26:41
  gun that is only used for good? Well, define good and define
• 26:46
  gun, because that's I think where some of these, you know,
• 26:50
  ethic, you know, and moral decisions come into play for
• 26:53
  identity. And we've got an episode
• 26:54
  actually coming out in a couple weeks talking about ethics and
• 26:56
  identity. But you know, that's that's
• 26:59
  another area too. It's like how, how would you
• 27:00
  even, how would you even govern that?
• 27:02
  And who decides what's good for the uses, usage of a of a weapon
• 27:07
  or for whatever? Yeah, we had.
• 27:09
  We had this exact conversation yesterday as we record that
• 27:12
  episode. We're all kind of races, say
• 27:15
  stealing is bad, but what if you're stealing food for your
• 27:18
  starving family? Is it?
• 27:20
  It's not as bad, that's for sure.
• 27:23
  Yeah, well, there's lots of Shades of Grey and that's that's
• 27:25
  why I'm not a Sith, I'm a grey Jedi.
• 27:27
  Only sis dealing absolutes. We only got a couple minutes
• 27:31
  left here, so let me turn it back over to a lighter note.
• 27:35
  As we type tend to end these episodes, if you had to sum up
• 27:40
  the entire identity and access management industry, community,
• 27:46
  whatever you want to call it, into a single bumper sticker,
• 27:49
  what does it say? Stuff happens.
• 27:56
  And you're censoring the stuff. Yeah, yeah.
• 27:59
  That's it. I think like I would have
• 28:01
  something like, you know, my other, my other vehicle is, you
• 28:06
  know, some well known IGA or privileged access management or
• 28:10
  something like that on top of the junker that I'm that I'm
• 28:13
  driving around something like that.
• 28:14
  Do you have any other ideas on other bumper stickers?
• 28:16
  Maybe you know, if you want to drop them in the chat, we can
• 28:18
  kind of read through them, but. How about Jeff Rich as my
• 28:21
  copilot? Yeah, that, that could be
• 28:25
  another one. Whether you get there or not
• 28:28
  debatable, but you will be entertained the entire way that
• 28:31
  you're going there. All right, let's see.
• 28:36
  We got 2 minutes left. I don't want to go over our
• 28:38
  mark, but let me just go ahead and say thank you everybody for
• 28:41
  being part of this Happy Identity Management Day gym.
• 28:44
  And everyone in the chat, if you like the style of conversation
• 28:48
  when it comes to the podcasting, this is what we do every week,
• 28:51
  commercial free and idacpodcast.com.
• 28:55
  Like subscribe to all those fun things.
• 28:57
  And Jeff, when you're ready, I can play my outro and we can get
• 29:01
  things going and move on to the next one.
• 29:03
  So thanks everybody for watching it or listening and we'll talk
• 29:06
  with you all in the next one. You've been listening to
• 29:10
  Identity at the Center. We hope you've enjoyed the show.
• 29:14
  Make sure to like, rate and review, and we'll be back soon.
• 29:19
  But in the meantime, hit the website at
• 29:21
  identity@thecenter.com. See you next time on Identity at
• 29:27
  the Center.