Latest / Identity at the Center / #385 - Sponsor Spotlight - Nexis

Transcript

#385 - Sponsor Spotlight - Nexis · Identity at the Center

0:04
This is Identity at the Center. Hi, welcome to the Identity at
0:12
the Center podcast. I'm your host, Jim McDonald.
0:14
Unfortunately, Jeff Steadman had other activities going today and
0:19
wasn't able to make this episode.
0:21
This is a sponsor spotlight with a company called Nexus.
0:26
They're at nexus-secure.com and I hope you have an opportunity
0:31
to check them out at nexus-secure.com/idac.
0:37
Again, this is a sponsored episode, so it's a little bit
0:40
different than our regular episodes.
0:42
We're going to be joined by Doctor Heiko Klarl, who is the
0:45
CEO over at Nexus. And that's NEXIS, in case you're
0:50
wondering. And Doctor Klarl's going to kind
0:55
of give us what they do and how they help solve the identity and
0:59
access management practitioner problems that we all kind of
1:03
fight with on a daily basis. So walk through the show, Doctor
1:08
Heiko. Yeah.
1:09
Thanks, Jim. It's a pleasure.
1:12
Well, really glad to have you here, the pleasure of all ours
1:15
and we really want to learn about Nexus and what you, what
1:20
you guys do and what it is that you bring to the market.
1:24
So, but of course this is your first time on the Identity at
1:28
Center podcast. So maybe you can kind of give us
1:31
your background how you got into Identity?
1:33
Did Identity choose you or did you choose it?
1:38
Yeah, that, that's a good question.
1:39
So I would say I've chosen identity.
1:41
So back back in time, more than 20 years ago, I started computer
1:45
science and at the end I had to kind of make my diploma thesis
1:49
and all the kind of security thingies have been super excited
1:53
for me. And basically I did research on
1:56
service oriented architectures and business process modelling
1:59
and how to apply some security things with an example of BA
2:04
equilogic security. So the listeners experienced in
2:08
a longer time in the market probably remember still BA Yeah,
2:11
this was my step into the kind of identity and access
2:15
management business and and community.
2:18
And after that, I did my PhD also in, in identity and access
2:23
management and was researching on how to apply access policies
2:30
into business process modelling. So you probably remember back in
2:34
time, but the service oriented architectures, everyone had the
2:37
hope that business people, business departments can model
2:41
their processes and so on. And then what's the question on
2:44
how to keep it secure? Can we model it in an, in an
2:49
model language like BPMN and kind of having an an, an process
2:56
to create a model driven approach to create all the
3:00
models that finally are needed to end up into a policy for
3:05
commercial of the Chef products? Yeah, the rest is history.
3:08
And the rest is history. So now you're part of the
3:10
industry and you are the CEO of Nexus.
3:14
And I'm wondering, you know, what would, you know?
3:18
Give us the elevator pitch. What does Nexus do?
3:21
Yeah, Nexus takes care about authorization governance.
3:25
So we're taking care about helping large enterprises,
3:30
regulated customers such as insurances and, and and banks to
3:36
do a proper role mining, role management and role life cycle
3:39
management. Or in a wider sense, going away
3:42
from a kind of static authorizations also covering the
3:46
dynamic part like attribute based access control, policy
3:49
driven based access control and this kind of stuff.
3:52
And we see that especially in regulated challenges, it's quite
3:57
cumbersome to really ensure that everyone is allowed to do what
4:01
they should do and not, not more.
4:04
And so all the kind of access review things are quite
4:06
complicated. And looking back those 20 years
4:09
in the industry, basically I started my career with Sun
4:14
Identity Manager 20 years ago. Things are still not super
4:20
great. So business managers are still
4:22
struggling when they have to recertify and review access for
4:26
the employees. And this is where Nexus comes in
4:30
into a Better Together story, sitting on top of large IGA
4:34
products such as say .1 Identity, Savient, Oracle, IBM
4:39
Open Text, you name it, in A Better Together story.
4:43
And that's the most important thing.
4:44
So we are bringing those capabilities that clients are
4:48
missing and kind of ensuring happy customers.
4:52
Yeah, I I love that Better Together story.
4:55
So you, you mentioned a lot there.
4:58
We'll get to dive into all of it.
5:00
One of the things that I kind of took away from what you're
5:03
talking about was creating this visibility over the
5:07
authorizations. And I think that's such a key.
5:10
It's one of the things that practitioners struggle with is
5:14
how do you get visibility to everything, all these identity
5:17
systems, identity silos that exists within your organization,
5:21
and how do you make sense of it all?
5:23
So does that resonate with you? AB Absolutely.
5:29
So the, the whole visibility part in getting rid of this of
5:32
silos is something the whole industry is, is struggling.
5:36
There are so many large enterprise customers out there.
5:40
They have at least one most likely 2 or even more kind of
5:44
AGIGA focused systems, an old one and a new one and with an M
5:50
and a merger a a third one that will have some Pam systems and
5:56
probably a couple of access management systems.
5:58
And despite every, everyone is moving into a kind of
6:03
consolidated identity and access management landscape.
6:06
It just takes ages. So recently I was talking to a
6:11
big bank here in in Europe with roughly 2 1/2 thousand
6:14
applications. They have just managed to
6:16
onboard 500 so far into their new IGA solution.
6:20
And so basically they have 500 there, 2000 there, which makes
6:25
you as a manager, which makes you as a CSO and finally as ACEO
6:30
a completely blind whether you can really fulfill your
6:34
compliance obligations and building the umbrella on top of
6:41
the systems is really that what helps.
6:43
So getting the visibility across all kinds of IM vendors and
6:50
products and across all kinds of identity.
6:53
And not only the visibility, I think and very, very important
6:55
part is not just to create a task list of things that are not
7:01
looking good, but also to provide a proper remediation in
7:05
the sense helping helping IM teams and helping business
7:09
departments to clean up things kind of immediately with
7:13
automated remediations. Yeah.
7:16
I mean, ultimately that's a big part of the why, right?
7:18
Like how can you manage what you don't, what you can't see?
7:23
You have to be able to see it to have the ability to manage it.
7:27
And maybe you just answered my next question already, but I've
7:32
got to think a lot of identity practitioners start with the
7:35
question of I've got an IGA system, I've got a Pam system,
7:40
why can't I just do what I need with them?
7:42
Why do I need Nexus? Do you hear that much?
7:47
It depends to whom we are speaking, but but we hear this
7:50
question. So I would say to those identity
7:54
practitioners that are experienced and that who have
7:56
done it before or kind of who have progressed and basically
8:00
left the honeymoon face with the IGA tool.
8:03
Most likely they have experienced.
8:05
It's not everything polished and shiny like they have probably
8:08
expected and then they get quite quick.
8:13
Oh, that's the problem Nexus solving and this is the solution
8:17
we are providing. OK, make sense, give us a demo.
8:20
And then their understanding is quite there.
8:22
When you're in early stage, so you're starting on a Greenfield
8:26
approach or having something very, very old, old school, then
8:30
people hope for sure that all the new products, their Magic
8:34
Quadrant leaders, that they completely fulfill what they're
8:37
expecting and, and to be fair, the large players do a good job
8:41
as well. They have mature of the
8:44
products, but when you are a regulated industry, you have so
8:47
many additional add-ons like maintaining a proper segregation
8:52
of duty implementation across a variety of system really do a
8:58
proper access refuse and recertifications whether it's
9:03
often direct assignment, but any policy has to be recertified at
9:07
a certain point in time. And this is often a little bit 2
9:10
technology focused. So it might be doable for an IM
9:14
practitioner, but it might will both be doable for an senior
9:18
consultant in finance, for an HR manager and this sort of non IT
9:25
folks out there in the companies.
9:28
So our mutual friend Rebecca Becky Archambault from Gartner
9:33
posted recently about this IVIP space and her research that was
9:41
recently published about IVIPI noticed that you are one of the
9:45
first person to reply to that post and comment on that post.
9:50
So I guess my question is, is IVIP the space that you see
9:54
yourself in and you know, even before that, like do you feel
9:59
like the boundaries of IVIP make sense to the practitioner?
10:05
Absolutely. I, I would say so.
10:06
So I really appreciate that this, this term, this box was
10:11
coined by Becky and and the Gartner team and that discussion
10:16
within the community started. Is it a platform?
10:19
Is it not a platform? Is it just a bunch of
10:21
capabilities or or? So I think what's really
10:24
important is that there is an understanding, there is a kind
10:29
of software, a kind of product out there that are building this
10:33
umbrella function in order to fulfill this Better Together
10:36
story and bring additional capabilities in.
10:39
Some products are are missing and missing for often very good
10:43
reasons cause larger players have to focus on on other areas
10:48
and not going super deep for specific industries or for
10:52
specific use cases and everything, every technology or
10:57
every area of technology that has a name is far easier to to
11:00
discuss. So when you do an industry
11:02
comparison, when you do a tool selection, it's far easier if
11:06
you have a label, if you have a name for it and say, OK, this
11:09
kind of technology, I want to understand better, I want to
11:13
make a deep dive. And so this helps at the end of
11:16
the day, everyone is you have a clear label, you can do a proper
11:19
comparison and you have an answer in the sense of of a
11:27
legal brick. So to say that you put on top in
11:29
your enterprise architecture and say exactly this IVIP category
11:34
is taking care about this in my enterprise, yeah.
11:38
What I take from what you said is that Nexus works with your
11:44
existing investment in identity technology, which I think very
11:49
few companies make these investments and want to walk
11:52
away from them every few years. So buying tools that can kind of
11:56
enhance the functionality seems to make a lot of sense.
12:01
And I think that's a lot of what the IVIP space is about, right?
12:05
Increasing visibility, increasing intelligence and
12:09
adding on to the capabilities. And I'm wondering, there seems
12:14
to be like a lot of companies that kind of their solutions
12:19
fall into the space. How do you how does Nexus
12:22
differentiate from the pack? Yeah, that's, that's a good
12:27
question as well. First and foremost, I think
12:31
you're absolutely right and that that hits the nail that IVIP or
12:36
IVIP as others are saying, ensures and saves existing
12:42
investments into technology. When you have rolled out an IGA
12:46
tool, an integrated 1 1/2 thousand or 2000 application,
12:49
nobody is really willing to RIP it out three years after and
12:54
say, OK, we start completely from from scratch and are now
12:57
bringing in another, another tool that's just a slightly
13:01
better. Because at the end all the human
13:03
related processes, all the integration processes, are they
13:06
the cumbersome work and the work that really is creating a lot of
13:12
effort for for integrators, for consultants, for IMM teams.
13:16
So basically having some something there that's well
13:20
integrated that works, where provisioning works is super
13:23
fine. And then there are just a few
13:25
capabilities missing. It's far, far smarter to sit
13:28
something on on top. And coming from the enterprise
13:34
engine, you have IGA systems and let's just PEM systems for
13:39
example. You want to ensure SOD, you can
13:43
figure out on how to do it or you say OK, SOD is done by Lexus
13:47
in their IVAP space building an umbrella between IGA system and
13:52
the PEM system and you can ensure that no one really
13:56
conflicts with your SOD segregation of duty policies.
14:01
What's the difference between all the vendors that that are
14:05
there? I think IVIP or IVIP is at the
14:10
very beginning. So it's kind of in the finding
14:13
phase what's really included and what's really not included.
14:16
My point is that the visibility part is a very important part of
14:22
figuring out across all types of identities and across all
14:27
different systems of IM building this umbrella and bringing
14:31
visibility to the business side. That's number one.
14:34
Number two is visibility is not enough observability.
14:38
Like for example, Martin Kupinger, who was also a guest
14:41
in the IDSC podcast in in the past says is important.
14:46
I do say it's remediation. Basically we have the same
14:49
understanding, not just creating a list of findings because
14:53
everyone knows his mailbox or his large To Do List.
14:56
So basically this doesn't make sense.
14:58
Having an automated remediation for at least the most important
15:03
findings or the kind of standard routines makes absolutely sense
15:07
in order to get get rid, RIP off a task list list that that's
15:13
just law at the end of the day. Yeah.
15:16
I mean, you know, I think Martin has his finger on the pulse of,
15:21
you know, he's got this identity fabric concept that talks about
15:25
a lot in his presentations and to me, a spot on.
15:28
It's like, you know, enterprises that are complex, you have tools
15:32
all over the place, but when it comes to something like
15:35
visibility, having tools all over the place, it's, it's not
15:39
the solution, right? You need something to be able to
15:42
aggregate all of that. You brought up the idea of
15:45
segregation of duties. To me that's the perfect
15:48
example. It's like how does somebody's
15:52
access relate across the enterprise and all these
15:56
different identity systems that give access to business systems
16:00
and do those capabilities? Or do you know, within your sets
16:06
of authorizations, do you have the ability to, you know, maybe
16:10
it's not commit fraud in the accounting sense, but do things
16:14
that you're not supposed to be able to do?
16:16
How would you even have the visibility to that given, you
16:20
know, a spattering of different tools in different places, or
16:23
tools that really just don't show the full scope of all the
16:26
access? App app app absolutely.
16:30
And this, this is the, is the big challenge.
16:32
And when you have the visibility, you're sitting on
16:36
all the identity related data. And then the next place starting
16:40
we, we recently released ISPN identity security posture
16:43
management for IGA 'cause when you have all this historic data
16:48
and then you have the current data and when you will be aware
16:51
about the future data, you can find out is there something on
16:55
going on that's smelly? Is there some deviation from
16:59
what this could look like? Let's say Jim McDonald is an
17:03
engineer and you have been an engineer in your company the
17:06
last 10 years and out of a sudden on a Sunday you get high
17:11
risk HR privileges. That seems not to be OK and I
17:15
can immediately make a proper remediation.
17:18
Some people might say, OK, that's now a corner case and
17:21
cyber attacker is preparing Jim's account and probably it
17:24
is, but see it from an from another angle.
17:28
You're assigning some authorization, some some roles
17:32
or policies to a new employee as as a manager.
17:36
And there are, you know, in the US, in Europe and everywhere
17:40
around the world, there are this very, very common names.
17:43
So you have this John Smith and there are probably at large
17:46
companies 20 or 30 John Smith and 10 of them are working in IT
17:50
and probably in the same, same department but not in the same
17:54
team. So the likelihood that you just
17:56
picked the wrong is quite, quite high.
17:58
Or giving you another example, the movers process and process
18:04
that's quite common. You're moving from Department A
18:07
to Department B and most of the time you have some obligations
18:12
to fulfill for your former team at least for the next month, two
18:16
months or for the next next quarter.
18:19
And this is a friendly collaboration.
18:21
So what happens? You're getting the new policies,
18:23
the new authorization, the new roles for your new department
18:27
and you will keep the old one. Does somebody really take care
18:32
about that you're getting getting removed from this
18:37
policies? Most likely not.
18:39
So the old manager doesn't probably really care 'cause he
18:45
has you all the time and probably he can approach you 5-5
18:48
months in the future and ask for help and the new manager will
18:50
probably forget it. So if you figure out, OK, that's
18:54
an, that's a move and I apply some dynamic policies on it and
18:59
I probably give them an, an, an end date and the rows are
19:03
automatically disappearing or before disappearing.
19:06
I'm asking you, hey, Jim, are you really using those
19:09
authorizations anymore? Do you need them in the future?
19:13
Then I can have an automated clean up across the company.
19:17
And this sums up in a really, really large work reduction
19:21
where managers don't have to refuse some things and confirm
19:24
some things. They don't have a clue.
19:26
And when I'm talking to customers or when I'm speaking
19:30
on a conference, I always laughed.
19:31
The example what's when you're a manager, what's the best thing
19:35
to do when you have an access review?
19:38
It's always saying yes. And I can tell you, I can tell
19:41
you why. The moment you say no, you take
19:43
something away from somebody. So you always risk that your
19:48
team is not working properly anymore.
19:50
And then you are the bad guy who kind of messed up the company or
19:53
messed up the process or probably messed up an important
19:56
delivery when you're just saying yes, that's not good from a
19:59
security perspective and that's really bad from an IM
20:02
perspective. But the likelihood that you are
20:05
the guilty guy who has said yes yesterday and the company will
20:08
be attacked tomorrow and basically you are the the guilty
20:12
one is super, super low. So most likely the kind of best
20:17
individual strategy is just saying, yes, you have less, less
20:20
work, you don't have to think and everyone is up and running
20:23
again. And from this kind of very human
20:26
behaviour, you have to get away from and provide systems that
20:29
are kind of incorporating the security and the safety
20:33
mechanisms that the company is secured without kind of human
20:38
interaction, so to say. Yeah, So interesting that, you
20:42
know, you brought up so many different use cases that
20:45
resonate with me. And I was trying to think of
20:49
what is the the, the Uber use case.
20:54
And I thought obviously large global organizations where
20:59
there's some level of decentralization happening and
21:02
identity systems are just by nature a little bit all over the
21:09
place. But then I was thinking, imagine
21:12
the private equity scenario where you have a a portfolio of
21:18
companies and maybe you're doing some level of shared service or
21:21
you have some people who have access across multiple companies
21:26
and you're pulling that data back.
21:28
I don't know. It just struck me as something
21:30
that would be an interesting use case for this type of
21:34
technology. One thing that you you also
21:39
mentioned that I, you know, just I want to pick on that term
21:44
platform for a minute and you guys you have a platform, right?
21:48
You have multiple capabilities within the platform.
21:52
And I was wondering if you kind of enumerate those for us so
21:56
that we have a better understanding of what is the
21:59
total product offering from Nexus?
22:03
Yeah. So yes, we do have a platform,
22:06
but I know also that some people don't like the platform term
22:10
cause platform can be gigantic, platform can be a a bit smaller,
22:14
a platform can be in, in, in between.
22:17
So whether it's a platform or not, I would say it's an it's a
22:21
great collection of capabilities that are playing together and
22:24
creating value for customers. From an pure Nexus perspective,
22:28
I would say it's a platform as a software product.
22:31
From an enterprise architecture point of view, referring to the
22:34
identity fabrics, I would say we are covering a lot of
22:38
capabilities within the identity fabrics and then you draw the
22:41
line around then this is this is our platform.
22:44
So we, we've been talking about the role in authorization
22:48
governance and the analytics piece where we help you to
22:53
handle access refuse, probably where we incorporate AI for
22:56
access administration, but also kind of role mining and role
23:00
discovery in order to help businesses to kind of clean up
23:03
the space. We, we have a very cool health
23:05
check format that's like going to the doctor, giving them a bit
23:09
of your blood and you get an examination later on an
23:11
examination report. And we're telling you what's
23:14
good, what's bad, and how you can improve within on a on a
23:19
written road map and strategy to get better.
23:23
That's really interesting. Can you tell me, let's hone in
23:26
on that health check, then we'll get back to my I'm sorry to, to
23:30
pull you all over the place, but I, you brought up the health
23:32
check and that sounds like, OK, there's something actionable
23:37
that people can do. Tell us more about the health
23:40
check. Absolutely.
23:42
And This is why I really love the the health, health tech.
23:45
So you're a big company and normally you are having a bit of
23:50
a feeling that your role and authorization landscape isn't
23:53
looking that good, but you don't have really a clue to convince
23:56
your management to get additional budget.
24:00
Your pain is probably not documented well enough to move
24:03
on. And this is where the health
24:04
check comes in. You get a Nexus subscription for
24:09
a short term of four to 8, four to 8 weeks either on SAS or as
24:14
in a container for on Prem, which makes it sometimes a bit
24:17
easier as you don't have to handle all the data protection
24:20
thingies as everything stays in in in your company, especially
24:23
for European companies. And then we help you to load in
24:27
a copy of your production. So nobody in the company has to
24:31
be afraid that the production environment will be messed up.
24:35
It's then a kind of a read only snapshot and then we do the
24:37
investigation and after we've done the investigation, there
24:42
are two potential outcomes. Option 1, you have done an
24:46
excellent job. Then you can't get off and
24:49
certificate from us on how you create your authorization
24:52
landscape. Looks like you can go to your
24:53
boss and say, hey, I'm I'm the man, I'm your man.
24:57
What about a pay raise or something like that?
24:59
Unfortunately, that's very unlikely that that's very
25:03
unlikely. So that far more likely cases
25:06
that we have some findings, but this is good for you as well as
25:11
an IM team or an IM practitioner manager whatsoever 'cause you
25:15
have this documented findings. OK, we have found your IM
25:19
landscapes looks like this. This amount of rows, this amount
25:23
of direct assignments. Most of the time it's kind of
25:26
quite messy to be honest, but we are not just finger pointing to
25:31
those things that are not looking well.
25:34
We give you also a road map on how to remediate things and how
25:37
to improve things with a kind of effort estimation and how you
25:40
can do it in a tool. So you're not going a bit bad
25:43
news to your management and saying, OK, that's that's the
25:47
bad news because nobody wants to hear bad news.
25:49
You can go to them with a solution.
25:51
You can say we found out that and we have now the proof that
25:55
we have really to take action on in order to make a proper
25:58
security within our company. And this is my plan, this is my
26:03
strategic road map on how to get rid of it.
26:06
And this is a very, very good starting point to have really
26:09
this data and fact based discussion, discussion within
26:13
the team and not a feeling where some probably have a good
26:16
feeling and some don't have a good feeling.
26:20
The cool thing is you can decide on your own.
26:24
So basically whether you go ahead with us or not, the health
26:29
check is a value on its own 'cause you have all the
26:32
examination results there, you have an road map there, what you
26:36
can improve. So you can use this, this all
26:40
this information for improving your, your landscape.
26:45
Enemy. I, I always compare it to real
26:48
doctor. So you go to the real doctor and
26:50
they take your blood and they examine your body and probably
26:53
they will say, Haiko, you're a little bit too heavy for your
26:57
size. You can probably eat a little
27:00
bit less fat and do a little bit more better nutrition, what
27:03
whatsoever. But after that, I can decide on
27:07
my own. Do I change my behaviour?
27:09
Will I increase my sport activities?
27:12
Will I change what I'm eating, something like that?
27:14
Or am I fine with it? So I'm not forced with the
27:16
results from the doctor nor our customers with the results from
27:20
our health check. OK, so you might have said it
27:24
but I and maybe I missed it. What is the charge to do the
27:27
health check? How much do I have to get
27:29
approved to pay you for this? That that's a good question.
27:34
So it depends on the number of identities and the company size.
27:38
Basically it's an always an individual offer.
27:43
But let me say this, for most of the companies, it's it's
27:48
something which can go either directly below a procurement
27:51
level or short, short above. So it's ideally for the end of
27:55
the year. Now it's November.
27:57
So if you're looking for a last term activity, the Nexus hedge
28:02
check that hits the nail. OK, that's good to know.
28:06
That's something that I think everybody should look into it
28:09
again, kind of go to nexus-secure.com/I DACI think
28:15
the information on the health check will be there.
28:19
Heiko, you, I so rudely interrupted you as you were kind
28:24
of describing the platform. I want to give you an
28:27
opportunity to pick up where you left off.
28:29
And I'm sitting here thinking you had mentioned the ISPMPS
28:33
earlier. I know you're going to save the
28:36
best for last, right? That's something I'm very
28:38
interested in hearing about as well.
28:41
So yeah, I, I already elaborated a bit on on ISPN.
28:46
What I really love within the ISPN is the license killer,
28:52
which is probably something you don't expect with an IM.
28:56
Why did we come to the license killer?
28:58
So we, we've started with ISPN that the one thing is assigning
29:04
you, whether it's dynamic or static policies for things you
29:09
are allowed to do that's good. But when you're not using
29:14
things, you should lose it. So use it or lose it as the
29:18
saying saying goes. And from that we said, OK, it
29:22
makes absolutely sense to figure out is an identity using the
29:26
authorizations the identity has been given.
29:29
Course, when not I can reduce it.
29:31
And then basically I'm following the principle of least privilege
29:34
on the one hand and reduce my security exposure out out there.
29:42
For a couple of systems, this works very well.
29:44
That's Microsoft, enter ID governance.
29:47
That's SAP in the cloud as well as all three and all those
29:52
systems that provide us the data directly or whether with an
29:56
access to the scene. There are applications out there
29:58
to be honest that just don't have information who's actually
30:02
using what in my application. But given that you can provide
30:06
us the data, we can ensure that we kind of cut down your
30:10
privileges, cut down your authorizations to the number
30:14
you're really using, which makes it easier.
30:17
And the less direct assignments you have, the better it is for
30:20
everyone. And then they come to the to
30:23
thinking, what does it mean if it goes down to zero?
30:27
You're not using the system at all.
30:29
And imagine a large enterprise with 100K or 200K employees.
30:33
How many employees have subscribed for this cloud
30:36
service, for this Microsoft add on for this kind of stuff and
30:40
this kind of stuff and not using it, but also not giving it back.
30:44
So have you ever heard someone approaching an IT team and
30:47
saying oh I have too much software, I have too much
30:50
privileges, please, please take it back.
30:53
So having is better than needing and this is the principle most
30:57
most employees are are working. So when we figure out there is
31:01
nothing left, we can remove you at all from the application,
31:07
which means we can give a license back.
31:09
And when you trusted the math with 100K or 200K headcount
31:14
company and we have just a fraction of those people that
31:17
are not using a certain SAS service Salesforce license or
31:22
something like that, it sums up in an into enormous amount.
31:26
And so this is really cool. And then we presented it to our
31:29
customers and also where we have this kind of discussions with
31:32
them when in the, during the signing phase, we've learnt that
31:36
so many IM teams are approached by license management.
31:39
So can you tell us about how people are using the software
31:43
your IM, you're giving all this kind of access thing is, can you
31:47
tell us more? And most of the time they have
31:49
been suffering and at the end they have to say, oh, no, sorry,
31:53
we can't. And you're now kind of kind of
31:57
covering this, this white spot and helping customers to follow
32:03
the principle of these privileges on the one hand and
32:05
on the other hand, saving costs at the same time.
32:09
I think he gave a really good overview in like the why of
32:16
Nexus and kind of like how you get the value.
32:21
Now I'm going to talk about the how in terms of like how it
32:25
actually worked, because you talked a little bit about how it
32:29
sits on top of an IGA system. It sounds to me like it
32:35
leverages a lot of the data that's in the IGA system.
32:39
The idea is then to provide managers with the information
32:43
they need so they can make good decisions during an access
32:47
review campaign, for example. I'm also wondering, is there
32:52
some kind of, so you're pulling data from the IGA system?
32:55
Are you pushing data back into the IGA system?
32:59
Going to talk to me a little bit about how that whole process
33:03
works. Absolutely.
33:07
You described it very well. So we're sitting on top on those
33:10
IM systems, a lot of IHIGH systems where we have very, very
33:18
mature connectors, certified connectors reading the data
33:21
route and writing the data back. So when we are changing
33:25
something, we can write it back at the same time, which is
33:28
important because otherwise you can't do any improvements or
33:31
remediations then you are trust on kind of read only system.
33:35
So, so to say the advantage is that companies save their
33:39
investment, they have kind of rolled out say .1 identity or so
33:43
then all the integration. So it doesn't make sense to do
33:47
it again with Texas. So when we are sitting top of
33:50
them reading out the data and kind of providing it back is
33:54
quicker for us, a shorter time to value for the customer and
33:58
saving a lot of integration, integration efforts when rolling
34:03
out new applications. It's always the question, so how
34:07
do we do onboard now an application into my IGA system?
34:11
And this is where our application onboarding comes
34:14
into play where we have this kind of very, very structured
34:18
process to collect all this data that's needed for doing a proper
34:22
integration into say .1 Identity, Savient, you name it.
34:26
Why? Why is that important when
34:28
you're talking to IGA practitioners and you have
34:31
probably done it so many times in the past, they are suffering
34:34
all with speed of application onboarding and with costs.
34:38
Coming back to a very, very simple example, doing the math,
34:43
you have two and a half thousand applications and you want to
34:47
onboard this 2 1/2 thousand applications.
34:50
And it takes just one day for doing a bit of conversation with
34:54
the application owner, sending him documentation, asking for
34:58
documentation back for some technical settings, but also for
35:01
business settings. In Europe, for example, there is
35:04
an finance regulation called Dora, the Digital Operations
35:08
Resilience Act, which requires regulated companies such as
35:12
banks and insurance companies to do a proper documentation about
35:15
SOD recertification cycles and this kind of stuff.
35:18
So it's a lot of things you have to collect and incorporate
35:21
somehow. And we've glued that into a
35:24
product. And now imagine you're doing
35:26
this 2 1/2 thousand time one day and you apply a Trulia
35:30
consultant and for the sake of simplicity, just let's say it's
35:34
$1000 a day, that the math is easy.
35:37
Then we're ending up with two and a half, $1,000,000.
35:40
A Trulia consultant is just asking people in the enterprise,
35:45
hey, can you give me this information?
35:47
And probably they won't react. They're giving you kind of
35:52
information in the format of choice, but not in the format
35:55
you can can really eat. And our streamlined process
35:58
helps exactly to to go there and kind of reduce the workload.
36:03
And at the end of the day, you have this kind of collected set
36:06
of information in order to either use the IGA soft IGA
36:12
software application onboarding tool that does all the kind of
36:16
connect the configuration or when you're working with an SI
36:19
or a managed services provider, they have often built their own
36:22
procedures on how do those to do those things very, very quickly.
36:26
You can use all the data you have collected with us, throw it
36:30
into these tools and kind of doing quicker on onboarding with
36:34
the sake of speeding up enormously.
36:38
One of the things that you've done throughout this episode is
36:41
really done a good job of kind of sprinkling examples
36:45
throughout. And one of the questions we
36:47
always like to ask our sponsors is how do customers show value
36:54
or how do they measure the value they're getting from the Nexus
36:59
solution so they can communicate upward.
37:03
You know, hey, this is the difference it's making.
37:06
This is why it's worth the investment.
37:10
Maybe you can kind of answer that question and again kind of
37:13
give some examples where you've seen your clients be able to do
37:18
that. Yeah, it's.
37:21
It's very manifold and very specific for the use case of
37:25
what a success look like and also a bit related to the
37:28
customer for sure. But let me pick the example of
37:32
excess refuse or policy refuse for recertification by for
37:37
regulated companies that have, this is a is a thing that you
37:40
have to do regularly, whether you like it or dislike it.
37:43
And most of the time this is one of the, let's say, Halloween
37:48
month or horror month for the IGA teams.
37:51
They have to prepare everything. They're reaching out to the
37:53
business departments and everyone has to give feedback
37:57
within 3 or 4 weeks to kind of finish your initiative.
38:02
And so one very important KPI for them is have things kind of
38:07
speed up and especially has the number of manual assignments
38:14
being reduced significantly. So when you can assign a lot of
38:17
authorizations via birthrights, via dynamic policies, I had
38:21
earlier the example that your assignments run out
38:25
automatically after 1/4 for example, or after you changed
38:28
your organizational unit, something like that, You don't
38:31
need that many certifications anymore recertifications
38:34
anymore. So the workload is significantly
38:37
reduced. And this is some KPI to measure.
38:41
Another thing is we had a customer also of finance
38:46
institute, they wanted to put everything into business roles.
38:51
So no individual assignment of entitlements or so.
38:55
And they had a big initiative and basically they succeeded to
38:59
do it that that way. And all those things you can put
39:02
on your KPIs and really measure whether you have been successful
39:06
or not. As my last example, I was
39:09
talking about application on boarding or the authorization
39:12
concept. And this is exactly the way
39:15
imagine for the authorization concept where you have to a
39:18
written documentation about your policies about refuse cycles and
39:23
so on. And you have to do this for 2
39:26
1/2 thousand, 1000 or even just 500 applications.
39:30
And you know, the tool of choice for so many people is Microsoft
39:34
Word and Microsoft Microsoft Excel.
39:36
It's a super flexible tool. You can do everything, but you
39:42
have boundaries quite, quite early.
39:44
So you're starting and at the moment you're you're ready, your
39:48
documents are outdated because your system landscape has
39:51
changed. Back in time 20 years ago when
39:54
everyone was doing waterfall and then there was probably 4
39:58
releases or three releases a year, you might have been able
40:02
to kind of align updating your documentation with that release.
40:05
Now everyone works in an HR mode.
40:07
HR teams are continuously releasing and every basically
40:12
everyday something is changing in an enterprise IT landscape.
40:18
And so it's an never ending story and it's a nightmare.
40:21
Imagine you have now a system that basically gives you an
40:26
audit when a non compliant situation pops up.
40:29
So you can measure this documentation is not compliant
40:32
anymore. You get a red traffic light.
40:36
You can work on it and kind of move back into a compliance mode
40:39
and reduce the time of being not able to have your proper proof
40:44
of audits that you have to show up to the to the auditor, for
40:49
example. Yeah, of course.
40:51
So I want to shift the conversation a little bit.
40:55
And we always have one question. I I feel like if we finish this
40:59
episode and I don't ask a question, I'll be I'll feel like
41:03
I missed out. So how did you come up with the
41:06
name Nexus? And it's NEXIS.
41:11
Yeah, so I didn't came up. So the founder of Nexus and my
41:15
successor Ludwig Ludwig folks who did also his PhD by the way,
41:19
at the same university in in Regensburg, which is Munich
41:23
metropolitan area. And I started the business and
41:28
had to look for a company name. And this is at least what he,
41:32
he, he told me all the the scientists and they do have a
41:36
research project. They are inventing this funny
41:39
names, approvating some things and sometimes the approvation is
41:45
a match and sometimes it's not a match.
41:48
And so basically it was Next Generation Information Security
41:52
Systems and now you get it. There is no Qi in Nexus.
41:56
But anyway, that's some kind of scientific work play.
42:00
Originally it was Next Generation Information Security
42:04
Systems, now it's Nexus and as I said, NEXIS.
42:09
I love it. That's great.
42:11
So you mentioned also Munich, is that in Germany where you are
42:16
headquartered? So we were headquartered in
42:19
Regensburg, which is an old medieval city going back to the
42:23
to the Romans, which is 100 kilometers north of Munich where
42:28
I'm living. So it's Munich metropolitan
42:30
region from AUS perspective. Perspective, it's just a suburb
42:35
of Munich, so to say. You know, as you're talking
42:38
about the solution today and kept thinking to myself like
42:41
this is needed by pretty much every organization that is of
42:46
any kind of that is sizable. Is the solution focused on the
42:54
European Union or is it applicable?
42:57
Do you basically market your product to the United States and
43:03
Canada or what are the limitations in terms of what
43:07
geographies should cover today? So basically it fits for
43:14
customers around the globe. That's the important message.
43:17
And then I started back at Nexus beginning of the year, I did a
43:23
lot of travelling, meeting a lot of people also in the US
43:25
attended various conferences, was talking to customers, was
43:30
talking to systems integrators also to get my own perspective
43:33
on what they are, are, are are saying.
43:35
And it's absolutely clear, as you said, it's, it's a match for
43:39
US customers, for North American customers, for Europeans and for
43:42
APG customers. So for customers around the
43:45
world, our our roots have been determined Truman speaking
43:50
region as Nexus was and this is probably a story that's
43:54
different to so many of your guests here in the podcast.
43:58
Nexus was not an NBC based company.
44:01
It was bootstrapped without any money and kind of running up and
44:07
by Ludwig, Michael Matthias and and and the team, which is a
44:11
great success story being there 15 years and the market and
44:16
having done you think becoming mentioned that Gardner without
44:21
getting a big load of money where you can invest in the
44:23
product. On the other side when you do
44:25
so, you don't have this really big sums for GTM for sales and
44:31
marketing to kind of pop offices around the globe.
44:34
This was not done in the past, but the team started two years
44:38
before forever starting three years to kind of professionalize
44:42
all all this scale or to prepare the scale up phase, so to say
44:47
hiring, marketing, hiring sales and approaching the global
44:51
market. And now we've get probably an
44:54
extra traction on on on top of it scaling across Europe and
44:59
talking to US customers as well, those who are listening and
45:04
those who will be attending. Gardner, I am in Dallas.
45:07
Michael and I will be there as well.
45:08
And we're more than happy to meet or having a coffee without
45:11
any sales talk, but just from an identity enthusiast perspective.
45:17
So it's always great to talk to identity people.
45:21
Yeah, I saw that you had that on your LinkedIn bio or your title
45:25
identity enthusiast, and I'd love that.
45:27
You know, I, I put on their identity practitioner because
45:31
that's how I see what I do professionally as like I'm
45:35
writing the game with folks who are doing it on a day-to-day
45:40
basis. And I am as well from a
45:42
consulting perspective. But I just look at us as we're
45:46
all fighting the same battle. You mentioned conferences.
45:50
You and I spent some time together at Eici think that's a
45:53
fantastic conference. I did want to bring up the
45:56
Gartner conference. So if people want to reach out
45:59
to you to meet you at any of these conferences, what's the
46:03
best way to do that? What's the best way to do so?
46:07
Either drop me on a message on LinkedIn.
46:10
I'm the only haiku cloud out there, so I'm quite easy to to
46:15
to to find. We can put the schedule link or
46:18
a contact link on nexusminusck.com/idic as well,
46:24
so that's probably the easiest way to to reach out to me.
46:29
Yeah, that's fantastic. And I know you're somebody who
46:33
is like a kind of an open network or so anybody who's kind
46:36
of in our industry, if they connect to you on LinkedIn,
46:40
you're always open to those kind of conversations.
46:44
The one thing that we like to do kind of our tradition around
46:47
here is to always end on a lighter note.
46:49
And I've been to Germany a few Times Now.
46:52
I've been to Frankfurt and I've been to Berlin.
46:56
I've never been to Munich, but putting all that aside, I want
47:00
to know from you, what is the thing in Germany or the place in
47:05
Germany that people should visit?
47:11
I would say that's for sure Nexus headquarter, Reddis Bone
47:15
at the Danube River and and Munich and I can tell tell you
47:19
tell you why. So Munich is a great, great,
47:23
great city, the right size, very international.
47:26
We do host Oktoberfest, which is a great event for so many people
47:31
out there and it has the right location within Germany, so it's
47:37
a short way to the Alps, to the mountains for those who like
47:39
hiking. It's not that far to Italy,
47:43
where you can go either to the sea or enjoy the mountains as
47:47
well. It's a little bit more up into
47:49
the north to the North Sea and Baltic Sea, but it's a very
47:55
lovely place and why it's Ratisbone, Ringsburg, our our
48:00
headquarter, not just because it's it's Nexus head
48:03
headquarter, but you're more than welcome to visit us in case
48:07
you are you're doing some tourist stuff stuff there.
48:12
It's an old mediable city going back to the Roman times.
48:16
That was my my friend Andrea Rossi from your mount visitors
48:21
us just a few weeks ago during our customer custom event and
48:26
the summertime as well. And it's feels like an Italian
48:30
city and all the things that are looking like they are old, 506
48:36
hundred years, they are really old.
48:37
So for especially for Americans that know very very new and
48:43
modern city with with a great skyline, Ringsburg is probably
48:49
the opposite, being there in an in a time machine experiencing
48:53
an old medada diversity that was not destroyed during the war.
48:58
Yeah, that sounds really great. So Andrea visited it sounds like
49:03
right around Oktoberfest, right? I mean, that's the time to come
49:06
to Munich and well, I think that's it's either the time to
49:11
come or the time to avoid What what do you say?
49:15
So I like Oktoberfest very much. So I would would say it's the
49:19
right time to to come back. Prices are are high for for
49:23
example, and you have to take care to kind of adopt your
49:28
drinking to Oktoberfest style in the sense the beer is larger and
49:32
the beer is stronger. So most likely you can't drink
49:35
as you're used at home and have to slow down a bit to be fit for
49:38
the next day of Oktoberfest as well.
49:40
But if Oktoberfest doesn't work out, then Oktoberfest is at the
49:44
end of day of September, which is off my voice friend and a
49:48
trap. The summertime is is really
49:51
nice. So in end of September it's
49:53
getting already cold, but in July, August the temperatures
49:57
are quite high and nice and it's not as hot as in other places
50:01
where you can't go out without any AC or so.
50:06
This is a great time for visiting both Leesburg and and
50:09
Munich. You know, it sounds like very
50:12
wise advice and hopefully we all get an opportunity to take you
50:17
up on that and come over and visit.
50:20
Was there anything else FICO that you'd like to leave as kind
50:24
of like parting advice or parting words for the identity
50:28
practitioners who are just learning about Nexus and what
50:31
you do? So there is a new report out
50:37
there fresh from the press from Martin, not from Martin
50:41
Kupinger, but from Copinger Coal analysts, from the analyst
50:45
literature and executive view on Nexus.
50:48
We'll put it up to the Nexus minor seeker.com slash idic
50:53
website as well, which is a great read.
50:56
Basically what we've been talking about today written from
50:59
the analyst perspective in three to four pages.
51:02
So it's a quick read when you're commuting or when you have just
51:06
a free, a couple of free minutes to to work through.
51:09
I think that's that's really great.
51:11
Otherwise, I said I'm regularly attending a variety of
51:15
conferences. I'm attending identity as well.
51:17
And Enrique, our joint friend is organizing one very, very likely
51:22
for Gartner. I am as as well.
51:25
So be there if you see me, if you recognize us, say hello,
51:30
hello. And I'm more than happy to have
51:32
and and chat, whether it's about identity or any other topic
51:36
you're interested in. I'll definitely be there.
51:39
So add me to the list and if you get a chance, if you're out of
51:43
Gartner, please come out and meet us.
51:46
Thank you so much for doing this, Haiko.
51:48
One more time for everybody's Nexus Dash secure slash idac.
51:52
You'll have that paper from Cooper Cole there for folks to
51:57
get a copy of, which I think is fantastic.
52:01
Those papers that Cooper and Cole puts out are always top
52:05
notch. That's going to wrap up the show
52:08
for this time. Find us on the web at
52:10
idacpodcast.com. Find us on YouTube by just going
52:14
to idacpodcast.tv. And we'll talk to you all on the
52:19
next one. You've been listening to
52:23
Identity at the Center. We hope you've enjoyed the show.
52:27
Make sure to like, rate and review, and we'll be back soon.
52:32
But in the meantime, hit the website at
52:34
identity@thecenter.com. See you next time on Identity at
52:40
the Center.