Latest / Identity at the Center / #151 - What's the difference between Digital Identity and Identity and Access Management?

Transcript

#151 - What's the difference between Digital Identity and Identity and Access Management? · Identity at the Center

0:09
You're listening to the identity of the sender podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:25
sender podcast I'm Jeff and that's Jim.
0:27
Hey Jim hey Jeff, how are you? Oh not so bad yourself good.
0:31
But a little bit sad I'm having to go through the process of
0:34
canceling. My reservations for the identity
0:37
versus conference. Just have too much stuff going
0:40
on and I'm not going to be able to make it and I know I've been
0:43
telling everyone on the podcast recently that I was going to be
0:46
there. This podcast is going to go live
0:49
the day before and I'm very sad that I'm not going to be able to
0:51
be there in person, but I'm hoping doing Least be able to
0:55
catch the sessions virtually. We have lots of friends there.
0:59
I think I've shared, I won't be there by the time.
1:02
People are listening. This, I will be neck-deep in
1:04
boxes. Moving a house moving moving out
1:07
of my house and into another house the same week.
1:09
So kind of Bittersweet and was looking forward to it.
1:12
Especially this being the first conference that's being run by
1:16
different organization than paying kind of truly separates
1:18
it from, from, from them and makes a little more vendor
1:21
neutral method. It wasn't before, but it's been
1:24
in a while. I was at RS a few weeks ago, and
1:25
it was cool to kind of see people there, you know, be able
1:28
to kind of fist-bump folks that I hadn't seen in a very long
1:32
time. I did see Vittorio on the
1:34
street, I think, after we recorded because we recorded on
1:38
this tutorial is on the shree Bose.
1:39
You like once-over. Now it's one of those things
1:43
you're heading your you know every night there's like some
1:45
sort of activity and I don't know what he's doing is going to
1:48
get food or something like that. I was like done for the day and
1:51
I saw him from a distance. I mean Miss that hair.
1:54
We can't miss. I heard, yes.
1:56
I was like, oh, that's what are you guys like?
1:57
And we were working on something specifically for this show, so
2:00
we'll get to that in a second. So I kind of want Harry I fist
2:03
bump him and say, you know, what's going on in chat for a
2:06
second and then kind of went on our way is, but that was pretty
2:08
much like the conference was like, you know, like a 30
2:12
seconds to one minute to minute fist bump and then like, hustle
2:15
and bustle off to the next thing that was out there.
2:16
But the good news was that you were seeing Victoria on the
2:20
streets, because he couldn't get a hotel, which I know for sure.
2:24
Conferences in the past special, ersa that can sometimes be an
2:27
issue. It is so hard to get a good
2:29
hotel for our site. You have to book the day that
2:33
they announced it, or you are staying far away, you're taking
2:36
shuttles or yeah, you're just out of luck.
2:38
Hopefully, you're not crossing the Bay Bridge.
2:41
It's a, it's a try to make it but yeah, that's, that's the
2:44
approach that we talked about, you know, last time we were
2:46
talking about, this was make sure you book early and book,
2:49
often hotel rooms are going RSA, that's right.
2:54
It's all just yeah, this thing that we were talking about with
2:58
the torrio that I sort of tease the little bit.
3:01
This actually came as a result of a conversation that you and
3:07
myself and Andy hindle who was on the show a few weeks ago kind
3:11
of we're talking about. I think it was actually even
3:12
during like one of just kind of like our pre-meeting kind of
3:15
getting setup and mic check and right you know all that good
3:17
stuff and we're kind of thinking about as you know, has Has the
3:21
definition of identity and access management changed.
3:25
It was like okay well that would be kind of an interesting show
3:27
because I feel like it kind of has and there's a lot of
3:30
different terms sometimes used for this right?
3:32
Digital identity. I am I DM you know all different
3:37
color of identity words that could be out there and say oh
3:40
well maybe we can turn this into a show and my original thought
3:42
was, hey, let's do like a live panel like, you know, we have
3:46
this wide stream, I'm having a little bit of will do it mostly
3:48
because my schedule sucks. It should be stabilizing here in
3:52
a couple of weeks after I get moved.
3:54
But I thought was I think it will be interesting to get, you
3:56
know, some of the identity as we like to say, you know, on the
4:00
show in some way and kind of have a Roundtable discussion and
4:03
then actually you had the brilliant idea was I want to we
4:06
just asked people the question and have them email in there.
4:10
Are audio response, so I guess Jim you want to kind of take you
4:14
take us through the process and how we got to where we are
4:17
today, and from your perspective.
4:19
Yeah, you know, I think you do. No, they're pretty good there.
4:23
You know, I think what would happen was Andy, kept saying,
4:26
digital identity, digital identity, and I thought to
4:29
myself, whatever happened to I am.
4:32
And so I asked him that question.
4:34
What's the difference between digital identity and I am and it
4:38
kind of stumped them, right? And he's like, well this is a
4:41
longer answer. This would be a longer answer
4:44
than we have time for in, you know, this little bit of the
4:49
episode. So, We make it a follow-up
4:51
episode and then from there, we kind of, as you mentioned
4:54
evolve, the idea to this kind of Round Table and we're going to
4:58
go through the recordings that were submitted in the order they
5:02
were said to us, so no particular order.
5:06
But do you want to go through and kind of like mention each
5:09
person and played the clip and then comment?
5:12
Yeah, I will emcee this and so the oh yeah, the way it's worked
5:16
was, you know, Jim spammed everybody that we could think of
5:19
sending Male to say hey here's the question if you wanted to
5:22
record like a two to three minute, sort of answer on what
5:26
your thoughts are and the question that we posed to
5:29
everyone, was this, what's the difference between digital
5:32
identity and identity and access management really kind of
5:35
looking to see? You know, what the different
5:36
responses where we got responses from a few different people.
5:41
We have Ann Glaser, he's a senior vice president identity
5:44
product management. At Salesforce, he's a friend of
5:46
the show been on the show before Sarah such a tea.
5:49
She's the head of product. Amazon Cognito another person
5:52
who's been on the show, actually all these people have gone to
5:54
show, he's mailer Chief technologist, technology officer
5:58
at Ford Rock, we've got Adam Michael, who's a data management
6:01
officer and director for it risk identity and Adjunct professor
6:06
at Texas A&M University and then our old friend Jamie Lewis
6:10
grows, who's the vice president Solutions, engineering and
6:12
strategy at stadiums. So, now by saying that Jeff
6:15
you're not calling Jamie old, right?
6:18
Here's your beautiful friend for a long time.
6:20
She has and I think I'm, I think I am older than she is.
6:24
So she I've got her beat on that one, but here's his inches like
6:29
when she let you listen. So if you're listening to the
6:32
show and you stick around for when Jamie gets into hers let's
6:36
just say she ages herself as well.
6:38
How about that of her own you know volition whether it is
6:42
sorry JB don't mean to throw you under the bus but you start off
6:44
with it. But yeah.
6:46
And the other thing is cool here is I think really the only
6:49
answer that Jim has heard so far is Ian's.
6:53
So the other is Jim hasn't even really kind of listened to and
6:56
Jamie's is going to be a complete surprise to the first
6:58
time. So, a lot of this will be a
6:59
combination of reaction. Mostly on Jim's Park.
7:03
I have heard them all because I have added them together and,
7:06
you know, prepped sort of the Sound Stage here as we're
7:09
recording. So it'll be interesting.
7:11
So why don't we go ahead and get started?
7:13
And the question again, as we ask people was what's the
7:16
difference between digital identity and identity and access
7:19
management And this first clip is from Ian Glazer.
7:23
So at first, I thought that this question.
7:25
What's the difference between I am and digital identity was an
7:27
easy one to answer and then I realized it's absolutely not.
7:32
And it's the reason why it's not, it's not because if you ask
7:36
three identity people, what their definition is of a
7:39
specific identity term. You'll get six answers.
7:42
It's because in within the question is actually a bunch of
7:47
different issues So I think at the surface layer, the
7:51
difference is in my mind, I am. Although it used to be the way,
7:58
certainly analyst referred to the General market of digital
8:01
identity has become shorthand for Workforce, identity, and
8:07
access management. So I think in sort of more
8:10
modern parlance, I am is the work force equivalent of Siam.
8:14
Okay. And so then that's true.
8:18
We're left wanting an umbrella term that could cover both
8:23
Workforce, identity, and Siam and all the other bits that are
8:28
starting to become integral to the industry.
8:32
And so to me, digital identity has become that umbrella term
8:37
problem is that's not entirely ideal.
8:42
It certainly leaves areas out of the conversation.
8:45
So for example, if you talk to an identity practitioner Then
8:48
you say hey do you work on identity theft?
8:52
The likely say no that's not Identity or that's not the
8:55
identity I work on and if you you know, ask another
9:00
practitioner about you know, how much they do in terms of source,
9:05
documentation verification for legal identity, bound to a
9:09
digital credential depending on industry.
9:12
And they may say well I don't do that at all and so the identity
9:16
and identity documents which off Often come from the physical
9:20
world and now are starting to make their way in the digital
9:22
world that often gets left out of the conversation to.
9:25
So the reason why I'm thinking about these things is because
9:29
boundaries are important in names in this case really come
9:34
with a set of boundaries and that helps Drive Clarity in the
9:38
conversation. Well one thing that that you
9:41
know I realized was actually a couple years ago Andrew Nash at
9:46
the time. I think he was with Capital One.
9:48
Give me a really good talk. That basically said, hey, you
9:52
and the audience think you're doing identity management.
9:54
What you're probably actually doing is just user account
9:56
management and he wasn't being demeaning, he was saying like
9:59
look the totality of the things that go into.
10:01
What many of us do on a day-to-day basis is user account
10:05
manipulation assignment of title entitlements doing the identity
10:09
Plumbing but we weren't doing was the more holistic.
10:15
I have a digital representation of this legal entity and all of
10:18
the Things associated with it, let's manage those things.
10:21
Which notionally would be identity management or digital
10:25
identity management. So coming back around, I think
10:31
the answer is at the surface level.
10:33
I am is now become shorthand for Workforce identity, then all the
10:37
things associated with a classic Enterprise Workforce, identity,
10:40
infrastructure and digital identity is the umbrella term
10:42
for the industry, but I think that's maybe not as exact as it
10:47
could be. And, you know, Again given the
10:49
opportunity to talk about definitions.
10:52
Everybody's got a bunch of opinions.
10:54
Those are mine. Alright so that was Ian Glaser
10:56
at Salesforce? What are your thoughts?
10:58
Jim. I think that he got to the heart
11:01
of kind of what I think the difference is, which is that
11:05
it's a, it's kind of how your its wording around, you know,
11:12
what is the classification of the industry?
11:15
Now, he's saying identity and access management has been
11:18
Become kind of a focus on the workforce part of this whole
11:23
digital identity space, whereas I think is kind of like a
11:27
historical change this happens, like we started out with the
11:31
industry of identity and access management and yes it was
11:34
Workforce. And yes you know at the time if
11:37
you look at the solutions that were on the market, they were
11:40
identity Management Solutions, wasn't even IGA and their access
11:44
Management Solutions that they were.
11:46
How do you protect your websites?
11:48
Less about federating out. There's more about protecting
11:51
the systems that you had so the classification identity and
11:56
access management did it very well for the time and then as
12:00
what kind of start to build up in the space kind of grew and
12:05
added new scope, it kind of stretch and the term identity
12:10
and access management. I feel like became less
12:14
descriptive of what this whole Space has become.
12:18
Come, which includes customer identity management, which
12:21
includes self Sovereign, identity, and identity.
12:25
Verification of these things that no longer to determine
12:29
identity and access management fit very well.
12:31
And I think the term digital identity has been around for a
12:35
while, but people weren't really taking it seriously, until
12:39
within the last. Let's say, 34 years, where I
12:44
feel like it's, you know, people are starting to now break from
12:47
using I Am I still use? I am but that's kind of the way
12:51
I am. I still write with a pen on a
12:54
piece of paper sometimes and the term digital identity is kind of
12:59
taking over which encompasses this much larger area and I
13:04
think it's probably just more appropriate.
13:07
Yeah. One thing that he said that
13:08
struck me was this delineation between I am as being like
13:13
Workforce and Siam or customer identity access management.
13:18
I know you of I have really kind of figured out some of that
13:22
stuff as we were kind of talking over the last couple of years.
13:24
We've started to call it, like, E.
13:25
I am Enterprise. I am versus Siam or see, I am
13:29
customer. I am maybe it's not easy.
13:32
I am maybe it's w. I Am Workforce identity and
13:35
access management or maybe why I am Prince, I am right, things
13:39
like that. But I think it is interesting
13:41
that the definition clearly has changed.
13:44
I'm a little surprised, not surprised because we're going to
13:48
have more More answers here at the perspective that it seemed
13:52
to me. When I was taking is that I am
13:54
sort of fits underneath the umbrella of digital identity.
13:59
I can see a situation where people might have a definition
14:02
of digital identity as sort of like a Civic or citizen type
14:06
identity. Will be interesting if he is.
14:08
You listen here to some of the other folks that we've got, if
14:12
you know, how, how close are some of these definitions and
14:15
how different some of them are, because I think the perspectives
14:17
really are pretty. Different.
14:19
Why do we go ahead and get into Sarah's such a tea?
14:23
Next? She's with Amazon Cognito, we
14:25
asked her, the question. What's the difference between
14:27
digital identity and identity and access management?
14:30
What's the difference between I am and digital identity?
14:33
I was tempted to say there is no difference between I and digital
14:37
identity, and I suspect that's what many experts will tell you,
14:40
but that's not true. There's a very important and
14:43
over, which difference, there's a division of the US government
14:46
called the National Institute for standards and Acknowledge
14:49
our nests and their job is to measure things.
14:52
How long is a meter? Ask Nest, how heavy is a
14:55
kilogram? Ask missed.
14:57
Well in the 21st century, they started measuring not just
14:59
physical things, but digital things like security and
15:02
identity. They wrote a document called
15:05
special publication 800-53. The publication outlined a way
15:09
to measure how strong an identity transaction was and it
15:13
used in measure, called level of assurance.
15:15
How sure can I be that the person at the end of the line is
15:17
who they say they are. R, as that document went into
15:19
broad use, they found it had cracks in its armor.
15:22
It wasn't doing the job that it was intended to do because it
15:25
was too one-dimensional, and it was one dimensional and exactly,
15:28
the access that we're focusing on.
15:29
In this episode, it conflated, I am with digital identity.
15:34
It said that the strongest transactions have both strong
15:36
authentication mechanisms and strong identity proofing,
15:39
meaning that we verified the real-life identity of the person
15:42
at the end of the line. But that measured me leaves no
15:45
room. For a very important use case
15:48
stronger. The authenticated Anonymous
15:50
users. Imagine a political dissident
15:52
who wants to tell the story of what she's experiencing in her
15:54
country but she needs to keep her identity hidden that her
15:57
government won't find her. Do we need strong authentication
16:00
for that person? Absolutely.
16:02
We need to use the strongest technology we have to make sure
16:05
that her lines of communication haven't been compromised.
16:08
Do we need strong identity proofing?
16:09
Shouldn't person. No identity proofing.
16:12
That person could actually compromise her safety.
16:15
We need strong. I am without strong digital
16:17
identity. That's one missed hired a team
16:20
of identity experts, including myself to rewrite the whole
16:22
concept of identity verification.
16:25
We throughout the one-dimensional limiter and made
16:27
it three dimensional. Now, instead of one level of
16:30
assurance, there are three identity Assurance level
16:33
authenticator Assurance level and Federation Assurance level
16:36
because I am and digital identity are, and must remain
16:40
different. All right, so what do you think
16:41
about saris answer? Well, I think that that's a very
16:45
good use case, right? And I haven't hadn't thought of
16:48
that. I can see where she's coming
16:51
from. Yeah, I mean that, I mean, it's
16:53
obviously, you know, given the state of the world, right?
16:55
The the political dissidents and government distances and things
16:58
like that, that are happening, certainly makes the case for.
17:02
Okay. So, what is what is addition to
17:05
definition of digital identity and she's exported it into three
17:10
dimensions is, are those enough Dimensions?
17:13
Is there a fourth dimension space and time?
17:16
It may be, you know what? Is the the right way to look at
17:19
or maybe maybe the definition changes based on the use case
17:25
which might be a little bit tricky to.
17:27
Yeah I remember in the early days of I am some people kind of
17:31
making the argument, I'm Jim McDonald.
17:36
So why can't I just be Jim McDonald whether I'm using my
17:41
Google login or my corporate login?
17:45
I'm still the same person. I think the case is Sir.
17:48
I was making is that sometimes I don't want you to know that Jim
17:52
McDonald make this statement because if I speak out I make
17:57
disappear the next day. So there are times where
18:00
Anonymous is what I want to be. I want to separate that
18:03
authentication so my right to access that account from who I
18:10
am as a person. I think the you know the other
18:14
aspect to this could be just thinking about.
18:17
It is it could be The identity of things which again is kind of
18:21
fallen into originally fell into I am maybe wasn't the best fit,
18:27
definitely under the digital identity umbrella but you know,
18:31
I think that it's it's one of the biggest conundrums of I am
18:36
or digital identity is does the thing really have an identity?
18:40
Yeah. And it in the same way as a
18:41
person with the timing with the the news out of Google, right?
18:44
With one of the one of the folks in Google saying that they're
18:46
aii. This is his Come sentient, or at
18:49
least appears to be your, some like that.
18:52
Yeah, I mean, does does a thing have an identity.
18:55
I mean, clearly there's internet of things.
18:58
And now, I think we're stretching into the line of
19:01
digital identity of things. So does a smart thermostat,
19:06
which clearly lives in the real world, I can touch it.
19:10
It has its own digital identity on the network, or you know,
19:15
whatever it may be the platform that it's connected to.
19:18
I think I feel like if this was a video podcast, I'd be like
19:21
using that exploding brain gift right now, we're going to be
19:25
coming out of the top of your head.
19:27
Yeah, exactly. All right.
19:29
Why don't we move to the next one?
19:31
This is Eve Mahler. She's a chief technology officer
19:34
at Ford truck. We asked her.
19:36
What's the difference between digital identity and identity
19:39
and access management Identity language has been a contentious
19:43
subject for a long time thinking back to the beginnings of iiw,
19:48
the internet identity Workshop, the original effort by that
19:52
Community was to actually develop a lexicon comprehensive.
19:55
Lexicon. It was tough going then and I
19:58
think it's always tough going in this area.
20:01
How I see digital identity as a phrase is that it applies to the
20:07
users of or the interactors with identity.
20:10
Technology. And I see, I am as being about
20:15
the implementation of identity technology in whatever guys.
20:20
So, when it comes to digital identity, the kind of the user
20:23
perspective, you know, most people interact with identity in
20:26
a way that actually isn't all that Pleasant identity theft is
20:29
probably the first thing that comes to mind.
20:32
And a lot of times that interaction is actually in an
20:34
offline fashion versus an online runtime authentication.
20:39
For example, Fashion. When it comes to, I am that term
20:44
itself is, is a bucket for a lot of other different things and
20:46
sometimes they overlap. But I am, sometimes there may be
20:49
a little bit apart. So identity management, kind of
20:51
life cycle, considerations access management, really all
20:55
the runtime considerations and also governance and
20:59
administration which gets into the world of really operational
21:03
things. And there's this phrase that I
21:05
really like lately bolts, which is business, operational, legal,
21:09
technical answer, societal. So that's kind of the game that
21:13
you get into when you talk about both the above, the water user
21:18
considerations and the below, the water, implementer
21:20
considerations one, of the things that I find when I just
21:24
talked with ordinary people out there who don't do what I do
21:28
about, what you call the jobs to be done of digital identity.
21:33
Is that all of the things people expect to get from this sort of
21:38
Technology, it cross-country. Sweet things businesses want as
21:41
well. You know, I have a new Venn
21:43
diagram about this where, I think, in terms of protection,
21:47
and personalization, and payment, and people, so there
21:51
are unique needs among all of those categories and they cross
21:55
cut quite a lot of things like achieving security is actually
21:58
something that's welcomed by people.
22:02
And by businesses, it applies across all of the identity
22:05
language but I thought that was pretty interesting.
22:08
The definition is it? She has for the to, and kind of
22:12
seems to me like it was it's, you know, changes a little bit,
22:14
right? Whether your I am or digital
22:16
identity, what are you thinking? Yeah, it's interesting because
22:19
going to allow my mental definition to adapt.
22:23
As I hear these recordings because there's really, you
22:25
know, as I was listening to Ian that like you said, I was the
22:28
only one who listened to you beforehand, kind of saw identity
22:33
and access management as a subset of digital identity as
22:37
those listening to Yves like kind of thinking there, too.
22:40
Separate Concepts rate, identity and access management
22:43
potentially is something I do with all these processes to, you
22:48
know, manage who gets access to what which I think is the
22:52
traditional definition right? But then, when I think about
22:55
digital identity, I'm actually thinking about some
22:58
instantiation of say, apple has this concept of who Jim McDonald
23:03
is and I can, you know, have apples vision of Jim McDonald
23:09
but it really Kind of has a border around it and then Google
23:13
has a different definition of the digital identity for Jim
23:17
McDonald. And then as Jim McDonald, I've
23:19
got all these digital identities running around, maybe they all
23:23
tie back to me. But essentially, they're like a
23:26
data set that these companies have about me.
23:30
They're like a digital fingerprint of me.
23:33
Maybe they can grant me access to things within their border.
23:37
Maybe they can grab me to access to things beyond my Border.
23:40
So you know, maybe OCTA has that digital Identity or that
23:44
thumbprint about Jim McDonald and it can pass me on to concur
23:49
for example but yeah, so so maybe rather than I am being a
23:55
part of digital identity representing, you know,
23:59
Workforce or even some set of Technologies.
24:03
It's it is that Workforce set of Technologies, how I go and
24:08
manage. But then the digital Identity is
24:10
a separate concept which is these companies have this
24:14
fingerprint this data set about me and that is with digital
24:18
identity is yeah, I think it's interesting if we take that
24:21
concept of okay, when it's concept digital identity and
24:24
separate out from what is identity and access management,
24:27
it's typically a collection of services that are being done.
24:31
Its identity management, its access management privileged
24:34
access government student Administration, make things that
24:36
you've mentioned, even even the the The service of running.
24:41
And I am program is a service within that, and now you're
24:47
starting to help. People are starting to catch on
24:49
as like, this is hard to Define because people have different
24:53
interpretations of, you know, digital identity.
24:57
What does it mean? Does it mean your your
24:59
fingerprint, you know, so to speak online or other digital
25:03
transactions or is it meant to be the overarching?
25:08
Well, we know it's more than I am and we need to come out
25:12
somehow say that. Well, we both do boats you know,
25:14
I am from an Enterprise perspective but you also do it
25:16
from a customer side and you know, we do other things other
25:20
than technology, maybe it's program.
25:22
You know, does that fit under the bucket or that definition?
25:25
I think it's interesting. You know, as we're kind of going
25:27
along. I was certainly I certainly had
25:30
sort of a in my head definition and as I listened to these over
25:34
and over and over again, stir that through the editing process
25:37
and prepping the show it. Changed a little bit and now
25:42
I'll be honest, I'm not sure what to think it's so let's keep
25:47
going and let's now hear from Adam Michael over at Texas A&M
25:51
and what his answer was to the question of what's the
25:55
difference between digital identity and identity and access
25:58
management? When I think about the
26:00
difference between I am and digital identity, I really think
26:05
that they are overlapping sets. So I see digital T as being a
26:12
key component of an overall, I am strategy so digital identity
26:16
to me and I'm coming from the perspective of a higher
26:20
education environment, but so much of what we do now, learning
26:26
and research is moving to an online environment and the
26:31
ability to authenticate someone and know that, okay, if Joe
26:34
student is taking a test, we actually have the correct person
26:38
on the other end of the online resources.
26:40
Taking that test, right? It's important that we have an
26:44
easy way for our students and our faculty to assert their
26:49
identity, in a digital space. Now that's just step one.
26:53
Write authentication, and saying that this person actually is who
26:57
they say they are. But when we talk about, I am it
27:00
goes beyond that and we have this concept of giving them
27:04
access to resources. So once we've verified their
27:07
identity in a digital space, we To be able to grant them access
27:12
to the right things in the right way and the right time, right?
27:17
So that's the access component in I am.
27:20
And so I really see digital identity and I am as being very
27:25
closely related and maybe even overlapping sets I am being the
27:30
superset of something. A concept that digital identity
27:33
fits inside, all right? So remember when I was saying
27:37
maybe digital identities overall Adam, when a different way, He
27:40
sees it the opposite where digital identity is a component
27:45
of identity and access management, which I can kind of
27:48
get behind as well. What are you thinking?
27:50
Yeah, because show you that. There's there's no wrong answer
27:53
here. It's it definitely makes you
27:57
think because I think it kind of even brings in that concept of
28:02
the thumbprint. Now I assert or I authenticate
28:07
myself, is I am Jim McDonald. Now, you can take that
28:10
thumbprint of data and you know, go go ahead and Associate it
28:15
with me through whatever interface I'm using.
28:18
And when he thinks about identity and access management,
28:21
it's all those processes that are included.
28:25
So, I mean, that's definitely a valuable perspective.
28:29
It. I think what's so interesting is
28:32
like that. You can have two people who live
28:36
in this world independently come up with, totally Opposite, you
28:41
know, configurations of which one encompasses the other.
28:45
That that's why I think it is. Such a good question.
28:48
Well, here's another wrinkle throught.
28:50
So, the people that we asked, Adam is the only one that's
28:54
actually in the business side of is practitioner is not, yeah,
28:58
he's a practitioner, right? He's not a vendor, he's not an
29:01
identity person. For example, right, he has more
29:05
on the business delivery of identity Services, rather than a
29:09
product. T', person which Ian, Sarah Eve
29:14
and Jamie coming up, are all more on the identity product
29:17
side of things. So it is interesting to hear
29:20
sort of like the business definition or do business
29:23
answer. You know, from someone like that
29:25
to say, okay. Well here's here's how the
29:26
business of Senate, which I thought was interesting.
29:28
Yeah, I think one of the things that I also have was thinking
29:34
about is, you know, especially like Ian's case and Yves case,
29:38
because I think the first time, Met the two of them is close to
29:41
20 years ago at identity and access management conferences
29:45
and they were part of this identity arathi, right?
29:48
And there's many other folks who were kind of there in that is
29:52
that I am was this, you know, especially conferences, were
29:57
people really talking about was what is an identity like these
30:01
really philosophical conversation?
30:03
And I've been in it at that point for probably about, you
30:06
know, eight years. I was like, I've never run into
30:10
Into a new look with in it wears like all about are so much of it
30:17
was about the philosophy of what we're doing here and so that's
30:22
really what the roots of I am. And so I kind of heard that a
30:26
lot in their answer as well as kind of that coming from those
30:31
roots. Deep thinkers deeper thinkers.
30:34
Yeah, for sure. All right.
30:35
Why don't we go to Jamie Lewis Grace and her answer to the
30:39
question of, what's the difference between a digital
30:41
identity and a dating access management?
30:44
And she's from sabian's, I was asked what's the difference
30:48
between I am and digital identity?
30:52
Well, this is a lot to unpack in a very short amount of time,
30:56
because I've been at this for a very long time.
30:58
And I've seen the industry evolve, I am Identity and access
31:03
management. So early on I am was often
31:07
synonymous with authentication it then pushed into automation
31:11
of processes password management efficiency gains reduction of
31:16
cost. Ultimately I saw I am become the
31:20
umbrella of Technologies and policies to manage access and
31:24
mitigate risk. Inclusive of not only
31:27
authentication single sign-on and multi-factor but then
31:32
Started to extend into privileged access management
31:35
identity governance and administration risk profiling.
31:39
Authorization are back a back P vac and the focus was really
31:44
always all in the workforce at least from from my experience
31:48
and so that brings me to digital identity.
31:52
So digital identity has extended Beyond just the carbon-based
31:57
identities of our Workforce, our vendors, our suppliers, our
32:02
Contractors. It's encompassing of b2c, B2B G
32:07
to C, but also was very important to understand is it's
32:10
taken on the Silicon identities to those not, well managed
32:16
service accounts and included, certificates Keys devices,
32:20
workloads containers. It goes on and on think about
32:25
it, as you know all of the machine related identities that
32:28
are out there and what's happening is with digital This
32:32
formation initiatives there is a exponential growth of connected
32:36
devices and these machine identities use to manage process
32:40
Automation. And it's really creating that
32:43
larger surface and and threat attack Vector, really opening
32:49
organizations up to the Cyber vulnerabilities.
32:53
So you know, when we also think about digital identity often we
32:57
also think about the specific personal data So whether it be
33:03
personas on social media, whether it be someone's online
33:07
bank account access to Amazon Netflix, that's all digital
33:13
identity as well. And then, there's that digital
33:16
blueprint that really is surrounding us.
33:18
We rely on it. It might be the nest thermostat
33:21
in your home. Your home Wireless, the security
33:23
systems that surround you. The list goes on and on personal
33:28
identity in the digital format is as Limitless.
33:32
Our data's continually analyzed and it's, it's used, it's used
33:36
against us. It positions, adds to us, it
33:38
sells to us. It's funny.
33:40
Just the other day. My 84 year old father-in-law,
33:44
was essentially taken advantage of.
33:46
Because he did an innocent search at the library, looking
33:50
into knee pain. And before, you know, it he's
33:53
purchasing something online that, you know, has little
33:57
information about it, but it was served up to him through an ad.
34:00
So there's just so much Much more I could go on and on about
34:04
and discuss. But I want to end by saying
34:07
that, you know, right now, for personal digital identity and
34:11
the information that's used. There's very little control.
34:14
So as we go forward in a world of evolution, you know, I think
34:18
that the future is really going to demand better protection and
34:22
controls of the personal information and with that, you
34:27
know, in the future maybe my father-in-law won't blindly
34:31
purchase some Misguided product for his knee pain.
34:34
So I hope I have answered your question today.
34:37
All right, well, first of all, a couple notes, a hopefully her
34:40
father-in-law's knee is feeling better.
34:42
Second of all. I'm going to give her bonus
34:43
points for using the term. Carbon-based life-forms is part
34:47
of her answer and then third circling back to the very
34:50
beginning when age was brought into it.
34:53
She's the one who said she's been doing this for a long time,
34:55
not me, there you go. I think it's, I think it's
34:57
interesting that she brought up the Privacy angle and the really
35:01
kind of private think it's that kind of go hand in hand with
35:03
those some of those. And it's the first time that
35:05
that has been mentioned in this conversation was ownership
35:09
really of the attributes of the digital identity and how they're
35:12
used. So, yes.
35:14
And so here's what I was thinking as I was listening to
35:18
Jamie, is that there's two ways? This question could be
35:22
interpreted, one is, what do people mean when they say,
35:26
digital identity versus identity and access management?
35:30
So in other words, when people use the Those terms, what are
35:34
they trying to differentiate? Or when you hear those terms?
35:38
What do you think of? And then there's the question of
35:42
what should those terms mean, right?
35:44
And I think if you answer that it might be a different answer
35:48
than the previous question. So as I've been listening to
35:53
these responses, I'm getting more and more on the side that
35:56
digital identity is really this thumbprint Of who of data about
36:04
you. Now, one thing that I've run
36:05
into overtime in the identity and access management consulting
36:10
or digital identity Consulting, whatever you want to call it
36:13
right is Winters. That data, stop being, I am
36:19
data, right? So when what data is I and
36:23
actually one thing I would differ differentiate from what
36:26
Jamie said, but I first got into identity and access management
36:30
it seemed like it was all about Directory synchronization and
36:33
ldap data, and we got all the cell data.
36:35
How do we manage the ldap data? And then the applications are
36:38
going to bind to the ldap and authenticate or of an access
36:42
management system that binds the of that but is all about
36:45
directories. But you know what used to be the
36:48
boundary of what was identity data or digital at your digital
36:52
Identity. Or I am data was what was in the
36:55
directory? I think that what we found with
36:59
virtual directories is now you Can expand that out and they
37:02
take it to another sub match. If we had Dan Creed from meta,
37:06
answer this question, what is the digital identity?
37:10
What it, what is your digital identity thumbprint well, now
37:13
it's, you know, all these different data points that you
37:18
can, you couldn't even imagine where are you?
37:21
And you think, well, maybe that's marketing data to me,
37:24
that's what like the digital identity data is, where's the
37:27
identity and access management is what is the data that?
37:31
What you should have access to great.
37:34
So one, what is my credential data?
37:37
What is the data that is needed? For me to authenticate myself?
37:41
And then what defines? What's going to give me access?
37:45
It could be attributes for attribute based authentication,
37:49
or it could be roles and things like that.
37:52
But that is my, I am data but it seems to me the digital identity
37:56
goes beyond like what are my shopping preferences?
38:00
What is my Location, you know, especially like I was at
38:04
Starbucks the other day or every time I go to Starbucks down if
38:08
you get in the drive thru drive by it, it's like, you know, on
38:11
your iPhone. It pops up with your Starbucks
38:13
app. Like, you know, you can just
38:15
push this button and go in and and have a latte if you'd like.
38:19
So all of that data analysis is kind of extending its marketing
38:24
data but it's kind of becomes your digital identity.
38:28
I don't know. It's so to me that that could be
38:32
What actually is a digital identity versus I am not
38:37
necessarily how the terms you because I believe the terms are
38:40
being used as a replacement. I think that when you look at
38:44
consulting firms they're just replacing their identity and
38:47
access management practice with digital identity.
38:51
You're saying yeah we have a digital identity practice.
38:54
You know five years ago would have been called their identity
38:56
and access management practice. So to me dish identity is
39:00
replacing identity access management from lexicon
39:04
standpoint, but I think that they should have a deeper
39:07
meaning. That's interesting.
39:09
I think I think you're totally right, especially that last
39:11
example, there are like Consulting, what do you call?
39:15
What is it? You say you would do around
39:16
here? Well, what are you?
39:18
I'm, I am consult a. Yeah, yeah.
39:21
Or I'm a digital identity consultant or two people, you
39:27
know, how do I, how do I name the practice that I'm, you know,
39:30
starting and running up is I am. Is it digital identity?
39:33
Is it secure digital identity? Is it just identity?
39:36
I don't know. I think it's interesting.
39:37
I think having listened to, you know, five really smart people
39:41
and then us listen to, you know, pontificate on this is, I think
39:47
the definition morphs and changes on a couple things.
39:51
It's the first is, who were you talking to?
39:54
And the second is, what is the point that you're trying to get
39:57
across is if I'm talking to someone who doesn't know
40:00
anything? NG about identity and access
40:03
management or digital identity, I'm going to try and keep it
40:06
simple and I might use vaguer language that you know, is maybe
40:12
easier to understand or try to articulate versus hey Jim.
40:15
Let's go talk about why we should be using you know, adfs
40:19
for authentication and then you know that's what we should.
40:21
That's a bad example. Sorry.
40:22
She recently using modern standards for authentication but
40:25
you know having a more technical conversation and talking through
40:28
identity and access management versus just this Umbrella of
40:33
identity, which has other connotations to it to write,
40:37
especially in the physical world with gender and things like
40:40
that. So now we're like, okay, well,
40:42
where is the line for identity? I don't know what to tell you.
40:47
I think I went into it. Originally with the idea of
40:51
like, okay, well, I see, I am as a subset of this broader thing
40:55
called digital identity visual identity is the concept of
41:01
power. We managing identity and access
41:03
management in a digital way, whatever that looks like having
41:07
listened to Adam like, okay, I can certainly see that where its
41:11
flipped on its head in my world and like, okay, well digital
41:14
identity sort of a component of identity and access management.
41:16
If I say, I think about it from a service standpoint.
41:18
What is it that we're actually offering and then you brought me
41:23
back when you set up your on the Consulting side, how would you
41:24
explain what you do? Okay.
41:27
Well I run an identity practice. And I think that's how I've been
41:31
introducing really kind of myself.
41:33
Is you know, talk to me about identity and that's kind of
41:37
where I'd left it so far but I'm sure it will continue to evolve
41:41
over time. I think, I think what's
41:43
fascinating is, you know, we got five expert opinions and then
41:47
ours and between the seven of us.
41:50
None of us really had the same answer which I think is why this
41:53
made it made it made the question.
41:54
So, interesting, when we originally talking with Andy
41:56
about it, a few weeks ago and I know my Three evolved throughout
42:01
the show. And I bet you if Ian was
42:04
listening to, there's other definitions.
42:06
There'd be things that folks had said that would, you know, as
42:11
the conversation evolved? He probably would evolve his
42:13
definition as well, because those perspectives, but I think
42:17
the end of the day, we did not solve the question, right?
42:21
We got, we just showed that this is Something that's in flux
42:27
something that's happening. I think, is a fantastic format
42:32
for raising some questions like this in the future.
42:35
And I mean, I'd love to hear from our listeners.
42:39
If this format resonates with you, we can go ahead and do some
42:43
more episodes like this. Yeah, I mean, I think it's easy
42:46
enough to, you know, record on your phone, just a simple audio
42:49
clip. If you've got a definition of,
42:52
or at least an answer to the question of what is the Between
42:55
digital identity and identity access management.
42:58
Is there one, feel free to record something and tag us on.
43:01
Hit us up on LinkedIn. You can attach the file there or
43:04
we can figure out how to get over to us but I think it's
43:06
something continue on. I think with identity versus
43:08
hitting this week you know a lot of these folks that we heard
43:11
from today - us will be there, you know, ask them, you know,
43:16
what do they need about some of the stuff because I think it'll
43:18
be interesting to hear. I think it's only right that if
43:20
I think if we had all these folks in the room I'd be willing
43:24
to bet some parts of each definition would have evolved
43:28
just within the last 45 minutes as we've been talking here.
43:33
Absolutely. Yeah, so like any good podcast
43:36
we didn't we didn't offer any answers, we just talked about it
43:40
for 45 minutes, I think, you know people can kind of figure
43:43
out and even if we don't have the answer, maybe what we did is
43:46
we sparked an idea, right? In someone's listening out there
43:49
saying, oh, I never really thought about it from that
43:51
angle. I don't think there's a right
43:53
answer or wrong answer. I think your is just here's how
43:57
I represent. You know, this specific question
44:01
and I think I think that's okay. I just got to be Of about who
44:05
you're talking to and what's the context of the conversation,
44:08
because sometimes things can get lost in translation, but I don't
44:11
know if you're necessarily needs to be a right answer, right now.
44:14
Does it correct? So I think your robes out and I
44:16
think that was kind of what we expected out of this.
44:21
And we got what we hope for, we got what we asked for and but
44:26
like I said, I think this is a great format so we come up with
44:29
some other questions, you know. I think that we could pursue
44:33
this Format again. Yeah, definitely.
44:37
There's a lot of fun to kind of put this together.
44:39
So, all right. So why do we go ahead and start
44:42
to wrap things up? I was thinking about, you know,
44:44
what's our end on a lighter note for this episode?
44:47
And I want to jump on what Jamie was talking about with her
44:51
father-in-law and knee pain and some sort of, I don't know
44:55
order, purchase whatever that you may or may not be helpful.
44:58
Hopefully, it was, but you never know.
45:00
So, here's my question to you, Jim.
45:01
What is the worst or strangest online?
45:04
Add, you will admit to that. You have been served based on,
45:10
you know, browser, cookies or session history, or whatever.
45:12
It may be. Well I'm not going to even go
45:15
close to the that I would admit to kind of thing because I think
45:20
I gave you that escape hatch just in case.
45:22
Yeah, right. So I mean, I wouldn't call
45:25
myself a conspiracy theorist, but this one of the strangest
45:28
things that happened to me, was, I grew up in Philadelphia, my
45:33
brother, obviously grew up there.
45:34
As well and I was he still lives there and I was visiting him and
45:38
he lives in an older house which that the townhouse style
45:44
buildings there they call them row homes.
45:47
It was a row home and there's probably 75 100 years old and it
45:52
go into his basement and he's got this big plastic sink next
45:58
to his washer and dryer. At least always call them
46:01
utility sinks. Yeah, that was a beauty utility
46:04
square, right? Yeah.
46:05
It's like a dip Square. Deep bass.
46:07
Yep. And I said I haven't seen one of
46:09
those in years. Mike yet.
46:10
You know this utility sink and follow.
46:13
We had a whole conversation about it and I really hadn't
46:15
seen one in years. A couple days later and
46:19
advertisement showed up on my laptop in Amazon, like it Amazon
46:23
ad for utility sink. And so, the conspiracy theorist
46:28
in me, says, somehow, my phone was listening heard utility sink
46:33
since some kind of sold, some kind of message to Amazon or
46:38
whatever. And they served me up in that.
46:42
Did that happen? Probably not.
46:44
Maybe just triangulated that I was in this area because I do
46:49
think that, you know, location is something that can be served
46:53
up, potentially sold to a vendor.
46:56
And that maybe there were a lot of utility sink purchases within
47:01
that area because I would bet you every row home and that
47:05
whole neighborhood have these utility sink.
47:08
So you know, that's probably what happened.
47:10
But yeah, it got me thinking like okay it's my phone spying
47:14
on me. Yeah we've heard I think I've
47:16
heard that before too. Like pit level is my phone's by
47:19
me. Could it be your brother or
47:21
someone you know was searching for utility sinks for something
47:25
replacement repair whatever. / and because at no, you know, the
47:28
powers that be know that that's her, brother's.
47:31
I got a little baby, you might be interested in this as well,
47:32
right, or whatever way it looks like mine is weird and strange
47:39
slightly offensive, and definitely creepy.
47:43
This, I'll never forget this because this was right around
47:47
the pandemic. Kind of beginning I want to say
47:49
we're about six months into it. It feels like it was ages ago
47:52
but I guess that would have been what 20, 20 gruffly.
47:56
So I want to say it was probably like around June, maybe July
48:00
were a couple months in a lockdown, people, worried do any
48:03
things and for whatever reason I was scrolling through I remember
48:06
was Facebook or Instagram is one of those two and you know you
48:10
get as all time for just weird stuff and stuff that they think
48:13
it might be interested surf. Of course, you know watching
48:16
your browser history and so forth and I don't know why this
48:19
came up, but it was a it was a ad for I don't know.
48:23
The right terminology is but it's like you know, it's Banks.
48:26
Our where it's like tights for generally for people to like
48:31
look like they're Slimmer. Oh, Come usually you'll see
48:34
like, you know, I'm sure it's for both sexes, but the ones
48:37
that I know of are Spanx are like for women where, you know,
48:40
they put it on, it kind of Slim's the figure and so forth.
48:43
And this was the equivalent. But for men as like Spanx
48:47
underwear or compression thing that good supposed to go up and
48:51
over your belly to try and compress things.
48:55
I was like, what the Because this seems and then I got
48:57
offenders like, well, I okay, yeah, I could lose a few pounds
49:00
and yeah, you know, like, huh. I don't know how they are.
49:06
You know, they decided that I was in that other than okay,
49:10
well here's a person who hasn't left his house probably like two
49:12
or three months, they probably need help.
49:15
You know, we've noticed that there's been a lot of doordash
49:18
delivery, a lot of pizza delivery.
49:22
Yeah, exactly. So I was I was offended mostly
49:26
He amused mostly and slightly perturbed that.
49:32
Uh you know how dare you make that recommendation but I'll
49:35
never forget it. I was like all right well that's
49:38
weird whatever just to get you back I'm going to order to
49:41
Frosty's for milk from Wendy's right now.
49:44
Exactly. Well I'm gonna start wearing
49:46
them. I guess I got to get the maximum
49:47
value out of it. Exactly.
49:49
So I never did order them but even though I probably could use
49:52
them, I thought that was Interesting as well.
49:58
Just from a timing perspective and I wonder what in went into
50:01
the decision. For whatever logic was used to
50:05
run that ad location. Had to change mostly at home.
50:10
A lot of food, deliveries pandemic, I don't know, you
50:15
know, whatever it may be but I'll never forget that.
50:17
I think that was just the weirdest thing.
50:20
I've been served up so far. Was that it an Amazon, a door?
50:23
Was that? Oh, you said that was it?
50:25
I think. It was either Facebook or
50:27
Instagram, I can't remember which one it was, and the same
50:30
companies like this is really matter but, you know, I do
50:32
remember where exactly I saw it. But usually my Facebook ads are
50:36
around like audio equipment because that's what I'm looking
50:40
for the podcast, right? Or backpacks.
50:43
I have like a bag collection, I'm a collector of like, you
50:47
know, nice backpacks, things like that.
50:48
So usually that's what I guess pan with.
50:51
But this one was just so far out of like the blue.
50:55
I just didn't, I didn't get And I remember showing it to my
50:57
white to I was like leave us and she's kind of like smiled.
51:00
I was like okay well screw you then to it's okay you know your
51:05
buddy look good more of those. Yeah exactly.
51:09
Alright let's go ahead and wrap it up there.
51:12
I really want to thank Ian. Sarah Eve, Adam and Jamie.
51:15
For taking the you know the few minutes or however many other
51:18
long, it took, you know, it's a to get that stuff sent over to
51:20
us. I thought made for really
51:22
interesting episode. I think if you're listening to
51:24
this and you're identifiers, you know, Try to you know, fist bump
51:28
those folks. So if they're around and let him
51:30
know you heard us here and ask them to kind of articulate what
51:33
they meant and see if if their position is changed at all.
51:36
But I think that would be interesting and if you've got a
51:39
take on it that you think is is different, send it to us as
51:42
well. Will be happy to play it on the
51:43
show and serve discuss it so we can go with that.
51:46
Before we wrap up any final thoughts for this week, Jim, no
51:49
sir. I'm not going to see everybody
51:50
out there that I did a verse but next year and, you know, I think
51:55
it's good. Fantastic conference.
51:57
I'm really so depressed about not being there.
52:01
Yeah, the energy. Level was pretty good at RSA to
52:03
think people are ready to be back.
52:05
I'm going to try to make it out to Gartner in August in Las
52:08
Vegas, so maybe maybe that'll be my next one.
52:13
After my move here, takes place over the next week or so.
52:17
So alright. I'm going to go ahead and leave
52:20
it there. Thank you all for listening.
52:22
You can find us on the web at etiquettecenter.com.
52:25
We're on ER at IDC podcast the live stream that we do at idac2
52:30
live is still on Hiatus while I figure out my life my schedule
52:36
but it will be back at some point and with that we'll go
52:39
ahead and leave it for this week.
52:40
Thanks for listening and we'll talk with you all in the next
52:42
one. Thanks for listening to the
52:48
identity at the center podcast. If you like what you heard,
52:51
don't forget to subscribe and visit us on the web and identity
52:54
at the center.com.