Latest / Identity at the Center / #393 - Breaking the Tyranny of Joiner, Mover, Leaver with Ian Glazer

Transcript

#393 - Breaking the Tyranny of Joiner, Mover, Leaver with Ian Glazer · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey partner. Hey, Jeff, how are you?
0:15
I just can't I. Can't open the show any other
0:18
way than hey Jeff, how are you? Yeah, I know you're on autopilot
0:20
and I just can't get past the the the ensemble, the hat, the
0:25
jacket. Even just said he felt like he
0:27
was sitting across the table from a Texas holdem dealer or
0:30
player or something like that, so I'll go with that.
0:33
It was a year ago, we sat up in the in the suite with head
0:36
codets from Silver Fort and you were dressed like a, you know,
0:40
olden times poker dealer or whatever from like a western.
0:44
And I feel like you're really kind of growing into this Texas
0:48
theme here. Well, we're in Texas, right?
0:50
We're at the Gartner I am Summit 2025 actually ran into head.
0:54
They've got a big silver fork presence downstairs.
0:57
I love coming to these conferences and running into old
1:00
friends, making new friends. I mean, it's just what it's all
1:04
about for me. Yeah, well, I'm usually stuck in
1:06
this room recording and editing, but I do get out a chance to to
1:10
talk to people and stuff like that.
1:11
So shout out to Gartner for giving us the space to record
1:15
in. Shout out.
1:16
RSM for getting us out here. So shout out.
1:18
RSM you got the RSM shirt on? That's actually our real jobs.
1:21
People think we do the podcast like full time.
1:24
Not even close. Yeah, our son pays the bills and
1:27
the podcast generates them. That's how we look at it.
1:30
That's pretty much the case. Yeah.
1:32
Well, look, we're very fortunate to be able to come to as many
1:35
conferences as we do. Most of the practitioners out
1:38
there get to go to one or two a year.
1:40
Hopefully by tuning into the podcast you can get kind of
1:45
what's going on in all these conferences and we bring in
1:48
great guests like Ian to kind of give a bite sized version of
1:53
kind of what the industry is talking about.
1:54
It's like a hallway conversation, but broadcast.
1:57
There you go. So you know, it's kind of like
1:59
that. You know, one thing that I'm
2:01
going to bring up because that we're recording this at Gartner,
2:04
it's December. I don't know what to say.
2:06
December 8th. It's not going to go live until
2:08
January, but by the time people listen to this we will probably
2:13
be at one and a half million downloads.
2:16
We're impressed over. Absolutely nuts over the course
2:19
of 6 1/2 years or so, ever that we've been doing that.
2:22
Yeah, but like the first four years was like nobody, not even
2:25
half a million downloads, right, so.
2:27
Yeah, it was not even, not even close to half a.
2:29
Million. Not even.
2:29
Close like yeah, whatever, but sort of reason.
2:31
So thank you to all the folks who listen and make us part of
2:34
their lives. And you know, whether it's to
2:36
drive to work or time on the treadmill or however you carve
2:39
out time for it, Jeff and I are extremely grateful.
2:42
So thank you. Yeah, it's very cool.
2:43
Whether you love it or hate it, either way it works.
2:47
That's super cool, so we'll keep doing it.
2:49
If you hate it and you listen every week.
2:51
Some got hate. Listen, that's fine.
2:53
Like, okay, you know, I'm not going to say that I'm a cup of
2:56
tea for everybody, but, you know, that's fine.
3:00
Yeah, I'm looking at my notes here.
3:01
We're going to introduce Ian and it just says intro him somehow.
3:04
So Ian Glazer, welcome. Back that technically meets the
3:10
requirements of intro him somehow thank you guys it's it's
3:14
it's great to be here I can't believe almost 1,000,000 1/2
3:17
yeah. Yeah, God.
3:20
And 6 1/2 years. 6 1/2 years too.
3:22
July 2nd, 2019 is our birthday. That was the before times.
3:28
It was the right before the before times.
3:30
Yeah, Yeah, yeah, yeah, yeah. That's amazing.
3:33
Thank you guys. Again, it's it's an honor and
3:35
pleasure to be able to come and spend some time with you.
3:37
Well, you've been with us several times at this point.
3:39
And I think if you just go to idacpodcast.com and just search
3:42
and just type Ian, it would be like, I don't know, 8-9
3:45
different episodes. We were had a little bit of a,
3:47
of a check to see like how many people, how many times you've
3:49
been on. I think Andrew Shakyar is still
3:52
the lead. Well, that means there's enough
3:55
footage to when I answer your questions now to go back and be
3:59
like, wait a minute, he's contradicting himself in episode
4:01
35. He said the follow it like
4:04
there's going to be all sorts of discontinuity, like the Canon is
4:07
all. He's not wearing the same shirt.
4:09
That's an edit. That's an edit.
4:11
But you know what? That's a sign of growth.
4:13
Just because you believe something today doesn't mean
4:15
that you can't be presented with new information tomorrow.
4:18
You'll change your opinion on something.
4:20
That's totally fine. We can all get smarter.
4:22
I think we're OK with that. So let's see, when's the last
4:25
time we actually chatted? Because I feel like I've seen
4:27
you at a couple different conferences throughout the year.
4:30
I think probably the last time I sat down in this Surya format
4:34
was authenticated last year with some of the die off winners.
4:38
Actually I think the Digital Identity Advancement Foundation
4:41
folks, we had one or two winners.
4:43
Grace was there. Yep, Grace and Diane, Yeah.
4:46
Right, right. So I think that's probably the
4:48
last time I've I've sat in this capacity with you all.
4:52
Well, thanks for joining us again.
4:54
I feel like there's so much to cover.
4:55
I know, Jim, you've got like a laundry list of questions.
4:58
That are not at all AI generated I have been told.
5:00
You're right, you just have to believe us.
5:02
AI might have helped but. And the hat is not AI or the
5:06
jacket. No, no, this is this is real
5:09
gym. This is not, this is not you
5:12
ever. This is not nano Banana do.
5:14
You see me at Walmart? I might look just like this.
5:18
I'll see. This is not something that AI
5:19
could even think about hallucinating or leaning.
5:21
Out no 'cause he's not wearing shorts, wearing shorts and
5:24
obviously. That obviously, right?
5:25
The camera angle is not catching below.
5:27
It's and we're all thankful for that.
5:29
So I just thought of something though.
5:31
You know Grace Kluke, who you guys gave the the scholarship
5:36
to? Yeah, she's been very active.
5:38
She has. I feel like that is exactly what
5:42
die F is all about. S 1st off, for those who don't
5:45
know what die F is, do you want to just give?
5:47
Sure. The short version is this.
5:48
The Digital Identity Advancement Foundation Die F was created to
5:53
address the global short staffing.
5:56
Essentially, we have an identity.
5:57
And really it was to attack the problem of how do people get
6:00
involved, get involved. Just generally they're coming
6:03
from a socio economic situation, a geographic situation where
6:06
they don't have necessarily the same identity community that
6:08
many of us are lucky enough to have and they want in somehow,
6:13
right? So how do we get those people
6:14
from Bhutan to EIC, for example? The other mission was to look at
6:21
participation in technical standards.
6:22
And this is a crucially important thing for our
6:24
industry. We've heard it throughout the
6:26
day in sessions and this was the sort of other half of what we're
6:30
doing is how do we get more people involved in technical
6:33
standards processes and contributing to those standards.
6:37
The awards that we have on our two late great friends of ours,
6:40
Kim Cameron and Victoria Botocchi, and it's been around
6:44
for a couple of years now and we are excited for opening up new
6:47
scholarship opportunities next year.
6:50
Miss Awesome. It's a great cause is something
6:53
that Jeff and I have contributed to.
6:57
You've been really active. I mean, you've been a
7:00
cornerstone or keystone of this community for a couple decades
7:04
now, and you keep coming. Up with too long, Ian.
7:10
A while. Can we keep it in a while?
7:11
It's just it's there's, I'm putting in a talk for identity
7:16
for next year. I don't know if we'll get
7:17
selected, but I'm putting in a talk.
7:19
It's a panel and right now the working title is 100 Years of
7:23
Identity Experience. You'd think we'd be better at
7:25
this, and it's got some friends of the show on it.
7:29
And yeah, so I've been doing it for a little while.
7:32
Yeah. Well, it's a great point.
7:34
It kind of brings me to this question.
7:35
So I saw your presentation, I think give us that authenticate.
7:40
And you talked about kind of the failures of Enron, which was
7:44
around, you know, not having the right controls in place and the
7:49
industry. Well, kind of the outcome of
7:51
that was Sarbanes-Oxley, and that's kind of been a driver for
7:54
identity. It was supposed to be probably
7:56
for the 1st 10 years afterwards we get it all fixed and then we
8:00
move on to other things. But it feels like in a lot of
8:03
ways, we're still trying to solve those problems in the same
8:05
kind of ways, and it seems like it's broken.
8:10
Look at it this way, your approach to IGA, one's approach,
8:14
I mean yours individually, but one's approach to IGA at this
8:17
point is old enough to rent a car, right?
8:19
It's like 25 years old. We've been basically doing the
8:22
same kinds of things. And it is really a very strong
8:25
reaction to Sarbanesoxley around segregation of duty, around
8:30
review of access, review of access, ongoing access control
8:33
and access certification. Now there is a lot of goodness
8:38
inside of that, but the reality is when you hear, oh, we're five
8:42
years into our IGA deployment and we're still not there yet,
8:46
it makes me think that it's a lifestyle and not necessarily a
8:49
program or a project and that the outcomes are fine, are great
8:56
fine, right? We've ended up creating a bunch
8:59
of burden and friction with access request processes and
9:03
with access certification processes, for example, managers
9:06
having to review all of these things.
9:09
They work to a point, but we're still seeing outcomes related to
9:12
access related risk, right? We're still seeing negative
9:15
consequences, whether it is abuse or it's misuse, standing
9:19
access is still a huge problem. And this is not for lack of
9:24
trying, right? And you guys know better than
9:26
most. Like there are organizations who
9:28
are really determined and really great practitioners, really
9:32
determined to solve these problems, to address what has
9:35
been challenging the organization for years, to fill
9:39
those compliance gaps, to fill those productivity gaps.
9:41
And yet they can't make as much progress as they want to.
9:44
It's not because they're not trying hard enough.
9:47
That sort of tells me, huh, maybe it's time for something
9:51
else. And 25 years is how demographers
9:53
measure what a generation is. So the talk I gave at
9:56
Authenticate was really about like, I think there's some
9:58
generational change happening. Legitimately we are seeing the
10:01
emergence of what next looks like.
10:04
And I don't mean next Gen. in a very marketing kind of way.
10:07
I mean like literally we are now on to seeing there are other
10:10
patterns emerging that can help not just address where we have
10:17
been and where we are coming from, but actually define where
10:20
the sort of new standard should look like.
10:22
What is the new pattern of an identity stack look like?
10:25
What are those interaction models look like?
10:27
And I'm, I'm really excited to see that start to bloom.
10:31
Yeah. So there seems like there's so
10:32
many factors that could be contributing to kind of where we
10:36
are. There's, you know, technology
10:39
factors, terms of like the technology is going faster than
10:43
the IM department can keep up with it.
10:46
There's the fact that it can be really expensive and when
10:50
companies go through tough times, they tend to pull back.
10:53
I mean, we all like to think can't cancel cybersecurity and
10:57
that's probably true, but you can spend less on it.
11:01
And then there's a kind of just like technology limitations,
11:06
like how far can you can you take?
11:08
I think one of the things is, you know, sometimes I talk to
11:11
folks where it's like, yeah, we've got 300 apps integrated to
11:15
our IGA system and that's different than we don't even
11:19
have an IGA system, but the 300 apps.
11:22
Doesn't that kind of like lock you into a technology too?
11:26
So I guess to turn that into a question is like what do you
11:29
think the biggest factor is that's kind of held the the
11:33
industry back? Biggest is a little bit of hard
11:37
question to answer, but I think among the things one is that
11:43
we're sort of pinned in by what we believe to be is the art of
11:47
the possible. And it's really hard as an I am
11:51
practitioner and I am leader to say I'm gonna go in a radically
11:54
different direction, right? Whether simply that vision is
11:59
too hard to make into architecture or it is that you
12:03
simply can't because internal or external audit has a set of
12:06
expectations. The industry we're working has a
12:09
set of expectations and common practices.
12:12
And to be an iconoclast in doing that, to say I'm gonna try
12:15
something different, that takes an enormous amount of courage
12:18
and clout and political willpower.
12:20
And so we think partially there is sort of organizational
12:25
restrictions Part 1, Part 2 is nobody really wants to be the
12:29
first person off the diving board, right?
12:31
It's like, I'd like to see someone else go in and tell me
12:33
how the water is before I do that.
12:35
And I think that's why running in parallel, I don't know when
12:40
this is going to air, but ID Pro is doing this really great four
12:44
part series on continuous identity with Andrew Cameron and
12:47
Sean Odell and Eric Flanagan. And so I've just done Part 1.
12:50
So this is the first week of December.
12:51
The, the Part 1 just got aired, Parts 2-3 and four are coming in
12:55
January and in a little February.
12:57
So these are practitioners who've come up with different
12:59
models, different ways of doing things in differing industries
13:03
in differing states of their deployment.
13:06
But they're talking very openly. This is sort of a redo of a talk
13:10
they gave at ideniverse. They're being very generous with
13:12
their time. But if you're interested in
13:15
seeing through what this can look like, if you want to see
13:18
that other person off the springboard and into the pool,
13:22
this is a great live example that's happening alongside of
13:25
this recording, which is really, really neat.
13:28
That's a great segue because that was kind of next on the
13:30
list was to talk about this thing called continuous
13:32
identity. It's gotten hot this year,
13:34
right? Sean and Andrew have been
13:36
talking about it. I think you've been talking
13:37
about it as well. For people who aren't familiar,
13:40
what is the elevator pitch 30 seconds on what is continuous
13:44
identity? Sure.
13:46
Continuous identity is a way to break out of the tyranny of
13:49
joiner mover lever and login. If we just wait for like when's
13:55
the joiner event happening and I can manage access or what's a
13:57
mover event, when do they get a login?
13:59
If I look at the number of those events in the day, those are the
14:03
only opportunities I have to affect an access related
14:06
control. Wow, the speed of our business.
14:10
Just the humans, the carbon based life form, it's not in,
14:14
that's not in step with that. If I then look at the needs of
14:17
workload identity in AHIS, it's not on pace there and it is
14:21
comedically out of pace with what we think AI and agents will
14:25
require. So it is a way to say, look, can
14:28
we enforce our identity controls continuously so when things
14:33
change, take action that may govern access?
14:36
Can I do this based on a little bit of contextual information
14:39
which we talked about in the past, Just a little clue that's
14:42
just out of reach of my identity systems.
14:45
It could be page your duty who's supposed to be working right
14:48
now. It could be your EDR vendor, it
14:50
could be your ticketing system. But a clue that says, look, this
14:54
is going to change the access that that Jim should have.
14:58
And then can I do that consistently across my
15:00
infrastructure as opposed to having silos a policy.
15:02
And that's something that actually Paul Mazzaro was
15:05
talking about today in his authorization management
15:07
platforms talk, which I thought was really neat.
15:08
But really it's about breaking out the tyranny of journey of
15:11
reliever login and affect our controls more continuously to
15:14
for the outcome of less human in the loop processes.
15:19
A more reasonable and effective way to limit the abuse of access
15:24
and the misuse of access and do so without having to throw out
15:28
everything that you've already invested.
15:30
Make it as an incremental process that can get you to what
15:33
we think will be the coming new platform, then the coming new
15:36
style of identity architecture I.
15:38
Was talking to my friend Shashwat earlier today and we're
15:41
kind of talking about this continuous ID paradigm shift
15:44
that we're in right now. And I don't know if people
15:48
really understand what it means. It sounds cool, like, OK, great.
15:54
It's more than just product, it's data, it's business
15:58
process. And the way that I've kind of
16:01
described it to people is instead of batch identity,
16:05
meaning joiner mover, lighter, right, event based things is
16:09
it's data-driven. It is, you know, millisecond
16:12
based identity versus daily or weekly.
16:16
Yeah, based identity. And I think like, that's the
16:18
only way you can keep up in today's world, especially when
16:20
you have AI agentics, you have, you know, all the different NHI
16:26
types that are out there. And these are ephemeral
16:29
identities that spun up, spun down, doing things while they
16:33
live, shutting down and that idea of continuously evaluating
16:39
what is happening. But you can't do that without
16:41
data. That's correct.
16:43
And I think that is a big gap that a lot of organizations in
16:47
the real world struggle with. They don't struggle with the
16:50
lack of data, that's for darn sure.
16:52
I think I have yet to meet an identity practitioner that's
16:57
like, Yep, my data is good. Like there's not a problem,
17:01
right? But I think we've, we've kind of
17:05
had this weird learned helplessness about this in the
17:09
sense of like, yeah, HR data is crap.
17:12
It's always going to be crap. And our authority to go make
17:15
them change that data to not be crap is 0.
17:19
Let's be honest about that. That's why that's one of the big
17:22
reasons why IGA products cost a half $1,000,000 to implement.
17:26
It's like over processes are broken, over data is garbage.
17:30
So it's yeah, we bought a product.
17:33
You can't just slam it in you. Can't bite.
17:36
I also think that there is good enough data and we should
17:41
acknowledge that in a lot of cases good enough data is in
17:44
fact good enough. And then if I want to pull that
17:47
contextual information and that extra data, those often are
17:51
domain specific sets of information.
17:53
Your EDR system is really good about EDR data, right?
17:59
Your pager duty data, right? Your duty rosters in theory are
18:03
pretty darn good about it because otherwise someone's
18:05
getting called in three in the morning and they're going to be
18:06
pretty pissy about it and they're going to fix that data.
18:09
So I think some of these domain specific sources of information
18:12
are good enough to work with because you only need a small
18:15
sliver of it. And that allows us to make a
18:19
little bit of progress to sort of shake lucidly.
18:20
Like I have to have every source of data fully correlated, fully
18:25
scrubbed isn't just a thing. But Jeff, there's another thing
18:29
besides having data. It's the timeliness that that
18:33
data can get around. And this is where something like
18:36
shared signals framework is so important and continuous
18:39
identity. The analogy I like to use is
18:41
that we are at the part of the story where everyone needs a
18:44
telephone. And as everyone gets a
18:46
telephone, by that I mean a shared signals framework,
18:49
receiver and maybe a transmitter, then we can do all
18:53
of these value add things on top of it.
18:55
But we're just in the beginning of the story where we're
18:57
building on a telephone network and we're standardizing what
19:00
that looks like. So that's an incredibly exciting
19:02
time from a standards perspective, and it's incredibly
19:05
enabling as that comes to pass. But the nice thing is we don't
19:09
have to wait for full standards adoption, which we know we know
19:12
will never happen. You can still make progress
19:14
today, even in proprietary signals, to do some really
19:17
amazing things in a timely fashion.
19:19
Something I wanted to make is I think a follow up on on what
19:22
Jeff was saying, because I think it's a mindset shift and I think
19:28
you run into identity practitioners, leaders who are
19:33
different stages in organizations that are different
19:36
stages of their life cycle. Maybe they have nothing or next
19:40
to nothing. Maybe they are mid deployment of
19:43
your big, big boys, IGA, single sign on privilege access
19:48
management or maybe they're very mature.
19:52
If you were in any of those 3 buckets, what would you do with
19:56
shared signals? Would you prioritize it before
19:59
kind of moving ahead or? If I was, if I had nothing,
20:06
right, if it was truly a Greenfield organization, that's
20:08
I think a bit of a special case because I don't think most
20:11
people live in a Greenfield there.
20:13
I would say build for a real time identity infrastructure,
20:15
build for continuous identity day one.
20:17
And I've certainly talked to some practitioners who are lucky
20:20
enough to be in an organization. We're like, Yep, we're
20:22
greenfielding or we are designing a Greenfield solution
20:27
alongside our brownfield existent solution because we
20:30
know this can't keep going right?
20:32
We're we're burning money, maintaining it.
20:35
I see organizations that are at at 0 where they're either have a
20:39
custom homemade solution or they're an organization that
20:43
should be run centralized, but they're decentralized and they
20:46
have a bunch of batch scripts. Or really it's usually service
20:50
desk tickets where it's like somebody just manually goes and
20:54
executes out a ticket. Sorry, go ahead.
20:57
It's fine. And I think that's actually a
20:59
really good point, which is that there are identity teams that
21:02
are, let's say, aligned to identity as Productivity Tools,
21:08
right? Nominally the CIO's office,
21:11
right? Those are those access
21:12
management teams that are essentially decoding those
21:14
tickets. And then you see identity teams
21:18
aligned as a security control, right?
21:21
So you see identity for security teams more closely aligned with
21:25
the Sisos organization or in a weird nether zone between the
21:28
two. And for some organizations, the
21:34
the ability to automate that first sort of ticket processing,
21:38
that seems like it's right for AI as a booster, right?
21:41
Like I think that's a fertile ground for actual real
21:44
meaningful progress to be made on the identity first security
21:48
side of things. Now we're saying we have the
21:51
plumbing in place, we have a reasonably stable architecture.
21:54
What we don't have is a way to break out of the tyranny of
21:57
joint remover lever login. And this is where they're saying
22:00
I want to put in a shared signals infrastructure.
22:02
So at the very least I can get telemetry that can allow me to
22:07
make decisions more quickly. I will still work through the
22:10
existing plumbing to do that. And that is subject to the same
22:14
constraints we've had in the past.
22:15
Is it connected to all the systems?
22:17
Do we have everything wired up to SSO, etcetera.
22:19
But that at least gives me the opportunity to react faster.
22:23
And then we decide where do we want to start mitigating risk
22:26
and using that as the primary means of doling out access
22:30
versus the cleanup method does? This mean for teams in the real
22:34
world. So the reason I asked that is a
22:38
lot of organizations today will have multiple teams doing
22:40
identity. Yep, they've got some
22:42
authentication taking place in sort of like the IT area, right?
22:45
Your Windows administrator. The password people, right?
22:48
They're everybody's favorite. Right.
22:49
And then you've got people who might be in security or help
22:52
desk that are doing joiner mover lever or access reviews.
22:56
This concept of continuous identity, is this a opportunity
23:00
to kind of re architect the organizational design of an IM
23:05
program? It can be, but it's, it starts
23:10
with a frankly, I think an architect more often than not
23:15
when I talk to people and, and Sean and Andrew are good
23:18
examples of that there, there's hundreds of them out there that
23:22
do this sort of thinking about like we have an, we have systems
23:27
for operation and the identity operations teams that are doing
23:29
those things. We've got increasing
23:32
requirements from the scissors office, whether we sit inside of
23:35
it or not. This is in material.
23:38
How are we going to go about this knowing that we can't just
23:40
RIP and replace everything and we shouldn't?
23:41
That's the wrong decision to make.
23:44
I think what we'll see is again, as we bring in some more AI
23:49
tooling, the those access request processing teams, I
23:53
think those are going to be able to move into other kinds of
23:56
capacity inside of identity as opposed to being ticket
23:59
processing, right? I think there's actually
24:01
something viable there, but I've got those resources.
24:04
People that have been dealing with customer pain, internal
24:08
customer, external customer, the one thing they come armed with
24:12
is an enormous amount of empathy for the people who can't get
24:14
their damn jobs done right. And so when you suddenly offer
24:19
them the opportunity to be like, imagine that we could do this
24:21
thing in seconds, not weeks. If we can give you the right
24:26
access without you having to put in an access request, simply our
24:29
business process. Have you opened the ticket
24:31
because there's an emergency change needed and not just
24:34
magically gives you the access and it goes away when you're
24:36
done. Hell yeah.
24:38
Who's gonna say no to that? Right?
24:40
So I think those folks, especially armed with that
24:43
empathy of realizing like, Oh my God, it's been 3 days.
24:45
I don't have access. This is really important.
24:47
Like they, they get the brunt of that.
24:49
That's not fun, right? So I think they're going to be
24:51
some of the most eager to be like, wait a minute, you mean I
24:54
could do this like, like this whole.
24:57
Yeah, sign me up, right. How do I help?
24:59
I can operate policy. I can help give you that insight
25:01
into those applications. I think we're going to have a
25:03
cadre of new practitioners who are freed up to go do some of
25:07
this work, which I think will be great to see.
25:10
You care deeply about the identity practitioner community.
25:13
You're a Co founder of ID Pro. I wanted you to give us a state
25:18
of the state of affairs for the identity practitioner.
25:26
I think it's a it's a great and tough time.
25:31
It's a great time because there are new patterns to deploy, new
25:38
patterns to learn about, a new opportunities to achieve the
25:42
mission faster. That's awesome.
25:45
I think it's a tough time because on one hand, AIAI, which
25:50
is like just nonstop like both, how do we protect this?
25:53
How do we use this? And it's it's probably very
25:56
fatiguing. Part 1, Part 2 is it is a names
26:03
have a lot of power. The problem is that we're
26:06
grasping for new names for how we do identity.
26:09
Identity security isn't a thing in my book, right?
26:12
It's an umbrella under which a whole bunch of companies who
26:15
have bits and pieces of capability, which can affect
26:18
different kinds of outcomes, some important, some really
26:21
important, some not important are like harbored under right
26:25
now. And that the analyst community
26:30
is continuing to come up with new kinds of concepts, IVIP,
26:34
these others. And I don't think anyone
26:36
understands what all these terms mean like IGA and access
26:39
management. Those terms are out really out
26:40
of date. What they actually mean from a
26:43
market perspective, what I can buy, what I can deploy versus
26:47
the definition of the outcomes that you see that was have
26:50
drifted apart in a lot of ways. So it's really confusing to
26:54
understand and say like, what am I deploying?
26:56
Why am I doing that? And so the challenges coming
27:00
back to what are the outcomes that the organization is trying
27:03
to seek and how do these capabilities actually address
27:09
those outcomes? I think that's a really
27:11
challenging time. I will say that a friend of the
27:14
show said to me, I walked around the show floor, not Gardner, but
27:17
similar. There was dozens and dozens of
27:20
companies. Every single one of them said
27:22
they did identity security. It took me 30 minutes with each
27:24
one of them to figure out what the hell they actually did,
27:26
which is not a good use of my time.
27:28
You're like, yeah. And that's more endemic of our
27:31
inability to as a, as a practice right now find those new terms
27:36
that we can then start to anchor on and say, like, I get it, this
27:39
is, this is aligned to these outcomes.
27:41
It gives me these capabilities. I am deficient there.
27:44
I'm really good there. Great.
27:46
Let me move on to the next thing.
27:47
I think this is a weird moment for us in that regard, in a
27:50
weird moment for practitioners because of it.
27:52
So for practitioners, I mean, I feel like the mission has always
27:56
been the same, you know, ensuring that the right people
28:00
have the right access. Well, maybe we change the word
28:03
people with whatever things and people, right, but.
28:07
Things are people too. That's not.
28:10
It do we now just have a lot more work?
28:12
Is the community just a lot bigger or because let's take an
28:15
example like NHII think for most identity practitioners, if you
28:21
went back 20 years ago, NHI meant service accounts or maybe
28:25
some application IDs that you ran batches with.
28:29
Well now it's like there's more, there's more non human accounts
28:33
or machine accounts than there are humans.
28:35
So let's face this, a lot more work even if you have the right
28:40
tools. It's a lot more work if you
28:43
expect the work to be fulfilled by that same access request team
28:46
who's processing tickets. That's an impossible ask.
28:49
And that is truly impossible, especially when you say, well,
28:52
NHI has all these workloads and it's secrets and it's certs and
28:55
like, Oh yeah, like there's a non starter, right?
28:58
Like we have reached the limits of what humans can do with human
29:03
tooling. That's right.
29:05
And so is it a lot more work? Yes, maybe.
29:11
But actually maybe not in the sense of if we had the right
29:15
tooling to bring to the story, then I can apply policy, I can
29:18
apply automation, and I can manage this with the same humans
29:23
that I've got today Versus saying if I had we, we used to
29:27
talk about the ratio of identity practitioners to employees or
29:31
the ratio of security practitioners to employees.
29:33
That number is always wildly varying.
29:35
And one of the economic justifications for products was
29:39
how many password resets would you avoid here?
29:42
It's 25 bucks. A password reset I think is the
29:44
apocryphal number that has not been adjusted for inflation and
29:47
living expenses. But you know, that was how we
29:49
used to price a lot of the especially the life cycle
29:51
management tools. We can't take that mentality of
29:54
like, oh, I have one carbon based life form to every 10
29:57
million silicon ones. That seems like the right ratio,
29:59
right? Obviously it's a ridiculous
30:01
statement, right? So we've got to have modern
30:04
tooling for modern challenges. I think very personal opinion of
30:09
this is I'm a little bit skeptical in the NHI and AI
30:13
space of the yes, no doubt volumetrically there is a lot
30:17
more of those things to manage and all of them will have
30:20
access. Absolutely, absolutely true.
30:25
What is the impact of that? I think the NHI one has always
30:30
been a problem and we are well into cloud adoption.
30:33
So we've had this problem for quite some time.
30:36
It doesn't strike me as problem one to go track.
30:38
I think the, the agent side of thing actually represents
30:42
something that is a problem to say we've got to get ahead of
30:45
this or at least be contemporaneous with it, because
30:47
now we're having delegated access, which we as an industry
30:50
have never been great at doing and never fully solved.
30:54
And it's stressing the weakest part of our practice, if you
30:57
will. So now we've got to put eyes on
30:58
this thing because that is going to be a legit problem.
31:01
But I'm a little suspicious where people like, you know
31:03
what, we're going to catalog all the, all the things, all the
31:06
silicon based life forms. Great.
31:10
Now what? Right.
31:11
Like, oh, look, there's all these workloads and now what?
31:16
Yeah. What?
31:17
Yeah. And I think this is where we're
31:21
trying to find the. I think it's oh gosh, it's
31:27
what's her face. I can picture her I blanking her
31:29
name. Sizzo.
31:31
Was it Duo? Oh.
31:32
Oh, come on here. There's Christine.
31:35
Nope. Oh my God I'm going to.
31:37
I was on a podcast with her. I'm going to remember this as
31:39
soon as we stop recording. Has this great quote, which is
31:41
like at some point you're worried about this vulnerability
31:46
is like saying there's a window open on the 43rd floor of your
31:49
skyscraper and you got to go get someone to close it.
31:51
Like, is it really realistic that someone's going to climb up
31:54
43 stories and into the building through that window?
31:57
And I feel like in some cases, we're seeing some of the same
32:00
sort of reactions in the identity space.
32:03
But what if? But what if no one wants to be
32:06
inactive or seen as not to be having thought of that or taking
32:09
a precaution or what have you versus saying we did think about
32:13
it, we did our evaluation against it.
32:15
These are the mitigations we have in place.
32:18
Let's keep going because we've already had this for quite some
32:21
time. And it doesn't mean that we
32:23
won't get popped, it won't get abused.
32:26
But this is what we have and be realistic about.
32:29
It are we a mature profession? Well, if you sample the three
32:34
people in the stream, obviously the answer is no.
32:36
But where do we at in the life cycle of the identity and access
32:39
management profession? Like, are we still in the very
32:43
beginnings? We're still trying to figure
32:45
things out, you know, are we teething a toddler?
32:49
Are we, you know, just got our driver's license?
32:53
And where do you see us in the continuum right now?
32:59
I think we're in a mature place, but the world around us has
33:09
changed. So if you were, you know,
33:14
imagine you were Gen. X, just hypothetically, you did
33:18
not grow up as a digital native. You sort of saw it happen and
33:23
you learned it and helped shape some of it.
33:26
But you sort of learned it in your own idioms based on truth,
33:29
as you said long ago versus say digital natives, say, if you
33:31
were say Gen. Z.
33:34
So I think in some regards, a lot of practitioners have Gray
33:39
hair and have really matured their skills and and the the
33:45
totality of skills to be able to communication skills, the
33:48
ability to understand technical architecture, the ability to
33:50
communicate to this. They've done an enormously good
33:52
job at that. What's happened is as we've been
33:54
doing that, the world has also been innovating as well.
33:57
And so a mature practitioner now confronted in an unfamiliar
34:01
territory of saying, OK, I've got to learn these new things.
34:04
I have to learn a whole new set of languages around AI and all
34:08
the tooling that go along with that for that or even the NHI
34:12
for that matter, may not really have ever did dealt with
34:14
anything other than service accounts.
34:16
So I think we have a mature practice that's now confronted
34:20
with a different world. And the question is, is that
34:22
practice, if it's out of step, how do we mature that if our
34:27
practitioners are missing skills, which I don't think they
34:30
are, but how do they mature those skills as well?
34:34
So we have to decouple sort of the practice and the
34:37
practitioner both the matured, but they matured in a world that
34:42
joiner move, leaver login was OK enough and now we're not there.
34:47
And I think that's the tension maybe underneath some of like
34:52
where how practitioners feel about what they're doing so.
34:54
I'm going to disagree slightly, but I don't think I think there
34:58
are skills that a lot of people need to learn that think they're
35:02
an identity that they have not learned, and I'll use
35:06
authentication as an example. I knew you were going there, but
35:08
I want to hear you say it out loud a lot.
35:10
Of people think authentication is identity and access
35:13
management. So you can.
35:15
They have a name. They're called Sysos.
35:17
They're also sys admins and they're Windows admins and
35:21
they're all that kind of IT folk, right?
35:24
And I used to be part of that. And it's certainly the A it's
35:28
the access in identity and access management.
35:31
But there's so much more to it. And, and my concern is that for
35:35
those folks who are not putting all the pieces of the puzzle
35:39
together, they're dealing with an incomplete picture.
35:42
They know one small sliver of identity.
35:45
Yeah. And there is so much more to it.
35:48
And they're also going to pick up that tool that addresses that
35:50
sliver, no matter which end of it they use.
35:53
Damn it, they're gonna hammer that nail in.
35:56
And. Everything is SSO.
35:59
Yeah, everything is MFA. And that's kind of it.
36:01
And there's so much more to it. And I get concerned when I see
36:04
really smart people neglect the soft skills that go around a
36:08
well-rounded identity professional.
36:10
If you can't explain what it is you're doing to somebody who's
36:13
not technical, you need to learn that skill.
36:16
I don't can't document it. It's another way.
36:18
Yeah, I don't, I don't disagree. I think one of the things I see
36:23
most typically in talking to practitioners who have been at
36:26
DAS at this 10/15/20 years is fatigue around that.
36:31
Like how many times do I got to give the same talk?
36:35
And it's hard to stay passionate about something, right?
36:38
It's hard to stay engaged if you you know, you're just on a
36:41
treadmill on that. So I don't think you're wrong at
36:43
all. The the thing that we have
36:47
lacked in a lot of cases is metrics.
36:51
We could express that matter to anyone other than us.
36:56
And especially because a lot of our metrics are what I like to
36:59
call suck less metrics. Like, all right, we're less
37:02
horrible at this today than we were yesterday, which is
37:04
important because that is how you have a growth mindset,
37:06
right? It's like I have to be just
37:07
slightly better today than I was yesterday or at least suck less
37:11
than I did yesterday. And we don't yet.
37:15
We really haven't nailed the this is a clear expression of
37:19
the outcomes that other people care about that you can baseline
37:23
us with. I think there is one, hopefully
37:26
I'll be talking about this a little bit more, which is
37:29
entitlement exposure hours or entitlement exposure days.
37:33
So let's say take an entitlement, how long has it
37:36
been granted across the and you can do this per capita, right?
37:39
Per carbon based life form, per silicon based life form.
37:42
You can actually slice and dice this in a variety of interesting
37:43
ways. But if I actually look at look
37:46
at the total hours that a entitlement has been statically
37:48
assigned and just sitting out there, that becomes a number we
37:51
can baseline by application type, by population again and
37:55
then drive that down where risk, where the risk warranted being
37:59
driven down. And right now the way people do
38:01
that is access certification that's proven to be semi
38:05
effectual at best. It is certainly a great way to
38:08
annoy people. Everyone's favorite IAM business
38:11
process. It is.
38:12
It is. I mean, think about this like we
38:15
have willingly, willingly joined an industry where the two things
38:18
we're known for are flipping passwords and access
38:22
certification. Like, wow, I mean, you're
38:25
running for dog catcher and losing.
38:27
Like it's unbelievable how unpopular we could be.
38:30
If you think that's the only two things, that identity is.
38:33
And we gave it to people who don't want to do it and who
38:36
don't understand what it is that they're doing.
38:38
And it's not their damn job to understand what we're doing,
38:39
right? Right it's not.
38:41
And so. I see no problems with this, no
38:43
notes. Why aren't we successful?
38:45
This seems perfect. Why aren't we?
38:47
Yes. This goes back to the Sox
38:49
conversation. It does set up all these crapola
38:52
processes, maybe the the password side, but access
38:55
certification. I mean, I've heard people call
38:58
IT security theater. If it's not done in the right
39:01
way, then it's just rubber stamped.
39:03
And I, I sound like a commercial here, but it's well, this is the
39:09
non commercial part. It seems like a waste of time to
39:11
see. So here's The funny thing.
39:12
We're sitting here at a Gartner event and before I was Gardner,
39:16
when I was at Burton Group, the really the first new report I
39:19
wrote was on access certification.
39:21
And I can vividly remember writing the phrase big rubber
39:25
stamp as a section header, the big rubber stamp, and talked
39:30
about fatigue and talked about the theater aspect of it.
39:35
I don't know if if you go and look up that document in the
39:38
modern version that has been edited by many friends over
39:41
time, whether it still has the big rubber stamp in it.
39:44
But like, it's a thing, right? It's a thing.
39:46
And no practitioner enjoys that, right?
39:51
Because like, what? What do you do?
39:52
I do busy work. I generate busy work for the
39:54
entire enterprise. But audit says it's cool.
39:57
Yeah, that's not AT shirt I want.
39:59
So, first Helen Patton. Yes.
40:02
Yes. Wait, no, no, not Helen Patton.
40:06
I can literally picture her. This is going to.
40:10
How bad was the CSO duo? Yep, and A and a.
40:14
Wendy Nether. It's Wendy Nether who talks
40:16
about this. We got there.
40:18
Save we did it. Thank you.
40:20
Ready for? Being here OK, I want to add
40:24
something to the identity skill. Identity, practice your skills,
40:30
which was 2025 years ago. If somebody said I want to learn
40:34
the technology that I can use an identity, I'm not sure what path
40:38
I'm going to go down. You'd probably say LDAP, learn
40:42
LDAP because all the tools are based on LDAP.
40:46
I think you'd have a hard time figuring out where to start
40:49
today. You know, maybe say learn cloud
40:52
computing and then it'll probably send you in the right
40:55
direction. Or learn Microsoft.
40:57
It'll give you a taste of all these different things.
41:00
I don't know, I want to go back to one other point.
41:04
So this is a typical gym question, right?
41:06
I would try to hit like 5 different points in one question
41:09
and then expect you to understand what I really wanted
41:12
you to answer. 42 is the answer to.
41:17
Everything OK? We can turn off the podcast now.
41:20
OK, so I was going to ask you, are we solving the same problems
41:27
with different buzzwords? And I think if you, I said, OK,
41:30
what's the buzzword of the moment, it would be AI.
41:33
And I would say, OK, well, yeah, same problems, different
41:37
buzzwords. But I think it goes back to
41:40
something I was talking to you about earlier, which was, you
41:45
know, is it just more work or the same number of people
41:48
expected to do more work? He said, well, no, they need the
41:51
tools to be able to scale. The only tool that I can think
41:56
of that'll do that is, I mean at a high level is AI, so.
42:02
What if the cure was also the cause of the disease?
42:06
Is that the question? Well, no, because I know that
42:10
you also brought up the agent piece.
42:13
I'd like you to compartmentalize.
42:14
I'd push that to the side. OK.
42:17
But I, I kind of envision that like even for a practitioner to
42:22
come in and say I do identity at this organization or run a team,
42:26
I'm not going to get any more resources.
42:28
But my scope keeps getting bigger and bigger all the time.
42:32
I need automation tools. I think that comes from the form
42:34
of AI. Let's go back into earlier in
42:38
that question, which is are we saving the same, solving the
42:41
same problems with new buzzwords?
42:44
Let's reform that to are we delivering the same outcomes
42:49
without the new buzzwords or new tools or what have you.
42:52
And I think this points to the decision that none of us made,
42:57
but backed into which is we 20 years ago, identity was
43:04
primarily if not exclusively A productivity tool.
43:08
The outcomes we were delivering were productivity.
43:12
All right, how fast can I get that $1000 a day staphog person
43:18
productive on our systems? That was the problem we solved.
43:22
Now the other problem we solved was can I avoid password reset?
43:25
Cuz we were selling SSO back then.
43:27
So the outcomes we were delivering with productivity and
43:31
frankly user experience, give or take, the outcomes we need to
43:37
deliver now look pretty darn different from that.
43:43
And because of that a sort of side helping of that or they're
43:47
like the side dish of that is. And we need those outcomes to be
43:50
for more constituents than we have traditionally necessarily
43:54
addressed that the enterprise itself has not necessarily had
43:58
in the form of agents. The NHI thing has gone from
44:02
quaint just service accounts to work ephemeral workloads and
44:06
lambdas and all the things that sort of flit in and out of
44:08
experience, but like deliver a huge amount of business value.
44:12
So the outcomes are being asked to solve either implicitly or
44:17
explicitly are different ones. And with that comes new
44:22
constituents to serve. And so I think that's the
44:26
framing to look at in this problem.
44:28
And maybe the a take away for someone who is in a less mature
44:34
organization, either from a cybersecurity perspective or an
44:36
IT perspective is how do you, if I am for reasons trapped in the
44:44
outcomes, our productivity and experience, how do I sneak in
44:48
some of these other outcomes that are about blast mitigation,
44:52
reducing windows of access exposure, making good on zero
44:56
trust promises through identity. That's going to be the art.
45:01
Because if you're pinned in and painted with the, you're the
45:03
password gal, you're the SSO guy, it's going to be really
45:08
hard to go fight the fights that you need to, right, Just to have
45:12
the outcomes that we think the organization needs.
45:14
So I think it's going to be some of that story crafting,
45:18
essentially that narrative around under the guise of
45:21
productivity. What if I told you I could get
45:23
rid of all of your access request processes or 90% of them
45:27
for critical systems, people who have like the best approval
45:31
process to go through is the one that doesn't exist, right?
45:33
Yeah. OK, sign me up for that.
45:34
All of a sudden you're now solving different outcomes.
45:37
That's going to be the sort of forward frontier that we've got
45:41
to understand as a practitioner. It's kind of like continuous
45:44
identity. It's kind of like a continuous.
45:46
Identity, it's behind the scenes, it's under the covers,
45:49
it's the best security cuz it's invisible and it just.
45:52
Works it still leads to crappy demos right.
45:54
So identity, one of the reasons why we're also always struggling
45:56
a little bit is think about our demos.
45:58
I click on this and now you are into Salesforce, right Ta da.
46:04
Now let's look at the logs. Yeah, exactly.
46:06
It is it is the one of the least compelling demos one can have.
46:08
But now it's actually kind of humorous about that.
46:10
Like, and now I'll do the nothing up my sleep part.
46:12
Notice there is no session. And now there is a session ta da
46:16
that hasn't helped. US help You've given a tech demo
46:18
without telling me you've given a tech demo that is perfect
46:20
example of it. I'm going to ask you to, to put
46:25
on your prognosticator hat and tell me at Gartner next year how
46:31
many companies will be continuous identity the same way
46:37
that we've had ancientic identity and for that zero trust
46:41
identity and blah, blah, blah, right, every single fad.
46:44
I think we're going to have three camps, right?
46:47
And it'll be interesting to see if they, if Gardner, if you're
46:49
listening, you should organize the floor in the following
46:50
manner. There should be the aisle of
46:53
identity security, an aisle of identity first security, or if
46:57
people actually realize what's supposed to be going on with the
46:58
other guys, you're still going to have a healthy flavor of
47:02
agentic security. By then.
47:03
We will probably have a new name for it and then they'll be
47:07
continuous identity. So I think like let's say 25%,
47:11
what is interesting to me is I think myself and others look at
47:16
a lot of the things that are happening on the agentic side
47:18
and say, you know, I remember when this forest fire blew
47:21
through the last time and it was blockchain and identity.
47:25
And it's taken 1520 years. And now we're like, you know
47:30
what? Credentialing employees after we
47:32
proof them as a way to onboard them starts to feel like a much
47:36
better, better approach. We just didn't know that 1520
47:42
years ago. I think it won't be 15 or 20
47:45
years when we realize what the agentic thing where the ball
47:47
really stops there. But I think we're still in that
47:51
sort of fervor, let's say, and there is good outcomes that need
47:59
to be had here were early, early, early days on that still
48:03
thus still in the hype cycle. I feel like it's just the
48:05
marketing term waiting to get Co opted by every single company
48:08
and I am that is going to have a continuous identity solution of
48:13
some sort. I I will be eager for that day
48:16
because that implies that we can go to every one of them and ask
48:18
them a very simple question. Tell me if you were shared
48:21
signals framework can compliant. Have you gone through
48:24
conformance testing? Because if the answer is no,
48:26
then that'd be us. Simple as that.
48:28
I love it. That's a great that.
48:29
Cuts down that 30 minute conversation.
48:31
What the hell do you do to like, am I going to pay attention to
48:33
you? Yes.
48:34
Yes. Sweep.
48:34
Let's talk about how you do what you do.
48:36
No. All right, I'm going to keep on
48:37
walking. Point me to your shared signals
48:38
documentation. Yeah, yeah.
48:41
It's a great way to to get rid of all the the the chaff that's
48:43
out there. That's a good way to remove the
48:45
noise. So how close to an Identity
48:48
Salon conversation was this podcast?
48:53
And for those who don't know, what is Identity Salon?
48:56
And I don't want to get in trouble with Andy Chatham.
48:59
House rules, right? You don't talk about it's like
49:00
Fight Club. You don't talk about Fight Club.
49:02
So let's step back. Yeah, we've been doing this for
49:07
a while, and I've been involved in helping to build big tent
49:12
organizations like ID Pro right, to help practitioners learn from
49:15
one another. But I'm interested in
49:18
practitioners of sort of all, sort of all points in their life
49:21
cycle and in their understanding of, of what this practice is.
49:27
And so one thing I observed a couple years ago was events like
49:31
this are powerful and important for a certain kind of
49:34
practitioner, a point in their maturation and in their in their
49:38
tenure. And that there were fewer and
49:41
fewer places for people that have been doing it for a long
49:44
time at a high level to go and sort of freely talk with one
49:47
another within a safe space. Identity Salon grew out of that,
49:54
which was a need to bring together people that are looking
49:58
at some of the most difficult aspects of identity at large
50:02
scale with a three to five year timeline because they're working
50:07
in enterprises that are global and they can't just turn on a
50:09
dime. So like, how do we build a
50:11
sustainable architecture that's going to get us to that next
50:14
thing? So we've hosted a few of these
50:16
salons. They are Trenham House rules, so
50:18
we provide a safe space for people to come together and
50:21
talk. We produce after each of those
50:22
events a very detailed report, non identifying who talks about
50:27
things but what are the topics? Rules are.
50:31
That's right, that you can use everything you learn.
50:33
You just can't identify who actually was talking about those
50:37
things. So Heather Finnegan does an
50:39
amazing job building these really detailed reports, and
50:43
that becomes available to anyone who's attended the event.
50:46
And so Identity Salon is the place where people can have
50:49
these kinds of conversations. How is this one salon tends to
50:54
spend an hour on one question, right?
50:58
And we were talking about lever events in a supply chain.
51:04
Imagine you're in Consumer Packaged Goods, your global
51:08
organization, you've got a variety of people that are
51:10
fulfilling different aspects of your supply chain.
51:15
You don't have access, They don't all have SSO and you don't
51:17
have access to HR. How do we manage this right?
51:20
Are there implicate, are there patterns that are in other
51:23
industries? How do we address this?
51:24
And we spent an hour on that one.
51:26
Well, the real answer is best guess.
51:28
One is the topic that we've been trying to solve for is the
51:31
beginning of I. Delegated admin I think is
51:36
delegated admin. Part of it, right?
51:37
Yeah, what but but point being is that we give a space for
51:41
people to have these conversations and then say like,
51:43
OK, are there material steps we can make?
51:47
How do we start to do that? Where should they happen?
51:49
How do we get this conversation in more places?
51:53
And it's a lot of fun. It is exhausting for everybody,
51:58
right? Because you've got 30 people in
51:59
a room that are are pretty high wattage and the conversations
52:04
are intense and they go deep and they go wide and it's a hell of
52:08
a lot of fun. Much like this.
52:12
Yeah, well, you know, we do our own version of it.
52:14
Yeah, absolutely. We just broadcast it to the
52:16
world. And you don't great.
52:18
You don't like pixelate me or give me like a robotic?
52:20
Voice, I guess I mean at some point it'll be very easy to do
52:23
like a, you know, Ian as a, as AV tuber, right?
52:26
Something you know from an identity mascot perspective.
52:29
So we usually end shows on a lighter note, but I want to
52:33
trouble. We're not this time, right?
52:35
But we're not going to wait a minute.
52:37
We're going to end with chuckles.
52:39
And I want Jim to explain why he's giving out Chuckles.
52:42
I'm glad everybody in the room. OK, so there is his presentation
52:47
which he that authenticated, he talked about the guys from
52:52
Enron, he had the pictures of them and ask does anybody in the
52:55
room know who these chuckleheads are?
52:57
And immediately, immediately, my mind went to chuckles Candy.
53:02
It's upside down product place and and Mike, so thanks.
53:08
Denise and I went out one that very night to a old fashioned
53:13
candy store and they have these and I just had to buy them.
53:16
I'm I'm beside myself and I'm so excited to they're only 190
53:21
calories. This is going to be amazing.
53:23
I'm going to get so hopped up on sugar after this episode.
53:25
Oh yeah, A. 190 calories, all carbs.
53:29
Depleted uranium. I mean, I don't give you what's.
53:33
That the I'm just impressed at the word chucklehead.
53:36
I've been using that word for decades and I never really heard
53:39
anyone else say it, so I I. Yeah, Hi, dude.
53:43
So, so you guys know I write out all my talks.
53:46
I write out word for word what I'm going to say.
53:48
And then it gets, it gets rehearsed.
53:50
The point that I don't use those words anymore.
53:52
There were other words to describe them.
53:54
And I suddenly realized that like, you can't say that on
53:56
stage. Like you can't say.
53:57
That's it. You can't say.
53:58
How do those things to the podcast today, you would not be
54:01
as happy. Yeah, so I was like, I I landed
54:05
on chuckleheads. Like a good one.
54:08
Like, take it off, dust it off the shell, you know, take it off
54:11
the shelf, dust it. It's still a usable phrase.
54:13
And there are an awful lot of chuckleheads out there.
54:15
They're. Ready.
54:16
They're not. So guys.
54:18
Awesome. Thank you.
54:19
All right, let's go ahead and wrap it up.
54:22
Yeah, this is Gartner 2025. I am Summit.
54:26
This is the last event of the year, right?
54:27
Like for me? Are you guys making an
54:29
appearance anywhere else? No.
54:31
Local holiday parade or something?
54:34
Hey, you know what, if you've got a local I am parade and
54:36
you'd like us to show up, let us know, you know, come out there
54:39
and do that. But no, I think this is my last
54:41
one for the year and this episode will go live in January
54:43
so. Where's Gartner going to be next
54:45
year? I think it's Vegas.
54:46
I think it's Vegas, baby. Vegas bag.
54:48
Yeah, in December. I don't know, I kind of hope so
54:51
cuz like I'll turn it and it's including August.
54:53
That seems horrible. Yeah, like 8000° in.
54:57
No, I think, I think I'm just more comfortable if we take it
54:59
back to Caesar's Palace. Just keep it safe as it ever
55:02
was. It's predictable.
55:04
Yeah, there's plenty of hotel rooms there's.
55:06
Plenty of hotel rooms, of which I did not get one this time.
55:09
Longer story, but yeah, I would. I know Vegas is polarizing,
55:14
sure. I think the town is built for
55:16
conferences. Like, it's just, I don't
55:18
disagree. It doesn't mean I necessarily
55:21
seek that out, but yeah, you know.
55:23
So, you know, that gives me another opportunity to do Other
55:25
Mama Supper Club. So for people who were at
55:28
Ideniverse earlier this year, people who know they are and
55:31
maybe they're listening, we will be doing another Other Mama
55:35
Supper Club at Ideniverse if Gartner is in fact in Vegas next
55:39
year. And we may, and we.
55:41
I've known you for a decade, I have no idea what you're
55:43
talking. About because you weren't there.
55:45
Yeah, and I feel like. Sean was this one.
55:47
Sean was there. I thought he was going to say
55:49
something about chicken and waffles.
55:51
Best chicken and waffles on the strip so far is Yardbird at the
55:55
Venetian, so I'm just going to say that right there.
55:57
There's also a Yardbird in DC Talk.
55:58
About product placement. My gosh.
56:00
Yeah. What's going on?
56:02
So where do I? Yeah, so I'm just going to throw
56:04
it out there for the people who are listening that were at Other
56:07
Mama for our our supper club. You know, that gives us an
56:11
opportunity to that and we're looking to expand the tent.
56:13
So I will explain what supper club or I Other Mama Supper club
56:16
is after we hit the recording. And if you're curious, let me
56:19
know because we'll be setting something up for Identiverse.
56:22
So sweet. With an ominous start to the
56:25
year, exactly what does that mean?
56:27
All right, let's wrap it up. Ian, thank you so much for
56:29
taking. Thank.
56:29
You bye. I just tell you now as always
56:31
and and thank you for what you guys for what you do in the
56:33
industry and it means a lot. It means a lot to a lot of
56:35
people. So thank you well, I.
56:36
Appreciate it, We like it a lot. Coming from you.
56:38
Yeah, we'll keep doing it as long as we like doing it, and
56:40
then we'll be done. That'll be that.
56:42
Let's see, we're on the web. IDC, podcast.com on
56:45
youtubeidcpodcast.tv still go on the YouTube channel.
56:49
I'd say like 99.9% of our. If we were a different channel I
56:53
would say hit subscribe and the bell and smash that like button.
56:58
Yeah, or because the radio RIP the knob off, right?
57:00
Remember that one? All right, That's how old we
57:03
are. So thanks everybody for watching
57:05
and or listening and we'll talk with you on the next one.
57:10
You've been listening to Identity at the Center.
57:13
We hope you've enjoyed the show. Make sure to like, rate and
57:17
review, and we'll be back soon. But in the meantime, hit the
57:21
website at identity@thecenter.com.
57:25
See you next time on Identity at the Center.