Latest / Identity at the Center / #347 - The Future of Identity: Analyzing and Forecasting IAM with Simon Moffatt

Transcript

#347 - The Future of Identity: Analyzing and Forecasting IAM with Simon Moffatt · Identity at the Center

0:00
You can't be secure without identity.
0:01
You can't deliver online services without identity.
0:05
You cannot deliver employee productivity without, you can't
0:09
do anything really. You can't do this podcast
0:11
without identity. So there's a lot of things I
0:14
think which will probably surprise non identity
0:17
practitioners. I think for the for the, for the
0:20
people who've been in the identity space for a long time,
0:23
I think it will give a better set of analytical tools.
0:27
I think there's a lot of assumptions you can make if you
0:30
spend time a long time in any technology sector.
0:34
And I think it's really about unpicking some of those maybe
0:38
bad habits or, or, or complacencies we all get into
0:42
and trying to say, look, have a a fresher and I guess more
0:45
contemporary analytical framework to look at how
0:49
identity should be measured, how it should be integrated or
0:52
problems it should be solving in trying to help analyse both the
0:57
vendors and also existing deployments.
1:00
Because nobody has the luxury of, of designing things from
1:04
scratch and picking out the best technologies.
1:08
You have to deal with existing systems, existing problems.
1:11
So I think the big take away will be at least provide people
1:16
with a set of analytical tools that they can look at their
1:19
existing systems, existing vendors, existing suppliers and
1:23
be a little bit more informed around what success looks like.
1:33
This is identity at the centre if it has anything to do with
1:38
IAM. This is the go to podcast now
1:43
your hosts Jim McDonald and Jeff Steadman.
1:53
Welcome to the Identity Center Podcast.
1:54
I'm Jeff, and that's Jim. Hey, Jim.
1:56
Hey, Jeff, how are you? Oh, not so bad yourself.
1:59
I'm doing great One. I do have one complaint, OK.
2:04
No, that's shocking. You complain.
2:06
No, only one. That's the shocking part.
2:10
So. It's what is it 1 complaint with
2:12
like 8 different bullet points. Yeah, exactly.
2:15
Now we've got we've, we're doing awesome in terms of or what I
2:19
should say is our listeners are doing awesome in terms of, you
2:23
know, downloading the podcast, listening to it mostly unlike
2:27
audio only formats. I've checked out our YouTube
2:30
site, our numbers. What would you call those rookie
2:33
numbers right? So not complaining is definitely
2:37
not knocking our listeners be. Careful, Jim, don't don't take
2:39
off our listeners. I'm not taking off the listeners
2:42
hopefully, but what I wanted to say was I was watching this
2:45
channel earlier today, so it was beard versus food.
2:50
The guys had a video out for one year where he eats a pizza.
2:53
Basically he eats a pizza during the episode. 8.5 million views.
3:00
So he's doing something right that we're not doing.
3:04
What it what could it be? Doing something right, I don't
3:06
know about right. Doing something that's attracted
3:10
viewers, I guess I don't know. I mean, if you have a beard, if
3:13
you want to eat pizza while recording, and if you think
3:15
that'll get, you know, people to like and subscribe, we can give
3:18
it a shot. Well, I'm up for anything, so
3:22
I'll give it a shot. I'll give it a shot.
3:24
I'll take a video of me eating pizza.
3:26
We'll see if we get 8.5 million views.
3:29
Unlikely, but hey, you never know.
3:31
This is how this is how maybe you go viral, right?
3:33
I'm. Pretty sure you can monetize
3:35
that many views, right? I mean, for sure, yeah.
3:39
I mean, if you're having, if you're pulling that stuff in,
3:40
you know, that'll probably pay for, for the pizza that you're
3:43
eating. No, so OK, so beard versus food
3:47
is the guy that does all these eating challenges.
3:49
So the pizza was a 30 inch pizza.
3:53
So it's pretty much like the size of the moon.
3:56
And he ate the whole thing in one sitting.
3:58
And he was the first person to ever beat this challenge was
4:01
actually at a pizza place in Norway.
4:04
So really cool channel. I think there's a lot of
4:07
channels out there, but I think, you know, the coolest one is
4:10
still identity at the center. Oh, without a doubt, it does
4:14
make me wonder about your algorithm.
4:15
Like why is? Why is this being pushed into
4:17
your feed? No, I well, well, two things.
4:21
One is I'm going to Norway next week, so I've watched a lot of
4:23
videos as I've covered in past episodes.
4:26
I think the other thing is that like, this guy's channel is
4:30
awesome. Watching people eat like massive
4:33
amounts of food in like 20 minutes is pretty entertaining.
4:39
I I'm I'm struggling with why this is entertaining.
4:42
It's just watching people eat, like what's the point?
4:45
He's doing something that you can't do if you can use a 30
4:48
inch pizza. I mean, I'm sure you could build
4:51
a heck of a following. OK, well I guess to each their
4:55
own. Yeah, I guess so.
4:57
So we should talk about our conferences.
5:00
By the way, I'm going to have a cache of stickers with me at
5:04
every conference. I'm going to make sure that
5:06
you've got a pocket full of stickers too, at all times.
5:09
So folks see me or you. That's not the reason to go out
5:12
to YouTube, so they can see our face and recognize us when they
5:15
see us on the conference floor. We have stickers and they're
5:19
good stickers. They are like vinyl stickers.
5:22
So they're kind of weatherproof, dishwasher proof, all that, and
5:27
we'll have them. Yeah, Jim is very proud of these
5:30
stickers, so you definitely want to get one for sure.
5:33
Let's talk about the conferences because you and I are going to
5:34
be at EIC and well, by the time people listen to this tomorrow,
5:38
we'll see you tomorrow. So it's kind of the last chance
5:41
for people to use a discount code.
5:42
If you haven't already registered, you know, probably
5:45
want to get on that, but it's May 6th or the 9th.
5:47
If you use the code IDAC 25 MKO, that'll get you 25% off.
5:52
Like I said, if you're listening to this, chances are you're
5:55
probably already registered or you're not going to be there,
5:57
but we will be at EIC and looking forward to that.
6:01
Then we've got the Identiverse conference coming up that's in
6:03
Las Vegas. So kind of a quick turn from
6:05
Europe over to the US. June 3rd, the 6th, we have the
6:08
code IDV 25-I D AC25, another 25% off for that one.
6:14
So we hope to see lots of friendly faces there and I think
6:16
we're at the spot now. We're going to say, hey, we are
6:18
bringing our game show to Identiverse and we have, at
6:23
least for now called it Identisquabble.
6:25
So this. Is finalized on the name
6:27
Identisquabble. For now, right.
6:29
And I gave a lot of thought over this and then you just kind of
6:31
blurted it out, I think yesterday in real time as we're
6:34
talking about this, like, Oh yeah, that's better than
6:35
anything I've been thinking about.
6:36
So we'll just go with that. So yeah, Identisquabble, we're
6:39
going to kick off, I think the Expo kind of opening night in
6:43
the Expo hall. So we'll have a space there.
6:46
I will bring my cameras and I definitely want to try and turn
6:48
this into an episode. But if you're familiar with what
6:51
we did at the Authenticate conference last year, it is a
6:54
Family Feud style game. So Jim is going to be a team
6:58
captain. We're going to have another team
7:00
captain, a couple of team mates for each of those.
7:02
We're going to have judges and things like that.
7:04
They're going to help with, you know, deciphering the answers
7:08
that our contestants come up. And I will be playing the role
7:10
of MC or Steve Harvey or whatever you want to call me,
7:14
trying to keep these cats moving in the same direction.
7:17
So looking forward to that. Definitely want to invite people
7:19
out to that. So if you're going to be in
7:22
Ideniverse at Ideniverse in Las Vegas, definitely come check us
7:26
out the opening. I think we're the first on 1st
7:29
on the board that night. So I think it's like 5:30 or
7:31
6:00 PM or something like that, that we'll be there.
7:32
But look forward to seeing friendly faces and having some
7:35
fun. So it's going to be just a fun
7:36
you. I don't know if you'll learn
7:38
anything, Jim, but hopefully you'll be entertained.
7:41
Yeah, I mean, I think you'll learn how goofy we can get, but
7:46
I think it'll be a good time. So I'm really excited about the
7:49
guests that we have. As somebody that I've known in
7:51
this identity space since all the way back in his four Drock
7:54
days and before we got started recording, he mentioned he's on
7:59
the Ubuntu computer, which I thought, oh, that's, that's so
8:03
him, that's and that's so Legacy 4 Drock Classic to be on some
8:10
version of a Linux laptop. So I had to or I'm I'm not sure
8:14
if it's a laptop or a desktop. I shouldn't say laptop, but why
8:19
don't you go ahead and introduce him?
8:21
I mean, it's Linux. It could be anything.
8:22
It could be a Flipper 0 for anything that he could be
8:24
recording on right now. So yeah.
8:25
It could be a black BlackBerry, right?
8:27
Right, Who knows? Yeah, let's introduce Simon
8:30
Muffet. He's an identity researcher and
8:32
author. He's an identity podcaster, just
8:34
like we are, and he's the founder of the Cyber Hut.
8:36
So, Simon, welcome to the show. Hi guys, it's great.
8:41
Great. To be honest.
8:41
It's it's, I've listened to you guys for a while.
8:43
As you know, it's, it's a small world and the identity space,
8:47
albeit it's getting bigger. So you guys doing a, doing a
8:50
great job in, in entertaining us and informing us of all of the
8:54
identity worlds. But it, it is a laptop, it is a,
8:57
it's a Linux laptop. I I don't know why I fell in too
9:00
Ubuntu actually it wasn't really a forge rock thing or be it
9:04
being in the open source game I guess for that's all 1020 years
9:08
I suppose. But I, I, I fell into using
9:10
Ubuntu 15 years ago and I don't know not not really seen it all
9:16
to not a Mac fan and I didn't nobody likes Microsoft.
9:19
Did I? Should I say that?
9:21
Hey, hey, I'm on a man. So I, I just, I've used lyrics
9:26
and Ubuntu for a long, long time.
9:27
I think everything's browser based these days, isn't it?
9:31
It's everything's web-based, so I, I totally fully enjoy having
9:36
a very lightweight laptop or I probably can't see.
9:41
I, I, my Kindle is my, is my main device of choice these
9:45
days, a nice old fashioned Scribe and a Kindle and my
9:48
mobile phone. I can, I can just about get by
9:53
most days with that. I'm just the five years of the
9:56
laptop may may disappear, but that's that's probably another
10:00
podcast worth of conversation. But what what devices we may end
10:05
up using in a, you know, five years from now, I guess.
10:07
Well, I. Think we can definitely have a
10:09
conversation about that at some point because I think if you've
10:11
been following like where some of the tech companies are going,
10:14
it's glasses are back, right? Maybe it's, you know, Google
10:17
Glass was a big thing a couple years back and then, you know,
10:20
now we're getting back into what I would call more normal looking
10:22
glasses. And I have some that I use like
10:24
when I travel that are, you know, I plug it into my phone
10:27
and I can watch a video and a a movie like it and a huge screen.
10:30
But yeah, there's a lot going on for sure.
10:34
I'd like to get to know more about you, Simon.
10:37
So one of the things we like to do with the first time that we
10:39
have people on the show for the first time, and I'm kind of
10:41
shocked that it took 347 episodes to do that, is let's
10:45
find out about your background. How did you get into the space
10:48
of identity and access management or digital identity
10:51
or whatever the heck we're calling it these days?
10:53
Is this something you chose or did it choose you?
10:57
It, it seems a long time ago. I, I started in 2001.
11:00
So that's nearly nearly 25 years, which is, I mean, that's
11:04
an absolute eternity in, in any technology or any career, I
11:08
guess. And I think identity has seen
11:10
just huge transformation in that time.
11:14
But I, I, I did sort of fall into it ultimately.
11:16
I did, I did economics at university with Microsoft first
11:19
degree, utterly unrelated to identity and access management.
11:24
And you sort of roll out of university at sort of 2122.
11:29
What, what should I do in this big, big wide world?
11:32
And I, I ultimately, I took on a contract straight out of
11:36
university for three months working for a large insurance
11:40
company in the UK. And it wasn't a particularly
11:43
complicated contract, as you can imagine at the age of 22 or
11:46
something. You know, we have many great
11:49
life skills at this age. And the, the, the job was for
11:52
three months to do mainframe Security Administration.
11:55
And the project essentially was this, this insurance company had
11:59
about 3637 thousand users and they ran it out of user IDs.
12:06
Can you believe it on their racket for mainframe system.
12:08
Long story short, they run out of I DS.
12:10
So the project, they pulled in three or four graduates who we
12:13
all didn't know anything about mainframes or identity or
12:18
anything like this. And they brought us in for three
12:20
months and we essentially had to go through this list by hand,
12:23
36,000 identities within rack F and essentially copy and paste
12:28
them onto a new rack FID. So if your ID was, I think it
12:33
was something like 5 numbers in a letter, so say 12345 and then
12:39
A and we have to essentially change the ID to be something
12:42
like 123456 and then A, something like this.
12:45
I can't remember the details well.
12:47
We literally had a print out everyday from PeopleSoft and
12:50
used to go through this list, find the ID within RACF and then
12:55
copy and paste and set up all of the TSO options.
12:57
The the job control language stuff, the data says all this
13:01
stuff. I knew nothing about the age of
13:03
22, but it was all by hand. So there's no, there was no
13:06
connectors, there was no provisioning systems, there was
13:08
no ticketing systems. So they, they essentially
13:11
brought in actual people to with sort of shovels to shovel
13:15
through this huge list of mainframe identities.
13:19
And obviously the project never lasted 3 months.
13:22
It lasted 12 months. And that was my first taste of,
13:26
well, first and last taste of, of mainframe Security
13:30
Administration and TSOIDS and job control languages and Karla
13:35
languages and all this crazy, crazy stuff.
13:37
But it did get me into this identity world and and from
13:41
there I spent another three or four years in house for this
13:46
insurance company looking after their Novell E directory
13:50
directory services for the mainframe looking after 30-40
13:54
thousand identities in Novell. And that was then replaced by
13:59
Active Directory. So all of the good learning
14:02
skills you're looking having to look after servers.
14:05
People remember servers that don't get serviced anymore.
14:07
So having to look after servers, having to do health checks,
14:10
having to script things, having to build out sort of resilience
14:14
and and directory replication topologies and all this really
14:19
by hand stuff, which no way do you need to do in 2025.
14:23
But as as a young guy starting my career, it was great.
14:28
You know, I learnt, I learnt loads.
14:30
I was working with experienced professionals, technology of all
14:34
calibres, you know, old fashioned mainframes, what at
14:37
the time was pretty cutting edge Novell directory.
14:41
So it was, it was a really good apprenticeship if you like.
14:44
I did that for four or five years and then I went into
14:46
consultancy for a couple of years, similar sort of stuff,
14:50
Directory services, moving a little bit more into the sort of
14:54
networky world as well, VPNs and firewalls and the like, but
14:59
still very much focused on, on the directory.
15:03
And then I guess I got a big break, if you like, probably six
15:07
years into that. I, I, I started and I, I didn't
15:10
start. I joined a startup called Value,
15:14
which was one of the early pioneers in role based access
15:18
control and identity certification and access review.
15:23
And they had a, a stellar two or three years and were then
15:27
acquired by Sun Microsystems. They become Sun role manager as
15:32
part of the, the open source Sun stack, Sun identity manager, the
15:37
DS Sun access manager, all this stuff.
15:41
And they acquired this tiny company called Value as part of
15:44
their role based access control strategy.
15:47
And the rest is history after that.
15:49
If you like a lot of time then spent in the in the vendor
15:53
world. And it's yeah, it's, it's
15:55
looking back even sort of the early 2000s, things just have
15:59
changed just substantially really in a, in a whole host of
16:03
ways. I did 15 years in the vendor
16:06
landscape at a time. So Microsystems, they were then
16:10
acquired by Oracle. I had a couple of years at
16:13
Oracle looking after the European identity business there
16:16
for Oracle Identity Analytics. And then I spent a good eight or
16:20
nine years at another open source company called Forge
16:23
Rock, at least partially open source, started, started open
16:28
source, ended up closed source for various different reasons.
16:32
It was a great journey, great journey.
16:34
I was doing sort of solution architectural work and finished
16:37
off doing four or five years as a, as a product manager there
16:40
for, for their access management technologies.
16:45
And as part of that, to sort of close this little story off,
16:48
part of that process was looking at emerging technologies.
16:53
What, what should four drop do next?
16:55
Looking at start-ups, looking at standards, looking at OF2 and OP
16:59
ID connect and what what what's going to happen next.
17:02
And it was a struggle because I couldn't, I couldn't find the
17:05
information I was looking for. And yeah, we have big research
17:09
agencies out there doing high levels quadrants and compasses
17:13
and this sort of stuff. But I was struggling to find
17:16
that knowledge of the next big thing if like the start-ups, the
17:20
emerging patterns, use cases, etcetera.
17:23
And that really was the inspiration to set up for an
17:26
organization called the Cyberhuts, which I set up during
17:30
the pandemic. If, if, if there's ever a
17:32
difficult time to start a business, do it during the
17:35
pandemic when the whole world is shut down.
17:38
But I actually, in hindsight, it was a huge opportunity because
17:43
everybody else was at home as well.
17:45
So I, I found at the Cyberhooks the end of 2020, start of 2021,
17:50
looking all of the exciting, cool emerging identity
17:54
technologies, use cases, patterns, vendors, all that sort
17:58
of stuff. And attempt now to to deliver
18:01
enablement research, Fender guides, training, all of the
18:06
stuff to just help the world understand our our amazing
18:10
identity, practitioner knowledge, vendor knowledge and
18:13
all that stuff. And it feels like a really good,
18:16
really good journey. So a lot of lot of knowledge
18:19
accumulated in that time. A lot of a lot of change, as you
18:23
can imagine, as you guys have seen as well.
18:25
I think the world has changed spectacularly even the last 10
18:28
years, let alone last 25 S Things like servers.
18:33
Well, exactly. You know, they've got AI to deal
18:35
with as well. So it's it's been great.
18:36
I feel feel privileged actually to, to be doing what I'm doing
18:40
now, which is essentially being briefed by technology vendors,
18:44
understanding what's happening next, understanding what use
18:48
cases are being solved and attempting to translate that
18:52
into into consumable knowledge. You feel like it's, of all the
18:56
jobs I've had over the last sort of 25 years, I feel this is the,
18:59
this is the nicest job, I think. Is there a particular content
19:05
that you like that you kind of have an affinity to?
19:07
Is it written? Is it audio?
19:10
Is it reports? Is it research?
19:13
Is it thinking about the future, Right.
19:15
And sort of ideating, like where is this thing going?
19:17
And we're going to get to a book you're writing, you know, on
19:19
that topic. But is there a a specific thing
19:21
that you really kind of like? Yeah, this is really my favorite
19:24
part of this part of what I do. Oh wow, yeah, I think content is
19:29
really interesting for me. I think it has the, the
19:32
technology has changed, so has content.
19:34
And I think you know, we, we have, we are swamped with
19:38
material. We have material everywhere on
19:41
your phone, your Kindle, you can research anything, 30 inch
19:45
pizzas if you want, you know, wherever you go, whatever you
19:49
want to buy a new car, you can find as much content as as you
19:52
like. So information overload is the
19:55
issue. So I think it's it's trying to
19:57
deliver content in in design material.
20:00
In a variety of ways. And that's something definitely
20:03
the Cyprus experimented with being, yeah, the podcast thing,
20:06
but also taking maybe a big research report and then
20:10
breaking that down into a whole host of different channels and
20:14
different opportunities from one or two-minute training or videos
20:18
or training shorts by guys training in the written form.
20:23
So that this, I think the content aspect is, is totally
20:26
changed. I think for me personally, I
20:28
like to read and write. I think most people do.
20:31
I consume via reading, but I also helps me think to write.
20:35
So if I'm ever stuck on something that I write, because
20:38
then I can much more easily understand it.
20:41
And if I can understand it, I can then deliver that in a way
20:44
which other people can. But I think it's, it's always
20:48
about, to me, there's three things you should always be
20:50
doing 3 ES essentially educate the audience, empower them and
20:54
maybe entertain them a little bit as well.
20:57
So it's how you can get some of these, some of these complex
21:00
topics we're all engaged with. Now.
21:02
How can we put that across in, in simpler ways?
21:05
And I think we have to do it in a variety, whether it's written
21:08
books, reports, podcasts, whatever.
21:11
Simon, I have a question about your writing process.
21:13
Take us through that. Like do you like to write it at
21:16
night to like to write in coffee shops?
21:19
Or what is your What's the perfect situation for you to get
21:23
the most creativity out of your time?
21:27
Do you know, do you know, I think there's, there's a few,
21:29
there's a few parts to this. A lot of people like this is my
21:31
second book I've done. So that's I don't know how many
21:34
pages I did 700 pages, but I, I as an analyst, I write for a
21:37
living in the sense of I write all the time.
21:40
It's writing isn't difficult. And I, I say this with a bit of
21:44
a quip here, but the difficult part is thinking about what to
21:47
write. The act of writing something if
21:50
it's researched and thought about it should take seconds.
21:54
It should take as, as as quick to write as it does to read.
21:58
In my opinion. That's how I typically like it
22:00
to operate. And my, my modus operandi is I'm
22:04
thinking and by thinking, I've got my Kindle here now, my
22:06
Kindle and my Scribe. I use this daily, hours per day,
22:11
writing, sketching notes, small things.
22:15
I'm quite pictorial, so I'm like pictures, matrices and diagrams
22:19
and drawings and stuff like this.
22:21
And I will do that constantly. But a lot of the time it's
22:24
thinking, thinking about the topic, thinking around the
22:28
topic, thinking sort of through the topic and trying to create
22:31
counterpoints and I guess arguing myself out of a
22:34
particular position, for example.
22:36
And I think if you spend time on that aspect, on the thinking
22:40
aspect, the writing to me is, is relatively relatively simple.
22:45
But you, I think you do have to be dedicated at it to, it's a
22:50
bit like going to the gym. It's you have to do a little bit
22:52
everyday, 20 minutes, thirty minutes, 15 minutes.
22:56
Even if you have writer's block or content block or whatever,
23:00
just just do something, something, a little a line, a
23:02
sentence, a word, anything. And that just continues to push
23:06
that rock a little bit further forward.
23:09
But I think, yeah, I, I, I'm always jotting stuff down.
23:12
I've got reams and reams and notes for all sorts of stuff.
23:16
And it, over time it's sort of builds out a bigger picture.
23:19
And then the execution aspect, physical active writing is, is
23:22
pretty straightforward for me personally.
23:26
You've mentioned the. Podcast and I've mentioned it as
23:28
well. Tell us something about the
23:29
analyst brief, because you do this with our friend David
23:31
Mahdi's. And I'm curious, like, what is
23:34
the topic? You know, how did you get this
23:36
thing started? And just tell us a bit more
23:38
about that. Yeah, it's, it's nice.
23:40
It's not as professional as this one though.
23:41
Guys, this is, you know, this is the you, you guys are doing the
23:45
professionals. So we, I guess the honest brief
23:46
is, is, is a couple of things. Really, I think it's we try to
23:50
make it part of that contemporary back to that
23:54
content view. You're trying to provide that
23:55
contemporary comment, if you like.
23:58
There's, there's, there's so much material, so many vendors
24:02
doing so many amazing things, product launches, features,
24:05
mergers, acquisitions. There's so much happening.
24:08
And I think the analyst brief that the real modus operandi
24:11
there was to try and provide a bit of commentary, really a bit
24:15
of simple commentary as to what is happening.
24:19
It's not every week, it's probably a couple of times a
24:21
month. Really it's, it's trying to
24:22
provide that commentary around, look, there's so much change
24:26
around technology identity, security, all of these
24:30
overlapping technology areas and just try and provide a little
24:33
bit of clarity there, a little bit of an independent view, you
24:36
know, cut out. The vendor.
24:38
Speak or the the solution providers speak and the gimmicks
24:41
and the acronyms provide a bit of real commentary there.
24:46
Peel Back had a bit of history and they had some stories, maybe
24:50
call out some of the vendors perhaps, or maybe call out some
24:53
of the situations or the buzz terms or whatever it can be.
24:56
But just to provide that, that that weekly or that monthly view
25:01
of this is the snapshot of what's happening.
25:04
This is a bit of an independent view of of how things are going,
25:08
maybe why they're heading in that way.
25:11
So it's, it's trying to provide that contemporary view, if you
25:14
like, of, of all the change which is happening.
25:17
And it's there's a lot of change as, as you can, as you can tell,
25:21
there's all this, all the technology change, there's a lot
25:23
of stuff happening. So it's, yeah, it's trying to
25:25
provide that, that comment. I think it's the, it's the, it's
25:27
the big goal. Well, there's so much to cover.
25:30
I feel like, you know, when Jim and I started this six years ago
25:33
now, I guess at this point it's like, all right, well, at some
25:35
point we're going to run out of things to talk about Lean.
25:37
It's identity and access management.
25:39
What can you possibly do? And here we are, you know, six
25:41
years later, 347 episodes and counting, and there's just
25:46
always something happening and there's something new to report
25:49
on. And, you know, you're putting
25:50
out so much content between the podcast and the reports and the,
25:55
I guess the the Moffett laws of identity security that you put
25:58
out over this year. Tell me a little bit about what
26:01
those laws are and what are you trying to get out into the
26:06
identity sphere of influence with those things?
26:09
That was good. I quite like a lot of the stuff
26:12
that side but does and quite a lot of the stuff I do really
26:14
personally is, is just to get conversation going, is to get
26:17
discussion going, involving as many different people as
26:21
possible, many different voices. And for me it's always about the
26:26
signals which which get generated the conversations, not
26:29
necessarily to be provocative or get people disagreeing, but just
26:33
to get people thinking and discussing.
26:35
And the laws was part of that. Laws was a tongue in cheek,
26:37
tongue in cheek thing around describing it or having to try
26:41
and describe what what are some of the best practices really
26:43
around this, this area of protecting our identity
26:46
infrastructure, our identity landscape because it's under
26:50
attack. You know, there's there's no
26:52
question about that. You can Google, Google on any
26:55
day of the week and you can find a daily breach of some
26:58
description and it probably has identity at the centre.
27:03
They'll put into there's identity somewhere in those
27:05
breach reports. So the, the, the, the techniques
27:08
and tactics and procedures, they're somewhere in there.
27:10
Whether it's human or non human identity, something's gone wrong
27:13
with that identity landscape. So the laws, the laws aspect was
27:16
friends. Look, we need to just have a,
27:19
have a conversation here around what identity security looks at.
27:22
How can we protect all of this identity stuff that we have in
27:27
there? And to be honest, there's one of
27:29
two disagreements. So that the big the biggest
27:31
disagreement for those who haven't read them all, there's,
27:34
there's 10 basic statements in there.
27:36
I think there's #3 which is the one which always gets people
27:40
chatting. I think it's the carbon life.
27:42
They'll go on, They'll go on that you can tie food.
27:44
They think that the law was something around every identity
27:47
should at some stage be tied back to a carbon life forms a
27:51
physical person ultimately, especially for the workloads,
27:55
NHI, agenda, Ki, you name it. Smart TV's what anything where
28:01
there isn't a physical person there.
28:03
And it was, I think a lot of people once they actually
28:08
understand and nod and agree actually, yeah, that's probably
28:10
not a bad thing. But the problem is with this is
28:13
that actually a lot of our human identity records and identity
28:17
profiles are not linked to a carbon life form either, which
28:20
is this subtle part which a lot of people miss because even if
28:22
you're you're Active Directory record, it's not necessarily
28:27
tied to a biometric validated and verified identity.
28:32
It's just Simon's AD entry with the UPN and whatever else.
28:36
So there's a bit of a subtlety in that around trying to make
28:39
this real for, for, for all identities.
28:42
But yeah, the, the laws is really again, having some
28:45
discussion putting the flag in this.
28:47
I don't want to own the flag in the sand, but I will put the
28:49
flag there and we can all at least dance around it or discuss
28:53
it and get that get those topics and people's agenda around talk
28:58
about policy, talking about clean plenty of this of of
29:02
identity data, humans, people, software devices.
29:06
Let's talk about all of that stuff as well and just yeah,
29:09
raise awareness was the was the idea behind it.
29:12
So. Simon, I remember when you
29:13
posted this on LinkedIn, I went out and read them.
29:17
And by the way, I think one of the things I know you for and
29:20
probably other people knew you for is you're not afraid to be
29:24
bold. And I exactly #3 jumps off the
29:29
page to me because I agree with it and I know most people don't
29:33
agree with it. It's that, you know, basically
29:38
every say the controversial part, they're not the
29:42
controversial part is that every non human identity must back map
29:46
to a physical person who essentially owns it who can
29:50
speak for it. I do think the one potential
29:53
exception is that if AI becomes advanced enough, it could be a
29:58
representation of a person, in other words, able to make
30:01
decisions. So I think that at some, and I
30:05
don't think we're there now, but at some point you might have a
30:08
company where there aren't people or basically the whole
30:12
company is run by bots and maybe those bots are the decision
30:17
makers and identities as we know them are owned by that bot.
30:22
So I think that could be an exception.
30:24
I know you know, that's super sci-fi at the moment, but I
30:29
thought, let me argue. Against that point, because I
30:31
think those bots, unless this is a 100% AI company, there is
30:36
still theoretically a human at the very top.
30:39
They might be the CEO of, you know, founder, bottle washer,
30:43
janitor and all these agents or AI or whatever things that will
30:49
map to them. I could do we get to the point
30:52
where an entire company, like a legal entity, a definition of a
30:57
company is 100% AII have a feeling we would probably put a
31:00
stop to that at some point, at least until the AI takes over
31:03
the judicial system and the governance and stuff like that.
31:05
But. Here's my thought on that.
31:07
Jeff because I think that's, that's a good point.
31:09
But I think the intent of that statement or that law is that a
31:15
person who is accountable for it.
31:17
In other words, you understand enough about what is doing to
31:20
say whether or not it should be, should exist.
31:23
If you have a billion baht company or say a billion dollar
31:27
size company and it's all robots and maybe there are a few humans
31:31
at the top, those humans probably can't be accountable at
31:36
that level. And you may delegate the
31:38
decision to a bot that is smart enough to determine whether or
31:43
not that access is appropriate. A lot of supposing there, But I
31:50
think that the key point is what Syme made, which is essentially
31:54
that some life form, whether it's artificial or real, has to
32:00
be able to make the decisions for identities, like an identity
32:04
that, you know, runs a like a computer process or robotic
32:13
process. You know, you just can't like
32:18
leave these things kind of unattended and have nobody
32:20
accountable for deciding whether or not that access is
32:24
appropriate. And I think that is that is my
32:28
concern is that when we call these identities, to me, they're
32:31
really accounts. They're accounts that exist.
32:35
They're not identities, I I. Agree.
32:38
I just disagree. I, I think the, the
32:40
accountability thing is, is really what, what what's
32:42
important here. I think there's a good slide
32:44
that does the, does the rounds, I think on, on LinkedIn and
32:47
socials. It's by IBM, the 70s and it
32:50
talks about no, no machine should have decision making
32:53
capabilities or management capabilities.
32:55
Maybe it says because it can't be held accountable now that
32:59
that accountability is really important.
33:01
It is. It's just also a separation
33:03
between decision making and accountability.
33:06
Now, if you talk about a genetic AI and and whatever may come
33:10
over the next decade, all for autonomous decision making that
33:14
that's just going to happen. There's no way you can let you
33:16
know you get get in the way of that and put the put the genie
33:19
back in the bottle. That's going to happen.
33:20
Autonomous decision making, which is perfectly legitimate if
33:24
you have accountability of a chain of accountability around
33:29
who has the final say who, who is going to be the person on the
33:33
hook in the court of law to say, yes, that was me, that was my
33:38
responsibility to do so. And I think soon, as soon as you
33:41
have a disconnection there, you have a whole host of, of
33:44
liability issues and and process issues and governance issues
33:47
around how that data processing or how the organization should
33:52
be run. So it was really all about
33:53
saying, look, we have this brand new world potentially of, of
33:57
autonomous decision making, which is absolutely necessary
34:01
and scalable. We have to have some sort of
34:04
accountability there. And it may just start off being
34:08
a team. You know, it could be a team
34:10
that responds to an oath to client.
34:12
This team, this, you know, SEC OPS team owns this particular
34:16
oath to client perfectly fine because you then know who in
34:19
that team to go and knock on the door and say hey, this this or
34:23
two client is whatever behaving suspiciously or whatever it
34:26
could be. But you need to have that
34:29
lineage, I think to a physical person.
34:31
Yeah, maybe 100 years from now or 50 years from now, we do have
34:35
bot wars. And you know, I watched the film
34:37
recently, the electric electric state.
34:39
It was called electric state film.
34:40
That was pretty, pretty Skyfire with robots and humans and
34:44
stuff. And there's absolutely some,
34:46
some potentially terrifying use cases ahead.
34:49
So being held. Accountable for being held
34:52
accountable for an AI would be you're getting unplugged for 10
34:56
years. It's like going to jail.
35:00
Exactly. Exactly.
35:01
So yeah, the whole thing about the laws was having these sort
35:04
of conversations. I think it's you've got to
35:05
start. You've got to start somewhere, I
35:07
think. So this this whole topic of AI
35:10
fascinates me. And I think we're sort of in an
35:12
inflection point here where people are starting to wonder,
35:14
well, am I going to have a job when AI comes around?
35:17
And one of the things that's been making the rounds, I think,
35:19
you know, especially in the consulting world and probably
35:22
the analyst world as well. Can I just have an AI do the
35:26
same things that Jim, Jeff and Simon are doing if it's just
35:29
spitting out stuff? And there was an article that
35:32
was put out by Mike Neuenschwander around this very
35:35
topic. And I think he's hopefully right
35:38
that it's like, yeah, we're not dead yet.
35:40
There's still plenty to go. And, and I think there's still
35:42
going to be opportunities for being able to leverage those
35:47
types of tools. But maybe take, hey, here is
35:49
Simon's brain maybe to some degree, and here's what he's
35:52
thinking. But you're always going to have
35:54
the individual human element where, you know, we're ideating,
35:57
we're thinking about, OK, where things are going.
35:59
And at some point maybe we do borrow that line a little bit.
36:02
But where do you feel about AI? And, you know, there's this idea
36:06
about replacing consulting, you know, for any number of topics
36:10
because it's not just I am, right, it's doctors, it's
36:12
lawyers. I mean, there's all kinds of
36:14
stuff happening right now. Absolutely right.
36:17
Look, I think first of all, progress is is always scary I
36:20
think for all parts of of society and for all parts of of
36:25
the world. And I think this is a few
36:27
cliches you can throw out around, you know, futures here.
36:29
It's just not evenly distributed and things like this.
36:32
And you know, the industrial revolution, I doing this podcast
36:36
now sort of 20 minutes South of Manchester, which was the sort
36:39
of world's first industrialised city sort of 250 years ago.
36:43
And obviously when the industrial revolution came
36:46
along, that was a scary place. If you're a subsistence farmer
36:50
in rural Cheshire or Midwest or whatever, it could be suddenly,
36:54
wow, this huge big city with factories and mills and
36:59
automation, steam engines and this sort of stuff that that's a
37:02
pretty scary time. The pros and cons for where the
37:07
industrial revolution has taken us, I guess.
37:09
But ultimately it was changed, which you couldn't stop.
37:13
So I think AI is here to say, first of all, I think will it
37:17
impact jobs? Yeah, absolutely will, no doubt
37:19
about that for the next probably 3-5, ten years, I guess a lot of
37:23
jobs, which repeatable jobs, which will be automated purely
37:27
for productivity reasons. Flip side, of course, if you're
37:31
looking at things like government services, health
37:34
triage systems, banking systems, government services where you do
37:39
have finite resources, you don't, you can't do everything
37:42
with the budgets you have. You leverage automation.
37:45
So there's positive benefits to being able to triage and scale
37:50
services in certain ways. I guess back to your question
37:54
around replacement of people, we've experimented with, with
37:58
stuff for the cyber with, with AI, virtual analyst stuff for
38:02
internal uses. And by that we've we've fed it,
38:06
if you like, we've fed it all of the cyber's contents.
38:09
So things like research reports and things that we have
38:12
generated and I've generated and book material and everything
38:15
else. And it's very easy to create a
38:19
very powerful system. I guess there's a couple of
38:24
things I would add to this though.
38:26
It's very easy to get an answer for something or to create a
38:30
system that will give you an answer for something.
38:33
It's not so easy to have the right questions.
38:35
And this is where I think the value comes to play from being
38:38
a, an experienced practitioner where you know the questions to
38:43
answer, you know the questions that need to be asked.
38:46
And that's, that's a big, big difference.
38:48
It's very easy to go and do a search and say, right, give me a
38:51
identity assessment framework for IGA, whatever, you're going
38:55
to get some stuff splurted out there and great, you know what,
38:59
what can you do with this? But I think being able to again,
39:03
leverage judgement, leverage creativity, leverage the ability
39:06
to ask the right questions that really only comes with human
39:12
experience. Now.
39:12
I was quite like another another cliched quote around the guy who
39:17
who gets hired to fix the big engine on the big in the big
39:21
industrial plant and the engine's not working
39:24
effectively. It's making a horrible noise and
39:26
he gets brought in. He comes in, he looks at it and
39:29
he just whacks it with a hammer. It takes him 30 seconds, you
39:32
know, gets the hammer out of his bag, whacks the engine.
39:35
The engine starts working. He gives a bill to the to the
39:40
factory owner and says they go, there's a bill for 500 bucks and
39:43
the guy goes, well, that just took you 30 seconds and you all
39:47
you did was whack it with a hammer.
39:49
So yeah, yeah, absolutely. But I knew exactly where to hit
39:54
the machine with my hammer. And that, that's the sort of
39:57
stuff which potentially I can't do because it's bringing out
40:00
that judgement, the experience that, that creativity angle.
40:05
But I I think there's some huge, huge benefits.
40:07
Summarisations, being able to query things quickly, being able
40:10
to. Rapidly get to at least an area
40:16
where human can add a bit more judgement to the equation.
40:20
So I think it's, I think. The one thing, Simon, is that
40:24
it's hard to say where AI will be in 10 years.
40:28
I'd say, well, you know, looking at AI right now, you're right.
40:32
It lacks the creativity. It's almost like a calculator.
40:36
It can. A calculator can do arithmetic
40:40
far better than a human can, but the human has to decide what
40:44
goes into the calculator, what, how the calculations get applied
40:49
to something, etcetera. And I think AI sort of similar,
40:53
like we can never research the Internet or summarize these
40:58
large amounts of data in the way the AI can, But what we bring to
41:03
the table is the creative application of that data and
41:08
what we want to get out of that data.
41:10
Now, maybe where AI is 10 years from now, as you say, hey,
41:15
here's some examples of information.
41:18
Maybe you plug some raw data into it and you say, here's the
41:22
kind of output that I want. And boom, analysts, reporters,
41:25
birth from that. I, I actually could see a
41:29
process and I, I, I messaged this to Mike where potentially
41:35
you could have the AI tell you, hey, this is the kind of data or
41:39
tell me what kind of data I need to gather from a vendor to tell
41:43
me about their, you know, the example uses as ITGR for the,
41:47
your ITGR solution. Now you get that output.
41:50
Now you feed into AI all the output that I'm sorry, all the,
41:55
the vendor questionnaires responded to you give some
41:58
samples of here's the kind of papers that I'm looking to
42:01
create. Cross these two things, get what
42:05
you can find on the Internet and produce me an ITGR paper.
42:09
I bet you it could be pretty good that way.
42:13
So yeah. But I think there's huge, huge
42:15
opportunities, huge, huge value. And it's, I think you're right
42:19
in the sense of where will it be 10 years from now?
42:22
I think there's, there's probably a lot of ambiguity
42:25
there. And I think we're definitely
42:27
probably not going nothing spoiled under the the podcast
42:29
there. But there's definitely issues
42:31
around things like misinformation, disinformation,
42:33
data authenticity and where the the output is, is could be used
42:38
for. And I think we're definitely
42:39
moving towards a, a realm of assume fake, if that makes
42:44
sense. I think we in the enterprise, we
42:46
assume breach, you know that we talk about zero trust.
42:48
We assume the network's breach now probably got to assume that
42:51
everything online is fake. Everything's generated.
42:55
It's a deep fake. It's the content is synthesised
42:57
articles perhaps do not have factual information in them or
43:02
they are synthesised and blended.
43:04
So there's definitely my, my bigger word really is, is all
43:07
about that authenticity of the data origin really, and
43:10
providing data origin authentication against a piece
43:14
of content and making sure it's you know, the origin of it.
43:17
You can trust it and you can use that as part of, of something
43:20
else. And that that to me is, is not
43:22
really an area being actively solved at the minute.
43:26
I think that's that's the biggest, a bigger word for me
43:29
going forward, yeah. That's a good point.
43:31
So one of the, the, the main reasons we wanted to get you on
43:35
to the show, Simon, is you're producing this book.
43:38
Producing is the term I, I chose to use because it's not just
43:42
writing. I mean, this is a, a production
43:45
that you put forth. Tell us what is the book called
43:48
and what is it about? Yeah, this is my second book.
43:52
It's called IAM at 2035, so I am at 2035.
43:59
Basically, it's a future Guide to Identity security 1010 years
44:03
from now, which does seem a long, a long time to go in the
44:08
current evolution of things. Why?
44:12
I guess what? Why would I bother doing any of
44:13
the books? I, I did a book about four years
44:15
ago looking at BTC identity, So consumer customer identity and
44:20
access management. And as, as books go, you
44:23
typically never finish a book. And by this you write a book and
44:26
then you get asked to do a second edition and, and et
44:29
cetera, et cetera. And you've sort of leveraged
44:31
that book for, for consultancy and whatever else.
44:34
And it, it came to a point, the real inflection point, probably
44:38
about 2 1/2 years ago, I guess, when there were more non
44:42
identity people asking about BTC application owners, digital
44:48
owners, non-technical and product leads and others who are
44:52
wanting to know about BTC identity, which is quite, a,
44:55
quite an obvious thing because BTC covers a whole host of
44:59
different stakeholders. But it just got me thinking
45:02
around, OK, well, BTC is changing, but the whole identity
45:06
landscape is changing and there's a whole host of new
45:10
stakeholders wanting to understand what identity is,
45:14
where it's been for the past 25 years, what are the current
45:18
problems now and obviously where things may be heading to.
45:22
So I am at 2035. Essentially it's based on the
45:26
back of probably 2 years of of interviews and briefings as part
45:30
of the Cyberhub. Being interviewed, being briefed
45:33
I should say of all of the interesting start-ups doing a
45:36
whole host of different technology areas from password
45:40
less authorisation, ITDRISPMNHI, new authentication flaws,
45:47
orchestration, identity, data management, identity risk
45:51
management, the whole thing around AI and agentic AI in
45:56
there as well. So, so much going on, I felt
45:59
compelled to try and focus upon where we were, essentially where
46:04
we are today. All the problems we have today
46:07
around lack of coverage, NHI cloud versus hybrid,
46:13
decentralised versus centralised access controls is a bit of a
46:17
mess to be honest with all this stuff around identity as an
46:21
attack surface because of visibility concerns and
46:24
behavioural monitoring issues. So there's, there's a lot going
46:28
on with identity, but it's becoming more important.
46:30
So getting identity right can deliver huge benefits to B to E
46:36
workforce productivity and security.
46:38
It can deliver revenue and services online.
46:41
It can help with the disinformation thing we talked
46:44
about earlier, integrates with data and network and endpoint
46:48
security. So you, you get it, right.
46:50
You want a, a huge opportunity to deliver robust, secure
46:56
services. And I guess the, the, the sort
46:58
of second-half of the book is looking ahead, you know, where
47:01
things may end up in the next decade, looking at things like
47:05
intents, looking at attributions or I guess back to #3 in those
47:10
laws around being able to really tie identities to a biometric.
47:15
We're talking about people looking at behavioural
47:18
monitoring, intent of identity behaviours, looking the whole
47:23
world of, you know, how can we secure this identity ecosystem
47:27
if we are starting to see IAM and cyber merge together?
47:32
So it was really trying to say, look, this is where we are now.
47:34
A bit of the history there and a bit of the future view of, of,
47:39
of where things are going to. And it's, it's been a really
47:42
good, really good journey and enjoyable journey, if if not a,
47:45
a long one. Yeah.
47:47
My my favorite part, to be honest, was the history part.
47:51
And I think you could probably just write a book on the
47:55
history, but I could tell even there, there had to be some
47:59
things left on the cutting floor.
48:01
So when you look back on it, can you tell us what were the things
48:05
you said they have to be in here and what did you end up cutting
48:09
that you were especially things? What I'm really interested is
48:12
like it almost made it, but it didn't.
48:17
Oh wow, it's, it's funny. What do doing a book is, it's a
48:20
little bit like going on holiday with a very small suitcase and
48:25
you're desperately trying to scram your sewing trunks in your
48:29
jumpers, in your sunglasses, in your Lido and all you're trying
48:32
to squeeze it all into this tiny suitcase and you can't get
48:35
everything in. So you really have to be, you
48:38
have to be quite brutal with, with stuff.
48:40
And it's, it is difficult when you are trying to, trying to do
48:43
2 things. One, trying to get your
48:45
experience across. You can get AI to write a book
48:48
if you want to. I'm sure, I'm sure AI will do a
48:51
great job of that, but it's probably going to be pretty dry.
48:54
So part of part of both the books are written.
48:56
We're all trying to put your experience across.
48:59
You know what I've learnt my, my mistakes, the anecdotal
49:03
conversations that the water cooler chat, the linking
49:06
together of, of maybe some patterns I've heard or seen
49:11
really somehow trying to put my experience right and wrong in a
49:16
book which people can obviously hopefully then wrap into their
49:19
world as well. So I don't think that in itself
49:22
is congenerate content. I think the stuff that missed
49:26
out, I think you've always got to think of your audience, who
49:29
is the audience for this book? And it's it's really it isn't
49:32
just identity practitioners. First of all, it is a whole host
49:35
of of different personas I'd like to think gain benefit from
49:40
this non-technical as well as technical.
49:42
The security landscape, data application owners, seesaw sea
49:46
level people who are non-technical in obviously and
49:49
really should take them on that zero to hero journey.
49:54
And I think the stuff which you then pull out of there is often
49:58
some of that really fine grained detail, you know, explaining
50:02
what zero trust is for example. Well, you can go Google that to
50:05
be honest with you. Or the difference between O2 and
50:08
no IDC. So there's a lot of maybe fine
50:11
grained detail in there which you sort of assume can be found
50:16
elsewhere ultimately. So there's a lot of that stuff
50:18
gets sort of dropped and I try and raise up a little bit some
50:21
of those meta patterns and some of those bigger trends and then
50:26
so highlight my sort of experience in Yeah, so that so.
50:31
I think you covered well. Like who should read it now?
50:34
How should they read it? Should they read it like you eat
50:37
an elephant one bite at a time, or like you eat a 30 inch pizza
50:41
all in one sitting? Oh well.
50:45
I reckon you could do that. It's two pizzas, isn't it?
50:48
30 inch pizzas? That's probably 2 regular.
50:51
I think I could do that. I think anyway, definition of
50:54
two is well, yeah, it's a really interesting question.
50:59
So the the the book, essentially The thing is 16 chapters we
51:02
ended up with. And ultimately you talk, it's
51:05
based on the sort of standard, standard model of situation,
51:11
complications, implications, solution.
51:13
And obviously the first thing people look for is give me the
51:15
solution page, Give me what's the, what does 2035 look like?
51:20
Give me, give me the ideas, give me the, the buzzwords or the,
51:23
the vendors or the, the categories that will definitely
51:26
exist in 2035. So I reckon a lot of people will
51:29
aim for that. Now, in my opinion, you're
51:33
better off reading the whole book.
51:34
It's, it's you, you can get through it, I imagine pretty
51:37
rapidly. So I, I think it, it is a
51:39
journey read it is, it is looking at understanding the
51:43
past so you can better predict the future.
51:46
You, you can't, you can't understand the future unless
51:49
you've got a good understanding of history.
51:51
And I think that is vitally important.
51:53
So my, my, my recommendation will be to start at the
51:57
beginning with a coffee and slowly go through it.
52:01
You can probably do less than an hour per chapter.
52:05
I think 16 hours, probably condensed under 12 hours.
52:08
It's not a long, it's not a long period of time.
52:10
So my recommendation would be to read it through in a in a
52:13
journey in a journey and enjoy. It.
52:16
Enjoy it, enjoy it. Exactly is the book going.
52:20
To change people's mind about anything.
52:22
Are there preconceived notions that most of us identity
52:26
practitioners are walking around with?
52:28
And you read the book and you're like, I needed to question the
52:31
way I was thinking. I, I hope so.
52:34
I hope so. I think it'll, it'll definitely
52:36
change the mindset of, of non identity people.
52:39
I think it'll definitely put identity is a more strategic
52:43
enabler. I think, you know, 25 years ago,
52:45
identity was the purview of the CIO of operations.
52:50
It was focused on productivity and compliance.
52:52
It's, it's not that anymore. It's it's certainly a strategic
52:56
fulcrum within even the smallest enterprises.
52:59
You know, they can't, you can't be secure without identity.
53:02
You can't deliver online services without identity.
53:06
You cannot deliver employee productivity without, you can't
53:10
do anything really. You can't do this podcast
53:12
without identity. So there's a lot of things I
53:15
think which will probably surprise non identity
53:18
practitioners. I think for the for the, for the
53:21
people who've been in the identity space for a long time,
53:24
I think it will give a better set of analytical tools.
53:28
I think there's a lot of assumptions you can make if you
53:31
spend time a long time in any technology sector.
53:34
And I think it's really about unpicking some of those maybe
53:39
bad habits or, or, or complacencies we all get into
53:42
and trying to say, look, have a fresher and I guess more
53:46
contemporary analytical framework to look at how
53:50
identity should be measured, how it should be integrated or
53:53
problems it should be solving in trying to help analyse both the
53:58
vendors and also existing deployments.
54:01
Because nobody has the luxury of, of designing things from
54:05
scratch and picking out the best technologies.
54:09
You have to deal with existing systems, existing problems.
54:12
So I think the big take away will be at least provide people
54:16
with a set of analytical tools that they can look at their
54:19
existing systems, existing vendors, existing suppliers and
54:24
be a little bit more informed around what success looks like
54:28
for some of those things. Yeah, I mean.
54:30
The other thing I think is like you come with such a great
54:34
perspective. You kind of gave that history,
54:36
but also, like I said, you. I think your.
54:40
Creativity and kind of how you set yourself up for these, this
54:45
deep thinking and also your willingness to be bold and to
54:52
not just accept like, OK, this is what everybody's saying, but
54:55
I'm going to question it and I'm going to put out some big
54:58
statements and not everybody's going to agree with it.
55:01
That's going to get people thinking and potentially change
55:05
some minds. But I'm wondering now, what did
55:09
you learn through writing the book?
55:11
Did you start to question your own thinking?
55:15
100% yeah, I generally did yeah. I think, you know, I've been as
55:20
you guys have you do this stuff for a long time, you do get into
55:23
patterns of, of thinking, patterns of behaviour,
55:27
assumptions around certain things.
55:29
And it was I think it's really it's quite refreshing I think to
55:33
to to be briefed by technology start-ups who are early in their
55:38
journey. You feel like, you know, maybe
55:39
tackling ideal behavioural analytics or NHI or modern
55:44
approaches to authorisation or some quite esoteric parts of our
55:48
identity world and they bring a freshness to that.
55:51
And you have to be, you have to question that.
55:55
You have to question it, both business and technical is is to
55:58
their back story. But equally you've got to be
56:00
open minded. I think as well, I think there's
56:02
definitely opportunities for huge improvement across all
56:07
parts of our identity life cycles.
56:09
And to me, that's, that's what keeps me interested in this
56:12
because I think, you know, you could easily sit there and say,
56:15
well, you know, we still haven't solved the elder bar back
56:18
problem. And for honest support, we never
56:19
will. So accept that and move on and
56:22
start tackling some of the more pressing problems if you like.
56:26
But I think I, I always try and keep an open mind.
56:30
Don't accept, don't reject. Question the assumptions of
56:33
things. Question the assumptions of
56:36
vendors questioning assumptions of design and what, what, what
56:40
real problem is being solved. And I think that that is
56:45
definitely refreshed me over the last couple of years.
56:47
I think definitely kept me invigorated as to IAM being a a
56:52
really powerful dynamic industry that will definitely be around
56:55
10 years from now. I think there's there's no
56:57
question about so with this. Idea of like all this
57:01
proliferation of writing that you do.
57:03
I want to take us to a lighter note here as we kind of wrap up
57:06
the show and talk about if you were, you know, writing a
57:09
fictional story, Do you have any ideas on what a fictional book
57:13
might be from the mind of Simon Moffett?
57:17
Oh God, digging into my mind. Well, that's a fun.
57:20
Do you know, I, I, I do, I do, I do like writing.
57:23
I think writing is a very enjoyable pastime.
57:27
I think I, I don't, I don't actually read a lot of fiction.
57:30
I must say I, I typically read non fiction, essays,
57:35
biographies, history books, how how the world works, sort of
57:39
thing. And it's, I've actually a bit of
57:41
AI try and keep my local library running.
57:45
There's a big thing in the UK about libraries closing down.
57:47
So I, I try and go library relatively frequently.
57:49
And I'm, I'm probably four or five books at the minute into
57:53
whole history of, of looking at the natural world, if you like.
57:57
I'm reading an absolutely amazing book at the minute about
58:00
Eastern owls in Eastern Russia. A guy, a guy went over to
58:05
Eastern Russia about 20 years ago and he researched these fish
58:09
owls, massive big birds of prey, fish owls in eastern Russia on
58:15
the Japanese Sea of Japan. And he, he spent five years
58:18
going through, you know, the eastern coast of Russia,
58:21
tracking these fish owls, measuring them, checking their
58:24
habitat, all that sort of stuff. I love all that.
58:26
I carry on. It's, it's real life.
58:28
It's again back to the memoirs. And he's trying to transpose his
58:32
experience into into US non fish owl experts.
58:36
So I'm I'm into that sort of thing and non fiction me.
58:39
I think if I had to write something non professional, I
58:42
would probably go down the sort of essayist routes or writing of
58:48
essays around, you know, how we live our life, how how to take a
58:51
walk in the countryside, how to make a cup of tea and how to
58:55
drink a pint of beer. These sorts of things, which you
58:57
can, you can extend over 5 or 6 pages of link and really uncover
59:04
the real world. I think that'll probably be my
59:06
that could be a nice hobby, I think describing, describing the
59:09
mess we're all leaving this planet in, that sort of stuff.
59:13
What would be the setting for this?
59:14
Would it be something that is like realistic, a place that
59:17
you've visited? Is it something maybe a little
59:19
more fantastical or fantasy? Like give me the idea of like,
59:23
OK, I am, I'm reading about this character who is learning how
59:27
to, you know, sounds like, you know, relax in life a little
59:30
bit, take a step back and maybe have a cup of tea or some other
59:33
beverage it. Will be contemporary, so it'll
59:36
be it'll be right now it'll be 2025.
59:39
I did saying I wouldn't do a non fiction, but I did I did.
59:42
I did start an idea for something and it was it was
59:46
based on the back of reading 1984 by George Orwell Disatopian
59:51
novel where everything's everything's terrible.
59:53
And my book was going to be called 2361 right.
59:58
And the, the the the reason for this 23 the hour 202361 meant 61
1:00:05
minutes past midnight, which you can never get to, of course.
1:00:09
Now the the reason being long Long story short.
1:00:13
It was all focused on the Doomsday Clock.
1:00:15
If, if you've, if you've heard of the Doomsday Clock, which is
1:00:18
I think it's at 89 seconds to midnight at the minute, which is
1:00:22
the destruction of the planet, the nuclear annihilation of
1:00:26
everything. It's it's clicked forward to 89
1:00:28
seconds to midnight. And my, my idea was to say what
1:00:32
happens at one minute past midnight when the whole world is
1:00:35
in a dystopian mess. But yeah, I, I didn't think it
1:00:39
would be happy ending sort of books.
1:00:41
I thought I'd I might park that, park that for the time being and
1:00:44
focus on 2025 and how we can all live a slightly better life.
1:00:51
Not to be confused with the Iron Maiden song 2 Minutes to
1:00:53
Midnight, which is I guess roughly kind of the same idea.
1:00:57
Jim, if you were to. Write a fictional book.
1:00:59
What would you write about? Or I got this?
1:01:01
Idea. So I've switched companies a
1:01:04
couple of times and when you switch companies you have the
1:01:07
ability to take your retirement, roll it out of your 4O1K in the
1:01:13
US was like the employ the employment retirement package to
1:01:19
an IRA, which is kind of like an independent retirement package.
1:01:23
And during that time, it's kind of like you have to transfer all
1:01:27
your money into cash, freeze it, and then it goes into your IRA
1:01:31
and you select the investments that you want to go into.
1:01:35
I'm not sure exactly how that process, but I've done it a few
1:01:40
times. It's been a while.
1:01:41
Anyway, so my, the backdrop of my story would be I, you know,
1:01:48
the, the character in the book is switching jobs and decides,
1:01:53
OK, he's going to roll his money over.
1:01:55
It gets frozen in cash and then the market tanks.
1:01:59
I mean, it drops like 85% and then it's out of his control.
1:02:05
It's frozen in cash. Then it gets put into the
1:02:08
market. When it's down 85%, it bounces
1:02:10
back up even higher than it was. And so now the guy's like an
1:02:16
instant multi millionaire with dumb luck, right?
1:02:21
So now he's got all this money and then he goes to the doctor
1:02:27
and the doctor says you have only two days to live.
1:02:33
And so now he has all these millions of dollars and he has
1:02:35
to spend it or he has to decide what to do with it in two days.
1:02:39
He hadn't like given us any thought because, you know, he
1:02:42
basically by dumb luck became a a multi millionaire and now he
1:02:49
finds out he only has two days or some amount or some short
1:02:52
amount of time to live. He's got to figure out what to
1:02:54
do in that time. And then I think as like the
1:02:59
kicker, you get to the end of the two days or whatever it is,
1:03:04
and then you find out that he was still alive.
1:03:06
And you go back to the doctor and they'd be like, yeah, we've
1:03:09
been trying to call you, but it was going to voicemail.
1:03:13
We we gave you the wrong person's information.
1:03:15
You're actually going to live. There's nothing wrong with you.
1:03:20
You've given. This a lot of thought.
1:03:23
More, more. No, thought I, I.
1:03:25
Thought about it. All within the last hour.
1:03:29
It. Has like elements of like
1:03:31
Brewster's Millions, Joe versus the volcano.
1:03:35
There's there's tragedy. There there.
1:03:37
Isn't there? Right.
1:03:38
Yeah, there's. Identity plate, Yeah, like we
1:03:39
tried to get a hold of you and you know the wrong information
1:03:43
scopes. Of two token yeah I.
1:03:47
I just thought of it like I thought of different parts
1:03:49
throughout the show, but I was listening to you, Simon.
1:03:52
But I, I, I've been thinking about this like this investment
1:03:57
thing because the markets have been crazy lately.
1:04:00
But I also thought about that whole thing about how the IT
1:04:03
would have been. It's just too obvious to say I
1:04:05
bought a lottery ticket and won $10 million.
1:04:07
And maybe if I needed to keep that front part of the book
1:04:09
short, I would do that. But I think that whole scenario
1:04:13
that I just talked about could be a kind of a backdrop that it
1:04:18
also ruined a bunch of people. And now there's all these
1:04:20
desperate people living in the world.
1:04:23
Because one of the the offshoots of the story could be that
1:04:27
there's all these desperate people and they kidnap somebody
1:04:32
from your family who you had a falling out with and basically
1:04:37
you are estranged from. And they were asking for all of
1:04:43
your money as so state was one of your parents and you're
1:04:47
estranged from your parent. And now they're saying they want
1:04:50
all the money to release the hostage.
1:04:55
Hopefully it's not like. Stalin and his son, where they
1:04:57
kidnapped his son and then he's like, man, keep him.
1:05:00
Yeah, right. Right.
1:05:02
Well, you know, you'll have to read my book.
1:05:05
Yeah, well. Get get on it.
1:05:07
You know, maybe you make an AI Co writer or something to get
1:05:09
this out there. Get inside of your head.
1:05:11
Yeah, right. Good.
1:05:13
Idea I I I can't. Top that because you have so
1:05:15
much detail in this vivid imagination years.
1:05:17
I was I was waiting for the downer part of it.
1:05:20
And you, you, you got to it with the the death diagnosis and with
1:05:25
the kidnapping and the desperate people all around the world.
1:05:27
So it had a little bit of everything, you know, for you,
1:05:30
yeah. Hey, if I'm going to be the
1:05:31
author, you know, there's got to be some, some downside to the
1:05:34
whole thing, all right? Well, I, I'll just say probably
1:05:37
for me, something sci-fi, just because I'm a sci-fi nerd and I
1:05:40
am not super creative. So I, I don't know even what it
1:05:44
would be about, But it'll be something far, far in the future
1:05:47
where, you know, maybe I can somehow extend my brain to be
1:05:52
able to experience all the things I'm going to miss after
1:05:54
my mortal life is dead is has ended.
1:05:56
So maybe it's like an AI version of Jeff or, you know, I always
1:05:59
talk about the the the Baba verse set of books, which I
1:06:02
think is really good. So maybe something along those
1:06:05
lines of like some sort of AI immortality and what does that
1:06:08
actually mean? And you know, maybe it's
1:06:11
something on those. Lines.
1:06:13
So I don't know, we could. OK, let's go ahead and wrap.
1:06:15
It up there for this week. Simon, thank you so much for
1:06:17
taking time with us. Really you step appreciate you
1:06:20
stepping in with us. I'll have links in our show
1:06:22
notes for everything we talked about today.
1:06:23
So link to the cyber huts as well as the podcasts as well as
1:06:27
you are present on LinkedIn, Simon.
1:06:31
So hopefully that's all cool with you and perfect.
1:06:34
Thanks guys. Yeah, it's been.
1:06:35
Great. Let's not wait another 347
1:06:38
episodes to do this again. Let's let's let's talk more and
1:06:42
I'm sure we'll see each other at conferences coming up in the
1:06:44
future. So with that, we'll go ahead and
1:06:46
leave it for this week. Thank you everybody for watching
1:06:48
and or listening. Thank you, Jim, for not really
1:06:51
ticking off our listeners at the very beginning.
1:06:53
Like and subscribe. That's all we're asking for.
1:06:56
Share it with a friend, share it with an enemy.
1:06:57
We don't care. As long as somebody's watching
1:06:59
or listening, we'll keep doing this.
1:07:01
We're on the web, IDC, podcast.com, visit the YouTube
1:07:04
channelidcpodcast.tv. And yeah, thanks everybody.
1:07:09
And we'll talk with everybody in the next one.
1:07:10
Cheers, guys. Thank you.
1:07:13
You've been. Listening to Identity at the
1:07:16
Center. We hope you've enjoyed the show.
1:07:19
Make sure to like, rate and review and we'll be back soon,
1:07:23
but in the meantime, hit the website at
1:07:25
identity@thecenter.com. See you next time on Identity at
1:07:32
the Center.