Latest / Identity at the Center / #182 - IDQL and Hexa with Gerry Gebel

Transcript

#182 - IDQL and Hexa with Gerry Gebel · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the idea at the
0:26
center podcast I'm Jeff and that's Jim.
0:28
Hey, Jim. Hey, Jeff, how are you?
0:30
No, that's a bad yourself, good. It's going to be a busy day.
0:33
We've got a lot on the sports calendar in terms of TV watching
0:37
but I've also got a lot of, you know, household chores to do.
0:40
Because tomorrow I'm going to start my journey out to San
0:44
Francisco for the octane conference.
0:47
Yeah, so it's we recording this on Saturday November 5th.
0:50
So I've just gotten back from a week-long trip to Scenic
0:54
Elkhart. Indiana.
0:54
Now, we'll talk about that. Maybe you real quickly, and
0:56
then, yeah, we're gonna be an octane next week, so you're
0:59
traveling out, tomorrow's Sunday.
1:01
I'm flying out Monday for you and is kind of like an all-day
1:04
thing. Although we do get back like
1:06
three hours because of the time changes.
1:09
Well, we actually get another, our boys raised.
1:11
Yeah. Because this is all back.
1:14
I totally forgot about that. Yeah, so we're getting you're
1:17
going to get an hour hours all over the place.
1:19
So we'll be tired at like 6:00 in the shepherd knows how
1:23
annoyed people who. Live in Phoenix.
1:26
Get and I think there's a an area of Indiana that doesn't
1:29
recognize daylight savings time but and they're right.
1:35
I mean I think it's it's kind of from a bygone error but I guess
1:40
is the logistics of getting rid of it.
1:43
That's probably more difficult than just maintaining it.
1:47
Yeah, keep hearing at least in the u.s. they're going to It's
1:50
almost like yeah, we're thinking about getting rid of it next
1:52
year or so like that but it is from a relic from a bygone era.
1:56
It was originally marketed as something that the farmers
2:00
wanted and that's not the truth at all.
2:01
It was something else. It was just kind of got blamed
2:04
on farming for some reason, but that's not the reason I didn't.
2:08
I didn't know that. But yeah, I've always loved like
2:10
they're starting Farmers. Make it third because their kids
2:13
get up at 5:00 in the morning and milk the cows.
2:17
Yeah, it was not. Yeah, I it's funny.
2:19
I I went to recently, it was like, why are you know, why do
2:22
we have? Why do we have this thing?
2:23
And it was not a farmer's at all.
2:25
It was some sort of PR thing, that sort of blamed it on the
2:27
farmers. So kind of funny Side Story if
2:31
we got a minute. Yeah, so I would, I grew up in
2:33
Philadelphia in the inner city and when I went to college, it
2:37
was Millersville University, which is in Lancaster County and
2:42
a sitting in a freshman year, political science class.
2:47
I only remember what I was saying, but Some guy raised his
2:51
hand and looked at me as like, you City.
2:53
People don't care about the farmers at all and it was like,
2:57
whoa, maybe he's right. I thought that I didn't care
3:01
about the farmers, but maybe I was coming off that way and so
3:05
it was a learning experience. I think that, I mean, that goes,
3:09
I'm sure I'm not breaking any big news for people here, but
3:12
it's like about flexibility and being willing to learn and
3:16
challenge your perspectives throughout your life.
3:18
I think, when you get to a point where you're not, Willing to do
3:20
that. You're done learning.
3:23
Yeah, for sure. I think it's probably just that
3:25
awareness thing, right? If it's, if you're never brought
3:27
into contact with stuff, how do you supposed to know about it?
3:29
So I love travel and I think it's, you know, one of the
3:33
things that I recommend, everybody's travel go see the
3:35
world, you know, all the different, cultures, people's
3:39
Nations, all that stuff, you know, I'm an optimist.
3:42
I like to believe most people are, you know, good and just,
3:44
you know, trying to trying to get by with their own different
3:46
lives. But yeah, go out and see the
3:49
world and And get out of here. A little corner is a big
3:52
eye-opener. I always kind of reference of
3:53
back. My first trip to India.
3:55
I want to say was like 20 2008, maybe 2010, I don't remember
4:00
someone now was was a big eye-opener for me was kind of
4:02
like my first international trip was like, oh, okay.
4:05
You know, there is more to the world than just, you know,
4:07
Chicago area and the United States right in cats like that.
4:11
And, you know, I had done some travel around there before, but
4:13
that was sort of like the first kind of like okay, there's
4:16
there's there's some things out there that I want to check out.
4:19
Yeah. Definitely true.
4:21
Soba. Speaking of travel.
4:22
So we'll be in San Francisco next week which has always been
4:26
one of my favorite parts of the country, you know, between just
4:31
the bay area. But also like the wine region
4:36
it's just to be it's like it's kind of like heaven on Earth in
4:39
terms of, you know all those Wineries and ranches and
4:44
everything you just, I love it. But also really just looking
4:49
forward to the conversation. Prince, there's a slate of
4:51
speakers who are, you know, not even just in the identity access
4:56
management fee. So Serena Williams Magic Johnson
5:00
are going to be speakers, and, of course, a lot of the
5:02
executives from OCTA, as well as some of their partner companies.
5:07
I'm just a really looking forward to learning a lot being
5:10
around people who are thinking about, I am in the future, not
5:15
just I am now, but I am in the future.
5:18
Yes, it'll be. It'll be interesting and fun.
5:20
I think I definitely give a shout-out to really multiple
5:23
people talk to team but they've really been welcoming and really
5:26
kind of helping us get it. Set up for this including making
5:30
introductions with some folks that we don't want to put names
5:33
out there yet. But we're going to have multiple
5:35
podcast episodes I think right now the plan is probably have
5:39
something for like Wednesday, Thursday, Friday, maybe into the
5:42
following week as well. So we'll see how it goes.
5:45
That's kind of like our our modus.
5:48
I for when we hit a conference but definitely give a shout-out
5:51
to Steven Strong. He's been like a super advocate
5:54
for us and totally appreciate that.
5:56
I think last time we talked about this, you know, he talked
5:58
about his getting into his 15 minutes of fame, so I will give
6:01
you another few minutes towards that to towards that credit.
6:04
So yeah, thanks so much Steven and definitely others.
6:07
So as we get things kind of lined up this week I'm sure
6:09
we'll have a whole bunch of people to thank and yeah,
6:12
that'll be cool. So, yeah, and you mentioned some
6:15
of the some of the folks that will be there like sorry too.
6:18
Williams and Magic Johnson, you know, that's kind of cool,
6:20
right? I think you go to a conference
6:21
and it's like, okay, it's great to hear, you know, form, like,
6:25
you know, so-and-so product person, whatever, or like, some
6:28
speaker in the industry. But it's always a treat when you
6:30
get to, you know, hear stories that are really outside of like
6:34
the industry. Right?
6:35
So I'm curious to see what Venus and Magic are going to talk
6:41
about. Well it's not for you to Serena
6:43
I'm sorry honey but you know I think what Yeah, I think so just
6:50
name dropping those two, they're not going to be on the pocket,
6:55
be cool. But I don't know what we would
6:56
talk about. Yeah, well I think we would
6:59
figure something out if they if they if they decide they want to
7:02
be on the Pike house. Yeah, invitation is open.
7:04
I just think that they probably get a nice speaker fee and the
7:10
identity of the sender podcast has yet to reach the level of
7:13
which we pay speaker fees. Hey you never know.
7:15
I you know Serena magic, if you guys are listening you I can
7:18
Want to come on, the world-famous identity access
7:20
management podcast. Hit us up on LinkedIn.
7:23
There we go. Yeah.
7:24
There you, go offers open. What else we got going on?
7:28
So we're actually you had a conversation with Jerry, Gable
7:31
friend of the show from Strada Identity or gas or
7:35
orchestration. Easy for me to say.
7:37
You guys talked about, I DQ L which is identity query
7:40
language, and the hexa project which is this open source policy
7:45
orchestrator for multi-cloud which is Pretty cool.
7:49
We're going to play that interview sort of like to end
7:51
the show because it's about 20-25 minutes.
7:53
I think something like that. So that's kind of like coming up
7:57
but I think it certainly has a nice kind of like dovetail until
8:00
like where things are going, especially we start talking
8:01
about authentication and multi-cloud and things like
8:05
that. And I think you did a round
8:06
table recently where maybe something like that came up,
8:09
right? Yeah.
8:10
You know, shows on this connects round table and it's really
8:15
cool. I didn't know what to expect but
8:18
The participants were, you know, the I am practitioners folks who
8:22
listen to this podcast, you know, same kind of you know
8:27
daily responsibilities. And one of the questions that
8:31
was asked at the end was if you had the magic wand, what I am
8:36
thing would you create? And you know, one of the folks
8:41
described I think the exact thing that that strata what the
8:48
identity orchestration looks to solve as so it could not making
8:52
a shred of commercial here but you know, it validated to me
8:57
that people out there needed a tool for and this is what
9:01
identity orchestration is all about is, you know, coming up
9:05
with an abstraction layer or platform where you connect
9:11
identity services, like your single sign-on multi-factor
9:14
tools along with Legacy Technologies and applications
9:19
that are in your Cloud infrastructure.
9:23
But like I said that kind of like validated to me that this
9:27
identity orchestration is something that people actually
9:32
need there. A couple other things I did come
9:34
up in that whole dialogue as well which was one that really
9:39
jumped out at me was the piece around.
9:43
I am policy. So not like policy
9:46
orchestration. I'm I'm talking about technical
9:48
policies but you know the Microsoft Word documents with
9:52
the PDFs of like this is what Thou shalt do as an Enterprise
9:57
employee and employee or an application over things like
10:01
that. And I think one of the things I
10:03
poked struggle with is you're balancing.
10:06
Okay, we have all these compliance requirements, but we
10:09
also have legal requirements and then we have security best
10:14
practices and we want to meld all those things.
10:17
Our policies them the question or the goal from there is to
10:21
drive enforcement. So how are we getting?
10:23
You know, first the knowledge that folks are actually using
10:27
these platforms and or complying with the policies and then how
10:33
do we increase the the compliance with our own policies
10:38
and it's just as you know, something that we've been, you
10:43
know, solving in our I am strategy development for a long
10:47
Long time, have we talked about a framework and so, I was able
10:50
to kind of contribute that to the group, which is, hey, this
10:53
might not be the one and only answer.
10:55
But this is how we solve this in the past, which is really like,
10:59
you know, first off using those policies as a way to drive
11:04
adoption of your IM platforms by saying, if you're using our
11:08
single sign-on, if you're using our Pam in RI GA, you know, the
11:12
I am program offering of those Technologies.
11:15
Well, that your Flying across all these policies that were
11:20
driving your the password policy things like that.
11:24
And yeah. So you know that was kind of one
11:29
of the things that I was able to contribute was that you can get
11:32
to that and then you know where you don't have compliance.
11:35
Yeah. You do need to check and folks
11:36
that are out of compliance that. In other words, not following
11:40
your corporate security or I a policies, it's kind of like
11:45
that. I'd have a better way to put it
11:47
but now Almond shape. So it kind of like you know
11:49
identify put a spotlight on that.
11:52
This is where we're not compliant.
11:53
This is where we're we're not following our own policies.
11:58
Yeah I think it sounds like a good conversation.
12:01
Is it sounds to me also like it. Maybe it was something very
12:03
specific to specific group of people.
12:05
So this is not something it's like publicly available that
12:08
people can check out. Yeah.
12:10
Unfortunately that's the way these these membership has its
12:14
privileges membership. Has its privileges but I think
12:17
it Nobody's interested. I can certainly link them into
12:21
the folks of context so they can be invited to future events.
12:26
I just reach out to me and like them.
12:28
Yeah, I did something similar for the retail and Hospitality.
12:31
I sock group information, sharing and Analysis Center.
12:36
Talked about ransomware and identity.
12:38
And that's one of those things where, you know, it's a, it's a
12:41
similar actually, you know, kind of an updated version of the
12:45
presentation that that you ditched me on.
12:47
I'm at last year's, authenticate talking about smart, I am to
12:51
reduce ransomware. And so I kind of updated version
12:53
of that. So I think you're going now,
12:56
we're even so. So if you're in the retail and
12:59
hospitality industry, definitely check out our hias a c.org.
13:05
It's a great group of folks that really kind of come to go to
13:09
kind of share information around information security in general
13:12
around retail and hospitality industries.
13:15
So might be something worth checking out.
13:17
That's good folks over there and you know, membership has its
13:19
privileges. You can you can check out a
13:21
replay of of the webinar, I did on that.
13:24
So so we're going to think go ahead did want to mention one
13:28
other thing, which is, you know, I kind of feel like it's in our
13:31
nature. We're both 20 years in this
13:33
industry that we're really focused on giving back, so it's
13:37
between this podcast and doing events like that.
13:40
But I also don't think you have to be in the industry for 20
13:43
years to give back. I wanted to give a shot Shout to
13:48
Andrew, Chantal phone that I get his last name, right, chance
13:51
bun. You did you got it?
13:52
I nailed it for a change but he's put out a LinkedIn class
13:58
that he led. My really, you know, just more
14:01
or less been following it on his LinkedIn post.
14:03
I haven't actually gone out and done the training yet.
14:05
But they're shout out to Andrew because I think the first time
14:08
we talked to him is heading to new in the industry and trying
14:12
to give back at kind of this early stages.
14:17
Career and it's really admirable that he's doing that.
14:21
He's putting himself out there, he's not afraid to you know make
14:25
a mistake or something like that and I think that's a good
14:30
leadership you know but everybody quality to have right
14:37
there. Yeah I mean putting putting
14:39
herself out there is not easy right?
14:40
We do this podcast to do for a while every every time is a
14:43
journey but you know, my hats off to anybody who produces.
14:47
Content for other people to consume, doesn't matter what it
14:50
is. Every one of those folks are
14:52
putting themselves out there and yeah, sometimes, you know,
14:55
sometimes it's good content, sometimes it's not right.
14:59
And if they're, you know, you can get easily kind of bogged
15:03
down in the details especially if you're wrong on something.
15:07
And I think it's okay to be aware that.
15:09
Yeah, you're probably make a statement to stake at some point
15:12
and as long as you're willing to own up to it.
15:14
But yeah. Okay.
15:14
Yeah let me correct that or change my way of Or whatever,
15:17
you know what? It looks like that's cool too.
15:20
So I think the more people who are out there contributing and
15:23
Andrew is certainly one of them, you know, I'm excited.
15:26
So he's got next, he's got another class that he's working
15:28
on. I didn't want to spoil his
15:30
thunder. So you know, I've invited him as
15:32
I hate when you're ready, you know, let's publicize it on on
15:35
our podcast, he's got his LinkedIn Channel, but there are
15:37
others that are doing the same and yeah, I think having more
15:40
viewpoints in the world that people could consume and take as
15:43
a data point for their own decision-making.
15:45
Just makes everyone smarter And makes it easier for everybody to
15:50
get better, you know, every day. So, totally agree with that one.
15:55
Yeah, you know, Andrews been on a mission to bring more people
16:00
into the industry. I saw Bill Nelson, put out the
16:06
ID, Pro monthly newsletter email and he cited a statistic, where
16:11
the I am industry is expected to double in the next five years
16:15
from 13 billion 226 billion. It's not too late to join the
16:19
party folks. That's exactly right.
16:22
Yeah, I'd love to see more content around the business.
16:25
Side of I am. There's lots of Technical
16:28
Training and sort of, like, you know, here's how to do X inside
16:31
of why application. What I don't see a lot is sort
16:34
of like all the intangibles that sit between sort of like the
16:37
engineering aspect and sort of like the information of how to
16:40
do things and the real world, right.
16:43
How do you get buy-in from the business?
16:45
How do you run? And I am program.
16:48
How do you know what are some things to think about if you're
16:51
establishing policies and procedures are standards for
16:53
things like that. So I think that's something
16:55
that, you know, we might see some some uptick in in the next
16:59
couple of years, I don't want to spoil any things that we might
17:02
be, you know, working on. But that is an area that I think
17:05
more people contributing to the better for everybody.
17:08
Absolutely. Alright.
17:10
So let's get to your conversation.
17:12
You had with Jerry. But before we do that, I
17:14
mentioned that I was in the RV capital of the World, Elkhart
17:18
Indiana, I think earlier on, I didn't realize that it was the
17:21
RV capital of the world. I guess I kind of knew in the
17:23
back of my head because of kind of live in the Chicago area for
17:24
so long. But did you know that there is a
17:28
RV /, manufactured housing, or manufactured home Hall of Fame?
17:35
I was not aware of that. Yeah, so it is across the street
17:39
from our SM offices in Elkhart. Yeah, I have not been to it, but
17:45
I wasn't aware that there was, there was Thing.
17:49
Yeah, I mean, there's, you know, one thing that I found out is
17:52
that there are so many different manufacturers of RVs &
17:57
motorhomes. I had a Jayco brand and that,
18:02
you know, one of the big trends right now is that there are
18:05
sites that are kind of like airbnb's for RVs.
18:10
So you, if you have one, it's in decent condition.
18:13
You can print it out which I think is super cool.
18:16
It's parked on a lot of And you've kind of got almost like a
18:19
tiny home, right? Yeah.
18:20
Well, most people know, it's not even to leave it on land.
18:23
I mean that the idea is that people can actually drive it and
18:27
okay. So yeah and so, you know, I
18:31
think the most people who have RVs, at least what I had an RV
18:34
is like use a couple times a year.
18:35
And for the most part, you're paying insurance and maintenance
18:38
and all, and, you know, taxes, basically registration taxes for
18:45
to sit there and not get used. So if you're able to read it out
18:48
and recoup some of that money. And also, I mean, I think one of
18:52
the great things about Airbnb is not only the fact that you can
18:55
make money from the, you know, from renting out your place.
18:58
But also to somebody else, gets to enjoy it and somebody else
19:02
gets to build their experiences there.
19:03
So, yeah, I think it's kind of contributing to the good in the
19:07
world. So it's got me thinking, you
19:10
know, we usually lighter note the end, but we're going to end
19:12
this episode with your conversation with Jerry.
19:16
Let's do that. Now what?
19:17
Does your perfect RV look like? So I I had an RV like I
19:24
mentioned it was a classy. But it was 40 foot too big.
19:28
It was like it was not even a little whom, is it be home on
19:31
Wheels. So definitely have to be smaller
19:34
more maneuverable. And it would have to have, you
19:39
know, either some kind of vehicle that came out of the
19:43
side or that you dragged behind it.
19:45
Because if you're going to Have that kind of motor home then?
19:50
Actually, I think I would just rather than that, as pull
19:53
something behind, but I definitely would like to get on
19:58
the electric Trend. Okay?
20:01
So, the main point is what I really wanted to say about my,
20:04
my dream RV would be that the worst part of having an RV is
20:08
doing the sewer. It's disgusting.
20:11
You have like, basically this long tube that you hook from the
20:14
side of your RV into this train, A pipe and you have to like
20:20
drain out your your black water which is the worst stuff and
20:24
then flush it out with your gray water.
20:26
It's like a process that you go through to basically clean out
20:29
your, your sewage tank is disgusting.
20:32
And if you have any kind of mistaken, you better put on
20:36
plastic gloves every time because the one time that you
20:40
don't, you're going to get some sewage on your hands and you, it
20:43
doesn't just wash off it stinks. You're not you're not really
20:48
helping me, you know, want to do this very much, but I was
20:52
thinking like I'm the same like I want something that's easy and
20:55
I think something that is like an electrified version of a RV
21:00
of some sort would be kind of cool.
21:04
Yeah, I want the bells and whistles like I want Wi-Fi.
21:07
You know, I want to basically have like a hotel room on
21:08
Wheels. It's kind of a, but I'm thinking
21:11
about it. Yeah, I actually had a VW
21:14
Vanagon back in the 90s and they were built mostly in the 80s.
21:19
It was like, look, you don't have the shower and the toilet,
21:24
but most campgrounds, have those things.
21:26
So if you're willing to use public stuff for that, I mean
21:30
it's it's really convenient because you can park it on a
21:33
normal parking spot, and it's got a cool factor to and BMW,
21:38
has a has a, their updated ID that buzz is there, electrified
21:42
little VW band. Type thing, coming out, coming
21:46
out Out. But you know what?
21:47
They've been talking about that going to help for like decades
21:51
now. I mean, seriously think it's
21:53
closed. I think it's like within the
21:54
next year or so it's already being driven around and sort of
21:57
tested. So it will be sold out
22:00
constantly. You'll have every order animals.
22:02
So yeah, that's true. But even if it wasn't even if
22:05
electric vehicles weren't going, the way they are VW stuff.
22:09
Has just so much demand. I'm surprised they haven't
22:11
released it sooner. Cara.
22:15
Okay. Anything else before we hear
22:17
from yourself? A Jerry?
22:19
No, I'm going to be rooting for my Georgia, Bulldogs today and
22:24
the Philadelphia Phillies because I'm not a Houston Astros
22:26
fan. So let the hate mail flow so
22:31
Phillies and I guess anti Astros is how your position is.
22:36
Yeah. And I'd like the Bulldogs over
22:39
the volunteers of Tennessee and I have zero positions on either.
22:44
Let's get into your conversation with Jerry.
22:46
Thanks everyone for listening and we'll see everybody at
22:48
Octane and then in a few days I'm here with Jerry, Gable head
22:51
of standards as shred identity. Hi Jerry.
22:55
Hey, Jim great to be back with you, great to have you again, we
23:00
saw each other Gardner recently, it was great to see you and we
23:05
decided we needed to catch back up with this.
23:07
Is your second time on the identity at the center podcast.
23:11
So you know, the normal routine is we ask Q.
23:14
How did you get into identity? But since we already got that
23:17
story from you and anyone who's interested in checking that out
23:21
they should go back to that. Episode my question more is
23:25
what's what's been? What's new for you?
23:29
Since the last time you're on the podcast?
23:31
I know there were some new things getting started and
23:34
hopefully you have an update for us.
23:36
Yeah, I sure do and I know we'll get into that as we as we
23:40
continue here but yes, it was great to see you at the gardener
23:43
identity. On Friends.
23:44
It reminded me of my actually my first visit to the first
23:49
Gardener identity conference back in the day, I think it was
23:52
circuit two thousand six or seven.
23:55
I was a burden group at the time and I tried to get Gartner to
23:59
give me a comp tickets to the show, you know, just because we
24:01
wanted to check it out, of course, identity had been a big
24:04
part of the burden group Catalyst conferences for many
24:07
years and because Gardner had got an idea.
24:11
Hey, this is a big thing, we should get into it.
24:13
As well. But that was it was interesting
24:15
to see their show the first time around and you know it's
24:18
definitely one of the better identity conferences in the
24:21
industry these days. So it's definitely a must-see
24:25
for folks that wanted to see and hear what gardeners thinking
24:27
about on the identity landscape. Yeah.
24:31
One of my favorite things about their conferences that you meet,
24:34
a lot of people who are new to the space who are trying to wrap
24:37
their brains around it. And I think Gardner does a
24:40
really good job of kind of No making things understandable for
24:46
folks who are coming from a different perspective, maybe
24:50
other parts of it or other parts of the business and trying to
24:53
wrap the rate their brains around this thing of what is
24:56
identity? Access management.
24:58
Yeah, I totally agree with that end.
25:00
In there were several really good presentations by buying
25:03
some of the analysts and definitely enjoyed that part of
25:06
the event. But you also ask the you know,
25:07
what's new here on on the front front lines of identity
25:12
orchestration and what I've been working on, I think last year
25:16
when we spoke might have been the first public mention of the
25:21
identity query language standard that we've been working on.
25:25
So that's been been my focus at people like to come on this
25:30
podcast, to break big news. So, well, when you, if you want
25:34
to say, you heard it here first, it's actually true.
25:36
So kudos to you guys for wanting to learn more about that, but
25:42
since then we've been doing Lot of work on the project, a lot of
25:45
work on the open source heart of it that we call hexa hvx.
25:50
A and the I guess the other big news is that over the summer
25:54
over this past summer the CN CF. The cloud need of computing
25:58
Foundation accepted by 2 ql and hexa as a Sandbox project.
26:05
So that's a huge milestone for us.
26:08
Congratulations on that. That took a lot of work.
26:11
I'm sure, you know, one of the things that we like to do with
26:15
the podcast is not lose people too quickly, right?
26:18
So maybe we start at the basics is shredded identity of solving
26:25
a problem. The solution is called identity
26:29
orchestration, but the problem is really around this
26:33
multi-cloud, Pidp situation that so many companies are in as not
26:39
just big multi multinational conglomerate corporations but
26:45
it's even mid-sized companies. So maybe talk about that problem
26:50
a little bit and what you guys do with the identity
26:52
orchestration to kind of solve it.
26:56
Absolutely the identity orchestration is really a new
26:59
technique and new technology within the identity industry
27:02
these days. You know, it's strata is Is the
27:05
one really to I identify this as something new and different, and
27:08
to invent the concept and it's really about building an
27:12
abstraction layer between your applications.
27:16
And all of the identity infrastructure that those
27:19
applications consume them primarily we talked about idps,
27:23
you've identity providers were authentication providers and
27:26
things of that nature. But yeah, it's this abstraction
27:30
that decouples your apps from the identity function.
27:35
It's so that you can do a lot of, you know, more flexible
27:39
things today with software that you could not do previously, you
27:43
know, if you wanted to modernize the authentication of an
27:46
application, you actually had to rewrite that part of the app.
27:50
For example, you know, if you want to add MFA or password list
27:55
to existing applications, it's really difficult to modernize
27:58
them in that way because, you know, they weren't maybe some of
28:02
them weren't even built for Samuel, you know, maybe A lot of
28:05
Legacy applications that are very important to distances,
28:09
still use things like ldap authentication.
28:11
He was so how can you break that Bond and you modernize that to
28:17
you, something like open ID, connect and in addition add-on
28:21
MFA, or password list where needed.
28:23
So that's what an identity orchestration, abstraction layer
28:27
can accomplish because you connect the idps MFA and other
28:33
identity functions to the Fabric to the abstraction layer and the
28:38
orchestration is the you've sort of the flow of what happens when
28:41
a session is initiated, you know, I'm a business user trying
28:45
to access a certain application which I DP.
28:48
Should I go to, for certain parts of that application?
28:52
Maybe they're more sensitive. I need to use a step-up
28:55
authentication or MFA. And again the identity
29:00
orchestration layer can manage that sort of session flow until
29:05
Open. Ultimately, you get the
29:07
application, the information it needs to to properly establish
29:10
the user session. Yeah.
29:13
That abstraction layer I mean that seems to be the you know
29:18
such a common architectural principle now and how you take
29:25
Legacy applications infrastructure and kind of you
29:30
know integrate them with with modern Technologies and it
29:34
sounds like Really, that's what the identity orchestration is
29:38
really about and it provides that Rosetta Stone because
29:42
that's the hard part. Right?
29:43
Is like you know, when I think about all of these applications
29:47
is they all are not only applications but platforms, Etc.
29:53
They all have their own way of integrating communicating
29:58
providing authentication. So is the identity orchestration
30:01
layer. From what I understand that you
30:03
know provides that Rosetta Stone.
30:05
So that you as a practitioner you as a company don't have to
30:09
solve this for all of the platforms that you need to
30:12
integrate. That's right because when we
30:15
talk to customers you know so many of them have you know
30:18
hundreds of applications, maybe a few thousand.
30:21
So if you think about you incorporating password list for
30:26
each of them you just you don't have enough time or resources or
30:32
budget to accomplish that but instead You the orchestration
30:36
layer, connects to the applications and you connect the
30:41
MFA or password lives or the IDP to the orchestration layer and
30:44
we can coordinate. We can broker those interactions
30:48
in a much more efficient way so that's what strata and Identity
30:52
orchestration or all about. Can I ask you a question here is
30:57
to talk about is this terms of Legacy?
31:00
Yes yeah when we talk about this term Legacy, I know it you know
31:04
one point my career I meant one thing and one thing only which
31:07
was the green screen, nowadays? I mean, you can talk about like,
31:13
well certainly, any kind of like corba or Java applications even
31:19
but it, you know more like web enabled applications, maybe
31:26
header, based authentication. So how far back can you go?
31:30
I mean, when are you talking about?
31:31
You can even integrate the the green screens into some of these
31:35
Idps or just it's just not possible with the technology.
31:40
Yeah, it's a wide range of Technology of application
31:43
technologies that can be supported, definitely had her
31:46
based apps, you know, that's sort of table Stakes.
31:49
You need to be able to bring those older applications that
31:53
still have a lot of business value.
31:55
You need to continue to bring them forward into into the
31:58
modern way of managing them and so yeah.
32:01
So there's, you know, there's definitely techniques for
32:03
dealing with them and Kerberos Stamps for example.
32:07
Yeah I remember kind of some my my earlier projects in my ID
32:12
career was you know, building web interfaces to Mainframe
32:17
applications and you know, those were not fun projects.
32:21
A lot of screen scraping and stuff going on in the
32:23
background. Yeah, they're still out there,
32:27
right? The, you know, the mainframes
32:28
will will be out there for, for quite a long time.
32:32
Yeah, absolutely. So, You would mention the
32:36
updates to the new standards. Would you kind of give a little
32:42
bit more background of what their standards are all about?
32:46
And kind of what the process is like that.
32:49
You're going through because you're the head of standards.
32:53
What does it mean to kind of develop a standard and get
32:58
people to buy into it was that whole process?
33:00
Like, but me first, start with just like the update on the
33:04
those two particular Sinners. Sure.
33:07
Yes. So we talked about identity
33:09
orchestration here. Neo to how do you deal with
33:11
applications deployed across multiple clouds and you still
33:15
hybrid deployments dealing with multiple idps and you all other
33:21
kinds of authentication and that abuse providers.
33:24
If we think about policy orchestration, it sort of the,
33:29
you the flip side of that. Because each Cloud platform each
33:33
major Cloud platform has its own way of defining access policy
33:37
and how they enforce it. And this is true also up and
33:41
down the stack you know from the application to the
33:43
infrastructure and platform to the data level and even to
33:48
networks you can zero trust network access.
33:51
So you have all of these different And policy formats
33:55
then think about, you know, how difficult it is to manage that
33:58
just you know, from a staffing perspective you need skill sets
34:02
now and all of these different areas because each of those
34:05
systems manages access in a primarily, a proprietary way and
34:12
then also how difficult it is to really govern that sort of
34:18
complex environment who has access to what it's still a very
34:22
difficult. Question to answer.
34:24
So, when we looked at this space, we came up with the idea
34:29
of identity query language or I dql as a way to generically
34:35
define the access policy. So it's a declarative format.
34:40
That's meant to describe you. The vast majority of use cases,
34:45
but it's not just to be clear, it's not a runtime policy
34:49
decisioning or enforcement mechanism, it's it.
34:53
Way to Define policy in a generic format and then the hexa
34:58
software that I mentioned before, Tech say is an open
35:01
source software project that implements, I dql and translates
35:07
that I dql into the bespoke OR imperative format of the target
35:12
system. So you can imagine that over
35:14
time as we have more and more Integrations and connections
35:17
available, you'll be able to bring in more and more access.
35:22
These from these different Target systems and be able to
35:26
manage them in a single way, be able to do reporting analytics
35:29
governance on them. And also just use the power or
35:34
of the the hex ni de que. El model to manage many, many
35:39
Target systems in a uniform and consistent way.
35:43
So that's what that's why we came up with the idea of this
35:47
project and the folks at at strata you know, our From our
35:53
Founders and management team. They were part of the sam'l
35:56
definition, way back in the day, right?
35:59
So we have folks here there were co-authors of sam'l, so we, it's
36:04
really in our DNA to support and really invest in Industry
36:09
standards. And we felt strongly enough that
36:12
this is not something just that strata should consume, but that
36:16
it should be, you know, part of an industry wide effort, to try
36:19
to address some of these challenges that customers are
36:22
facing And so samples are standard.
36:24
They're really took off Wade. I think if you're listening to
36:27
this podcast, you're probably well familiar with Sam.
36:30
Oh, what does it take to get? That kind of, you know, ubiquity
36:38
in a standard. Yeah, it does take a lot of lot
36:42
of effort, a lot of coordination and and time commitment.
36:47
So what we did was we started out writing, you know, the the
36:51
Baseline. White paper, if you will
36:54
describing what what it, what I dql consisted of, and we started
37:00
looking around talking to to customers and partners and
37:03
seeing who was interested to get in at the start, and really help
37:09
to build this out. So we talked to a lot of
37:11
customer organizations about, you know, some of their issues
37:15
and and then it death, you know, the concept definitely resonated
37:19
with them. They saw this as a challenge
37:22
that really It was on met by a lot of the you, the primary
37:26
vendors in this space today. And and so we use the, you know,
37:31
the customer review here to help help build the the impetus and
37:36
the momentum behind the effort. And we also started building the
37:42
hexa open source software because it's, we weren't
37:46
starting out to just Define a specification, you know, pretty
37:50
much anyone can do that, but we wanted to Show that it could
37:53
actually work, you know? So that's why we have the hex
37:57
open source project as a component of this whole project
38:02
is to show that we can take, you know, I dql and convert it to
38:06
you the Google Cloud platform format or as yours or AWS, you
38:11
know, that we can connect to those platforms and using their
38:14
public apis to discover. What application resources are
38:19
there within a domain or project?
38:22
What a access policies are already defined, you know, pull
38:25
them in, translate them to the, I dql format.
38:29
Now we've got you know, many applications, many systems in in
38:34
the administrative view so we can manage them from there.
38:37
We can make changes to that policy and then retranslated to
38:41
the imperative or bespoke format of the target system and use
38:46
orchestrations and push that out there and activated.
38:48
And and again I'll reinforce that we don't replace.
38:52
Runtime decision or enforcement functions.
38:56
We are just an administrative function of managing the access
39:01
policy itself. Yeah, right.
39:03
I mean, it's just a Rosetta Stone that we talked about,
39:06
right? So we got, you know, so we
39:09
developed this working group, we started working on the open
39:12
source. We built out and rode the first
39:14
edition of the specification. And earlier this year, we
39:19
submitted a proposal into the cloud native computing.
39:22
The foundation because we wanted to be part of an industry
39:27
organization that was vendor-neutral that had all of
39:30
the protections you know of until actual property and so on.
39:33
So that as new contributors came on to the project they would
39:37
have the the Comfort or the confidence of being within that
39:41
sort of intellectual property regime and and then early in the
39:47
summer we got approval for for a Sandbox project as I as I
39:52
mentioned. Earlier.
39:53
So now we're, you know, we're opening up that working group
39:57
membership to more and more people, bringing more and more
40:00
folks into the project and you know we're just continuing
40:03
onward and upward and in trying to build more more momentum and
40:08
you know, eventually get to that point where we see idq all being
40:12
a common standard implemented in the industry.
40:15
That's yeah to me that seems like that's the mark of success.
40:19
It's kind of like when you have a child raise the child And then
40:23
they move out of your house and they go live their own life that
40:26
it's kind of, like success on child rearing and it seems like
40:30
right developing a standard Europe, Angela lysing.
40:33
It you're bringing other people into the fold or some point, it
40:37
kind of goes off and lives the life of its own.
40:39
It does ultimately it has to go out into the wild on its own and
40:43
stand on its own merits. You're right, you're right about
40:45
that. So I know you're you're we had
40:48
Gary verow on the yes, on the podcast.
40:51
Couple weeks back. He's running the Chrysalis
40:56
conference and you're going to be one of the speakers.
40:59
You're on a panel, they're talking about this very topic.
41:02
So I guess that's part of the evangelization of the standard,
41:07
right? Is generating awareness and what
41:10
else is are you hoping to get out of being on that panel?
41:14
Yeah it's definitely creating more and more awareness.
41:17
You know them Gary and team of are putting together a great.
41:23
Content of the Gent, you know? And agenda of content for for
41:26
Crystal has again this year and we think it's you know another
41:30
good audience to talk about the ID ql standard and how far we've
41:35
come and the things we want to do in the future.
41:37
You know the things we have on our roadmap and so be on a panel
41:41
with way delery of brilliant logic.
41:43
But it's done, I guess, two or three webinars with, in the past
41:47
Pam, Dingle is going to be on there from the ahead of Sanders
41:50
from Microsoft as well. Patrick from Ping Identity, it's
41:55
going to be on the panel. So I think it'll be interesting.
41:58
Definitely some different viewpoints to talk about there.
42:02
Yeah, I guess, you know, probably one of the keys on
42:05
getting a standard adopted, these days, just getting support
42:12
adoption of the standard by some of the the what they call Big
42:17
Tech Amazon. Microsoft, Google, right?
42:20
I mean, that's kind of like when They're kind of buying into it.
42:24
I think I would think that's, you know, what can really make
42:27
this thing take off it, can, you know, that's even it's obviously
42:31
very helpful to get a big Marquee, vendor like that
42:34
involved in the process and we've been having some of those
42:37
conversations. But it, I said earlier, it's
42:41
also important that vendors hear about this from the customer
42:45
side from the Enterprise side, and we're starting to see some
42:50
of that happen. And then also, So we've gotten
42:54
quite a bit of coverage from Gartner, you mentioned.
42:56
You speaking of the identity conference that you I saw you
42:59
had recently you know I dql is being tracked by the analyst
43:04
Community as well. Uniteq Vision, Gartner Forrester
43:07
and others and you know, that's also helping to raise awareness
43:11
of it, get from the Enterprise customer side of things.
43:16
Yeah, I think one of the cool things also about the crystals
43:19
conference is, you know, you had mentioned June that Gartner
43:23
conference back in 2006 and I think that was my first Gartner
43:27
conference says, well, you know, that was when I was kind of like
43:31
really getting into this industry and I think I was also
43:36
at the burden group conference a year, but that aside and digital
43:40
ID world is like I said and all the conference's van I was going
43:43
crazy but one of the things I realized was identity and access
43:49
management is a special industry.
43:52
We're not Getting in the room and talking about technology but
43:55
there's also kind of a philosophy that plays into this
44:00
like what is your identity? And I, you know, where I see
44:04
that really manifesting today is on this whole idea of like
44:08
digital wallets and decentralized identity in the
44:12
ability for a person to actually own their identity.
44:16
You know, there are several areas that are that are real
44:19
interesting like that. You always see these.
44:21
These new things cropping Yup. But to me, like, that could
44:25
literally transform how this industry looks further on down
44:30
the road. What do you think?
44:32
Yeah, absolutely. Absolutely yeah, we started
44:36
talking about, we called it limited liability, personas back
44:43
at Burton group and I forget which Catalyst conference it
44:47
was, but it was around that time frame 06-07 that Bob Blakely
44:51
gave a talk on this And I'm, you know, another subject was that
44:56
the identity Oracle, if you will you know the limited release of
45:00
attribute information about a person given the context of a
45:04
transaction or for an interaction online.
45:07
So yeah. We've been talking about these
45:09
sorts of things for a long time. I think the biggest impediment
45:13
really has been the business model of those properties that
45:18
you're trying to interact with. You know, are they really going
45:21
to give up? Up.
45:23
You know the ownership of all this data about you is you I
45:27
think has always remains. The biggest challenge is not the
45:31
technology per se. You know there's I think you
45:35
know the some of the Sovereign identity folks are taking a
45:37
different techno technological approach to it with limited
45:41
liability personas. We're thinking of it more in a
45:44
legal context knew that you would actually incorporate some
45:49
kind of pseudo identity of yourself.
45:52
So that Could have some of the same protections that a regular
45:57
Corporation has. So we were taking more of that
46:01
angle rather than a technological one.
46:04
But again, bottom line is I think the you the economic
46:08
business model is still a symmetrical when it comes to an
46:12
individual consumer. Say, trying to limit how much
46:17
information Amazon collects about them.
46:20
Yeah, absolutely and You know, Jeff likes to use the the quote,
46:26
if the product is free, you're the product and I was going to a
46:32
podcast. I wanted to get this out.
46:33
There is tools and weapons with Brad Smith.
46:37
I mean, I think he's got a really good podcast as a recent
46:41
episode you did with Kara Swisher, who was like a
46:46
journalist in kind of multiple eras of Silicon Valley, right?
46:52
And she Talking a lot about that, you know, all with
46:56
Facebook was coming along and other platforms trying to figure
46:59
out what the business model is and how can a business model
47:03
succeed on Advertising alone? Well, it's essentially selling
47:07
people's private information or using that private information
47:10
to Target advertising toward that person, right?
47:16
And we obviously we're seeing many examples of that business
47:19
model in effect these days. Yeah, absolutely.
47:22
Lee. Well, Jerry it was great
47:24
catching up with you. Hope we can have you back on
47:28
some point in the future and get some more updates on how things
47:32
are going with the standards and the adoption and the growth of
47:36
them. Anything that you want to leave
47:39
the losers with before we close out.
47:42
Well, I think you guys have been talking about and all the
47:45
conference's that you're attending these days and yeah it
47:49
seems to be conference season in full for so I'll Chrysalis next
47:53
week, as you mentioned, looking forward to connecting with some
47:56
folks. Folks, there are a lot of old
47:59
friends used to work with, but then taking a break for the
48:02
holidays. And then, you know, things that
48:04
we could get started again next year.
48:06
Cloud. Native security conference for
48:08
looking forward to, as well as RSA, I guess that's an April
48:12
coming up next year. Yeah, looking March, March next
48:16
year and say it again, sorry gardeners and March next year.
48:20
That's right. And in Texas, you know, so they
48:21
finally moved out. To Vegas.
48:23
So glad glad to see that he has to just looking forward to that,
48:26
too. I like me, some Vegas, but this
48:30
year I had to go twice within the same month that I was like,
48:34
that's way too much. Yeah I've got it pretty limited
48:36
thresholds for my tolerance of Vegas these days but it's really
48:41
it's great to catch up with with Folks at these events.
48:44
So definitely look forward to doing that and seeing you and
48:47
Jeff out there again. Yeah, we'll look forward to that
48:49
as well. Thanks a lot Jerry.
48:51
Thank you. Appreciate it, a gym.
48:58
Thanks for listening to the identity at the center podcast.
49:01
If you like what you heard, don't forget to subscribe and
49:03
visit us on the web and identity at the center.com.