Latest / Identity at the Center / #207 - Banking on IAM with Srini Kasula

Transcript

#207 - Banking on IAM with Srini Kasula · Identity at the Center

0:01
This is identity at the center. If it has anything to do with I
0:08
am this is the go-to podcast. So if you're a beginner or an
0:14
expert or anyone in between you've found your new home
0:18
welcome to Identity at the center now your host Jim
0:23
McDonald and Jeff Steadman Welcome to the identity of the
0:30
sender podcast. I'm Jeff and that's gem a gem.
0:32
Hey Jeff, how are you? Oh, not so bad yourself.
0:35
I'm good. Hey, I got a an email from
0:38
LinkedIn today that they are that I get one every so often
0:44
with companies that are hiring people in the I am space and
0:47
there happened to be a particular Airline hiring, and
0:52
it happens to be the airline that we were talking about
0:54
yesterday. They're looking for, like a
0:57
senior, I I am manager and I've we all say the name of the
1:03
airline, but I mean to find out that they're still using Seeker
1:10
questions as a second factor of authentication.
1:15
I don't know. I don't know if I'd want that
1:17
job. Yeah, naughty I think I don't
1:21
know which one you're talking about but I'm pretty sure if
1:23
it's the one I'm thinking about. It's not even good Seer
1:26
questions. It's favorites and oh my gosh.
1:28
I don't know how many soap boxes I've stepped on and off of
1:32
around. I hate favorites.
1:33
When it comes to any sort of validation favorites change and
1:39
they're very difficult for users to remember, stop using
1:41
favorites Airline people who I think you're referring to Jim,
1:47
whoever that new person is. Please make it a mission, Fix
1:50
It. Go password list, please do
1:52
something better. I don't fly them anymore just
1:55
because of my regional change, but I know what you're talking
1:59
about. And yeah, that is one of my one
2:02
of my first world problem pet peeves that I have for
2:06
authentication. Yeah absolutely.
2:10
And you know I think the reason I said that I don't think it's
2:14
the job that I would want. It's not that I don't think that
2:17
would be you know low-hanging fruit or shooting fish in a
2:21
barrel or whatever you want to say to describe something that's
2:25
very easy to do or very easy to identify But if it's been this
2:30
long and it still hasn't changed, there must be some
2:32
inertia like a marketing, like a CMOS like know, our people want
2:37
to have to use a second factor or people like the secret
2:41
questions. Yeah, they like it because they
2:43
don't have to do anything, more secure.
2:45
I don't know. I just I'm not gonna say
2:48
anything more about it because I'll get in trouble.
2:50
Say something I probably don't, I shouldn't say, but I don't
2:53
agree with that II feel like this chain this has been around
2:57
for at least seven or eight years.
2:58
If I recall when does one live, because I remember when I went
3:01
live, I feel that's enough. Time to, you know, figure out
3:05
what your next step is from a stronger authentication, but I
3:08
understand you got lots of users, you got to be really
3:10
careful about change and you know, all that stuff.
3:13
But man I just I didn't agree with that eight years ago and I
3:15
still don't agree with it now. Yeah.
3:18
Well, you know, I know that. You know what really brought it
3:20
to mind though about the airline's was I flew back last
3:24
night. I got home at 1:00 a.m. and I
3:26
was very fortunate. The flight was comfortable.
3:29
And, you know, it got in on time, but it's still a long day.
3:33
You flew today we're in the great cold north of the United
3:39
States and it was, we're working with a client who is a Regional
3:44
Bank, so much going on in the regional banking space.
3:47
These days. And I kind of think one of the
3:51
biggest challenges for the regional Banks, is that there
3:55
are for the most part managed by the same or the Hard to become
4:00
compliant with many of the same regulations as the big Banks,
4:04
but they don't have the size of the I am organizations that the
4:08
big banks have. And so, it's got to be a big
4:11
challenge. I'm sure it is.
4:13
I think you and I, you know, kind of talk through that this
4:16
week. Is we had a conversation with
4:17
that, but I think the good news is sometimes that can be a
4:22
blessing because there's less bureaucracy to get through
4:25
things and to actually get changes done.
4:26
So, I'm going to pretend So look at that as a positive glass
4:31
half-full scenario, rather than the negative because Jim, I
4:35
don't want you starting off with a - you were on a streak there
4:37
for a few weeks. Let's not go there.
4:39
It's Friday. I've been under his tail.
4:42
He have, it's not too late. It's not too late.
4:45
Yeah, I got to tell you. I so I flew back from, we were
4:48
in Chicago area and Wisconsin and stuff like that.
4:50
And I got I had to get up at 2 a.m. to drive back to O'Hare and
4:55
to catch basically the earliest flight they have out of there
4:57
and I have found what I thought. I think is the best airline Club
5:01
location that I've seen yet in the United States, the Delta
5:04
Club at Terminal 5 at O'Hare is fantastic.
5:08
It's like, it must be brand new but it's big.
5:13
Its spacious plenty of options, plenty of variety of seating
5:16
Styles. I got to tell you at 4:30 in the
5:18
morning it was a very welcome sight.
5:20
For me, I think Delta's up up their game across the board.
5:26
There are C so is Deb wheeler and our guest today and I
5:34
reported to her at one of the bank at the bank that we work
5:37
together at over a decade ago. So shout out to Deb your
5:42
company's doing a fantastic job. Yeah just fix some of the
5:46
Atlanta club please it was because he's like a couple
5:49
updates while before we get to our guest.
5:51
Let's go through. Eddie what kind of nonsense do
5:53
you got? I think we're coming up on a
5:55
Denver's coming up here in a month.
5:58
It's only 8:30. Years.
5:59
Yeah, at the Aria Aria Resort and Casino in Las Vegas.
6:02
Nevada. We have a very special
6:05
identifiers discount code just for our listeners because we
6:08
love you so much and because I don't know versus so very cool,
6:11
they hooked us up with this. This is like our first discount
6:13
code for a conference. So get those little pens out its
6:17
I DV as an identity verse ID isn't dog V as in Victor icen,
6:23
like identity Center twenty20. So i d v Dash.
6:27
I see EE. And 20.
6:30
You know, it's a little doubtful.
6:31
I'll make sure it's in our show, our show notes of people get it,
6:33
but that gets you 20% off which is, which is very cool.
6:36
So, very nice to the diverse folks, to kind of hook us up
6:39
there and I know you spent a lot of time kind of working with
6:41
them on that. So it paid off.
6:43
I hope your didn't pay off in terms of cash, but it paid off
6:47
for our and our listeners who hopefully can see him some cash.
6:54
Yeah, I think we talked about one of our priests, like, what
6:56
do you do with that? 20% savings.
6:57
Do you throw it back into the, into the pool of the corporate
7:00
pool or do you go to a little bit nicer dinner?
7:03
You know? Do you rent The Uber black car
7:07
versus The Uber regular car? I mean, how you gonna spend that
7:11
20%? Jim.
7:13
Yeah. I mean to, I, like, all those
7:15
ideas, I think I would maybe go to a show or something.
7:19
It is Vegas. There's Vegas as we do it.
7:23
Let's see. Any other news and notes before
7:25
we get into our main topic? No, let's Jump Right In and
7:29
let's do it. Let's talk about banking in the
7:32
I am World, maybe banking on. I am, I don't have excited on
7:34
the show name yet. Maybe that'll name itself, but
7:37
we're gonna invite on to the show.
7:39
First-timer, Serena casula, he's a senior, I am technology leader
7:43
at Wells. Fargo, welcome to the show
7:45
cerini. Thank you.
7:46
Yeah, thanks so much for taking the time to join us.
7:48
It sounds like you and Jim have some history.
7:51
So why don't we start there? I think, you know, one thing
7:53
too. To do with our first time guest
7:54
is understand sort of their identity origin story and to
7:57
find out is, is I am something that you chose, or did it
8:01
choose? You, we have an interesting
8:03
background and my journey starter exactly.
8:09
Back in 2000. When we were building an
8:14
authentication internally. We've been actually said, hey,
8:19
you know, why not? We look at the cards product.
8:22
So we started On looking at cars product.
8:25
And then, I started my journey with site minder, which is an
8:29
integrated product and then basically, you know, implemented
8:33
that well for the banking client, I was working for a bank
8:38
at the time as well, to be able to provide a single sign-on
8:43
across multiple business lines. That's how it's hard to make,
8:48
you know, security journey and I am journey.
8:51
And from then onwards, I being pretty Which, you know, as that
8:55
I am, is evolving. I was in the, you know,
8:59
authentication directory and then governments and improve
9:03
their gags. That's how I've been actually
9:07
involved in die. And you know, like,
9:11
interestingly German, I actually have worked out there, you know
9:16
at the bank with they've been given under the tarp, a bank
9:21
holding company status. So we We had two spun up, there
9:26
is a program and we actually have to bring everything related
9:31
to I am from the scratch and the time.
9:34
So that's how you know, Jimmy has been my partner in crime or
9:39
delivering that I am program. Jim seems to have a lot of
9:43
partners in crime so you're all innocent until I meet them.
9:49
Yeah definitely. That is for sure.
9:51
So Shri knee. You're a senior.
9:53
I am technology leader. What does that mean in the real
9:57
world? What are you?
9:57
What are you working on? What does that entail?
9:59
Yeah. Being a working on quite a
10:01
number of Tanks. It's basically we we have you
10:07
know, like not only just working for all the Terminal.
10:13
I am you know like capabilities development that means that the
10:18
control requirements and also like we are getting onto a new
10:24
digital transformation Journey to the into the cloud.
10:28
So we need to basically develop Cloud specific controls and
10:33
capabilities. That is something that it's new
10:37
and exciting stuff. That's what actually I've been
10:40
working out. Let's go.
10:42
Cool, socially you. And I work together at the bank
10:44
and, you know, you left, I guess after me at some point.
10:49
And I think you got out of the banking world for a while or
10:53
into Consulting, you probably saw some banking clients because
10:56
probably some in other Industries as well.
10:59
What I wanted to ask you is, you know, how is I am in the banking
11:03
World different than other Industries.
11:07
Yeah. So the banking industry is
11:09
heavily the glitter and it Lot of compliance requirements.
11:14
So one of the things that I know DC is basically because of the
11:18
regulation and compliance, you know, most of the time, they
11:23
will be heavy focus and emphasis on how do I make sure that we
11:28
just become compliance to that regulatory requirements?
11:33
You know, where as in other areas where you don't have this,
11:37
at least based on my Consulting experience you know where there
11:41
is Not much regulation. They actually get an opportunity
11:45
to be able to try some new things.
11:48
Like you know, like animal model based, you know.
11:52
Like whether you are to look at the other end clip response
11:56
inside, you know, I am or, you know, trying out some new
12:01
optimization techniques some of those areas, you know, you can't
12:06
you know, quickly introduce whereas in the case of banking
12:09
you got to make sure that everything is Actually run
12:14
through the compliance and making sure that you know, does
12:18
it actually, you know, introduce any risk to the controls, right?
12:24
Those are some of the things that I see significant
12:26
difference and then another aspect that I also see is for
12:31
the most part in the banking world, you try to make sure that
12:35
you are in compliance to the controls.
12:39
We don't like to actually have Have basically, at least, you
12:45
know, in my experience, you don't actually try to think
12:48
about and Beyond just your controls right, you know, you
12:52
like that. Looking at the overall risk
12:54
posture rain. What do I need to do above and
12:57
beyond? So that's something that, you
13:00
know, we won't have a lot of time.
13:03
I would say, in some cases that's that she's a bigger
13:08
difference that I've seen between a banking and not
13:10
banking. Yeah.
13:12
I can imagine a and some when I was in the banking space and
13:17
I've seen this, you know, working with financial services
13:21
clients, but not being in the spaces, it's kind of like not
13:26
every client that I work with is in banking, but going back over
13:33
a decade ago, it was there's a lot more suspicion and weariness
13:37
of leveraging, cloud Based Services.
13:41
Now there's Um spaces of Technology where you look and
13:44
it's like it'd be hard to find a non cloud-based service to fill
13:49
your needs. You almost are forced down the
13:51
road of using cloud-based services and I always remembered
13:54
that the hesitancy being around putting, you know, user customer
14:00
data in the cloud. But I have to imagine all of
14:05
those walls are breaking down now.
14:08
Yeah, you had absolutely like Jim, you know, back in the day,
14:12
like, you know, there was a lot of concern to.
14:14
But if you look at today, now most of the software is
14:20
basically a software-as-a-service, right?
14:23
You're already using route of the software service you already
14:27
have your data in some of these Cloud providers.
14:32
So you know that there is a lot of chipped in Approach and there
14:38
is also some confidence in the overall control structure in the
14:45
cloud providers. So, you know, banking world is
14:48
also exploring and looking at opportunities to Leverage The
14:54
Cloud providers, you know, as an extension of existing data
14:59
centers. We are so definitely.
15:02
And you know, with the amount that I T, is changed how the
15:06
cloud is. Acted things.
15:08
I'm wondering what are some of the cool things that you're
15:11
working on now in your role as a senior, I am technology leader.
15:17
Yeah so there are a couple of challenges that comes with you
15:21
know Cloud right. You know one of the things is
15:24
you know mom basically the whole agility right in with be able to
15:31
you know quickly deliver the resources and able to quickly
15:34
push the workloads and everything is done through.
15:37
Will automate Russian using, you know, like automation tools,
15:41
like Tara far more cloud formation?
15:44
You know, we cannot apply the traditional the old school.
15:49
I am processes are controls. So one of the things that I'm
15:54
actually looking at is, how do we make sure that we support the
15:58
agility and then also, to make sure that we also have enough
16:04
controls in place. So that we can actually support
16:10
the, you know, the business application to be able to be
16:13
moved into the cloud. That's one of the cool things.
16:19
And also other thing that I would also say, I mean again
16:22
like that was really think that I'm going out.
16:23
But another interesting thing is, you know, we have been
16:27
focusing too much on all the tools on the on-prem privileged
16:33
access and all What these cloud provider spring is like an
16:38
interesting challenge of actually having their own
16:42
privileged access tools, we need to figure out how do we bridge
16:45
the gap, right? How do we, you know, play along
16:49
with a toolset? How do we make sure that we
16:53
actually put the controls that we have on-prem onto this Cloud
16:57
providers as well? But those are some of the two
17:01
things that I want to highlight. That's cool things.
17:05
Yeah. Yeah.
17:05
I mean it sounds like a you get a lot of opportunity to figure
17:13
out how to do things faster more resilient than maybe even like
17:19
some of the cloud solutions that you're looking at it.
17:21
Like, you know, in terms of what service level agreements, they
17:24
can provide, you can you, can you actually beat those?
17:29
Can you, you know, survive a disaster?
17:33
I would imagine just something that You know, you look at
17:36
Italy, can I survive a disaster recovery from a disaster quicker
17:40
than being offered in terms of an SLA?
17:43
And then I've got, I've got to mention also.
17:45
When you look at soas and kind of historic data, usually like
17:50
in terms of like up time, if they question like okay, can you
17:57
actually do that? You know, you might be putting
18:01
it on as your guarantee if they fail to meet the also a like
18:05
What are you going to do not pay them for the service for a
18:07
month? You've got to look at it,
18:10
probably like okay, well if I can't get my authentication
18:14
system back up and running it could bring the bank to his
18:18
knees. Yep.
18:19
Yeah, that's that's an interesting challenge to write,
18:23
you know, like although they have all this High availability
18:29
BCPS, you know, like you have witness different data centers
18:34
on You know, like between East Coast West Coast and Global, but
18:39
still, you know, when it comes to authentication, you know, you
18:42
still need to make sure that, you know, we actually have an
18:46
ability to be able to quickly, you know, failover to the backup
18:52
or failover to a global region that is available to be able to
18:57
still serve to the out customers.
19:00
So that that's so far has been pretty.
19:05
Testing Challenge. And, you know, one other Cloud
19:09
providers that we work with, you know, they do actually have some
19:13
of this, you know, like able to kind of cash the credentials,
19:19
like, not the kind of credential caching, the tokens and to be
19:24
able to still operate and provide.
19:26
So they do actually have thought through this.
19:30
They are providing that ability. Even in the case of, you know, I
19:35
do not interfere lower. Originally I think of your area
19:40
of its kind of like focus on the workforce.
19:43
I am yet the big three areas access management identity
19:48
governance and privileged access management access management.
19:53
Pretty much has to be available. That's like you know that goes
19:56
down for 5-10 minutes. People notice IGA you can
20:00
usually last a little bit longer, right?
20:02
If your provision get slowed down so it's not like you know
20:07
it's got Be 24 by 7 uptime 8, obviously, you don't want it to
20:10
go down, but you can deal with a little downtime.
20:13
I think privileged access management is in a, you know,
20:17
ballpark by itself because you have the authentication, but
20:22
it's also like effect course systems of like, people not only
20:27
like, would it be people be inconvenienced by not being able
20:31
to authenticate? They might not be able to
20:34
restore from a disaster if you have your Ajax s management
20:38
system down and in my experience, that's a lot of the
20:41
time where you faced resistance or harder time getting a Pam
20:45
truly rolled out. Is that folks who manage
20:49
systems? Like servers?
20:52
Say, okay well, how am I how am I going to survive if you're
20:56
privileged access management system goes down.
20:59
Yeah, that's that's that's well that's pretty accurate
21:02
description of what are the challenges with each area,
21:05
right? So It's probably just touch on
21:08
the privilege. I think that's a valid concern,
21:11
right? You know, you need to be able to
21:14
give them access to be able to retrieve.
21:18
So, you know, we do actually have a couple of different
21:22
strategies, you know, you know, one of the strategies to make
21:26
sure that you always have a break glass through biggest
21:29
break glass that way that, you know, they can actually get into
21:33
it and able to quickly retrieve the access that they need so
21:37
that they can support the business operations on needs,
21:43
right? So we're able to Payable to get
21:46
into the axis and they're able to quickly restore.
21:48
So so that, that interesting as you rightly said, you know, by
21:53
being in the Consulting that is one of the concerns.
21:56
Why in my Consulting area, they in my Consulting experience,
22:01
they have not widely adopted, the privileged access to all the
22:06
platforms. There are a lot of concerns.
22:08
So, yeah, I'm one. I mean, I'm sure you guys do
22:11
kind of the tabletop exercises and, and But, you know, I know
22:17
that back in the day, people are always say, oh yeah, you have a
22:21
disaster recovery plan. But the question is, do you test
22:24
it or like, how often do you test it?
22:26
Because that's really the the the True Grit of whether or not
22:31
your plans any good because you don't want to be there having
22:35
different store in your plans, not good.
22:38
I did want to shift the conversation so you manage the
22:41
team I want to talk about like the pain.
22:44
Pemmican, how you know, we just came out of this long pandemic,
22:49
but it came on so quick. It hit a lot of organizations,
22:53
by surprise. They kind of shifted to a remote
22:56
work posture and having to support remote workers that at
23:02
the scale that they've never had to in the past, I'm wondering,
23:05
how did that affect you and is it starting to ease up, where
23:11
I'm in? I would imagine if, of course,
23:13
seizing up, but Are people starting to go back into the
23:16
office? Yeah.
23:18
So it's a pine amick actually, talked all of us.
23:22
A lot of new things, right? One is, how can we get the work
23:27
done remotely? And also it in interesting area
23:32
for I am. Especially we need to actually
23:36
be able to quickly scale up to able to support lot of this
23:41
Workforce who can work remotely and securely, right?
23:44
That that's a Canadian and as we are getting back, you know, like
23:49
a also, see some of the positive stop right in and you know like
23:54
other people are actually somewhat like a kind of bored
23:58
being That whole part so long once you know the officers have
24:03
opened up, you know like they like that social interaction,
24:08
they like to be able to get into a room and then whiteboard, you
24:13
know, especially on the alien at work in.
24:16
You know, we we like to actually whiteboard lot of stuff like in
24:20
how the integration works. You know, how do we actually
24:23
build this controls in place? So that is a gradual Transition
24:29
that we are going to right now. Yeah, did you guys ever get to a
24:34
point where you could, you know, virtually whiteboard?
24:37
I mean, did you try to take that and come up with some kind of
24:42
app that everybody could? You know, I think Microsoft has,
24:45
I actually never got to the point where we actually like
24:48
worded virtually, very often except you know, trying to use
24:52
like losing your power when it comes.
24:55
Yeah. When it comes to technology, I
24:58
like to. I like to use paper and pencil.
25:00
I'm excited for you. Get your new laptop.
25:02
By the way, Jim because as a pain you're going to love it.
25:06
Sorry I didn't tell me. Yeah, so I mean we have not used
25:12
a lot of that but, you know, I think as you know, with all the
25:16
bandwidth sometimes like you draw here it doesn't show up on
25:20
this Creek for quite some time. Like, you know, and then he's
25:24
doing video calls. But what we have used is like,
25:29
you know, Lucy chart or Vizio. You know, you basically draw on
25:35
the Vizio and then you know, that way that you can shade and
25:39
you know, basically are you, you know, he's do the Vizio upfront
25:44
and then about Vizio on the corn.
25:47
So, that's how I've seen at least in my experience during
25:52
that time. Yay, I think lucidchart for me,
25:56
it's like, I can use lucidchart to drop a diagram so much faster
26:01
than we do. Susie.
26:02
I think I don't like the zo. You remember those white boards
26:08
that a lot of places to have where you could draw on them and
26:12
then you push a button and do a print it out?
26:15
Yeah. I've seen that but I don't see
26:18
that no, but I do remember a decade backed up what their
26:21
Clint, right? You write it on a whiteboard
26:25
that you draw a picture, it'll automatically scan and intended
26:29
as a PDF to Peter that you can use either printed or share
26:34
that. So I don't think that quite
26:36
often. Now it is, it's like a nerdy
26:38
corporate Polaroid yet because really bad.
26:43
Yeah. So what was the one that Arturo
26:46
had Jeff? Yeah.
26:47
They had Microsoft Surface hubs, which are these, you know,
26:50
basically big screen TVs with touch screen with touch
26:53
touchscreen. Capability could draw and I'm
26:54
very cool, very expensive. I don't know if they were ever
26:57
actually took often and all but maybe the biggest Enterprises or
27:01
maybe the best Microsoft customers but it's a very cool
27:04
idea. But you have like this basically
27:06
50 inch TV that you can write on and it's connected to your
27:09
team's room and everyone can see it.
27:13
It was neat when we were there, that's for sure.
27:15
Yeah. So she need a topic that we've
27:18
been thinking a lot about lately, is you know, training,
27:23
you know, training of your team. What format do you think is the
27:29
best investment? Is it sending people to Sirs is
27:33
it semi-people to conferences is as something else is getting the
27:38
Melinda membership or just saying go hit YouTube and watch
27:42
videos. Then, you know, do you prefer
27:46
vendor specific trainings and conferences or something.
27:50
That's more, you know, industry General, I would say basically
27:58
bought a combination right, you know any English teacher.
28:01
General, basically is something that I would say at least, they
28:06
need to have an exposure because I am has been changing and
28:13
evolving, you know, in the last couple of years, right?
28:18
I mean, it has been changing for the decade, but what I wanted to
28:23
basically say is I want to be able to have my team to have
28:29
exposure to, with I am. Heading and how the industry is
28:35
is changing and where they are heading towards.
28:38
And also gives you a bigger picture of how I am fits into
28:43
the overall, you know, cybersecurity ecosystem.
28:47
Right, that's where I see a lot of value or products industry
28:52
conferences but when it comes to basically and expertise into a
28:59
specific capability, You know, that's when I see a vendor
29:04
specific. In a classroom.
29:06
Right? You know you go there is not
29:09
only learn about the product is it will also give you an
29:13
opportunity to connect with other people how they are
29:15
implementing, what are the challenges that they are facing
29:18
how they all come. So that is also, I feel like it
29:22
is very equally important to make sure that you know like you
29:27
become an expert in that area. Right.
29:30
That's that's that's how I say yeah.
29:33
And now I think that's a good point.
29:34
So it's kind of Like both vendor and Industry.
29:39
General is important for both fronts.
29:44
I will say this about conferences.
29:45
I love going to conferences and networking with people and
29:50
hearing about how they're solving problems.
29:52
And then you can follow you up and, you know, extending that,
29:55
that meeting to, you know, reconnect later.
30:00
One question I had for you is as e in the banking industry, when
30:07
you're a conferences or wherever and you're meeting your peers
30:12
from other banks, are they pretty much willing to share
30:17
information or you willing to share information in terms of
30:20
here's what we're doing? Here's the kind of threats that
30:22
we're facing and how we're taking them on.
30:25
Because I always felt like within the within the industry
30:29
information, security is one area where you're not, really
30:33
competitors, you're not competing, Against it.
30:36
You're competing against the adversary, right?
30:39
Not against other Banks. Yeah you're exactly right.
30:45
Basically we are not competing, we are not fighting with each
30:50
other competitor, right? And so you know, I mean I have
30:54
seen at least there are various different forums where they all
30:59
come together and then talk about you know what they see
31:03
what are the best practices. And I also have noticed
31:09
basically all these big vendors Right?
31:12
They also have a vested interest to bring it all these folks
31:15
together and say, okay, you know, like the to improve their
31:18
product. They want to actually have all
31:21
this potential companies to provide date, you know, like
31:27
product feedback and then they also wanted to hear from all
31:30
these Financial organizations. What are the the features that
31:34
you would like to see, which is common across all these
31:37
companies write all these Financial organization.
31:40
So, I'm saying more collaboration, more knowledge
31:44
sharing now than before great, I'm going to keep going, Jeff
31:49
you don't mind because I've got a few questions without
31:50
answering and actually, what I want to do now is kind of like,
31:55
do like a lightning round. So I'm going to throw some ideas
31:58
out there, some things that I've been thinking about, and I'd
32:01
like to get your perspective on them.
32:03
So the first one is devops, you know, doing the automation
32:08
automated deployment like infrastructure as code.
32:11
Code deploying applications. Devops.
32:14
What are your thoughts there, when, and how it relates to what
32:17
you're working on? Devops is basically The Veil The
32:23
Future, right? I mean, you know, develops is
32:25
the way to deploy the code. Obviously the way of actually
32:28
building the infrastructure, you know, I think I am actually also
32:35
be part of that pipeline right now.
32:39
You know, if we don't actually Be part of the pipeline then we
32:43
will become a blogger. So I think that there is a lot
32:48
that I am need to actually to the catch up with the developed
32:53
Pipeline and then be able to deliver all the required
32:57
controls as part of a pipeline. I think there is a lot more work
33:02
at least from my point of view in that area.
33:07
I think it's a big deal to. You have to think about like,
33:11
Robots, and their need to have identities and how can you, you
33:19
know, as I am professional, make sure that that's being used and
33:24
done according to policy, and within control, without slowing
33:29
down the process, right? That's the, that's the
33:31
challenge. Yeah, so that's the challenge
33:36
again. So, what we need to make sure
33:39
that is this We should support the agility, but at the same
33:44
time, we also need to make sure that we have enough controls in
33:48
place so that we are managing the risk.
33:52
Yeah, and maybe ask these are for because I think this is the
33:56
easier one or the thing that people point to that, it's like,
34:00
oh this is how you're going to secure Cloud.
34:02
So this new space called Keem or cie.
34:06
M stands for cloud infrastructure.
34:09
Entitlement management. What are your thoughts there?
34:13
So that's an interesting area. So that is basically is going to
34:18
be key if you want her to have a visibility into the cloud.
34:23
So, Rod up these Cloud providers, basically give you
34:28
some visibility but not the extent that you want to know
34:35
about it, right? So these like a see, I am
34:40
vendors who has become like a Our Diagnostic and they are able
34:45
to provide visibility across multi-cloud which is actually
34:51
going to be very key because you want to know, what are the the
34:56
entitlements, what are the account and who has access to
35:02
what? And then what type of access
35:05
they provide? The CIA actually is solving that
35:11
problem, right? So that is We're going to be key
35:14
if you are into the cloud. So that is what is is the
35:20
evolving, right? That's evolving.
35:22
So and if you look at the trend, you know, right now there are
35:25
some point solutions that are actually coming out but I do see
35:31
in the future that should become part of the IG a solution
35:34
because how IGA actually has a visibility into the on-premise
35:40
systems, you know, like I can see I mean, Providing the
35:43
similar visibility but we need to.
35:49
I hope I see I would see in the near future is having this idea
35:53
products bringing their GM capability into the IGA and not
35:59
only just bring the visibility you know we probably need to
36:02
look at in the future. How do we actually also leverage
36:06
that data to even you know think about how to be provision or how
36:12
to behave. Mediate the over-provision axis.
36:17
That's how I see in the future. The industry is going to head to
36:20
us. I hope it is.
36:22
I think that's really insightful that you can see moving toward
36:27
IGA because they're both kind of a detective control who has
36:31
access to what there's periodic reviews of that.
36:35
But I think you know at least operationally speaking, the idea
36:38
with Chi minh's that you're looking at it on a more frequent
36:42
basis. So so you know, maybe maybe
36:45
that's not true, but that you're looking at the, you know,
36:49
over-provisioning as I think the word that comes to mind for me
36:53
is hey, this role is given to to too many people.
36:58
These people have too many roles that are they don't use these
37:01
roles and then you can go and right size access.
37:06
But it's after the fact it's they've been sitting with that
37:10
role for so long. They haven't used it in 90 days.
37:14
You should take it away from that person, but the reality is
37:17
that they never needed in the first place kind of.
37:21
Yeah, that's you know, see Amy's is giving out of their
37:25
perspective which we never had with all.
37:28
This idea Parks is. It also looks like that usage is
37:35
never actually have visibility into the target system.
37:38
Whether this entire argument has been used or not.
37:41
See, I am actually Lee looks at not only, you know, the audit
37:46
data report, okay? When was the last time this role
37:50
has been used, who has used it, and it also looks at the
37:54
analysis of the, the road and the corresponding permissions
37:58
who have access to it. And then, you know, when was
38:02
Malik is this over provision taxes for what they are trying
38:06
to do. So it is bringing a different
38:08
dimension, which, you know, we never had even.
38:13
On-prem. Yeah, you're right.
38:15
And you know Jeff that I've had this discussion or only call it
38:19
a debate but it's more like I am we talk about I am it's who has
38:24
access to what and then there was the UVA or ueb a user
38:30
Behavior analytics which was and what are they doing with that
38:34
access? Or they is the access being used
38:37
appropriately? And I think there's an element
38:39
of that to Keem where? You know, it's just to your
38:44
point like okay, we're seeing things.
38:46
We were not able or not able to see with IGA.
38:50
Are they actually using the access?
38:52
So the last one in the lightning round was, you know, password
38:56
lessons. A lot of pastoralist Solutions
38:58
have identity proofing. In terms of part of your
39:04
onboarding process into your organization using a
39:08
government-issued ID and, you know, maybe doing like Video
39:13
selfie to make sure that actually match up moving that
39:18
into maybe that pre-populate some of your tax forms, but it
39:22
certainly gives you a higher proof that the person is who
39:26
they say they are maybe later on.
39:28
You can use that that data for pastoralist so you can do
39:32
pastoralists with a biometric things like that.
39:35
So I wanted to get your idea of like how important to you is
39:39
that or does that just seemed like science fiction.
39:42
So You touch that, two different topics.
39:45
What is the identity proofing? So in addition the Enterprise
39:48
World basically the proofing actually happens before
39:53
Enterprise user comes into the corporate right now.
39:58
You need to basically go through all the background, check all of
40:02
that and then we use a hedgehog system and then typically We
40:08
Trust once you are in the HR System when it comes to the path
40:12
for Less you talk about you know that that's it's a different
40:17
way. How I see it.
40:18
The password is basically again we all need to move towards
40:23
password is because we all know that passwords are not secured
40:27
way authenticating for the password list, you know?
40:33
I mean will you talk not like it's it is not only just for the
40:38
human user site, you know. As you see a lot of means, you
40:43
know, like when they're like, you know, providers like a
40:46
Google or Microsoft, they are moving towards a concept called
40:51
manage Identity or manage account.
40:53
So they want to be able to basically have these, you know,
40:59
identities become password as because they don't want to be in
41:04
a business of maintaining the credential and then putting a
41:08
burden on the app teams to actually live for Dating the
41:11
credentials. They want to actually provide
41:15
required resource axis at the same time.
41:18
Also bind it to a resource so that you are focusing on just
41:24
getting the access you need. And getting the access that you
41:28
know, you need to the right resources at the right time and
41:33
you know, moving the burden of like taking out the burden of
41:37
liquor as if you look at traditionally like Help the
41:41
on-prem. You know, you have a separate
41:43
account, you need to Walt it. Inactive, make sure that you are
41:48
rotating it. And all of that is lot of
41:51
overhead and, you know, for the Humanities as possible is
41:57
definitely the way to go. I would see that as more and
42:01
more applications and more and more Systems Support it.
42:05
I think the password is is the code.
42:07
It's, it's the most secure way off.
42:11
Authenticated, that's how I see. So I'm going to ask you to put
42:16
on your prediction hat here. I'm not going to hold you to it,
42:18
but when do you think at least for, for for your organization?
42:24
When do you think you'll be ready to introduce password
42:26
lists for your customers or for your internal Workforce?
42:31
Like what is your timing feel like, right now we already use
42:34
possible lists for into the Enterprise users.
42:37
So we are trying to expand that school, right?
42:41
You know, because if you look at it like, you know, Password is
42:47
it is something that I have solved, so should be in a
42:51
position to accept that, right? Not all the applications are
42:56
ready to accept the password. As we already have certain
43:00
applications password as we already have roll this out to
43:04
show real users internally and you know, I see in the next
43:11
couple of years, it's going to be widely adopted for witness
43:14
different up. Vacations.
43:17
I think this is more on the vendors to become a password is
43:21
complying, but we all know that a lot of banks love their main
43:25
frames. So I'm sure IBM and rack F, and
43:27
top secret. And all those words are are hot
43:30
on the trail getting password list, enables part of their
43:32
authentication stack, I will put you on the fire, you know, to
43:36
answer that. But that's just my into sense.
43:40
What are some tips that people can take away if I'm in
43:42
financial services and I'm listening to this?
43:46
And maybe they thought about it, maybe they haven't.
43:47
But from your perspective, what are some tips when it comes to
43:50
Identity and access management that you think people in your
43:54
industry should be thinking about?
43:56
Yeah, my tip is going to be, you know, Tink beyond the compliance
44:01
requirements, right? You know, we need to be more
44:05
cognizant of the threat landscape and make sure that,
44:11
you know, we are aware of the risks out there, think about and
44:15
Beyond the bid minimum article compliance requirements, but I
44:21
would say, you know, is going to be the number one people that I
44:26
can recommend. And it's not only for myself or
44:30
other folks as well. Better security improve helps
44:33
everybody. I would imagine a business.
44:35
So you know, the rising tide lifts all boats.
44:38
Let's go ahead and start to wrap up the conversation.
44:40
There could have been super generous with your time.
44:42
It is a Friday after actually almost evening.
44:44
It's five o'clock on a I so want you to get on with your with
44:47
your weekend, but before we go. Wow.
44:49
Let's end on a lighter note. And here's what I got for us
44:52
this week, would you rather go into the past and meet your
44:56
ancestors or go into the future and meet your
45:00
great-great-grandchildren trainee?
45:03
You're the guest of honor will start with you first.
45:05
I would like to keep the past in the past.
45:09
I don't want to look back. I wanted to ride it actually
45:13
look into the future and And I want to meet Mike then
45:17
grandkids. Jim are you?
45:22
Yeah I mean you know me like the first thing that came to mind
45:25
was like the past because it's just like I'm I'm into history,
45:32
I'd like to see how people lived but Man just thinking about like
45:37
the future and seeing what the world was like in the future and
45:41
seeing you know how? Well, first off, I guess if you
45:45
have grandkids or great grandkids then you know, hey you
45:48
did all right, you guys, you know, the world didn't implode
45:53
and I'm going to let you go into the future.
45:57
It's like some kind of like Terminator scenario where it's
46:01
like him, we're trying to stay positive, man.
46:03
Come on. Killing me here.
46:04
Hey, the episode Almost ended and it was all positive.
46:08
So I had to bring it back down to reality, you know, if there
46:13
was an apocalypse scenario, I really wouldn't want to be there
46:16
for that. Yeah, I know we have our issues.
46:18
That's our next podcast is apocalypse, talk with Jim
46:21
McDonald. So yeah, it's Jim McDonald.
46:25
Yeah. So I better get out there and
46:27
live while the world still going.
46:29
So, I'm going to just say future and move on.
46:33
Okay, so I wonder if this is Is if when you answer this
46:37
question, if it relates if you have children or not, I don't
46:40
have children. But I still would go into the
46:42
future, not because I want to meet my great grandchildren
46:45
because like you Jim and I think maybe she is like I want to see
46:48
what the world is like, right? Do we get to the Star Trek you
46:51
know, phase yet and you know in the next let's say 100 years 200
46:54
years worth of that looks like you know, with life expectancies
46:58
going longer, maybe that extends, what a great, great
47:01
grandchild, you know, might look like from an age or distance
47:05
perspective, from where Right now, I'm a future.
47:09
I'm with this rainy. I'm not going to the past past
47:11
has passed. Jim, I'm a little surprised.
47:13
I thought for sure you would want it.
47:15
You you would, you would, you would go between the two, but
47:18
you would end up on the past because of your love for
47:21
documentaries. So you.
47:24
Yeah. So I surprise you but, you know,
47:27
here's the thing about the past I always think about is that
47:31
probably I'd be dead in the past because I'm almost 50 and like,
47:37
people did you know, the further back in the past are a lot fewer
47:41
50 year olds. You know, people who are 60 or
47:44
over consider very wise because, like, they basically live well
47:49
beyond their life expectancy. So I'd be like the really old
47:53
dude in the past. Jim you just did.
47:57
You did it again. You took it to the morbid tip.
47:59
Thanks for thanks for that. We're going to go ahead and show
48:02
everyone. I gotta leave it there for this
48:04
week. SRI, thank you so much for being
48:07
part of this. We like to put our guests, a
48:09
LinkedIn into our show notes so hopefully that's okay, people
48:13
have questions. Maybe your things that they
48:14
might have reached out to you. Hopefully you're open to that.
48:16
Is that all right? Yep, of course I have in front
48:19
of, you know, thousands of people who are listening so they
48:22
know they know let's see as far as we go, you can visit us on
48:29
the web where idac podcast.com. We're on Twitter at.
48:33
See podcast we're also on Macedon and idea see podcast at
48:37
infosec that exchange Jim and I always love to engage with
48:41
listeners got a lot of actually great messages this week
48:44
including a book that one of our listeners wrote so I have just
48:49
started it I got through the first chapter on my flight today
48:52
so I'm intrigued and I will maybe be giving a book review
48:56
here in a couple episodes so that was kind of cool but given
49:00
all is a gym and I was like to connect on LinkedIn with folks.
49:02
So feel free. A show on your show ideas, you
49:05
know, whatever you've got for us.
49:06
We're happy to bring it to the show and don't forget about our
49:08
identifiers discount code. It's idv.
49:12
Icen, 20! I'll have it in our show notes
49:15
as well. Get you 20% off your
49:16
registration and you can use that to do an Uber black or
49:20
however you think you can. You know, finagle that 20% back
49:23
into your own pocket. I'm not saying you should just
49:25
saying, you know, there's an option there and then don't
49:28
forget to subscribe and, you know, rate the show that always
49:30
helps us. That's the number one.
49:31
We can help us. You know, grow and continue to
49:34
share with other folks. So with that we will go ahead
49:37
and leave it for this week. Thanks for any thanks Jim.
49:40
Let's start the weekend and we'll talk with everyone in the
49:42
next one. You've been listening to
49:46
Identity at the center. We hope you've enjoyed the show,
49:50
make sure to like rate and review and we'll be back soon,
49:54
but in the meantime, hit the website at identity at the
49:58
center.com and find us on Twitter at idac.
50:03
See podcast, see you next time on identity at the center