Latest / Identity at the Center / #282 - IDAC Sponsor Spotlight - RSM Digital Identity

Transcript

#282 - IDAC Sponsor Spotlight - RSM Digital Identity · Identity at the Center

• 0:00
  So when I talk to somebody that has no idea what I do, depending
• 0:03
  on the conversation, I've, you know, I'll say I help keep my
• 0:06
  clients out of the news, right, because that's part of our job
• 0:09
  as identity security practitioners is helping
• 0:13
  mitigate data breaches. So we do a lot of that.
• 0:16
  But ultimately, I find when we're working with clients, more
• 0:20
  of the time than not, what we're doing is connecting different
• 0:23
  pieces of the organization that may not have even spoken to each
• 0:25
  other before to understand how they view access, how they view
• 0:31
  the different audiences and the personas in their organization
• 0:34
  to be able to try to put some level of control and security
• 0:38
  around that. This is identity at the center.
• 0:48
  If it has anything to do with IAM, this is the go to podcast
• 0:54
  now your hosts Jim McDonald and Jeff Stedman.
• 1:04
  Welcome to the Identity at the Center podcast.
• 1:06
  I'm Jeff and that's Jim. Hey, Jim.
• 1:08
  Hey, Jeff. How are you?
• 1:09
  Oh. Not so bad yourself.
• 1:12
  Good. I've been looking forward to
• 1:13
  this episode for a while because we've got a special guest,
• 1:16
  somebody I've known and worked with for roughly 8-9 years.
• 1:22
  And the the funny part was we did a YouTube video together as
• 1:28
  kind of like a a panel of folks from the company we worked
• 1:31
  together at, which was identropy.
• 1:33
  Eventually you joined identropy, but it was me and Chad and Mike
• 1:38
  Woodburn and Wayne Cecil and Mario Dusai.
• 1:41
  And one thing I noticed was that I looked like I was about mid
• 1:45
  30s and Chad looked like he was about maybe 20.
• 1:52
  So you know it was it was just so funny looking back on that.
• 1:56
  And I came to the realization that from 40 to 50 is when you
• 2:00
  age the most. Yeah, the the accelerator gets
• 2:03
  pressed. The ramp becomes suddenly just
• 2:06
  kind of takes off. Now you're like this grizzled
• 2:08
  mountain man. You've got like this big beard
• 2:11
  and you know, you got the long flowing hair and you know, the
• 2:14
  swole jock physique. That's a far cry from the
• 2:17
  original Jimmy Mac I am. Yeah, I was lean and mean.
• 2:21
  I had a little goatee, a short haircut, so definitely change of
• 2:27
  style. I was more of a runner back
• 2:29
  then. Now I'm more of, like you said,
• 2:31
  a mountain man. But I do think that the beard
• 2:34
  probably ages me a little bit. But I don't know I'm comfortable
• 2:39
  with it. Now it looks good and you
• 2:41
  mentioned that video. I actually watched that video
• 2:44
  before I interviewed with identropy, just to know what I
• 2:47
  what was I getting myself into? Who are these characters?
• 2:50
  And I was like, OK, these guys know what they're talking about.
• 2:52
  It's like, all right, let's, let's do, let's, you know, let's
• 2:54
  give it a shot. So.
• 2:55
  And you still took the job, the funny.
• 2:57
  The funny thing was I was, I think it was you asked me on a
• 3:01
  previous episode, like, you know, you've been doing this for
• 3:04
  12 years. Do you feel like you're much
• 3:07
  better at the job than you were 12 years ago?
• 3:10
  And I said absolutely yes. I mean, I do stand by that, but
• 3:14
  I think the advice that, you know, at least what I said
• 3:18
  during the panel was good advice.
• 3:22
  I do think though the interesting part was it's like
• 3:25
  the assumption was everybody was doing their IEM on Prem or not
• 3:30
  in the cloud, right, Because I mean eight years ago is how the
• 3:33
  video was. I mean, you know, doing cloud
• 3:37
  IEM was, you know, a novel concept at that point.
• 3:41
  Very cutting edge of you to be in that area.
• 3:44
  But yeah, didn't scare me away. I knew some of the faces and you
• 3:49
  know, today's kind of special episode.
• 3:51
  I think we've been looking forward to this one for a while.
• 3:52
  We're featuring the company that we all work for for the first
• 3:56
  time ever, I think, on this show.
• 3:58
  So today is a sponsor spotlight episode.
• 4:00
  We are the RSMUSLLP Identity and Access Management or Digital
• 4:05
  Identity Team. If you don't know who RSM is,
• 4:08
  we're here to tell you about it. Don't be afraid because I wasn't
• 4:11
  either when they called me. So I was like, all right, who
• 4:13
  the heck are these people? And you know, this group here
• 4:17
  and others have. We've been building up a really
• 4:18
  strong team. So today's episode again, fully
• 4:21
  sponsored. We have our guest today, Mr.
• 4:23
  Chad Wolcott. He's the Managing Director at
• 4:25
  RSM. Welcome to the show, Chad.
• 4:29
  Thanks guys. Thanks for having me.
• 4:30
  This is by far the highlight of my career.
• 4:33
  So undoubtedly and you've been in this space for a long time,
• 4:37
  you and I have known each other for a very long time, was a
• 4:39
  former customer of yours. That's how far back we go and
• 4:42
  the three of us were identropy and and now we're putting a band
• 4:45
  back together at RSM. So very exciting times ahead.
• 4:49
  But before we get too far along the way, let's talk a little bit
• 4:52
  about your identity background. People are familiar with Jim and
• 4:55
  myself at least to some degree. What about yourself?
• 4:58
  How did you get into identity? Is it something that you chose
• 5:01
  or did it choose you? Well, I'd say, like most people
• 5:05
  in identity, I knew from the first time I dialed into AOL on
• 5:09
  my Commodore 64 that I wanted to grow up to be an IAM
• 5:12
  practitioner. No, but that's.
• 5:15
  A great story, very inspiring for.
• 5:17
  All those words, right? All started.
• 5:19
  It was a winding journey to get to get here since then.
• 5:23
  But I think I've been in in identity for a lot longer than I
• 5:28
  care to admit. You know, Jim says that the
• 5:29
  beard ages you. It's actually the kids that do,
• 5:32
  but I've been doing this for probably from somewhere between
• 5:37
  20 and 25 years. I got into identity through a
• 5:41
  former boss of mine who at the time was with a company called
• 5:45
  Corion, who was an IGA vendor way back in the day based out of
• 5:49
  out of the Massachusetts area. And he asked me to come over and
• 5:55
  be what they called an identity management consultant, which was
• 5:58
  kind of a mix of ABA and a project manager.
• 6:02
  And I had done a lot of work, similar work for him previously
• 6:06
  on the professional services side.
• 6:07
  And I said that, what the heck, I had just kind of parted ways
• 6:12
  with my own software distribution company and said
• 6:17
  let's let's give this a try. And that's really kind of where
• 6:19
  I got started in identity. And it's been kind of a a long
• 6:23
  journey since then involving multiple acquisitions and moving
• 6:28
  from company to company and going from you know a small
• 6:32
  three person company that I had myself to couple 100 people then
• 6:36
  back down to 80 to 100 people at Entropy, which was then acquired
• 6:42
  by another consulting firm and then most recently here at RSM.
• 6:45
  So it's been an interesting journey.
• 6:48
  Yeah, it's very interesting journey.
• 6:50
  Now you're at RSM, so who is RSM?
• 6:53
  What is? What does RSM stand for to start
• 6:57
  with? So RSM, it's funny, Jeff, you
• 7:01
  mentioned before that you didn't know who RSM was.
• 7:03
  I didn't either at first. So RSM stands for Robson Roads,
• 7:08
  Solustro, Riedel and Ian Mcgladrey.
• 7:11
  Some people may be familiar with Mcgladrey that was AUS
• 7:15
  accounting firm back in 1926, I believe is when the firm
• 7:21
  started. Now we are the 5th largest
• 7:24
  accounting, tax and consulting services firm in the US So
• 7:27
  people talk about the big four. We like to call it the big 5.
• 7:32
  So we've got about 16,000 professionals in in North
• 7:36
  America today across 87 cities and four cities in Canada.
• 7:41
  Yeah, it's interesting. You know, I'm a New York Yankees
• 7:44
  fan, and Chad, please don't hold that against me.
• 7:47
  I know you're a Red Fox fan, but I knew who Mcleodry was because
• 7:52
  they ran commercials during the Yankees games.
• 7:55
  I was like, oh, Mceladry, tax and audit tax and consulting.
• 8:00
  So I knew about Mcleodry. I think it takes some guts for
• 8:04
  an organization to take a, you know, maybe not a household
• 8:08
  name, but a certainly a well established name and change it
• 8:12
  up in that way. So I think that's a big part of
• 8:16
  kind of not knowing the name, you know or or like sounding
• 8:20
  new. But to me that's that's an
• 8:24
  interesting aspect and kind of like bold for companies to do.
• 8:29
  Yeah, absolutely. I mean, I think we've been RSM
• 8:32
  since 2015 is when they rebranded.
• 8:35
  So it's a fairly recent change. But like you said after at that
• 8:39
  point nearly 90 years of operating under that name to to
• 8:43
  change the brand is that's a pretty bold, bold step.
• 8:47
  So I had heard of Mcgladrey, but I had not heard of the other
• 8:50
  one. So Robson Rhodes was in the UK
• 8:53
  so Lustro Riddell was France. So for international listeners,
• 8:56
  maybe those names might ring a bell.
• 8:58
  But I had heard of Mcgladrey, but I thought they were some
• 9:00
  sort of advertising firm or something, maybe just because I
• 9:03
  was, you know, not really paying attention.
• 9:05
  But yeah, now here we are. We're all underneath RSM.
• 9:08
  My master plan of putting together identropy 2 point O is,
• 9:12
  well is well underway. I thought it would be
• 9:15
  interesting to kind of peel back the curd, kick down the 4th
• 9:18
  wall. We do that a lot on this
• 9:20
  podcast. And.
• 9:21
  And what is identity consulting? Like, what do we actually do?
• 9:25
  How do we explain it to the people that know us or don't
• 9:28
  know us? You know, you're sitting in the
• 9:29
  Barber chair. Oh, what do you do?
• 9:31
  Well, you know, I'm a consultant.
• 9:32
  Oh, what kind of consultant? OK, Information security.
• 9:35
  Oh, like, like hacker. Not quite.
• 9:39
  But, you know, things like that. So I thought maybe we'd start
• 9:41
  with, what is Identity Consulting?
• 9:45
  And Chad, from your perspective, what do we do?
• 9:51
  Well, the answer I give my kids when they ask me is I have
• 9:54
  meetings because that's what I do a lot of.
• 9:58
  But I think that's as consultants, that's what we all
• 10:00
  do a lot of is have meetings but but ultimately, you know when I
• 10:05
  boil it down to the simplest components, right, identity,
• 10:08
  identity is about understanding or identity.
• 10:11
  Digital identity is more about understanding who has access to
• 10:14
  what, what are they doing with that access, are they doing the
• 10:16
  right things, right. So for me, taking that as sort
• 10:21
  of the core of what we do, like making identity at the center of
• 10:25
  everything and it's really expanding that to the broader
• 10:28
  cybersecurity space. So when I talk to somebody that
• 10:32
  has no idea what I do, depending on the conversation, I've, you
• 10:35
  know, I'll say I help keep my clients out of the news, right,
• 10:39
  because that's part of our job as identity security
• 10:42
  practitioners is helping mitigate data breaches.
• 10:46
  So we do a lot of that. But ultimately, I find when
• 10:49
  we're working with clients, more of the time than not, what we're
• 10:53
  doing is connecting different pieces of the organization that
• 10:55
  may not have even spoken to each other before to understand how
• 10:59
  they view access, how they view the different audiences and the
• 11:03
  personas in their organization to be able to try to put some
• 11:07
  level of control and security around that.
• 11:11
  So let me flip this over to Jim because he loves to ask the
• 11:14
  question, what was, what is it you would say you do around
• 11:17
  here, Jim? Yeah.
• 11:19
  And before I even answer that question, Jeff, I do want to
• 11:22
  recognize that you said this is your master plan and then you
• 11:26
  did the Mr. Burns thing. But you know, kudos to you.
• 11:29
  You really did pull this together.
• 11:31
  I mean, you know, I I wanted to follow you over here and it was
• 11:36
  a great decision that I made. It wasn't long after you know,
• 11:40
  another year and a half and Chad came over and I hope that he's
• 11:44
  looking at that decision now and smiling, but you're the kind of
• 11:47
  the master cog to all that. So to answer your question, what
• 11:51
  do I do? So I've run our digital identity
• 11:55
  advisory services. So it's really if you look at
• 11:58
  the the model that we use, it's assess, advise, implement and
• 12:04
  manage. So really the assess and advise
• 12:07
  usually gets grouped into advisory services.
• 12:11
  You start with an and you could do just an assessment or just
• 12:15
  advise, but usually it's you assess and then the advice which
• 12:20
  is like strategy and road map kind of work stacks on top of
• 12:24
  that. So assess is really how are you
• 12:26
  running your identity program now?
• 12:29
  What's working well, what's not working well, what needs to be
• 12:33
  improved. And from that you can kind of
• 12:35
  start to identify areas where you need to make improvements to
• 12:41
  reach a certain level of maturity.
• 12:43
  And by the way, usually when you say to reach a level of
• 12:46
  maturity, it's one of those things where that maturity curve
• 12:50
  is kind of moving constantly. So you know you're, you're doing
• 12:55
  things to make yourself look younger, but your body's getting
• 12:57
  older or really what it is that the industry's advancing to try
• 13:02
  and stay ahead of the bad guys, if you will.
• 13:06
  The advice part is really about now that we know what the gaps
• 13:11
  are, the areas that need to be improved based on our experience
• 13:14
  and I call it experiential based advisory or experiential based
• 13:20
  consulting. So in other words, we're not
• 13:22
  coming up with ideas like that or whiz bang or hey, no one's
• 13:26
  ever tried this one. But you try it based on our
• 13:28
  experience of seeing what has worked and well and what hasn't
• 13:32
  worked well at the clients that we've worked with.
• 13:35
  I mean you and I have worked with over 100 clients.
• 13:37
  I know Chad's probably somewhere in the ballpark of 200 clients.
• 13:42
  And what what are, what are they doing that would be considered
• 13:46
  leading practice or best practices, whichever term you
• 13:49
  kind of gravitate toward. And where do we see where
• 13:53
  organizations tend to hit walls and flop and avoid those things
• 13:57
  of course. So now you build a strategy and
• 14:00
  really the road map, once you have the strategy, the road map
• 14:02
  is just building a plan that is going to do those things in the
• 14:06
  right order, in an order that the organization can absorb them
• 14:10
  and then an order that the organization can make the
• 14:14
  investments that are. Required.
• 14:16
  So if we're working with an organization and Jim this is the
• 14:19
  background you and I have been working on for what 8-9 years
• 14:22
  now at this point is that assess and advise kind of area, right.
• 14:25
  What are we trying to do? Who are we trying to do it to
• 14:27
  and what are we going to do it with?
• 14:29
  Right, Sort of that, that kind of question and that transition.
• 14:33
  At some point you have to stop talking and start doing.
• 14:36
  And that's typically where we might get into like implement or
• 14:38
  manage. And historically this is where
• 14:40
  we would bring our friend Chad into conversation, say, hey,
• 14:43
  what's going on? You know, here's kind of the
• 14:44
  situation, what, what can we do here from a technology
• 14:48
  standpoint. And maybe Chad, if you want to
• 14:50
  talk to me about implement and so manage, which is that back
• 14:52
  half or second-half of the assess, advise, implement and
• 14:56
  manage process, we can get into a little bit more.
• 14:59
  Sure. I I I think once you get into
• 15:01
  the implement that's where it becomes a lot more complicated,
• 15:05
  right? Not that not that the strategy
• 15:07
  in the road map is not a complicated process because it
• 15:09
  is like the technology is actually the easiest part of it.
• 15:12
  But when you get into the implementation side, there's
• 15:16
  lots of different considerations that you have to think through,
• 15:19
  not the least of which is there's a long list of
• 15:21
  technologies that are out in the identity, the broader identity
• 15:25
  domain and trying to determine which of those technologies is
• 15:29
  the most appropriate for the, for the client, right at RSM,
• 15:34
  you know, so our our idea is really meeting clients where
• 15:37
  they need us most. So that doesn't mean just going
• 15:40
  out with the leader in every identity domain and saying this
• 15:44
  is what you should should plug in.
• 15:45
  So there's an aspect of understanding the different
• 15:48
  capabilities of those technologies, but then working
• 15:51
  with the client in a way that makes sense for them.
• 15:55
  It is ultimately a a, a transformation effort that goes
• 15:59
  on when you implement any identity technology.
• 16:02
  So really understanding all of those key components of how to
• 16:06
  get that through the organization, how to drive the
• 16:08
  adoption, how to drive the completeness of the breadth of
• 16:12
  what you're trying to connect to.
• 16:15
  And then ultimately how are you going to get all the downstream
• 16:18
  people on board with that including internal and external
• 16:21
  auditors and those types of security organizations to be
• 16:25
  able to drive to get there. So having a team of people that
• 16:30
  understand the nuances of the technologies and how to work
• 16:35
  through the change management required at an organization of
• 16:39
  you know, 200 people versus 250,000 people, right.
• 16:43
  And trying to work through those nuances, that's really where
• 16:46
  our, our implement or build team comes into play is helping
• 16:50
  clients navigate that and from you know, program management all
• 16:55
  the way down through hands on keyboard development if
• 16:58
  necessary. And then often that transitions
• 17:02
  to our manage capability which can take different different
• 17:07
  forms and flavors. But ultimately we continue to
• 17:10
  see more and more clients just wanting to have someone solve
• 17:12
  the problem for them, right. Don't just give me technology,
• 17:16
  give me a solution and that's when our manage team comes in
• 17:19
  and helps clients either in a Co managed way where we're we're
• 17:23
  doing the day-to-day operational support for their identity
• 17:26
  technologies or in a true you know managed service provider
• 17:31
  capability where we're we're managing the entire
• 17:35
  infrastructure and the whole the whole problem for them.
• 17:39
  And I think one thing that is, is starting to get a little
• 17:42
  attraction here is a lot of people I think associate manage
• 17:45
  with implementation and sort of technology and tools.
• 17:49
  But you know, myself, I do a lot of program management myself.
• 17:52
  So even though it's maybe not part of that, you know, formal
• 17:56
  kind of, you know, assess and advise, I'm helping
• 17:59
  organizations build up their IM programs, projects, program
• 18:03
  charters, policies, standards, do we have a steering committee
• 18:07
  and things like that. And so I think that's something
• 18:10
  that sometimes gets lost in the mix of the people just kind of
• 18:12
  think, oh, it's just like a, a tech service.
• 18:14
  It's not always that way, right. A lot of organizations struggle
• 18:16
  just kind of getting the bare bones of a program in place.
• 18:19
  And you know, I know, Jim, you've done it.
• 18:20
  I've done it. Chad, I'm sure you've done it as
• 18:22
  well. But that's another aspect of it
• 18:24
  that that I enjoy because at that point it's like, oh, OK,
• 18:27
  now we're actually starting to fix things.
• 18:29
  Don't get me wrong, I love the advisory stuff that you know, we
• 18:33
  typically work on. You know, I always say it's it's
• 18:35
  a great gig to have if you can get it because you're paid for
• 18:37
  an opinion. Now that opinion needs to be
• 18:40
  good and it needs to be based on facts and understanding and be
• 18:43
  able to say, OK, you know, I understand what the client is
• 18:46
  looking to get done. And I'm marrying that up with
• 18:48
  here's where the industry is going and here's where
• 18:50
  technology in general and the business etcetera and really
• 18:52
  kind of putting together you know those Tetris pieces to put
• 18:56
  together and start you know illuminating lines of the ever
• 19:01
  of the ever growing Tetris problem for identity.
• 19:04
  I think one of the interesting parts of of that Jeff, I think
• 19:07
  is as you get involved in more of those program management
• 19:10
  engagements when you're working with you know, senior executives
• 19:14
  at at a client and helping them navigate the complexities of
• 19:17
  this, you learn. You get to learn a lot more
• 19:19
  about their business and you actually learn a lot from them
• 19:23
  about how they see things. And we can take that, those
• 19:25
  learnings and actually apply those to where we go next,
• 19:29
  right, and what other clients we work with because we get a
• 19:32
  different perspective on how different clients approach
• 19:35
  problems and how they think about the, you know, the
• 19:40
  business benefits of some of the solutions that we talk about.
• 19:44
  Yeah, Jeff, the thing that I was going to add to that is what I
• 19:47
  think is so cool about program management is like that's the
• 19:50
  reality, That's how all this manifests.
• 19:52
  It'd be nice to think like you wake up one day and say, oh,
• 19:56
  we're going to do identity and access management starting with
• 19:59
  assess and then we're going to get some advice and we're going
• 20:04
  to implement and then we're just going to manage it.
• 20:07
  That's just not the way it works, right.
• 20:08
  It's a program. All those things are kind of
• 20:11
  happening at the same time. You're definitely implementing
• 20:15
  and managing at the same time, but you're also thinking about
• 20:18
  what's next, where do we need to improve and that's really that
• 20:21
  assess and advise. Yeah.
• 20:24
  That cycle is ever present. You know, I I think sometimes we
• 20:28
  all wish it was that easy. It's like, oh, well, we're going
• 20:30
  to start here at the beginning. Well, that doesn't know what's
• 20:33
  happened really. You're probably in flight,
• 20:35
  right? I'm sure people are listening to
• 20:36
  this. It's like, yeah, we're already
• 20:37
  have, you know, either an identity program where you've
• 20:39
  got some capabilities in place and it's OK Well, what's next?
• 20:43
  What should we be working on? What should be improving?
• 20:45
  And I, you know, I enjoy that type of work.
• 20:47
  I, you know, I hate to say it, but I sort of enjoy figuring out
• 20:50
  the psychology of an organization to say, OK, what's
• 20:53
  the trigger word or trigger phrase or thing that I need to
• 20:56
  whisper the secret password that's going to unlock
• 20:59
  investment in time or resources or people or money or whatever
• 21:03
  it is right to improve things because I don't think nobody
• 21:06
  wants to do it poorly. But a lot of times the reality
• 21:10
  is, look budgets are limited, resources are limited and people
• 21:14
  get put into a position where you have to choose like OK, well
• 21:16
  how do I advocate for proper or better identity access
• 21:20
  management as part of that process?
• 21:22
  I find that aspect of the job, you know, a lot of fun and you
• 21:26
  know I've, I've made a lot of good friends working, you know,
• 21:29
  working, you know hand in hand with, you know some of our
• 21:31
  clients. And it's been, it's been great
• 21:33
  to kind of grow with them as they've matured their program
• 21:36
  and seeing them get better and say Oh yeah, I remember,
• 21:38
  remember back in the day when Chad, when we were working at
• 21:41
  Walgreens and I was like hey, we got to do like password resets.
• 21:43
  So we need to handle our mainframes and As for hundreds
• 21:46
  and like and you know what you want to do, what it's like
• 21:49
  you're crazy like stuff like that right.
• 21:51
  And you sort of evolve and mature the program over time.
• 21:54
  So let's talk a little bit about again assess, advise, implement,
• 21:58
  manage because I think historically it's called people
• 22:01
  might be familiar with like plan build run, I know we use that
• 22:04
  historically. Any reason to change from plan
• 22:07
  build run? Is it just an evolution of the
• 22:09
  process, is it aligning with any kind of other methodology or we
• 22:14
  just modernizing the way we think about things?
• 22:16
  What are our thoughts about that, Chad?
• 22:18
  I think, certainly my thoughts around that, I think it's a
• 22:21
  little bit of all those things, right.
• 22:22
  Some of it is a bit of an evolution that's to a degree
• 22:28
  necessary just based on the construct of the firm that we're
• 22:32
  with now, right? And that that's largely the way
• 22:34
  the firm approaches things, being able to, you know, being a
• 22:38
  public accounting firm, we have independence things that we have
• 22:41
  to work through which in some respects causes us to need to
• 22:45
  have some level of separation in some cases.
• 22:48
  So being able to separate out an assessment function where we're
• 22:53
  you know evaluating the client's current state of affairs with
• 22:57
  providing advice to how you move that forward and then implement
• 23:01
  an operator really I think analogous to the build and the
• 23:04
  run pieces. So I think it really the
• 23:07
  evolution is kind of taking that holistic advisory function and
• 23:11
  breaking it into a couple of areas which in some respects you
• 23:16
  know there's a never ending list of regulations that comes out
• 23:20
  every year and new and updated things.
• 23:22
  And we have to really be up to speed on all of those.
• 23:26
  And that's for me is is a large function of the assess
• 23:30
  capability that we have is to really go through and evaluate
• 23:34
  client's current state based on the various frameworks and
• 23:37
  regulations that are out there. Advisory takes that to the next
• 23:42
  step, right? Great.
• 23:43
  Here's where you are, here's where you need to go, here's how
• 23:45
  you solve these challenges. In some cases, the client just
• 23:49
  wants to understand where they are against NIST, CSF framework,
• 23:52
  right. And then they can run from
• 23:55
  there. But by being able to tie all
• 23:58
  those things together, I think it's as much as we would like it
• 24:01
  to be that linear path. But tying all those functions
• 24:04
  together, I think in that in that cycle that cyclical process
• 24:08
  is important. You know, I just to add to that,
• 24:14
  I've always I I love plan, build run because it's like so easy to
• 24:17
  remember. But I also think then it's like
• 24:21
  OK, so are you only planning in the plan phase?
• 24:24
  Like don't you build project plans during build and don't you
• 24:29
  are you saying that you don't plan during run?
• 24:33
  And so I don't think that that model was, it was great for the
• 24:39
  mnemonic and easy, easy to remember, but I don't think it
• 24:43
  was like complex enough to quite capture what we were trying to
• 24:46
  communicate. Yeah, I think that's fair.
• 24:50
  And I think as many organizations move towards more
• 24:54
  of an iterative or agile type of a model that plan, build, run or
• 24:59
  you know, assess, advise, implement and operate, even it,
• 25:03
  that lends itself more to a waterfall sort of mindset and
• 25:06
  approach, right. I think to do it the way we talk
• 25:10
  to clients about doing it, it's got to be iterative.
• 25:12
  So we're doing all of those functions, you know some degree
• 25:16
  of planning upfront with that assess and advise.
• 25:19
  But very quickly you're rolling into implement while at the same
• 25:24
  time you're going and replanning, right, and and
• 25:27
  trying to revise that plan because you're going to learn as
• 25:30
  you go, you're going to uncover things.
• 25:32
  And we see this with clients all the time.
• 25:34
  You think you've got all the requirements, understood.
• 25:37
  Everybody in the room nods. They're like, Yep, that makes
• 25:39
  sense. And then you start down the path
• 25:42
  and a week later, you know, Susie gets called in for a
• 25:46
  meeting and you bounce one of these ideas.
• 25:48
  Oh, that's not how that works, right?
• 25:50
  And then you've got to change everything over again.
• 25:52
  So it really forces you into that more iterative approach,
• 25:57
  which ultimately is a benefit to clients, right?
• 26:00
  Get some value sooner. A long time ago, someone said
• 26:04
  something to me, and it's always stuck in my head, right?
• 26:06
  Incremental progress over delayed perfection, constantly
• 26:10
  iterating instead of just trying to set a path and a goal and
• 26:14
  just blindly charging for it. It's because things are going to
• 26:18
  change along the way. That's why I like to follow the
• 26:21
  pattern of you know, how are we better this month, this quarter,
• 26:24
  even maybe even this year than we were this time period last,
• 26:28
  whatever measurement period is I, I, I said we'd kind of kick
• 26:31
  down the 4th all a little bit here.
• 26:33
  I'd like to understand what's a typical day like for each of
• 26:36
  you. And Chad, I'll start with you.
• 26:39
  So you're a managing director, you know you're in charge of a
• 26:41
  digital identity for us. What's your typical day like as
• 26:46
  a managing director in consulting?
• 26:52
  So my typical day involves a lot of different things as we've
• 26:58
  been really building out this practice and really driving
• 27:03
  towards you know sort of our our big launch if you will.
• 27:08
  You know our fiscal year starts May 1st.
• 27:09
  So this is our new year and we're jumping into this.
• 27:12
  So a lot of my, the last couple of months have really been
• 27:15
  working through our strategy and our approach to how we talk to
• 27:19
  our clients, how we talk to different technology vendors
• 27:24
  really are go to market and really are why, right.
• 27:28
  That's what I've been trying to establish is what's our why?
• 27:31
  And then so I spend a lot of time talking with RSM partners
• 27:36
  and understanding our client base and the needs that they
• 27:40
  have. So a fair chunk of my day is
• 27:43
  meeting with different whether it be clients or our partners,
• 27:47
  there's a lot of boring operational stuff that goes into
• 27:51
  it that that problem is going to continue to get worse as the
• 27:55
  practice gets bigger and bigger, right.
• 27:57
  So whether that's staffing calls or revenue forecast meetings and
• 28:01
  those types of things, but it's also because we are a North
• 28:07
  American practice, it is US and Canada.
• 28:09
  I spend a lot of time with some new partners that we just
• 28:12
  brought on board up in in Canada, aligning our our
• 28:17
  collective experiences around implementation, around advisory,
• 28:21
  around managed services to make sure that we're taking all of
• 28:24
  the benefits of all of our experiences and being able to
• 28:28
  kind of craft that into our own secret sauce that we can bring
• 28:31
  to all of our clients. So a lot of my time is spent
• 28:34
  with clients, with operational things internally and more sort
• 28:40
  of strategic trying to figure out where is the market going,
• 28:43
  where do our clients need us most and how can we make sure
• 28:47
  we're there before they are. So a lot of meetings.
• 28:50
  You weren't lying when you said that earlier.
• 28:52
  I wasn't lying when I said that earlier.
• 28:54
  Thankfully the the travel has slowed a little bit, but it's
• 28:58
  starting to pick back up, so that always adds another
• 29:01
  interesting wrinkle. You know, after a couple of
• 29:05
  years of not much travel, it's tough to get used to working
• 29:08
  from a little laptop screen again.
• 29:12
  Jim, what's your kind of normal day like?
• 29:15
  Well, mine will be easier to explain.
• 29:16
  So there there's two roles that I have here at RSM.
• 29:20
  One is obviously serving our clients with the assess and
• 29:25
  advise projects and it's interesting because we've got a
• 29:29
  a couple of folks on the team, I'm thinking of Brian Lindstrom
• 29:33
  and Ben Dowd who are just like superstars, right.
• 29:36
  So they wind up actually doing most of the work, but they do
• 29:40
  ping back to me, right, because you know we, I've been doing
• 29:44
  this role for 12 years now. So I have some good insights at
• 29:47
  least I'd like to think so and but I mean if you come and do a
• 29:53
  project with RSM to put together RSS and advise and many other
• 29:57
  areas, but specifically on those and you're working with Ben and
• 30:00
  Brian, you'll see what I mean. These guys are just superstars.
• 30:04
  So my role is mostly as like engagement lead for this
• 30:08
  projects, but I also focus on some internal initiatives.
• 30:12
  So I'm what we call the strategic pillar lead for our
• 30:16
  training and professional development track.
• 30:20
  And so what's been really cool about that is RSM.
• 30:24
  It's the group that we're in, the security and privacy Risk
• 30:27
  Consulting has been really, really focused on making sure
• 30:32
  that people are getting the training that they need to be
• 30:35
  great in their current role, but also ready for promotion to that
• 30:40
  next level. And so it's an investment in the
• 30:44
  individuals, but it's also something that the organization
• 30:47
  obviously reaps benefit of as well.
• 30:51
  So it's just been fascinating. I've put a lot of focus on that
• 30:54
  area again because it's like it's important to RSM.
• 30:58
  So I'm able to carve out a big chunk of my week to dedicate
• 31:02
  toward that. And I'm, I'm honestly learning a
• 31:05
  lot because I'm starting to interact with folks in different
• 31:09
  areas of our practice and I'm learning a lot about what they
• 31:13
  do and what training requirements people go through
• 31:16
  to be, you know, to. Usually when we hire folks,
• 31:20
  there's obviously people that we hire who are fresh out of
• 31:23
  college or whatever, but most of the folks that we hire are
• 31:26
  already experienced to some level.
• 31:29
  They come in with different certifications or different
• 31:32
  experiences. So it's a matter of going ahead
• 31:37
  and and how do they get you know go from uncertified to certified
• 31:41
  or if they have certifications how are they maintaining those
• 31:44
  certifications and what are the things that you know currently
• 31:49
  we don't have a solution for and let's make sure we have a
• 31:51
  solution for that. So I'm really proud of my work
• 31:55
  there and like I said I get to carve out a a quite a bit for
• 31:59
  that. It's gotten to the point where
• 32:00
  I'm pretty busy between client work and the strategic work and
• 32:05
  we're doing a lot of podcasts in the evening.
• 32:07
  I know you're you're in the same boat, Jeff, but and actually I
• 32:11
  kicked the question over to you. You know, other than being the
• 32:14
  podcast producer, which I know you're doing at nights and
• 32:17
  weekends for the most part, what's your typical day like?
• 32:21
  It depends on the day actually. It changes so much.
• 32:24
  I have been doing a lot of travel for like the last six to
• 32:28
  nine months. I would say.
• 32:29
  I think you know last year was a record for me over 100 flights I
• 32:32
  took in 2023 alone. I'm already platinum with Delta
• 32:38
  for next year. So I I I kind of see myself a
• 32:42
  little bit as as a Flex person now.
• 32:44
  So I'm kind of wherever I'm needed.
• 32:47
  So I might be meeting with clients, I might be you know on
• 32:50
  a phone calls with clients kind of talking about what's going
• 32:52
  on, might be pulling you guys into conversations as well,
• 32:57
  obviously doing the podcast. And so there are other kind of
• 32:59
  internal stuff that we work on different projects, but and then
• 33:04
  advisory work, I mean I'm still involved with some of those
• 33:06
  projects and kind of work through that.
• 33:08
  So it's a little bit of a this and that and the other thing
• 33:12
  which I kind of like gives me some variety and definitely the
• 33:15
  podcast which we are always have to point out is not an RSM
• 33:18
  podcast. That's why we can do what we
• 33:20
  need to do. But RSM has been very
• 33:21
  supportive. You know, they're helping
• 33:23
  sponsor this episode and they help us out quite a bit.
• 33:25
  But yeah, I mean that's and and this is one of the ways that I
• 33:30
  stay on top of things, right. So what's going on in the
• 33:33
  market, yes, talking with clients is one thing, but also
• 33:36
  getting to meet all the cool people in this space.
• 33:39
  I mean just in the last couple of weeks, right, we've
• 33:40
  interviewed Enrique Teshara who was with Gartner for a long
• 33:44
  time, very popular analyst and now he's with Sabian.
• 33:47
  We talked with Omri Gazit, who's over with Asserto.
• 33:50
  I had a conversation in Troy today because we were talking
• 33:52
  about policy based access control for some of our internal
• 33:56
  initiatives and was like, Oh well yeah, I know a couple
• 33:58
  things around this and I can make some introductions, right.
• 34:00
  So stuff like that, maybe we'll be a matchmaker, stuff like
• 34:04
  that, but that's, you know, my, my day is rarely the same, but
• 34:07
  most of the time it seems like I'm headed to the airport.
• 34:11
  You know, the work address in my car is the actual airport.
• 34:15
  So if that gives you any sense of of where of of how I
• 34:19
  typically spend my time, that's that's pretty much it.
• 34:22
  Chicken or steak? Depends on where, man.
• 34:26
  If we're doing chicken and waffles or are we doing like a
• 34:28
  nice steak place? Well, it's it used to be like
• 34:31
  the the phrase they would have on Delta flights was like, you
• 34:36
  know, has your life become, you're sitting at TGI Friday's
• 34:41
  or getting a meal on the plane is like chicken or steak?
• 34:45
  Yeah, neither. I'm probably going to bring my
• 34:48
  own. Bring your own Snickers bar.
• 34:52
  Chatter Are you a chicken or a steak person?
• 34:53
  What are you doing on the airplane?
• 34:55
  Probably more a chicken than a steak person.
• 34:59
  I do like a good steak, but airplane steak?
• 35:01
  Probably not high on my list of of things to to go for.
• 35:07
  No matter how much they microwave it and dress it up
• 35:09
  with a a fancy cloth napkin, it's not the same.
• 35:11
  Exactly, exactly. Let's talk a little bit about
• 35:14
  the market because I think one of the things that we get to do
• 35:17
  is be really at the forefront, at least we try to be of
• 35:21
  different aspects of identity and access management and
• 35:24
  there's a lot of spaces. We're not going to cover every
• 35:26
  single thing about identity today, but kind of picked out a
• 35:29
  couple things that are usually top of mind for our clients.
• 35:32
  And hopefully people out there listening will get some value
• 35:35
  out of this as well. But what I wanted to do was kind
• 35:37
  of pose the question of where are things going, Where do we
• 35:41
  see the identity industry going in X?
• 35:45
  The first one, and I'll start with Jim for yourself.
• 35:47
  Where do we see the identity industry going in
• 35:51
  authentication? Yeah, I mean great question.
• 35:55
  And you know the the biggest trend is toward password list,
• 35:59
  it's getting away from knowledge based authentication into
• 36:03
  possession based authentication which includes biometrics.
• 36:07
  So it's you know you still see the number one and #2 attack
• 36:11
  vectors being social engineering and fishing.
• 36:14
  Well those things become a lot more difficult when you layer in
• 36:17
  multi factor authentication and almost impossible when you get
• 36:21
  to password list. So those are kind of the biggest
• 36:24
  trends. Those are being led by the Fido
• 36:26
  alliance, you know. So if you're not familiar with
• 36:30
  the Fido Alliance, I think you should get familiar with it and
• 36:33
  the standards that the Fido 2 standard for authentication will
• 36:38
  really help drive. You know obviously pass keys is
• 36:40
  on the tip of most people's tongues.
• 36:42
  Now that's mostly focused on you know the customer facing or or
• 36:48
  or web facing type of applications.
• 36:51
  There's plenty of solutions also in the enterprise.
• 36:54
  You see, I think the other thing for authentication is really now
• 36:58
  using verifiable credentials so that you can, you know, prove
• 37:03
  your identity and start to match yourself up with a credential
• 37:07
  and kind of a live selfie test. And then some of that
• 37:11
  information can then be leveraged from an authentication
• 37:14
  standpoint. But all this is trending toward
• 37:17
  getting away from the password and having a better sense of
• 37:20
  that. The person on the other end is
• 37:22
  who they say they are. Yeah, I got to give a lot of
• 37:25
  credit to the Fight Alliance for really pushing pass keys
• 37:28
  forward, getting basically the big three in the same room,
• 37:31
  Microsoft, Google and Apple, to collaborate on this, which is no
• 37:34
  small feat. So shout out to Andrew, Shikiar
• 37:37
  and Megan and Adrian over there. We'll be at Authenticate later
• 37:41
  this year. We're big supporters of that
• 37:42
  organization, but you can show your appreciation by sending
• 37:45
  your favorite Heart song to Andrew Shikiar, 'cause he's such
• 37:47
  a big fan of Heart. We want to make sure that, you
• 37:50
  know he gets that. Chad, where do you see
• 37:53
  authentication going? I I don't think I have anything
• 37:57
  materially different to say to that.
• 37:59
  I mean password list is really what all the clients that I
• 38:03
  talked to aspire to get to. Now many of them they have
• 38:07
  difficulty just get getting people to change a password you
• 38:10
  know once in their life cycle of journey at that client.
• 38:14
  But password list is really where I see more and more
• 38:18
  clients wanting to go. But interestingly it's it's all
• 38:22
  about, it's more about the frictionless experience for
• 38:24
  their constituents, whether that's employees or vendors or
• 38:28
  customers than it is even they're not even thinking about
• 38:31
  it from a security perspective. It's more just we've got to stop
• 38:34
  asking people to remember 25 different passwords.
• 38:37
  And you know, Single Sign On is great when you can connect all
• 38:43
  of your systems to it. But as a lot of our, a lot of
• 38:48
  clients that I work with have environments that are very
• 38:51
  mixed. In some cases they're very easy
• 38:53
  to integrate Single Sign on, in other cases it's virtually
• 38:56
  impossible. So getting to something that's
• 39:00
  much easier for the end user is really where where we have to
• 39:04
  get to. We've got to find ways, creative
• 39:07
  ways to get there easily for clients.
• 39:11
  Yeah, I think over the last couple years, COVID really kind
• 39:13
  of forced people down the MFA route if they haven't already,
• 39:18
  which they should have been, but a enough like a little pandemic
• 39:20
  to get people started. So we're past that now and I
• 39:24
  think like most organizations, MFA now, they're looking at
• 39:26
  password lists, they're looking at, I've seen a lot of interest
• 39:28
  in Windows Hello for Business on the Microsoft side.
• 39:31
  So you know, projects coming along where it's like, hey, the
• 39:34
  the hardware cycle has caught up with where it's been from a
• 39:38
  software perspective. Remember, you know, Windows
• 39:40
  Hello might sound like, Oh yeah, it's been around for a while.
• 39:42
  But if you think about it from like a organizational
• 39:44
  perspective, it takes time to refresh hardware and it usually
• 39:48
  takes multiple years to kind of get everybody up to the same
• 39:50
  playing level. Do I have a compatible
• 39:54
  fingerprint reader or camera or things like that.
• 39:56
  And you know, thankfully now we're into that phase.
• 39:59
  So I am seeing more Windows Hello for Business and sort of
• 40:01
  taking that approach of I don't want to have to type my password
• 40:03
  a whole bunch of times. You know, I mean I I have
• 40:05
  Windows Hello set up on my work machine and I look at my camera
• 40:08
  and I'm in, you know, and it and it works great.
• 40:12
  So I think that's that's been a nice trend.
• 40:14
  Why don't we shift gears to authorization?
• 40:16
  And Jim, I'll come back to you on this one.
• 40:17
  Where do you see things going from an authorization
• 40:20
  standpoint? Well, I mean obviously the hot
• 40:23
  trend is around P back, a back re back, what does they're?
• 40:28
  Using acronyms, let's not lose people.
• 40:30
  OK P back policy based authentication.
• 40:33
  A back attribute based authentication.
• 40:40
  Re back is relationship based authentication and it's not that
• 40:45
  I'm against those things. Those things are great trends.
• 40:48
  What I still see organizations, clients having to do is RBAC.
• 40:55
  They understand RBAC, they get the concept, they can start to
• 40:59
  develop it without having to change their paradigm.
• 41:04
  But guess what? The other thing is, almost every
• 41:07
  organization I talk to, their group management in their Active
• 41:12
  Directory, their enter ID is a nightmare.
• 41:15
  They have more groups than they have users.
• 41:18
  They don't have the owners assigned to the groups.
• 41:20
  They they've got an ugly nesting maybe they've got poor
• 41:24
  descriptions and they've got groups that people just don't
• 41:27
  know what they do. They're afraid to delete them.
• 41:29
  They're afraid to write the description that says this group
• 41:33
  does XY and Z, because what if it also does PDQ?
• 41:38
  You know? So anyway, I think this entire
• 41:42
  spectrum is what's going to continue to happen.
• 41:46
  I think it's different than authentication, right?
• 41:48
  It's not like you're going to see more and more password,
• 41:51
  you're going to see the password go away.
• 41:53
  I think 510 years from now, it's like the only folks using
• 41:57
  passwords are like true laggards.
• 42:00
  I I mean, it's getting there now.
• 42:01
  So I'm saying I'm being generous by saying 5-10 years RBAC is
• 42:06
  definitely going to be around 5 years from now.
• 42:09
  Yeah, I I find a lot of organizations want to be our
• 42:13
  back or role based access control.
• 42:14
  They get about 15 minutes down that road and like oh, this is
• 42:18
  harder than I thought it would be.
• 42:19
  You know what I mean? We just can't make a, you know,
• 42:21
  a role called analyst. OK, well, you know, do you have
• 42:24
  the data, do you even back it up?
• 42:25
  That's another challenge typically see.
• 42:27
  So I'm right there with you. I've always been a fan of
• 42:29
  alternative backs. So attribute based is generally
• 42:34
  where I like to start things because generally you can say is
• 42:38
  this person an employee or not an employee Generally that's
• 42:41
  well defined. You can start to drive rules or
• 42:44
  policies based off those different attributes.
• 42:46
  Chad, what are you seeing from an authorization standpoint and
• 42:49
  where the industry's headed? So I I don't disagree with Jim
• 42:54
  about the about RBAC not going away.
• 42:57
  For a lot of organizations that's pardon the pun, a four
• 43:01
  letter word, right. They've gone down that path and
• 43:03
  like you said they've realized and this is a lot more
• 43:06
  complicated than we thought it was.
• 43:08
  But ultimately for many, for many companies that's really the
• 43:13
  only thing that they can, they can tie on to a degree R BAC is
• 43:18
  can be a little bit like a BAC, right.
• 43:20
  You can leverage some of the same principles which I think is
• 43:22
  great being able to do that attribute based access.
• 43:25
  I think where I see us getting to down the road is a little bit
• 43:31
  more effective dynamic evaluation of access really to
• 43:35
  be able to get to be able to make it easier to administer the
• 43:41
  process, be make it easier to kind of govern the controls.
• 43:46
  The hurdles that I think we've seen recently with a lot of the
• 43:50
  dynamic conditional access, dynamic groups, those types of
• 43:54
  things is more from a governance and an audit perspective because
• 43:59
  there's no historically has not been a good way to actually
• 44:03
  determine why that person was granted access at that given
• 44:08
  time in the in the past, right. You've got policies and you can
• 44:11
  say, well it's because they fit in this bucket, right.
• 44:14
  If you've got a series of screens and they made it all the
• 44:17
  way through each and they have the access they need, but there
• 44:20
  is no accounting for how they got that right.
• 44:23
  And that's where I think the gap has been there.
• 44:25
  It's got a lot of promise because I think people would
• 44:28
  much rather define a policy and manage that policy rather than
• 44:33
  going through and managing thousands and thousands of
• 44:36
  discreet roles. I I think we need to get there.
• 44:40
  I just don't think that the technology is is there yet where
• 44:43
  it needs to be. It's a probably a pretty good
• 44:46
  segue because they think the next thing I want to talk about
• 44:49
  is automation. I feel like to do things around
• 44:52
  automation or or say around policy based access control.
• 44:55
  Attribute based access control is you need some level of
• 44:58
  automation to actually make this real.
• 45:01
  Jim, where do you see automation helping those things or maybe
• 45:05
  other areas in the identity industry?
• 45:07
  Think that our scope as identity professionals is growing so fast
• 45:14
  and it can't all be done without automation.
• 45:19
  And I think most organizations who are in kind of a a laggard
• 45:23
  position or under invested over time, some of those, if you take
• 45:28
  over an identity program or maybe even managing it for a
• 45:31
  long period of time and haven't had investment in terms of you
• 45:37
  know spending money on automation, that's where you
• 45:42
  want to go, right. And that's how you're going to
• 45:45
  be able to do more with your resources is by automating as
• 45:49
  much as possible. So provisioning and
• 45:52
  deprovisioning has got to have automation.
• 45:55
  You've got to have automation in terms of you're monitoring and
• 45:58
  alerting as well and response. So that's the other one of the
• 46:03
  other big challenges is that you know you've seen these slides
• 46:07
  where it talks about the anatomy of a breach and it's like it
• 46:11
  takes 170 some days to figure out you've been breached, it
• 46:15
  takes this, that and the other. But when you find out like from
• 46:18
  the time clone breaches you to the time that they've got the
• 46:22
  keys to the Kingdom, it's like seconds.
• 46:25
  So your system has to be processing that data in real
• 46:29
  time to capture that that's happened and respond and the
• 46:34
  response has to be effective. So I think automation is, you
• 46:39
  know, table stakes at some level.
• 46:42
  What do you think? I mean, yeah, I think a lot of
• 46:45
  these things are really neat ideas, but they are not
• 46:49
  something that you can do by hand.
• 46:52
  If you're really serious about doing identity, you're going to
• 46:54
  need some level of automation. And it's going to be either, you
• 46:57
  know, identity governance, which is probably most traditionally
• 46:59
  associated with automation, onboarding, offboarding, like
• 47:02
  you mentioned, changes in access, taking your different
• 47:04
  attributes that you know about individuals or policies you
• 47:07
  define to say, OK, you know, Chad is here and he is a new
• 47:10
  joiner. And because he's a new joiner as
• 47:13
  an attribute of an employee in this department or this physical
• 47:17
  location, we've defined a policy that says these things mean you
• 47:21
  get these other things in automation or take them away.
• 47:24
  I think that's another way where automation is really helpful is
• 47:26
  a lot of organizations are really good at granting access
• 47:30
  and really not great at pulling away access when someone moves
• 47:33
  from, you know, one team to another team or whatever that
• 47:35
  looks like. So I think that's an area where
• 47:37
  automation is, is definitely big as well.
• 47:39
  But Chad, what do you think? Where do you see automation
• 47:42
  fitting into the identity industry and where things are
• 47:45
  going? Yeah, I think interestingly
• 47:48
  enough, back at the beginning of when when identity really
• 47:52
  started to become a thing, right, we like often call it the
• 47:55
  first wave of identity. It was all about connecting
• 47:57
  everything, connecting all the systems to drive a lot of that
• 48:01
  automation. That was kind of the promise
• 48:03
  back in the, you know, early 2000s.
• 48:06
  This is what identity is going to be.
• 48:08
  And everything failed like nothing worked.
• 48:11
  You couldn't connect to systems and then it shifted away from
• 48:14
  that and became more governance based.
• 48:17
  I think the rest of the technology around, you know, IT
• 48:21
  broadly has now gotten to a point where it actually may be
• 48:25
  possible to drive a lot more automation, right, as a lot of
• 48:28
  the legacy systems that you, you know, couldn't really integrate
• 48:32
  with very easily are all being retired.
• 48:35
  There's still obviously a lot out there, but the ability to
• 48:38
  integrate with systems for automation purposes I think is
• 48:42
  better now than it ever has been.
• 48:44
  As more organizations move to, you know, Federated models where
• 48:48
  you're leveraging some access management system to provide
• 48:52
  authentication and authorization, the ability to
• 48:55
  automate is just going to be that much better.
• 48:58
  So I I think, you know, the only way to do this effectively is to
• 49:02
  drive more automation. There are too many applications,
• 49:06
  too many users, too many regulations, too many controls
• 49:09
  for people to do that. I had a client the other day ask
• 49:13
  me, are there any tools out there that we can use to verify
• 49:19
  that our help desk did made the changes to the accounts that
• 49:24
  they were asked to in the ticket?
• 49:26
  So basically, are there is there automation that we can you put
• 49:29
  in place to check the work of a human?
• 49:33
  So like that's a very interesting idea, but why
• 49:37
  wouldn't you just remove the human from that process, you
• 49:39
  know, to start with and then put the human back in to check the
• 49:43
  work of the automated system, right.
• 49:47
  So I think we've got to drive towards more automation broadly
• 49:52
  across all of Identity. And that automation typically
• 49:56
  leads to more data than you probably know what to do with.
• 49:59
  So next topic is AI and analytics, because AI has really
• 50:05
  kind of taken the world by storm the last couple years, but
• 50:07
  generally in the last year or so, that means that we have
• 50:11
  better tools to sift through data.
• 50:13
  Jim, where do you see AI impacting identity in the
• 50:17
  analytic space? Here's where I am right now is
• 50:20
  that I believe AI could be used in an IM system, call it IGA, or
• 50:29
  call it like the total picture of your system to query it for
• 50:35
  meaningful information. It could start like, you know,
• 50:39
  just iterative questions that build on themselves.
• 50:43
  Give me a list of all the people who have access to this
• 50:45
  application. Now no I want to see the
• 50:49
  administrators of that application.
• 50:51
  Or you know who has access to be the administrator of that
• 50:57
  application and is also at least a a a power user of this other
• 51:03
  application. So in other words, have a way
• 51:06
  that people who maybe don't know how to use advanced reporting
• 51:09
  tools can go and make take me ask meaningful questions of your
• 51:15
  IM system to get meaningful answers.
• 51:18
  So I could see that as a fantastic way to use AI, and
• 51:23
  where I'd like to see it go is to be able to ask questions that
• 51:27
  we don't have the data for it now.
• 51:29
  So tell me all the users who can enter an order in our order
• 51:34
  entry system or SAP system, the IM system would have to know
• 51:39
  enough about. Or the AI would have to know
• 51:42
  about enough about your IM system, which is which roles and
• 51:47
  groups entitlements are going to give me that access.
• 51:51
  And then maybe it's going to have to know enough about SAP to
• 51:54
  understand how those groups map to some entitlement structure
• 52:00
  within SAP that gives you access to that order entry screen
• 52:05
  within SAP. You know, in other words, it's
• 52:08
  it's going to have to be the big brain that can cross the chasm
• 52:12
  of identity and business systems to kind of drill down and ask
• 52:17
  questions that we can't answer today.
• 52:20
  And what why couldn't AI do that?
• 52:22
  What? Why couldn't AI have a big brain
• 52:25
  and understand both of those models and and look at the
• 52:29
  entitlement structure of those applications, especially
• 52:33
  packaged applications? So it sounds like you see AI as
• 52:36
  being more of a helper for people using IM because what
• 52:40
  you're describing saw sounds off like querying data, right?
• 52:44
  And today, maybe you need to run Sequel statements and look at a
• 52:48
  database and pull pull data to make reports and things like
• 52:51
  that. I certainly see that same use
• 52:53
  cases like, yeah, show me all the users who have access to
• 52:56
  this rather than doing Sequel joins and trying to figure out,
• 52:59
  you know, what your database schema looks like to pull this
• 53:01
  information together or trying to do some sort of custom
• 53:04
  report. I think that's a really
• 53:05
  interesting approach to it is, you know, talking to your
• 53:09
  identity system basically, right?
• 53:11
  And talking to it and say here's what I'm looking for hey
• 53:15
  identity system give me this information and it's it's kind
• 53:18
  of the ultimate low code no code environment if you think about
• 53:21
  which is where we've been heading in the last you know
• 53:23
  several years was that it? Same thing.
• 53:25
  It's just instead of doing drags, dragging blocks on a
• 53:28
  screen, now we're just talking to it.
• 53:30
  Say hey product, give me this information.
• 53:35
  Yeah, you know, I think so. I think that's the the one major
• 53:39
  functional use case that I would like to see.
• 53:42
  I think the other thing I will do is chase the money.
• 53:45
  I I kind of feel like if you could have AI automate the work
• 53:50
  of an IM team across 50, a hundred, a thousand different
• 53:53
  organizations. So you get the same size team
• 53:56
  that can manage one organization, be able to manage
• 54:00
  hundreds or even thousands of organizations, Now you have a
• 54:03
  force multiplier. Well, you can only do that with
• 54:06
  a tremendous amount of automation.
• 54:10
  And if AI can become smart enough that it could build the
• 54:13
  automation and it could give you insight so that you could
• 54:17
  manage, now you free up a bigger portion of humanity to work on
• 54:21
  other things. Yeah, it's very similar to like
• 54:24
  when you know, manufacturing lines, automation started to hit
• 54:27
  that. You know, it used to be you'd
• 54:28
  have hundreds of people on a line building something.
• 54:31
  And I worked for SC Johnson for a while and I went to one of the
• 54:34
  factories and there was one person working a line spitting
• 54:37
  out 40,000 cases of Windex. So I I see it very similar
• 54:41
  except more more the IT production line so to speak,
• 54:45
  where you come in Chad, you've got a background in product.
• 54:47
  I'm curious from your perspective and all the
• 54:49
  experience you've had, where do you see AI hitting the AI or
• 54:53
  hitting the identity space and how is it going to help with
• 54:55
  analytics and things like that? Yes, I think there's there's two
• 54:58
  angles. I I, I love the idea of having
• 55:03
  AI that's smart enough to take a problem like application on
• 55:07
  boarding right? And that's that not only is that
• 55:10
  sort of instantiating the application in the various
• 55:12
  technologies but building the integrations right.
• 55:15
  You've got you know there's you can go to use AI now to generate
• 55:19
  code for things right. Imagine being able to just say,
• 55:22
  hey, I need to, I need to automate access for, you know,
• 55:27
  system X and just provide some information.
• 55:29
  And off the AI goes building the integration, connecting to the
• 55:33
  system, pulling it into all of your infrastructure.
• 55:37
  That's all stuff that needs to be done today to drive that
• 55:40
  automation, take that problem away, drive it through AI.
• 55:44
  And I think there are, you know, there are some vendors out there
• 55:46
  that are taking steps on that path.
• 55:48
  I think that's a that's a really cool idea to take some of the
• 55:51
  burden off the IT organization to be able to drive the breath
• 55:56
  of the implementation if you will, of these various
• 56:00
  technologies. But I also think there's a end
• 56:03
  user angle, right, an adoption angle that helps with this.
• 56:08
  Like I said, just being able to say, hey, I need access to the
• 56:10
  softball file share. Like I don't, I don't know where
• 56:13
  to go for that, but just tell the AI and it goes off and
• 56:15
  handles that for you. That sends things out for
• 56:18
  approvals as necessary. So I think there's an end user
• 56:20
  enablement or empowerment angle with AI.
• 56:24
  I'm really interested and I'm actually looking forward to one
• 56:27
  of the panels that identiverse that's talking about AI from AN,
• 56:31
  you know, from a threat perspective with identity
• 56:33
  security. Like that's something I'm really
• 56:35
  excited to dig into a little bit more because, you know, you've
• 56:38
  got the people that love AI, love to use it.
• 56:41
  I use it fairly regularly. A big fan.
• 56:44
  You've got the doomsayers that are like, oh, it's going to be
• 56:46
  Skynet and yeah, I can, you know, it can go both of those
• 56:50
  paths. But I think it's going to be,
• 56:53
  there's going to be a balance. We've got to find good use
• 56:55
  cases. The amount of data that these
• 56:57
  identity systems generate is tremendous and there's minimal
• 57:01
  correlation between those systems.
• 57:04
  Not a person is not going to be able to make those correlations
• 57:07
  and define those patterns and and action from there.
• 57:11
  So that's where I think we can use AI from a from an analysis
• 57:14
  and a monitoring perspective to make our people smarter and
• 57:18
  where they focus their attention in addition to a lot of the
• 57:21
  automation capabilities that I think it will be more enabling
• 57:24
  technologies. You bring up a couple
• 57:26
  interesting points there. And this idea of a copilot seems
• 57:29
  to be catching a lot of traction with the industry of some some
• 57:33
  sort of helper, right, that's helping you navigate through
• 57:36
  whatever it is you're trying to do today in space.
• 57:38
  You brought up security of AI, which I think is really
• 57:41
  important. So, you know, I'm looking
• 57:42
  forward probably the same session that you're referring to
• 57:44
  it identivers, but I think that's something we're going to
• 57:47
  have to navigate together and say, OK, well how do we keep
• 57:50
  these? AI is safe and secure and you
• 57:54
  know, large language models and they don't get poisoned with,
• 57:57
  you know, false information or manipulation or whatever that
• 58:00
  might be. It'll be interesting to see how
• 58:02
  the industry moves forward with this idea of AII can very I can
• 58:08
  my my vision right here is I see like a generalized AI and I
• 58:13
  think about things like Chachi, BT, Gemini, Meta, Perplexity,
• 58:18
  which is kind of a mix of everything clawed and that's
• 58:21
  sort of like the general AI. Then I see very specific AI,
• 58:25
  large language models or generative AI that is very
• 58:28
  product specific. Oh, here is the sail point.
• 58:32
  AI, here is the Sabian AI, here is the Octa, the ping, the
• 58:35
  Microsoft right And how those models interact together and
• 58:40
  keep your data safe and not have a transitive attack from another
• 58:46
  large language model into another one.
• 58:47
  Will be interesting to see how that develops.
• 58:50
  You know I'm I'm sure there are already plenty of companies that
• 58:53
  are you know thinking about what their their startup is going to
• 58:56
  be or is to protect protect your large language model.
• 59:00
  Protect your AI, right. Shield it from that thing.
• 59:03
  And maybe this is just at the end of the day API management,
• 59:07
  how are we managing? AP is talking to each.
• 59:09
  Other right. It is an interesting thing to
• 59:12
  think through because obviously you want you want those sort of
• 59:15
  proprietary large language models to be able to reap the
• 59:19
  benefits of all of the public ones that are out there and the
• 59:22
  more general ones. But you need to be able to
• 59:24
  segment your own data that you want to feed it so that it's
• 59:28
  smarter about your firm and what you're trying to accomplish and
• 59:31
  let your people do. So that's a that's a interesting
• 59:34
  balance of trying to understand how to firewall that.
• 59:38
  And there might even be tenants within tenants.
• 59:40
  So say you're an A cloud identity provider and you've got
• 59:47
  70 customers and they're all putting data in.
• 59:49
  Now it might be really interesting, at least from an
• 59:52
  administrative perspective to say to query that data spanning
• 59:57
  all 70. But then you wouldn't want two
• 1:00:00
  of your customers to start looking at asking questions that
• 1:00:04
  would violate that that tenancy model.
• 1:00:07
  In other words, what's my competitor doing with IAM?
• 1:00:11
  How many accounts do they have? What's their password policy I
• 1:00:16
  mean? No, those aren't really
• 1:00:18
  competitive secrets. Maybe, but still, you don't want
• 1:00:22
  them. You don't want to have that
• 1:00:24
  happen. Well, I'm looking forward to the
• 1:00:26
  day when AI start arguing amongst themselves trying to
• 1:00:28
  resolve conflicts. Well, the SAPAI is saying I can
• 1:00:31
  run this T code, but the other AI is saying that you can't.
• 1:00:34
  OK, well, you guys figure it out.
• 1:00:36
  Wake me up when when you've got that figured out.
• 1:00:39
  Chad, you mentioned Identiverse. We're going to be out there in
• 1:00:42
  full force and, you know, hopefully people come out, meet
• 1:00:45
  with us, but what are you looking forward to most at this
• 1:00:48
  year's Identiverse? I think the thing most I'm
• 1:00:51
  looking for, there's a little panel on Wednesday about
• 1:00:55
  identity security that this guy, Jeff Steadman is is moderating.
• 1:00:58
  I'm really looking forward to that.
• 1:01:00
  Check is on the mail. I think there's a couple of
• 1:01:04
  things I'm I'm really looking forward to catching up with, you
• 1:01:06
  know, new and long time friends, right?
• 1:01:08
  As I mentioned at the beginning, I've been in this space for a
• 1:01:10
  long time and every one of these concert concerts, these
• 1:01:14
  conferences is like, you know, old, old friend week, right.
• 1:01:19
  And it's just about OK, which firm are you with now, right,
• 1:01:22
  Both from a software as well as a consulting perspective.
• 1:01:25
  So it's great to catch up with those, those folks as well as
• 1:01:28
  some clients that are going to be there.
• 1:01:30
  But the two areas I mentioned AI, I'm really interested in
• 1:01:34
  digging into that a bit more. We talked a bit about password
• 1:01:36
  lists and you know, candidly that's not an area that I have a
• 1:01:40
  lot of expertise in. I usually go to gym when I have
• 1:01:42
  questions about password list, but that's an area I'm, I'm
• 1:01:45
  really interested. There's a number of sessions
• 1:01:47
  that I'm going to be digging into just to get a little bit
• 1:01:50
  more educated on that so that I can bring some of that knowledge
• 1:01:53
  to my clients. Jim, what are you looking
• 1:01:56
  forward to today anniversary? I think in the order of
• 1:01:59
  importance, it's hallway conversations, It's podcasting.
• 1:02:03
  So you and I, Jeff, work on trying to give a little taste of
• 1:02:07
  what's going on, but have it be original content, right?
• 1:02:10
  It's not just, you know, us dropping into a session and
• 1:02:13
  recording them and and posting them on the Internet, which I
• 1:02:17
  don't think the folks over at the Cyber Risk Alliance would
• 1:02:21
  appreciate. No, it's all the conversations,
• 1:02:26
  it's podcasting, It's attending as many sessions as we can fit
• 1:02:30
  in other than those things above.
• 1:02:34
  And then finally it's Las Vegas. I mean we're going to have go
• 1:02:38
  out and have some fantastic food.
• 1:02:40
  I'm looking forward to that part, look forward to the sights
• 1:02:43
  and sounds. I'm probably leaving something
• 1:02:46
  out, but what do you, what are you looking forward to, Forward
• 1:02:48
  to Jeff? I mean it's pretty much what you
• 1:02:50
  guys said. I think for me it is very much
• 1:02:52
  like a high school reunion almost where you know, if the
• 1:02:56
  the identity industry is a very small industry comparatively to
• 1:02:59
  others and people tend to know each other and chatty hit on the
• 1:03:03
  head, it's like, OK, well, which company you're with now or which
• 1:03:05
  consulting firm or whatever it may be, which vendor and people
• 1:03:07
  tend to move around a little bit in the space.
• 1:03:10
  And so just meeting people, you know, sometimes this is the one,
• 1:03:13
  one time of year that I might see somebody who's over at X
• 1:03:16
  organization and we catch up for a little bit and say, all right,
• 1:03:18
  well, see you next year or see you at the next conference,
• 1:03:20
  maybe Gartner, you know, later this year, stuff like that.
• 1:03:23
  But yeah, I think just the hallway conversations meeting
• 1:03:26
  people, you know, establishing or just you know strengthening
• 1:03:31
  relationships we've got out there in the space and you know
• 1:03:34
  just trying to be a a a good friendly dude to to walk up to
• 1:03:38
  and say hello to. So that's what I look forward
• 1:03:41
  to. And then of course, you know I'm
• 1:03:42
  moderating a panel our friend Sean and and the tool have asked
• 1:03:45
  me to moderate a panel on identity security with Cape
• 1:03:49
  Continuous Authentication Evaluation Profile.
• 1:03:52
  So I will be the person helping the smart people get the word
• 1:03:57
  out for that and quiz them with questions and things like that.
• 1:04:00
  So that'll be on Wednesday, May 29th, Joshua 10 plug for that
• 1:04:05
  11:40 AM come out see me sweat on the stage as I don't know as
• 1:04:09
  much as these other guys but I'm sure it'll be a a good one.
• 1:04:11
  But that's what I look forward to and and you said it Jim
• 1:04:14
  Vegas, I know a lot of people don't like Vegas.
• 1:04:17
  I don't gamble. I don't really drink.
• 1:04:19
  So the food and the world class people watching and you know the
• 1:04:23
  shows if there's time for that all top notch.
• 1:04:26
  So I'm always a fan of that and generally everything is pretty
• 1:04:29
  easy to get around to, especially in a location like
• 1:04:31
  we're out in the area where you know, you've got the Cosmo, the
• 1:04:35
  Vadara and you're just a few steps away from, you know, the
• 1:04:37
  the strip itself. So I'm, I'm looking forward to
• 1:04:40
  it all. And of course, editing podcasts
• 1:04:42
  every night just to try and get something out on time, since
• 1:04:44
  you're a real slave driver when it comes to the podcast gym.
• 1:04:48
  Six episodes in three days, baby.
• 1:04:51
  Yeah. And now we're doing a video, so
• 1:04:52
  that's just even more work. So, all right, we have gone over
• 1:04:56
  an hour, but I'm happy to keep going here for a few more
• 1:04:59
  minutes. Let's close out a couple ways.
• 1:05:02
  The first will be I am horror stories.
• 1:05:05
  You know, I think we've all been in this space for 20 plus years.
• 1:05:08
  We've probably come across some really weird stuff.
• 1:05:10
  The rules of the game are, you know, a Horror Story.
• 1:05:13
  But we will protect the innocent.
• 1:05:15
  We won't name names, we won't name clients or anything like
• 1:05:17
  that. But I think hopefully these are
• 1:05:20
  stories that we have that will help people avoid some of these
• 1:05:24
  situations in the future, or at least be aware of what these can
• 1:05:28
  happen, you know? If you don't account for that,
• 1:05:31
  Chad, we'll start with you. Do you have any good?
• 1:05:33
  I am horror stories. So this one is it's interesting,
• 1:05:37
  it's it's somewhat of a Horror Story.
• 1:05:40
  I worked with a client for many, many years.
• 1:05:44
  This back when I first got started an identity and it was
• 1:05:48
  one of those situations where you gather, you meet with a lot
• 1:05:52
  of folks, you gather a lot of information, you understand
• 1:05:54
  really where they want to go and and you build out a truly world
• 1:06:00
  class solution for them. It was amazing.
• 1:06:02
  It did everything like made you coffee, you know, took the dog
• 1:06:06
  out, did did everything you needed, connected to thousands
• 1:06:08
  of different applications, built out roles.
• 1:06:12
  All of those things are true, like a really robust IGA
• 1:06:15
  platform and it worked great and then they had a team of like 60
• 1:06:23
  people managing it, which now you think that's crazy like you
• 1:06:26
  know we would ever do that. And probably three years later I
• 1:06:31
  I ran into the CIO at A at a dinner one night and I just said
• 1:06:35
  hey, how how's everything going? Because it's been I moved to
• 1:06:38
  companies. And so I talked to him a little
• 1:06:40
  bit about it. He said, you know, you you built
• 1:06:42
  exactly what we asked you to build, but it turns out it
• 1:06:45
  wasn't what we needed, right? It was.
• 1:06:49
  They were just looking at things from a very tactical
• 1:06:52
  perspective. Just fix these problems and just
• 1:06:54
  make the like add more things and make it more complicated to
• 1:06:58
  make it larger and larger and larger.
• 1:07:00
  And it became unmanageable to a point where they continue to
• 1:07:03
  have to add resources at people to manage the system.
• 1:07:06
  And it really wasn't even remotely close to what they
• 1:07:08
  needed. Now they paid a firm a lot of
• 1:07:13
  money to build this and it did a lot of great things, but it
• 1:07:15
  just, it became something that was unwieldy.
• 1:07:19
  They couldn't support it anymore.
• 1:07:21
  They couldn't move to new versions of the platform.
• 1:07:25
  And unfortunately that's a pattern that I've seen over and
• 1:07:30
  over and over again, right when you talk to clients that are on
• 1:07:33
  their second or third iteration of of their identity journey and
• 1:07:38
  they've done the same thing. They customize the heck out of
• 1:07:40
  something and it's cost them millions and millions of dollars
• 1:07:44
  and what they've got is some big mess of spaghetti, but they
• 1:07:48
  don't know what to do with. So I know that's a little bit of
• 1:07:50
  a general Horror Story that I unfortunately I see over and
• 1:07:54
  over again. So how do you approach that
• 1:07:56
  conversation with, you know, a client like that where, you
• 1:08:01
  know, I think a lot of people are familiar with the phrase,
• 1:08:04
  the customer is always right. Well, the customer is not always
• 1:08:07
  right. Sometimes you have to help them
• 1:08:09
  figure it out. How do you approach that
• 1:08:11
  conversation? Say, hey, look, based on my
• 1:08:12
  experience or here's why are they generally receptive to that
• 1:08:16
  kind of conversation approach to say, hey, here's what you need
• 1:08:18
  to be thinking about? And based on what you're telling
• 1:08:20
  me or what you've built, here are some of the risks that are
• 1:08:23
  out there. Yeah, I I I think your mileage
• 1:08:26
  will vary on the the on the customer when you have that
• 1:08:29
  conversation. For me it really comes down to
• 1:08:32
  the organization's maturity around dealing with change.
• 1:08:36
  It's not even like a technology maturity.
• 1:08:39
  It's are they do they understand what true transformation
• 1:08:43
  initiatives are like or is this their first time going through
• 1:08:46
  it Because having that conversation about the
• 1:08:48
  complexity of just trying to over engineer everything for you
• 1:08:52
  know every single edge case. I think most people that I talk
• 1:08:57
  to certainly most C level executives have done this a
• 1:09:00
  number of times and they it resonates with them.
• 1:09:03
  Don't do that again. But every it seems that there's
• 1:09:08
  always somebody in an organization that says no, this
• 1:09:11
  is the way we've always done it. We have to keep doing it this
• 1:09:13
  way. So it's really hard to try to to
• 1:09:16
  peel people back from that. But that's ultimately one of the
• 1:09:19
  first questions that I talk to clients about when we start down
• 1:09:23
  this identity journey is how open is the organization from a
• 1:09:28
  cultural perspective to changing things, right?
• 1:09:31
  Do we have to fit everything into the way it's being done
• 1:09:33
  today, or is there an openness to think of new ways to do it?
• 1:09:37
  And that's really what we spend a lot of time doing with clients
• 1:09:40
  is trying to get them thinking about different ways to
• 1:09:43
  accomplish the goal. Don't tell me how to do
• 1:09:46
  something, tell me what needs to get done right.
• 1:09:48
  And then we'll work through the best way to do that.
• 1:09:51
  But you know there's I think there's a lot more openness
• 1:09:55
  within the last two to three years to to change because you
• 1:09:59
  can put together a reasonable business case for doesn't make
• 1:10:02
  sense to do this as an on premise.
• 1:10:04
  You know waterfall project where you're putting this a bunch of
• 1:10:07
  servers in your data center and making people think a little bit
• 1:10:12
  more about taking a different approach to solving the problem.
• 1:10:16
  That's a good one, Jim. How about yourself?
• 1:10:19
  You've got to have some I Am horror stories.
• 1:10:21
  Yeah, I've got a few. But I'm going to tell one that's
• 1:10:24
  a real doozy. And I'd much rather if you had
• 1:10:28
  asked questions like tell us about one of your great
• 1:10:31
  successes. But you learn way more from your
• 1:10:34
  failures, right? So this one goes back to the
• 1:10:38
  identity DS and I was a real hardcore spokesperson for, you
• 1:10:45
  know, I learned about Fordraw, a client and I said that's the
• 1:10:50
  wave of the future. We need to get on that.
• 1:10:52
  And I think that was very good advice.
• 1:10:54
  So we built A-Team, learned Open AM, learned Open IDM.
• 1:11:01
  It took a long time. We finally found a client,
• 1:11:04
  helped them build their strategy and then you know, they said,
• 1:11:09
  you know, we trust you guys, we're going to bring you back
• 1:11:12
  and build it out. The Open AM part was simple.
• 1:11:17
  The thing was Open IDM and I think it was like version 1.2 or
• 1:11:20
  something like that. You've heard it probably
• 1:11:25
  described as a box of Legos and what can you build with a box of
• 1:11:29
  Legos? Pretty much anything, right?
• 1:11:32
  So we started like planning the project and I was very involved,
• 1:11:37
  right? I was the practice lead for our
• 1:11:40
  Ford Rock team, but things were picking up like business was
• 1:11:45
  picking up in other areas. So I had to go and focus on some
• 1:11:48
  other things. So I left the team with this one
• 1:11:52
  piece of advice which was don't integrate that application.
• 1:11:55
  We have to integrate like 3 applications, but it ain't going
• 1:11:58
  to be that one. And the reason I said that was I
• 1:12:01
  looked at it and was like that's one of those applications they
• 1:12:04
  built 10 years ago. And they've been building out
• 1:12:07
  like every feature and functionality for their identity
• 1:12:10
  management like you know, edge use cases ever since.
• 1:12:14
  And if it took them ten years to build, it's going to take us 10
• 1:12:18
  years to build. I don't, I mean Open IDM is a
• 1:12:20
  great tool and everything but we're they're going to want
• 1:12:23
  every feature. So I said that thing needs to be
• 1:12:26
  re engineered. So I went off and got involved
• 1:12:30
  with my other projects and then you know started hearing some
• 1:12:33
  grumblings like it's not going so great project's not going so
• 1:12:36
  great. I come back and find that our
• 1:12:39
  team had basically rebuilt that application in Open IDM and it
• 1:12:46
  was, you know, what I I realized was we could work on this thing
• 1:12:50
  for another three months, six months year.
• 1:12:53
  It's still not going to work. So we had to go back to the
• 1:12:58
  client and talk about like, you know, we can't integrate this
• 1:13:02
  application. It's going to have to be a
• 1:13:05
  different application and we had to wind up integrating that
• 1:13:08
  other application at no cost. The client still wasn't happy
• 1:13:13
  because it blew their timeline and they didn't get the
• 1:13:16
  application that they really wanted.
• 1:13:18
  The learning from my perspective, was don't walk away
• 1:13:22
  like that again, you know, like I knew that thing could not be
• 1:13:26
  rebuilt in our project and if I stayed on, I would have said no,
• 1:13:32
  no, no, I would have pounded my fists, fists on the table before
• 1:13:35
  I would have done that. But again, you learn from those
• 1:13:40
  things, so that's the best thing you can get from your failures
• 1:13:42
  is a good lesson, a life lesson that you won't forget.
• 1:13:47
  Those ones are pretty good stories.
• 1:13:49
  I'll keep mine short and sweet and I'll focus mine more on the
• 1:13:52
  operational side of things. We we all know our good friend
• 1:13:56
  Wayne Sissel. He's the reason I got into
• 1:13:58
  consulting in the 1st place Back in the day.
• 1:14:02
  I was a customer of of Wayne's Curry on at Walgreens and so
• 1:14:06
  forth. And we're going through the
• 1:14:07
  process of rolling out Curry on IGA.
• 1:14:10
  And I remember very distinctly we were in a conference room, we
• 1:14:12
  were in Lincolnshire, IL. So if you're listening from
• 1:14:15
  Walgreens, that's how far back this goes.
• 1:14:17
  And we were sitting in a conference room, we were talking
• 1:14:20
  about orphaned accounts and we had built this home grown
• 1:14:24
  authentication system and directory and everybody in the
• 1:14:29
  in the company had at least one account in there.
• 1:14:31
  It was how all the stores so like 250,000 people had accounts
• 1:14:36
  and we were in the process of doing mapping of those accounts
• 1:14:39
  to say, OK, who do these accounts belong to?
• 1:14:42
  And I walked in the room and I remember Wayne seemed kind of
• 1:14:45
  nervous and he was like, all right, we've, you know, we've,
• 1:14:49
  we've done some account mapping. And I was like, all right, cool,
• 1:14:51
  you know, where are we at? And he's like, he's like, I hate
• 1:14:54
  to tell you. And he always, he always say it
• 1:14:55
  was like, you know, super nice music, but there's 90,000
• 1:15:01
  accounts that we can't map. And I was like, oh, that's not
• 1:15:05
  too bad, 'cause I was expecting like more than that.
• 1:15:08
  And he, I just remember him having like shocked face,
• 1:15:10
  shocked Pikachu face like it's 90,000 accounts.
• 1:15:14
  Like, yeah, there's no guardrails in this application.
• 1:15:17
  You can name your account whenever you want.
• 1:15:19
  And there were plenty of people who took advantage of that at
• 1:15:20
  the store level with not safe for work names, all kinds of
• 1:15:24
  stuff. But that idea of 90,000 orphan
• 1:15:28
  accounts and you know, really put my hands there, right?
• 1:15:32
  There needs to be better structure around how accounts
• 1:15:35
  are built and lesson learned, right?
• 1:15:37
  Putting in rules of the road, you know, safeguards to prove to
• 1:15:41
  prevent that, the importance of having an employee ID number
• 1:15:44
  associated with accounts, right. All those little tips and tricks
• 1:15:47
  to kind of make your IGA platform hum.
• 1:15:49
  But I'll never forget, you know, Wayne's face and it's like, oh,
• 1:15:52
  it's 90,000 And she's like, oh, that's not too bad.
• 1:15:54
  It's like, all right, like, that's just a drop in the
• 1:15:56
  bucket. We already have like several
• 1:15:58
  million accounts that we're managing, you know, 90,000.
• 1:16:01
  That's like a Sunday. You'll get that done your week,
• 1:16:04
  Wayne. Yeah, so the Horror Story was
• 1:16:08
  for Wayne. Not.
• 1:16:09
  It was probably. More for Wayne at that point.
• 1:16:11
  But the fact that we had 90,000 orphans in one in one system out
• 1:16:14
  of like dozens that we're integrating, I'm sure probably
• 1:16:17
  caused some heartburn in the Korean side.
• 1:16:20
  All right, we've gone real long. So we'll wrap things up with a
• 1:16:23
  very quick question. We always like to end in a
• 1:16:25
  lighter note. Chad, what's the most unusual
• 1:16:28
  job you've ever had? So I think probably the most
• 1:16:34
  unusual that most people wouldn't have experience with
• 1:16:38
  right out of college. I'm a mechanical engineer by a
• 1:16:40
  degree, right out of college. I started working for a company
• 1:16:42
  in Cincinnati, OH, and I was able to design and build robots.
• 1:16:48
  They're all powered by AI, and they're going to come back to
• 1:16:50
  kill us now. But no, I my I worked for a
• 1:16:54
  company that made projection television lenses and I was
• 1:16:58
  responsible for building a lot of the security really around
• 1:17:04
  our robotic class manufacturing lines.
• 1:17:08
  So big automated plants like you talked about before.
• 1:17:11
  We, you know, have one person managing a line of robots of
• 1:17:16
  these ten machines that would pick up a glass blank and Polish
• 1:17:20
  it through a number of stages at lightning speed and having to
• 1:17:25
  build a lot of the controls and the security around that to make
• 1:17:28
  sure that if someone walked anywhere near the robots
• 1:17:31
  envelope they weren't going to get beaten up by that robot.
• 1:17:35
  So it was very cool. It was from a mechanical
• 1:17:38
  engineering perspective, was a lot of fun, but it's definitely
• 1:17:42
  this was back in, you know, the mid 90s.
• 1:17:44
  Not too many people were dealing with robots then.
• 1:17:47
  That is pretty cool. That's definitely unique, Jim.
• 1:17:49
  How about yourself? What's an unusual job that
• 1:17:51
  you've had? And that's impressive is that
• 1:17:54
  one. But also mid 90s.
• 1:17:56
  I worked at an arcade in the mall and what was really cool
• 1:18:01
  and unusual about it was I had to take public transportation to
• 1:18:05
  get there. And it was like 1/2 hour 45
• 1:18:08
  minute bus ride and I would take the bus home and it'd be like
• 1:18:12
  11/11/30 at night. I lived in Philadelphia so
• 1:18:16
  public transportation could get you just about anywhere.
• 1:18:20
  But with the maintenance guys and oh man, some of the stories,
• 1:18:24
  this guy's hotel and just like horsing around on the on the bus
• 1:18:29
  and everything, like, yeah, that was pretty cool.
• 1:18:33
  So that was an educational trip as well then, I'm sure.
• 1:18:35
  Very, very educational. Let's see.
• 1:18:39
  People are probably familiar with my long history in
• 1:18:41
  restaurants, but that's not the strangest or I guess unusual job
• 1:18:44
  I actually was. I don't know what my position
• 1:18:48
  was but like, bank teller, I guess.
• 1:18:51
  But really what that meant. And I I this was, this came
• 1:18:55
  actually from a customer of mine.
• 1:18:56
  I was serving tables and somebody from TCF Bank in
• 1:19:00
  Chicago. I I guess I waited.
• 1:19:01
  I'm going to impress him and say, hey, give me his card.
• 1:19:03
  And he said, hey, I'd love to have you work for us.
• 1:19:05
  You know, give me a call. And I did.
• 1:19:07
  And I was like, all right, will you see what else you got?
• 1:19:09
  And I was like, you know, what do you want to do?
• 1:19:11
  I was like, oh, you know, like like working with people or
• 1:19:13
  stuff like that. I was like, all right, so I go,
• 1:19:15
  I get the job and go through training or whatever and I show
• 1:19:19
  up and I'm assigned to a Cub Foods.
• 1:19:22
  And so if you're familiar with Cub Foods, it's like a grocery
• 1:19:24
  chain, kind of like I don't know where it is now, but kind of
• 1:19:26
  Midwest, maybe upper Midwest, that kind of thing.
• 1:19:29
  Illinois at the time. And my job was to stand outside
• 1:19:33
  of the Cub Foods trying to get people to open checking and
• 1:19:36
  savings account and hang them Flyers.
• 1:19:39
  And I was. I lasted 3 hours, went to lunch,
• 1:19:43
  never came back. Called on the way, you know, on
• 1:19:47
  my car on the way back. I was like, this job isn't for
• 1:19:49
  me. Sorry, I quit.
• 1:19:50
  That's the only job I've ever quit with.
• 1:19:52
  Like, you know, no notice, didn't do anything.
• 1:19:55
  But it was not what was advertised to be.
• 1:19:57
  I was basically handing out Flyers outside of a Cub Foods.
• 1:20:00
  You're working with people. Who didn't?
• 1:20:04
  Want anything to do with me? So yeah, that was not my most
• 1:20:10
  favorite job, but you know, things work out for a reason.
• 1:20:12
  All right, let's go ahead and leave it there for this week.
• 1:20:15
  Hopefully that gave people some insight into RSM and the the
• 1:20:18
  digital identity practice that we've been building here.
• 1:20:20
  And people come out, we'll be at Identiverse.
• 1:20:23
  A bunch of us, pretty much all of us will be there.
• 1:20:26
  So you get to meet the rock star team that we've built here.
• 1:20:28
  And yeah, so rsmus.com. And what else should we should
• 1:20:34
  we plug? Maybe ourselves?
• 1:20:35
  IDC podcast.com our Twitter at IDC podcasts Our Mastodon IDC
• 1:20:42
  Podcast at infosec dot exchange I know Jim, you're all about the
• 1:20:45
  YouTube channel. See There's happy.
• 1:20:47
  I was like there there. We are.
• 1:20:48
  I'm happy now. Look us up on YouTube.
• 1:20:50
  We're starting to put more of our episodes in a video format
• 1:20:53
  and stuff like that. But yeah, and hire us, right?
• 1:20:56
  I mean, Jim, Chad, myself. We're happy to talk identity,
• 1:20:59
  but love to work with folks who are listening out there.
• 1:21:01
  Call us if you got any issues or concerns that you think we can
• 1:21:04
  help with and we'd be happy to hop on a call.
• 1:21:07
  So more meetings for Chad because I know he loves them so
• 1:21:10
  much. I do and thanks for having me
• 1:21:12
  guys. I appreciate it.
• 1:21:13
  Yeah. Thanks, Chad.
• 1:21:15
  That's it for this week. Thanks everybody for listening
• 1:21:18
  and or watching and we'll talk with you all in the next one.
• 1:21:22
  You've been listening to Identity at the center.
• 1:21:26
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:21:30
  review and we'll be back soon. But in the meantime, hit the
• 1:21:33
  website at identity@thecenter.com.
• 1:21:37
  See you next time on Identity at the center.