Latest / Identity at the Center / #239 - Authenticate 2023: Machine Identity with David Mahdi of Transmit Security

Transcript

#239 - Authenticate 2023: Machine Identity with David Mahdi of Transmit Security · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with
• 0:10
  IAM, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Stedman. Welcome to the Identity at the
• 0:23
  Center podcast. I'm Jeff and that's Jim.
• 0:25
  Hey, Jim. Hey, Jeff, How's it going?
• 0:27
  Not so bad yourself. It's going great.
• 0:29
  Did you know that I was on stage for the keynote here at
• 0:32
  Authenticate today? I did 'cause you were sitting
• 0:35
  right next to me. Pretty fantastic, huh?
• 0:38
  Yeah, it was cool. Yeah, good time.
• 0:40
  First time having done that. A little bit rushed, but I think
• 0:43
  that's just the nature of going last in a long sequence of
• 0:45
  activities. But yeah, pleased with the way
• 0:48
  it turned out about yourself. Yeah, it was fantastic.
• 0:50
  It was a lot of fun. I think that we're going to save
• 0:55
  that. We're going to get the recording
• 0:56
  of that. And then drop that as the last
• 0:59
  episode from Authenticate. We'll do that at the end of next
• 1:02
  week. So anybody who's interested in
• 1:05
  listening to that, we had a, you know, it's a pretty short, power
• 1:08
  packed episode, really focused on past key deployment.
• 1:11
  Yeah, it was like the Cliffs Notes version of an Identity at
• 1:14
  the Center podcast. Yeah, very much so.
• 1:17
  But it was fun. It was like.
• 1:19
  Big crowd. I think it was the we set the
• 1:21
  record for the most people listening to our podcast at one
• 1:25
  time. Yeah, which wasn't probably too
• 1:26
  hard, I don't think. But no, probably not.
• 1:28
  Hey, we got to start somewhere. I at least I'm, I'm happy
• 1:30
  because I got my shout out to Nick, the Segway camera guy who
• 1:33
  is, I'm sorry, Andrew and Megan and Adrian others, but he's the
• 1:36
  reason I really came to authenticate.
• 1:38
  The guy's a star. I mean, he's on a Segway.
• 1:40
  He's got like this gimbal with like cameras and stuff like
• 1:43
  that. He's zooming all around the
• 1:45
  room, back and forth. I mean, that's that guy's a
• 1:47
  superhero right there. But it's not even like it's not
• 1:49
  even like a Segway like you see in San Francisco with handles.
• 1:53
  It's more like one of those things that preteens stand on
• 1:58
  and zoom all over your house in. What does this ball and hit
• 2:00
  their face on hoverboard? I mean, I don't think they call
• 2:02
  them hoverboards, but it's not, it's not a hoverboard.
• 2:04
  I saw Back to the Future. That's not a hoverboard.
• 2:08
  So what are you thinking about the conference overall?
• 2:12
  That's good. I'm glad to have gotten through
• 2:14
  our thing, and now I can feel like I can enjoy the conference.
• 2:18
  Yeah, it feels like I, I say probably true for anybody.
• 2:23
  When you're getting on the keynote stage is a little nerve
• 2:25
  wracking, so. Yes.
• 2:29
  So we've got also a guest here sitting with us in this room,
• 2:33
  couple of fine folks also watching us, staring in
• 2:35
  intently. We got David Mottie, He's the
• 2:37
  CIO for Transmit Security. He's been on a show with us
• 2:39
  before. Hey, David.
• 2:40
  Hello. How's it going?
• 2:42
  It's going and and I just wanted to make a comment about the
• 2:46
  gentleman that's on the the Segway, Nick.
• 2:49
  Yeah, respect his name. Nick, I'm going to go well, I
• 2:52
  haven't met him personally, so so I so I appreciate that.
• 2:55
  But I'd say maybe it was almost like the thing in Aliens, but
• 2:58
  not. Yeah, like the exoskeleton it
• 3:01
  seems. Like an exoskeleton to me, and
• 3:04
  I'm just waiting for him to press the button and to turn
• 3:06
  into something. Much more.
• 3:08
  You guys are so sci-fi I. Don't know what you're talking
• 3:12
  about. Yeah, that's.
• 3:14
  What they meant. Well, maybe that's why I got in
• 3:16
  the identity space because I thought, you know all the
• 3:18
  biometric scanners and everything they had in in all
• 3:21
  the sci-fi movies in the 60s and the 70s, you know, we would get
• 3:24
  that eventually. Yeah, you can make it real.
• 3:26
  We're actually here now, we're actually here with biometric
• 3:29
  scanners and passkeys and all these types of things, so.
• 3:32
  Yeah. I spent an awful lot of time at
• 3:35
  a conference last week. At any week that was.
• 3:37
  Almost 100% like retina scan. Oh, really?
• 3:40
  That was like that. I mean, it's a big kind of used
• 3:41
  to be government conference. I think they're trying to branch
• 3:43
  out more. But yeah, lots of retina scan
• 3:46
  products on offer for whatever authentication needs you need.
• 3:52
  I mean that's we've come a long way in a short period of time
• 3:57
  and just how all the stuff is in like these consumer devices when
• 4:00
  not long ago you'd see them in movies and go, Oh my gosh,
• 4:03
  there's Tom Cruise and Mission Impossible One.
• 4:06
  And he can't set off the biometric scanner or else the
• 4:08
  room is going to explode, right? And now you can just go and buy
• 4:11
  a phone that has that in there, so.
• 4:13
  Yeah, Can you imagine how ridiculous of a hack that would
• 4:15
  be? And, like in the real world, Tom
• 4:18
  Cruise coming down through a vent, right?
• 4:20
  Dodging the fans and then can't hit the laser floor?
• 4:23
  Like, no, today it's just someone stole your password
• 4:25
  because you used it at Instacart.
• 4:26
  Yeah, exactly, exactly, exactly. It doesn't need to be that
• 4:30
  elegant. It never is.
• 4:31
  The movies always do that and someone calls the help desk.
• 4:34
  Initiates a reset and bang, you're done so.
• 4:38
  Or your slot machine's not working anyway.
• 4:41
  So tell us about your role as a CIO.
• 4:43
  You've been on the show before. It's not going to have you
• 4:44
  rehash sort of like your entire identity origin story.
• 4:48
  But one of things that we have started getting to more is about
• 4:51
  roles within identity organizations, York or transmit
• 4:54
  security and you're the CIO. We also were kind of jokingly
• 4:58
  talking about the Chief Identity Officer.
• 5:00
  Cheeto is, we're starting to call it, at least I am anyway.
• 5:03
  And so is Jim. Tell us a bit about your
• 5:05
  day-to-day as a CIO of a security company like Transmit.
• 5:09
  Yeah, so. So the CIO of security company,
• 5:13
  I mean obviously the dynamics are a little bit different.
• 5:17
  I know things like machine identity are really important to
• 5:20
  us because we see that as protecting the identity
• 5:23
  infrastructure. That we host for clients and
• 5:27
  especially building identity security solutions.
• 5:30
  Attackers are looking at all this stuff more and more and
• 5:33
  more. We see that with Okta,
• 5:34
  unfortunately and others and Pam Dingell from Microsoft.
• 5:37
  Today at Authenticate, she talked about that.
• 5:40
  She talked about how identity infrastructure itself is being
• 5:44
  weaponized against us. So as the CIO of a security
• 5:47
  company, you know myself and the team, we take it seriously,
• 5:51
  right? So just practicing everything
• 5:53
  that we're preaching with customers.
• 5:55
  But it goes beyond you know technology it it goes along with
• 5:59
  your people and your process and and how you drive all those.
• 6:02
  So, so kind of being in that type of role, I look at kind of
• 6:05
  all three of those areas and you know, I don't always look for a
• 6:09
  technology to solve the problem, right?
• 6:12
  Sometimes it's just changing a process or improving a process
• 6:16
  or having someone do another review making sure it goes
• 6:19
  through certain gates right and there's a consistent workflow
• 6:23
  all the way through. Again, almost like the Tom
• 6:25
  Cruise thing, it's not always the elegant things that you
• 6:28
  think are going to save the day. It's sometimes just actually
• 6:31
  taking a look at a a workflow and improving it and kind of
• 6:34
  going from there. So, so in in this kind of role
• 6:36
  it's it's kind of neat because I get to have this internal focus,
• 6:39
  but I think where I have a lot of fun also is.
• 6:42
  The external part of my role kind of doing activities like
• 6:45
  this with with you guys and and evangelizing all of these things
• 6:48
  as well, 'cause I don't think Transmit would be able to keep
• 6:51
  my mouth shut, 'cause I'm the kind of person that I'm like,
• 6:54
  hey, I discovered these really cool ways of of of dealing with
• 6:58
  problems or you know, our threat research lab is seeing evidence
• 7:02
  of some more AI fuelled fraud. I feel like I I should go and
• 7:07
  talk to the market about that, especially when.
• 7:11
  You know, I talk about things like authorized push payment
• 7:13
  fraud, which, you know, I talked to someone about that.
• 7:16
  I don't know if you know anything about it, but it's
• 7:17
  interesting it's being able to attack you without doing an
• 7:21
  account takeover. So anyway.
• 7:26
  I thought about Pam's presentation today was she was
• 7:29
  talking about the evolution of the Microsoft Authenticator and
• 7:34
  I thought. That's exactly what technology
• 7:37
  companies need to be doing, right?
• 7:38
  They need to see put something out there and see what the
• 7:42
  challenges are and they need to just keep improving, keep
• 7:45
  improving. Is that something you're finding
• 7:47
  as well? Yeah, so, so I, I also take it
• 7:51
  upon myself and my role as well to see that.
• 7:53
  So it's not just, you know, going out and evangelizing and
• 7:56
  pushing. It's also pulling and.
• 7:58
  And working with a lot of identity practitioners,
• 8:00
  cybersecurity leaders as well, because cybersecurity pros and
• 8:04
  identity pros, we need to come together because attackers
• 8:07
  don't. They don't care if you're an
• 8:08
  identity person or a cybersecurity person or a
• 8:11
  network infrastructure person. They'll get it in however way
• 8:13
  they they can. So I think as as in terms of,
• 8:18
  you know, thinking about what the problems and the outcomes
• 8:22
  that customers need, right, don't just go and say here's an
• 8:25
  identity verification solution. It's like, well, why does the
• 8:28
  customer need that? Oh, because they're trying to
• 8:31
  securely on board their, their clients and they want to reduce
• 8:34
  fraud and they want to also make it easy for their clients to
• 8:37
  securely create accounts, right. So, OK, well, maybe we come up
• 8:41
  with a product to solve part of that because that's all we can
• 8:44
  do today and maybe that's all the market will bear.
• 8:47
  But over time, talk to these customers, see what the market's
• 8:50
  doing, but then also going back to like APP fraud and all this
• 8:53
  looking at what the fraudsters are doing.
• 8:56
  And also trying to incorporate that stuff in your product as
• 8:59
  well. So it's not just the customer
• 9:01
  saying, oh, we see this. We also have to take it upon
• 9:04
  ourselves to say what types of threats are out there and how
• 9:08
  can we, how can we mitigate and and productize that to help
• 9:12
  protect the market. So you do a podcast also, right?
• 9:16
  Yes. Yes.
• 9:17
  This Week in Identity, Yes, with Simon Moffett from Cyber Hut.
• 9:21
  Tell us a little bit about that podcast.
• 9:22
  Yeah, that's awesome. So Simon, we, you know we're,
• 9:26
  we're, we're fans of you guys too.
• 9:27
  And you know for us, I think Simon is an analyst, I'm a
• 9:32
  former analyst. So I think when I left Gartner
• 9:35
  and and Simon kind of left the vendor space and he got into the
• 9:39
  analyst space, you know, we kind of got together.
• 9:43
  He was at Ford Rock. Yeah, yeah.
• 9:45
  And so it's kind of interesting because as I was leaving the
• 9:49
  analyst life behind me. And he was picking that up.
• 9:53
  We had a, we had a a talk. I gave him some pointers on, you
• 9:56
  know, good things and bad things about being an analyst, just
• 10:00
  pointers, things I've learned over the years as in terms of
• 10:03
  what what works. And and we just said, hey, you
• 10:06
  know what, Let's just. Why don't we just record this
• 10:09
  right? I I think it's not on like both
• 10:11
  of you. Right.
• 10:13
  And then we just decided to record it and I I honestly just
• 10:18
  see it as a way of us just catching up every, every week
• 10:21
  and hey what happened in, in the industry you know typically
• 10:24
  focused on news, you know acquisitions or you know new
• 10:30
  protocols or specs or? Last week, we talked about NSA
• 10:34
  and Cisa's top 10 misconfigurations.
• 10:38
  I listened to part of that and then I was listening in my
• 10:40
  browser and somehow lost the page.
• 10:43
  But I'll get back to it. Don't worry, it was a good one.
• 10:45
  Yeah, right. So it's just stuff like that and
• 10:47
  and I think it's we try to keep them short.
• 10:50
  So you could just, yeah, listen, listen on a quick walk or or
• 10:53
  something like that. So yeah.
• 10:55
  Yeah, I have a question for you. So we've been podcasting.
• 10:57
  We're up to. Episode 230 XI Think it's. 238
• 11:01
  went out this morning. OK.
• 11:03
  So this will be 239. It's a lot harder than you
• 11:07
  thought it was going to be. That's a good question.
• 11:12
  Now I should say Simon, Simon does some of the heavy lifting
• 11:16
  as in terms of recording and everything else.
• 11:18
  So I'm just a pretty voice that shows up so.
• 11:22
  You're the easy. Part Why?
• 11:24
  Yeah, that should be a question I'm asking.
• 11:26
  Simon actually had this. I do all the scheduling.
• 11:29
  Scheduling is a lot of work, that is.
• 11:31
  A lot of work, especially when your Co host travels all the
• 11:34
  time. Yes, he does dirty laundry.
• 11:37
  Coming out, but let me just say for the audience, because we're
• 11:39
  not on video. Jeff Jeff is surrounded by all
• 11:42
  kinds of devices, not unlike Nick who is on a Segway with all
• 11:46
  sorts of contraptions around him.
• 11:47
  No, but. But I I appreciate.
• 11:49
  I appreciate it for sure. So your topic this week here at
• 11:54
  Authenticate. Why don't you tell us what it is
• 11:57
  and why you chose it, why you're talking about it?
• 11:59
  Yeah. So the topic is an area that I'm
• 12:03
  super passionate about. It was an area that myself and
• 12:07
  Eric Wahlstrom, who's a Gardner analyst, we.
• 12:10
  Kind of help define this space and it's machine identity
• 12:13
  management. Specifically the presentation
• 12:17
  I'll be doing on Wednesday at Authenticate is Rise of the
• 12:20
  Machines. Why Authentication is needed for
• 12:22
  both humans and machines. And really the the thought there
• 12:27
  is that we've spent a lot of time with identity as and as we
• 12:33
  should focus on humans. And totally makes sense, right.
• 12:37
  All all this, all these types of authentication factors, how we
• 12:40
  use them when we talk about UX, user experience, but the users
• 12:44
  have been human, right. And so when we, when we think
• 12:49
  about machines really what what those are, it's it's there's
• 12:54
  kind of software and hardware, right.
• 12:56
  There's kind of two flavors. So if we say hardware, you're
• 12:58
  talking I0T, 0T0 T would be operational technology, so MRI
• 13:04
  machines or? Other types of manufacturing
• 13:06
  equipment, ultrasound machines, you name it, that's OTIOT.
• 13:12
  You know, different types of sensors, all all sorts of
• 13:13
  things. That's on the hardware side.
• 13:15
  Oh, I should also say laptops, desktops, mobile devices.
• 13:18
  Devices. Devices on the software side
• 13:21
  though, that's where things get really interesting.
• 13:23
  And not to say that the hardware side isn't interesting, but
• 13:26
  software side, you've got virtual machines.
• 13:30
  You've got containers, you've got workloads, you have
• 13:32
  software, you've got, you know all.
• 13:34
  Kinds of structure and software. Exactly right.
• 13:38
  So if you just think about the. Good old fashioned service
• 13:41
  accounts. Service accounts.
• 13:43
  All kinds of things that aren't, quote UN quote, human right Now
• 13:47
  there's a couple flavours of that too, I should say.
• 13:49
  There's supervised and unsupervised.
• 13:53
  So what do I mean by that? So a supervised machine.
• 13:58
  You could think of it this way. So if Jeff creates a script to
• 14:04
  run on your machine that's that's or on your say your
• 14:07
  laptop, that's a machine. But that machine effectively is
• 14:11
  borrowing Jeff's rights and entitlements, right?
• 14:14
  It's it's ceiling would be whatever access you have.
• 14:17
  And I have to initiate it at some level to start the work,
• 14:20
  correct? Or you could create a bot.
• 14:23
  Yeah, right. Like where I could learn, but
• 14:26
  it's it's it's going to be like a derivative of your identity.
• 14:28
  So it's kind of like it's, it's it's Jeff, but just a robot
• 14:32
  version of you. And so we say it's kind of
• 14:34
  supervised. You're not going to really let
• 14:36
  it do anything crazy. Hopefully not.
• 14:38
  Hopefully not that's supervised, unsupervised could be like a
• 14:42
  chat bot on a website, say you go to like, I don't know,
• 14:45
  T-Mobile or Verizon's website. And just by virtue of you going
• 14:48
  there, it's typically event driven.
• 14:50
  The event is a new user goes to website and boom, a chat bot
• 14:53
  pops up. Hey Jeff, last time you were
• 14:55
  here, maybe use a cookie. You had a problem with your
• 14:59
  bill, right? So that machine didn't exist
• 15:03
  before you went to the website, and now it exists.
• 15:05
  It's taking signals from whatever trans whatever transmit
• 15:10
  of data is coming from your browser or whatever signals
• 15:12
  right to drive that. For the record, I hate those
• 15:14
  chat bots that pop up automatically.
• 15:15
  They are the most annoying thing in the world.
• 15:18
  They, you know, they some of them, I won't name the
• 15:21
  providers, but some of them at some providers have actually
• 15:23
  gotten much, much better and I would say they've definitely cut
• 15:27
  down on my stress having to call into call centers.
• 15:30
  If they're helpful, yes. I run into so many of that.
• 15:33
  It just sends you a loop and loop and loop.
• 15:35
  It's like, OK, well, I could have just, I could have just
• 15:37
  made a phone call. Yeah, and you know the How many
• 15:40
  questions do they actually solve?
• 15:43
  I mean, they're basic, right? I think if you're thinking about
• 15:45
  a chat bot. As it stands today, they are
• 15:49
  event driven to you're saying and they are basing off of a
• 15:53
  specific challenge response. Essentially that's coming from
• 15:57
  the user. They're looking for keywords.
• 15:58
  They're saying oh you typed in bill and problem.
• 16:03
  So therefore you must mean this help desk article that is you
• 16:07
  know Dash 4657, whatever maybe And then it starts going through
• 16:10
  that script right of things. The challenge becomes, well, I
• 16:14
  think it's the challenge is. You're trying to deal with a
• 16:16
  whole bunch of humans and a bunch of different ways of
• 16:18
  saying I need help with my account.
• 16:21
  Yes, yeah. But I mean, I won't get too far
• 16:24
  ahead, but if you take that notion, Jeff, and you connect it
• 16:28
  to a large language model. Baby, that's what I'm talking
• 16:30
  about. So before they didn't really
• 16:32
  have much to reference when that bot was right.
• 16:35
  So. So I think, I think, Jim, a
• 16:37
  basic script and whatever. And if it goes off that script,
• 16:39
  the thing just doesn't know what to do.
• 16:42
  And so you get frustration on the consumer side.
• 16:44
  Plus, you know. Who knows what goes on the other
• 16:46
  side, but if you couple that with an LLM, now you get
• 16:49
  something interesting. So that being said, going back
• 16:52
  to machines, this is also, you know, this is also why I think
• 16:58
  just before the session, by the way, for our audience, Simon
• 17:00
  Moffett went over some data. Survey data and machine
• 17:04
  identities is one of the thing he talked about.
• 17:06
  And and I know we can get to that, but I'll I'll just say
• 17:10
  this is also I believe at least what Simon's thinking is in
• 17:13
  terms of this is. Machine identities are just
• 17:15
  going to explode when you think about containers and all that
• 17:18
  stuff. But not only that, I also think
• 17:20
  about that that robotic process automation use case, the chatbot
• 17:23
  use case, and how many agents, you know, autonomous agents
• 17:27
  we're going to see deployed in those scenarios tied with LLMS.
• 17:32
  That's only going to fuel more machine identities.
• 17:34
  So I'll cover this in my presentation, but you're looking
• 17:37
  at, you know, at least 50 X. The number of machines you have
• 17:43
  running in your environment over humans today.
• 17:46
  I do worry about the large language model with the chat bot
• 17:50
  if you need to have good security about around it, right?
• 17:53
  Or others. Otherwise, someone may just
• 17:55
  start attacking that thing with an AI bot, trying to see what
• 18:01
  kind of data could farm from that chat bot. 100%, right.
• 18:05
  So it's not unlike when you think about the early days of.
• 18:10
  Web applications being put up and then people just putting in
• 18:14
  you know. Yeah strings of text.
• 18:16
  Sequel injections commands. And then if they didn't filter
• 18:20
  those, it would just run those commands.
• 18:21
  I mean a machine is a machine. A machine's not smart on its
• 18:24
  own. It's just going to you give it
• 18:26
  something to to execute and if it's in the confines, that's
• 18:29
  fine, it'll do it. So that that led to the birth of
• 18:32
  the web application firewall filtering all those out.
• 18:34
  I think we're, you know we're we're we're at the place where.
• 18:38
  There are some interesting companies that are looking at
• 18:41
  that type of concept, you know to to front load and filter
• 18:45
  those LLMS, the inputs and even the outputs.
• 18:49
  But I think I think Jim we're still very early on in those
• 18:52
  days. But it it does if I just tie it
• 18:55
  back to machine identities, you know it it does come with if
• 18:58
  you, you know, if you think about the notion of having good
• 19:01
  IAM with your humans, if you've if you went to bat for that at
• 19:05
  your company. You should be going to bat for
• 19:08
  that for your machines. You know, I feel like at least
• 19:12
  10 years ago we were defining I am as ensuring that the right
• 19:17
  people have the right access to dot, dot, dot and it's like that
• 19:21
  was the huge miss, right. It wasn't just people, it was
• 19:24
  people and things. We kind of eventually got to
• 19:27
  that. But you know, one of the things
• 19:29
  that I find is like the the things that you almost forgot
• 19:33
  are the machine accounts. You almost forgot to get to
• 19:36
  where. The service accounts, right,
• 19:38
  Because they've been around for so long, it's like that's not
• 19:41
  the exciting thing anymore. The organizations have 20 years
• 19:45
  of machine accounts that they've been carrying through their
• 19:47
  Active Directory, and they don't even know which ones they can
• 19:50
  turn off. It's kind of scary.
• 19:53
  They've got the whole clean up of that.
• 19:55
  And if they don't get their arms around the accounts for
• 19:57
  Terraform, the accounts for Docker, the accounts for GitHub.
• 20:03
  It's going to be, they're going to have clean up for all that
• 20:05
  too. And they're just like you said,
• 20:07
  the attack service is going to grow exponentially.
• 20:10
  Exactly. And and yeah, so that's that's
• 20:13
  part part of some of the recommendations I get into in my
• 20:15
  presentation there this week. That's actually step one is
• 20:20
  discovery. So you can't manage what you're
• 20:23
  not measuring. And a lot of people have
• 20:25
  machines all over the place, right?
• 20:28
  You know, So there's there's service accounts.
• 20:30
  If they're using AWS and GCP and Azure, right?
• 20:35
  And some other cloud service providers and maybe fragmented
• 20:38
  across different regions. If they're a global
• 20:39
  organization, they're going to have all kinds of machines
• 20:42
  everywhere. So you have to run some kind of
• 20:45
  discovery process in order to say, OK, what machines do we
• 20:48
  have out there. So we can at least size the
• 20:51
  problem and then you can determine how can we monitor
• 20:54
  these things and then manage and so on and so forth.
• 20:57
  I think also there's the difference between identities
• 21:02
  and accounts, right? There's certainly that when you
• 21:04
  think about people. I'm Jim.
• 21:07
  I have an AD account. Maybe I'll have multiple AD
• 21:10
  accounts. Maybe there are multiple a DS.
• 21:12
  Maybe there are applications that fit outside of my IDP
• 21:16
  landscape. Machines are even more complex
• 21:19
  because you have a machine that could have multiple accounts.
• 21:23
  There's a machine, the identity or is it the human who runs the
• 21:27
  machine, and if you make it, the human who runs the machine when
• 21:31
  they leave the organization? From a governance perspective,
• 21:34
  how do I handle that? I don't think those rules of
• 21:37
  engagement are are cleared today.
• 21:39
  I think it's just you. You kind of come up with it.
• 21:43
  It's almost like you need a creative solution.
• 21:45
  Yeah, yeah I I you there's a lot on pack Jim what you just said.
• 21:49
  So first I'll just, I'll all these tackle you know the
• 21:53
  maturity side of it. We are very early on with
• 21:57
  machine identity management. There's a lot of different kinds
• 22:00
  of solution. Let me just say this, almost
• 22:03
  every client that I know, both of you work with and probably a
• 22:06
  lot of our listeners as well. Everybody has some kind of
• 22:09
  machine. First of all, everyone has
• 22:11
  machine identities accounts all over the place.
• 22:14
  That's anyone who says they don't.
• 22:15
  They're lying or they don't understand or they don't
• 22:18
  understand. They also, surprisingly, do have
• 22:22
  some machine identity management tools.
• 22:24
  If you've got a certificate authority and some certificate
• 22:27
  management, you're managing some kind of machines there you have
• 22:29
  code signing products that that's also machine stuff.
• 22:33
  You've got some cloud, cloud, security, posture management,
• 22:37
  you might have some there, right, Pam solutions, Cyber Ark,
• 22:41
  Delineia, right. They all have some kind of
• 22:45
  layers to this, but right now it's a mess from a functional
• 22:50
  perspective. And then going back to what you
• 22:52
  said from a again, remember I always think of the world as.
• 22:54
  People process and technology. So we have a lot of the
• 22:57
  technologies, but they're fragmented.
• 22:58
  So that's 1-2. We don't have people that are
• 23:02
  explicitly like, oh, I'm an an identity architect, but I
• 23:06
  guarantee you the majority of identity architects you talk to
• 23:09
  are on human identity. They focus on human identity.
• 23:13
  We need to get them focused more on a machine identity, but you
• 23:16
  might argue that could be some developers but but then the
• 23:19
  process, I think that's also where we're we're immature to.
• 23:21
  So we're very early in that maturity curve.
• 23:25
  And I've worked with thousands of companies around the world,
• 23:28
  you know, in this topic over the years.
• 23:30
  And I would say, you know, I don't think, you know, I don't,
• 23:33
  I don't. I don't say, hey, you are all
• 23:36
  behind. No, no, no, absolutely not.
• 23:38
  This is just the evolution of the space.
• 23:40
  So don't, I wouldn't beat yourself up if you're too, too
• 23:42
  early. But going back to the, the other
• 23:46
  point you made accounts versus identities themselves.
• 23:50
  Yeah, absolutely. It depends again on the use
• 23:53
  case. If there's a human involved, it
• 23:56
  could be Jim's account. But you're managing potentially
• 23:59
  thousands, maybe even millions of machines.
• 24:02
  If you're the the, say, a website operator or you're a big
• 24:04
  part of running a digital business and you're creating
• 24:07
  those chat bots or you're creating all those, those could
• 24:09
  be tied to accounts that you manage or monitor because maybe
• 24:12
  you're the privileged user behind them.
• 24:14
  And that's also why we see some, like vendors like Cyber Ark and
• 24:19
  others talking about machine identities.
• 24:21
  Because they see that as well. I think coming into the market
• 24:25
  anyway I'll, I'll stop there. That was a lot, that's a lot.
• 24:28
  But the other observation that I have and I see this say 90% of
• 24:35
  the clients who have are moving into the cloud.
• 24:38
  Is that developers? Or maybe a non strategic
• 24:44
  approach to moving out to the cloud, starting up applications,
• 24:49
  maybe doing DevOps, being done by teams who have to deploy some
• 24:54
  functionality not by, you know the CISO.
• 24:59
  So then by the time the CISO says hey I've got something I
• 25:02
  need to get my arms around, it's already built, it's already
• 25:06
  doing things. So you know you don't want to be
• 25:08
  the progress prevention department, but at the same time
• 25:12
  your your cloud infrastructure has to all of the same controls
• 25:17
  the rest of your enterprise does.
• 25:19
  So I think that's one of the big challenges is that a lot of this
• 25:23
  is springing up for organizations and maybe it's
• 25:26
  it's happened in the past. It really depends on where the
• 25:28
  organization is in their cloud life cycle.
• 25:32
  But they've got this situation that's been created for them.
• 25:37
  So they're they're stepping into it and like now having to get
• 25:39
  control over the environment. So take Terraform for example,
• 25:43
  you know it goes out and creates accounts.
• 25:46
  So as it destroy the accounts that provide it provisions the
• 25:49
  self rolls, OK, you know do you go in there and say stop using
• 25:55
  Terraform? No, you say, OK, well how do we
• 25:58
  do this in a way that's controlled and that so then I
• 26:02
  think the Infosec group becomes like oversight kind of making
• 26:06
  sure that it's not breaking rules or that at least can be
• 26:12
  monitored and managed. What do you think?
• 26:15
  Let me add one more wrinkle to that too, because I think
• 26:18
  there's two things. There's one is the creation of
• 26:20
  those accounts. Definitely an issue.
• 26:23
  The destruction of those accounts, I think are just as
• 26:25
  important because. In the automated world, these
• 26:28
  things might only live for fractions of a second or a
• 26:30
  millisecond. They conduct a very specific
• 26:32
  transaction and then poof, they're gone.
• 26:35
  And I think if if you try to draw a line to this, it might
• 26:39
  simple brain. All I think about is, yeah, it's
• 26:42
  just like on boarding and off boarding for a human person,
• 26:44
  it's just a whole lot faster. And we, we were not built yet to
• 26:50
  manage that volume and that time.
• 26:55
  And I think those are the, I think that's I try to make it as
• 26:58
  simple as I can and that's I keep going back to that idea.
• 27:01
  OK, I just need to say to our audience, I swear that Jim and
• 27:06
  Jeff have not seen my slides. One of my slides is I have a
• 27:10
  graphic of a human identity life cycle and then the slide right
• 27:15
  after is a similar graphic where I contrast it with the machine
• 27:20
  identity life cycle. Actually looks the same.
• 27:23
  But you're absolutely right. The volume, velocity and the
• 27:27
  variety of these machines, it depends on their use case.
• 27:30
  If it's one of those chat bots and you get a million people
• 27:33
  coming to your website and it's all and a chat bot's triggered,
• 27:36
  let's just say every time a new visitor comes, you might get a
• 27:39
  million bots right now at time one.
• 27:43
  And then at time three, you know, maybe 750,000 of them are
• 27:48
  dead because people close the browser and walk away and
• 27:50
  they're not going to let that process run.
• 27:52
  They're going to. Hopefully they would it would be
• 27:54
  killed off. You would hope.
• 27:55
  Right. So absolutely there, there has
• 27:58
  to be, first of all, you know you, you have to think through
• 28:00
  all those different types of machines.
• 28:01
  Is it hardware, is it software? Then what type is it?
• 28:04
  And based on that you know your risk profile, what are the risks
• 28:10
  of these machines, right? Are they dealing with sensitive
• 28:12
  information or are they not? Right.
• 28:15
  And then that should lead you to them say, OK, what is that
• 28:19
  creation process? Do I have to tie back to you
• 28:24
  know, one client I talked to they wanted to mirror PIV, you
• 28:28
  know, personal identif identical verification, right.
• 28:32
  They wanted to mirror that and use digital certificates for
• 28:35
  each and every machine they create.
• 28:37
  But then they also said you know, but we if we have these
• 28:39
  like you know, public, non classified, you know, bots that
• 28:45
  are accessing, you know, public information.
• 28:48
  We don't care. We we're not even going to give
• 28:50
  it a strong identity. We'll we'll just manage how many
• 28:53
  there are just for costs, you know consumption for our cloud
• 28:56
  usage. But other than that we don't
• 28:58
  really care. So I thought that was really
• 29:00
  interesting. It's going to always come back
• 29:02
  to that you know your risk tolerance.
• 29:04
  Do they have to adhere to any compliance standards?
• 29:07
  And then you need to determine like, yeah, we need to either go
• 29:10
  hardcore and and and issue certificates for each and every
• 29:14
  identity. And that might have an impact on
• 29:17
  what that creation process looks like, the authorization process
• 29:21
  and and and so on. But it really goes into all
• 29:23
  that. But there are a couple other
• 29:25
  things that that that you mentioned it's it's it's not
• 29:28
  just security as well. Security is a big, a big part of
• 29:32
  identity of course, right. Knowing who and what you're
• 29:35
  dealing with and then you can determine OK, these are the
• 29:38
  areas you can play and you can access and these are the areas
• 29:41
  that you can't. OK.
• 29:42
  That's a big part of security. But we also have to think about
• 29:47
  even just identifying these these things for also cost
• 29:52
  optimization and just overall operations.
• 29:55
  So if, if, if so, you can not only think of it as a security,
• 30:00
  you know, mitigating security, doing your compliance, all that
• 30:03
  kind of stuff, but also if you've got a good machine
• 30:06
  identity practice. I guess what I'm asserting is
• 30:09
  that it can also benefit you from an operations perspective
• 30:12
  because now. Let's just say it is the golden
• 30:15
  standard, it's hybrid, it's multi cloud.
• 30:18
  Now you can actually take a look and say you know what Jim, this
• 30:22
  month we had a lot more machines that we generated in Google
• 30:26
  Cloud than we did in AWS. Does that mean we need to adjust
• 30:29
  our contracts in one or the other?
• 30:31
  It could very well be. So now if you actually have and
• 30:34
  it's not, again it's not unlike good human IAM, it can actually
• 30:38
  give you some really good data that can help you make.
• 30:42
  Infrastructure decisions, cloud investment decisions and even
• 30:45
  just good business decisions because you now have data.
• 30:49
  So I would even argue if your company values data and
• 30:52
  analytics and you've justified for Chief Data officer, Chief
• 30:56
  Data Officer can work really well with this data because it
• 30:59
  could be really good consumption.
• 31:00
  And then I'll just say one last other use case, how many chat
• 31:03
  bots are you generating? How many people are coming to
• 31:05
  your website? Right.
• 31:07
  If marketing's generating all these campaigns and now
• 31:09
  everyone's like, hey, I'm going to go to this mobile operator's
• 31:12
  website because let's say it's Mint mobile and Ryan Reynolds is
• 31:15
  doing a big push on Mint Mobile and all of a sudden they're
• 31:19
  getting a lot. They could track that and they
• 31:21
  can track it with really strong confidence because they actually
• 31:25
  are identifying the machines properly.
• 31:27
  And it's not just text based stuff.
• 31:30
  Yeah. One more follow up and it's like
• 31:33
  the human identity management flows now.
• 31:36
  Seems so easy, right? I mean, there was a time where I
• 31:40
  was like, oh really? I have to wrap my brain around
• 31:42
  this. But now it just seems like it's
• 31:44
  black and white. There's an authority to source
• 31:48
  for employees. That's the human resource system
• 31:51
  and then it flows through your governance process.
• 31:55
  Contractors are a little more difficult, but if they're in the
• 32:00
  HR system it's still better or if it's in some kind of third
• 32:04
  party system. I know I'm not trying to step in
• 32:08
  on a landmine here, but authoritative source and the
• 32:12
  control around employees is like people make sure they get
• 32:16
  disabled when they leave the organization because we don't
• 32:19
  want to pay them. We may have strong policies
• 32:22
  around contractors, but it's like, you know, this person's
• 32:26
  the manager. They know when that person's no
• 32:28
  longer here, so ultimately they're accountable to get that
• 32:31
  person shut off. Now, when it comes to machines
• 32:35
  like, there's no authoritative sources there.
• 32:38
  Should there be? So one should there be 100%,
• 32:43
  because look, the world already runs on machines anyways, and
• 32:46
  it's only going to continue to run, you know, furthermore on
• 32:50
  machines. I mean, I know both of you flew
• 32:53
  here. We're in Carlsbad.
• 32:54
  California, The San Diego area. And they're bragging now because
• 32:59
  you didn't fly. Here.
• 33:00
  No, I did not fly here. I drove here, but I won't say
• 33:02
  anything else. The but there was all software
• 33:06
  on those planes. The military is using drones and
• 33:10
  all kinds of things that get updates every day.
• 33:12
  And software your cars are. You know what?
• 33:15
  The average car has 250 plus computers on it.
• 33:19
  So the world is run by software and that is only going to
• 33:23
  increase. And all of this is just machines
• 33:25
  and these machines need identity.
• 33:26
  So you know, I I think, Jim, you bring up a good point.
• 33:32
  When we see something in front of us, like a human being, you
• 33:36
  know, it's much easier to say, OK, you're an employee, you're a
• 33:40
  contractor, you're a business partner or you're a consumer.
• 33:45
  Identity, identity, identity, identity.
• 33:46
  Maybe I use this system or that system or whatever, but machines
• 33:51
  are a little bit more tricky because OK, maybe the physical
• 33:54
  ones. We could say, hey, I've got
• 33:56
  these MRI machines and I need to put them on the network and
• 33:59
  Cisco's telling me I need to put a certificate on it so I can do
• 34:02
  cert based offs. OK, what about all this funky
• 34:06
  stuff in the cloud? What about all these bots that
• 34:09
  are running? No one's really there right now
• 34:12
  as like, a regulatory force. Forcing organizations to do
• 34:16
  this? Am I advocating for that?
• 34:18
  I don't want to make life harder for our community, but at the
• 34:22
  same time, I think it might need that.
• 34:23
  I think we might need, you know, folks to do this because I'll
• 34:27
  give you another example of a a machine identity risk.
• 34:30
  Code signing, right? Applications need identities
• 34:34
  too. And So what if I'm able to
• 34:37
  actually hack into a software developer like, oh, this
• 34:41
  happened to Asus? And get into their environment
• 34:47
  and I could get access to their code signing cert.
• 34:50
  And then I start signing malicious code.
• 34:52
  And you have an Asus machine, and your Asus update application
• 34:56
  engine just downloads the malware and deploys it on your
• 34:59
  machine. And it doesn't really know any
• 35:01
  better because it goes, oh, it's it was signed by an authorized
• 35:03
  source, right? So that's that's an example.
• 35:06
  So should there be an authoritative source in your
• 35:10
  organization for all of your machine identities?
• 35:13
  Yes. Should we start thinking about
• 35:15
  it now? Yes.
• 35:17
  Is there technology available for them to do it in one like we
• 35:20
  do that would mirror human identity?
• 35:23
  Not really. I thought you were going to say
• 35:24
  yes. Not maybe.
• 35:27
  Yeah, it. Depends on the use case and I
• 35:29
  think the types, right? Correct.
• 35:30
  Yeah. Correct.
• 35:31
  We we see some interesting things with secrets managers
• 35:34
  again Pam this area. That traditional service account
• 35:39
  management type thing? Correct, correct.
• 35:43
  And then you have on the certificate side there I see
• 35:46
  some interesting things there. You have companies like Venify
• 35:50
  and Key Factor and others we're talking about machine identity,
• 35:52
  but that's a little bit more on the crypto space.
• 35:54
  But there hasn't been this leap to connect those dots with the
• 35:58
  service account side to to all this.
• 36:00
  But I think if you, if you go back and look at Gartner,
• 36:03
  Gartner's talking about this more and more, good, right?
• 36:06
  It's going to be an expensive problem to solve.
• 36:09
  I think there are folks whose mindset is don't sell things on
• 36:14
  FUD factor and it's like we're going to need a lot of money to
• 36:18
  solve this problem. It's a very real problem.
• 36:21
  The results are, you know, these major breaches that you're
• 36:25
  seeing. It's like that could happen to
• 36:28
  us. It's not FUD factor.
• 36:31
  No, no. I mean, I've been in this space
• 36:35
  for two decades now. And you know, I started out
• 36:40
  doing more like social hacking and all that.
• 36:42
  It was BBS stuff, IRC, you know, we're not getting more origin
• 36:46
  story. But.
• 36:48
  And then when I got into this field, it was cybersecurity.
• 36:51
  It's just folks I would talk to and say you're always scaring
• 36:53
  us. You're scaring us, you're
• 36:54
  scaring us. And and I don't think, Jim, now
• 36:56
  today I've heard anyone say that to me.
• 36:59
  I mean, if you are tripping over yourself and trying to scare
• 37:03
  someone with data, look at this breach.
• 37:04
  Look at that breach, OK, you know, just lay off.
• 37:08
  But again, going back to what Pam Dingell said, everyone in in
• 37:12
  in our space really needs to take note.
• 37:14
  Because as someone who was like formerly an attacker, it's like
• 37:18
  we have to get out of the mindset of joiner mover lever
• 37:21
  and think joiner mover lever adversary.
• 37:23
  Because attackers do not care if it's a machine, if it's a human,
• 37:30
  or if that machine identity or human identity is owned by this
• 37:34
  group in your company, that group or or or.
• 37:37
  You're an identity expert and this person is a is an endpoint
• 37:40
  security expert. They don't care about those
• 37:42
  roles or responsibility and they also don't have compliance.
• 37:45
  They don't have to adhere to anything.
• 37:46
  They'll just try and get in. So all this infighting we might
• 37:50
  have as as a community or as an organization, attackers love
• 37:54
  that, you know. And so I think that we are, you
• 37:58
  know number one, we need to plan on more attacks happening on our
• 38:02
  machines. It's only going to happen.
• 38:04
  Pam talked about identity infrastructure.
• 38:07
  Identity infrastructure is run by machines.
• 38:09
  Humans write the code, but it's the machines that are executing.
• 38:12
  It's containers and workloads in the cloud that allow you to
• 38:16
  authenticate, that allow you to do that SSO.
• 38:19
  And if someone compromises that because they stole a cert or
• 38:22
  they did whatever, they now own your identity infrastructure and
• 38:27
  they can do lots of things. Now you're in big trouble.
• 38:30
  Exactly. So I totally agree with you.
• 38:32
  This is a. I I think Simon said in the last
• 38:35
  session, he's like, this is going to be a Titanic problem to
• 38:38
  solve. Yeah, we've already talked about
• 38:40
  like the separation of duties within the hacker community,
• 38:45
  right? Some people go and steal the
• 38:47
  credentials with fishing or whatever method they use and
• 38:51
  sell them. The people who buy them just
• 38:54
  know how to run scripts. Once they get in, it's like, OK,
• 38:57
  I'm on this machine now. I'm going to try these 10 or 15
• 39:01
  things I can do to escalate my privileges or see how I can move
• 39:06
  laterally. Exactly.
• 39:08
  I I didn't go to cooking school. I'm not going to say if I'm a
• 39:10
  good cooker or bad cook, but I can follow a recipe.
• 39:14
  I can follow a recipe. Makes them feel a good cookie
• 39:16
  would have, said Chef. There we go.
• 39:19
  There we go. But I mean you know we could if
• 39:22
  you break it down and and people can follow recipes.
• 39:25
  And I, I, I, I know one of the talks today.
• 39:29
  When? When I can't remember the
• 39:31
  speaker's name. It drogged my memory.
• 39:33
  It's been a long day but when she was going through all the
• 39:37
  stuff with ChatGPT and she showed an Icelandic banking
• 39:42
  attack and it's like, hey, I think there was only what, few
• 39:45
  100,000 people who could speak Icelandic.
• 39:47
  But now with the advent of ChatGPT, everyone can, everyone
• 39:50
  can. I can make a phishing campaign
• 39:53
  that's in a that's in a that's in Icelandic.
• 39:56
  Sorry. And.
• 39:58
  Now as a result, a lot some of the Icelandic banks are like,
• 40:01
  wait a minute, are the number of phishing attacks just increased?
• 40:04
  You know, it's like, well ChatGPT made it easy.
• 40:07
  So I think to Jim's point, you know, unfortunately a lot of
• 40:11
  these things are getting easier for attackers to take advantage
• 40:14
  of. And I think machines, just
• 40:17
  machines give them a massive attack surface.
• 40:19
  We thought humans were of decent size attack surface.
• 40:22
  Machines are even bigger. Is that Rachel Toback?
• 40:25
  Yes. So, yeah.
• 40:26
  Credit where Credit's. Yes.
• 40:28
  Yes. Sorry, my brain is my brain's
• 40:31
  fried today, but. Well, if your if your security
• 40:34
  strategy relies on people not knowing how to speak your
• 40:36
  language you know, you probably should be thinking of other lay
• 40:41
  other layers to that security onion.
• 40:43
  You should be building exactly exactly.
• 40:45
  We've been talking a lot about Pam as sort of like one of the
• 40:49
  areas of solving this. But is it Pam?
• 40:51
  Maybe this is more like IGA considering the life cycle looks
• 40:54
  a lot like a human. Gardner has a market guide that
• 40:58
  talks about matching up machine accounts and to machine
• 41:01
  identities. Maybe IGA is we should be
• 41:04
  starting this if if IGA's root, you know capabilities to know
• 41:10
  who has access to what, how difficult is it to turn into
• 41:14
  what has access to what? Doesn't matter if it's a human
• 41:18
  or non human. Is IGAA place that we should be
• 41:21
  looking at to store these accounts or at least to
• 41:23
  inventory them and start to at least try to manage or govern
• 41:26
  them. So I I actually do think IGA is
• 41:29
  so. So I agree with you.
• 41:30
  I think IGA is a a big part of the core.
• 41:34
  But again I think if you think about when I describe the
• 41:41
  identity life cycle, there's onboarding, there's the creation
• 41:45
  of this identity. IGA could play a role there, but
• 41:50
  it could also be IGA orchestrating a connection into
• 41:54
  let's just say the identity is deemed that it needs to be a
• 41:56
  certificate coming from a certificate authority.
• 42:00
  IGA doesn't traditionally do that.
• 42:02
  So you're going to need some kind of orchestration capability
• 42:05
  to call out to a certificate authority which could be on Prem
• 42:09
  or in the cloud and then you know pulls it in.
• 42:11
  So. So I agree that I think IGA is
• 42:13
  at the is that really when you distill it down is really the
• 42:16
  core because it is about governance and administration
• 42:19
  and all that. But I think what IGA is missing,
• 42:22
  the traditional part, which is there's going to be a lot of
• 42:25
  heavy lifting here is the orchestration side of it.
• 42:28
  There really has to be a lot of, again, you need to say what kind
• 42:30
  of machine is it. It's something that needs a
• 42:32
  certificate. We need certificate authority.
• 42:36
  It's this other kind of machine that just needs a secret, OK?
• 42:38
  It needs to go into some kind of secret manager to generate a
• 42:41
  secret and pull it out. That could be a Pam function,
• 42:44
  but it's IGA at the core. It could be a symmetric key, it
• 42:48
  could be, you know a whole variety of things.
• 42:50
  So I think it's it's it's we can take the classic notion of IGA,
• 42:55
  but it has to be augmented to in order to I I I think really
• 42:59
  fulfil the variety of the different types of use cases.
• 43:03
  And the last thing I'll say, Jeff is that you mentioned it
• 43:08
  earlier, but the velocity of these things is going to
• 43:13
  absolutely mean that anyone who's running this
• 43:17
  infrastructure that would create or destroy these machine
• 43:20
  identities, it really has to be like.
• 43:23
  Super critical. Now it's Tier 1.
• 43:26
  Whatever the highest thing is to make sure it's got the
• 43:29
  appropriate resources back up. You know recovery plant like all
• 43:33
  that stuff, it's, it's critical infrastructure for the
• 43:36
  organization, correct, Correct. And even if we look at, again, I
• 43:38
  keep coming back to certificates because certificates are
• 43:40
  actually a good, a good best practice for what When I was at
• 43:43
  Gartner, we talked about PKI and IoT authentication, digital
• 43:49
  certificates, that kind of form. And even when you think about
• 43:52
  Fido and passkeys, that's PKI based, that is the gold standard
• 43:56
  for authentication is using PKI. But you got to make sure that
• 44:00
  that is not only scalable, everyone can talk scale, it's
• 44:04
  response time. That's the thing that if a
• 44:07
  consumer is sitting there, what is that?
• 44:09
  Just type something in for this chat bot and it's supposed to be
• 44:11
  LLM based and it's taking 20 minutes to get back to me.
• 44:14
  They'll just kill the transaction.
• 44:16
  This is like when traders would buy, you know, land near.
• 44:20
  The circuits that were driving markets because they wanted a
• 44:23
  faster response time, is that where we're headed?
• 44:27
  We need to have your identity management nerve center next to
• 44:31
  wherever your bot plant is. I I will say we haven't gone far
• 44:34
  from that. My son who who's a teenager, he
• 44:38
  is big in a fortnight and we recently moved from Canada to
• 44:43
  the San Diego area and he's he's like, hey daddy, Oh my gosh like
• 44:49
  so the main servers are in Los Angeles.
• 44:50
  We're so close to these servers. We're so.
• 44:53
  Way down now, Yeah. So he's not on like those
• 44:55
  traders, he's he's and then he keeps riding me to keep bumping
• 45:00
  up our bandwidth, you know? Can we get T1 lines, Daddy?
• 45:06
  Yeah. You don't really need T1.
• 45:08
  What you need is is symmetrical speeds.
• 45:12
  Because everybody, for whatever reason, the US loves fast
• 45:16
  downloads and overhooks, fast uploads.
• 45:18
  So if you can get like fiber or at least a symmetrical.
• 45:21
  I saw like Comcast is running A2 Gigabit symmetrical through
• 45:24
  coax, which I don't think was possible to figure out a way to
• 45:28
  do it. So now you're talking about
• 45:30
  instantaneous responses back and forth, which is crazy.
• 45:33
  I I'm sure they'll charge an arm and leg for it, but for people
• 45:37
  like. Me and Jim and others and like
• 45:39
  yourself right, who are doing audio, video, that instantaneous
• 45:44
  transfer back and forth is it can be a big game changer for
• 45:47
  our use cases. A normal person.
• 45:49
  I say normal person because let's be honest, we're a bunch
• 45:51
  of weirdos in here, but a normal person probably isn't going to
• 45:54
  have that as a use case. But machines, well, they need to
• 45:57
  move quick, fast. You know, lift fast, die hard.
• 46:01
  Yes, all that stuff. I like what you did there.
• 46:03
  I like what you did there but but no but that that is a a
• 46:05
  straight up legit point because I mean what we also didn't talk
• 46:10
  about as well so far is the machine to machine
• 46:13
  communication. So imagine if you have like to
• 46:17
  an autonomous agent that's working for Jim and Jim has
• 46:20
  given it instructions to to to say OK I need you to do trades
• 46:24
  for me or do whatever for me and you give it its rules and you
• 46:28
  here is access to my my my bank account and when you see a stock
• 46:33
  do something just go you don't don't have to call me up.
• 46:37
  I gave you the rules of engagement go now that machine
• 46:40
  might talk to another machine that is actually doing maybe the
• 46:43
  buying and selling you know on on behalf.
• 46:47
  And so if you have those great connections it means that there
• 46:50
  shouldn't be there's that that symmetrical upload and download
• 46:54
  between the two because it could be I'm using just transaction
• 46:57
  triggers but there could actually be you know bulk
• 46:59
  content that could be shared could be you know different
• 47:02
  types of things that that could be shared.
• 47:04
  So I think we're entering a really I'm I'm I'm excited about
• 47:08
  where we are going with everything and I think just
• 47:12
  first everything has to start with recognizing a problem and
• 47:15
  and what I'm really happy about is that for years myself and a
• 47:21
  few others like Eric Wahlstrom and and and some other folks in
• 47:24
  the industry we've been talking about this this potential
• 47:29
  sleeping dragon of of issues that will happen with machines.
• 47:34
  But no one was really maybe there was a little bit of a
• 47:38
  there's that's fear, uncertainty, doubt.
• 47:40
  But I think we're getting to a place now where people start to
• 47:44
  see it and and my hope is is that the industry will rally
• 47:48
  together because it's not going to be 1 vendor that's going to
• 47:50
  be able to do this. It has to be all of us.
• 47:52
  The cloud providers I think are taking it seriously.
• 47:56
  For their cloud, for their. Well, no, I think I think you're
• 48:00
  touching on the top most important issues and this kind
• 48:05
  of starts back with Jeff's question around what's IG as
• 48:08
  role. Well, I think the IGA vendor
• 48:10
  thinks they can solve it, but they take on the piece where
• 48:13
  their tool works well, Privilege access management kind of the
• 48:17
  same thing. Access management vendors kind
• 48:20
  of say, well, the authentication is what really matters.
• 48:24
  OK. Well, there's all the other
• 48:25
  stuff too. Right now, you have new markets
• 48:28
  springing up with like the Kim or Keem, whatever you want to
• 48:31
  call it. So I'm not sure if if you have
• 48:37
  an answer for that or it's just like it's the evolving space.
• 48:40
  One of the things I wanted to do is recognize you like you're
• 48:43
  taking on this issue at a conference and it's not a solved
• 48:46
  issue. This is not.
• 48:49
  We're not at the space. We're like, yeah, we figured
• 48:51
  this out and here's the road map.
• 48:53
  Now I'm going to lay out the road map for you.
• 48:54
  What you're going to be talking through is like, there's a lot
• 48:57
  of hard problems. They're not solved by the
• 48:59
  industry. Here's I don't know how I think
• 49:02
  about them. Yeah, I I love that.
• 49:04
  So again, you know Gartner like really burnt in me the notion of
• 49:09
  like always leaving clients with recommendations and a path
• 49:13
  forward. So absolutely I'm not going to
• 49:15
  go up on stage today. OK, Doom and gloom everyone.
• 49:17
  I'm going to obsess about the problem and see your time.
• 49:19
  See you. Thanks for your time.
• 49:20
  Bye. No, in the presentation I have
• 49:24
  clear recommendations which I can, I can mention a few here
• 49:28
  and I I believe I did. But so you know, I'll reiterate,
• 49:34
  always start with discovery, enumerate and discover what
• 49:37
  machine. Well, first of all define
• 49:39
  machine identities. And if you're a Gartner client,
• 49:40
  look at Gartner's research. But there's more and more
• 49:42
  research out there that's, that's that or you can you can
• 49:45
  hit me up and ask me, right. But identify the machines in
• 49:49
  your environment do some kind of discovery process that's kind of
• 49:54
  you know, part of your you know your your first journey which
• 49:56
  would include some tooling and and so on and so forth.
• 50:02
  Start to think about the teams. Establish a physical and or
• 50:05
  virtual team. There might be some developers
• 50:07
  that might be in the group, maybe some of your IM team,
• 50:10
  maybe some of your cybersecurity team.
• 50:11
  Because inevitably there will be cryptography based machine
• 50:16
  identities. Is that someone that's
• 50:19
  traditionally in your IM group or are they in the cybersecurity
• 50:22
  group that maybe you've tagged a network infrastructure person to
• 50:26
  your PKI. Someone who knows PKI is
• 50:28
  probably a good person to have on that team.
• 50:30
  The other thing I mentioned too I alluded to is the risk.
• 50:34
  So when you identify what machines are in your
• 50:36
  environment, also segment them and prioritize them based on
• 50:40
  risks. So what machines have, you know,
• 50:44
  access to things that are really risky and what machines have
• 50:47
  access to things that are maybe somewhere in the middle and then
• 50:49
  stuff that, you know what if that got breached, it it's
• 50:52
  segmented out, it wouldn't be a problem.
• 50:54
  That's also handy too. So those are the first pieces
• 50:58
  that I would, I would recommend and just understand that it's
• 51:03
  totally a new space, so it's OK to be, you know, no one's behind
• 51:06
  here, we're all just learning here.
• 51:08
  If anything, we're we're keeping up just by even knowing and
• 51:12
  understanding that there is a problem here that we need to
• 51:14
  address exactly. I mean just you want Tactical 1,
• 51:16
  so this is something Simon mentioned.
• 51:19
  It's like 70% of respondents to a survey question was machine
• 51:24
  accounts should use multi factor authentication.
• 51:28
  Where do you stand on that? Yeah, 100%.
• 51:31
  We're getting to a point where something, let me just start
• 51:34
  this way as in terms of evolution, when you talked about
• 51:36
  Pam talking about the evolution of the Microsoft Authenticator,
• 51:40
  it's the evolution of thinking about machine identities.
• 51:42
  You know, when we think about Pam, you know, years ago it was
• 51:47
  just we had Pam on its own and then it's like, wait a minute,
• 51:51
  Pam needs to be bolted in with MFA and hopefully other
• 51:53
  passwordless strong Fido based methods, right?
• 51:57
  Because why would you have a privileged user that's not using
• 52:00
  that, right. So that that just is laughable
• 52:02
  at this point, right? We have to do that.
• 52:05
  We're not doing that for machines.
• 52:07
  So when I saw Simon's data, I I totally agree with that.
• 52:10
  I think machines have to have strong identities and with that
• 52:15
  it should come part and parcel with some kind of authentication
• 52:20
  risk, view cause like a machine again in that that journey, just
• 52:23
  because that machine exists and it's allowed to exist, and let's
• 52:26
  just say it's not ephemeral and it goes to authenticate to a
• 52:30
  certain resource, should it be allowed access to that resource
• 52:33
  at that time, Maybe there's an attack going on in the
• 52:35
  organization. It's like this bot that's a
• 52:39
  clone of Jim shouldn't be allowed to access the credit
• 52:42
  card database right now because we're under attack right now,
• 52:46
  right? So.
• 52:48
  So I think all these things need to start to come together, and
• 52:50
  we're just not doing that right now.
• 52:52
  If a machine wants has access in your environment and it wants to
• 52:55
  walk into a credit card database, it could do that,
• 52:57
  which is, by the way, that's malware.
• 52:59
  That's ransomware. Ransomware is a machine I was.
• 53:01
  Going to say you just described it.
• 53:02
  Yeah, ransomware is a machine. And in terms of managing machine
• 53:07
  accounts, you know we talked about AI, generative AI in terms
• 53:11
  of kind of the bots but. Did you see a role for AI
• 53:16
  relative to machine account management?
• 53:19
  Oh. The bots watching the bots.
• 53:22
  Is this how the matrix started? Yes.
• 53:24
  So so or or or Terminator with Skynet.
• 53:28
  Yeah. I mean you know it it's there is
• 53:32
  a point where the the look the bad actors are already starting
• 53:36
  to use you know evil GBT, fraud GBT like was discussed today in
• 53:40
  in in the keynote I I transmit our researchers are certainly
• 53:45
  seeing that like we're seeing the threat environment just
• 53:48
  really quickly has done a huge phase change and so they have
• 53:52
  this now access to all this stuff and we do have to fight
• 53:56
  fire with fire. It's all we it always has been
• 53:58
  and always will be an arms race and it's like the situation
• 54:02
  where if someone is firing tons of missiles at you or you gonna
• 54:05
  have humans on the ground you know shooting shooting them down
• 54:09
  manually. No you're going to need a system
• 54:11
  that is automated and is using AIML to fight back.
• 54:16
  So I'll I'll just say this legitimately.
• 54:18
  We saw how good that works if you ever played Missile Command,
• 54:21
  right? Well, yeah, exactly.
• 54:22
  Yeah, right. That's what you're going to
• 54:24
  lose. Yeah.
• 54:24
  I mean, well, so there's a couple ways I think about AIML
• 54:27
  and benefiting, let's just say, security and identity leaders.
• 54:31
  One is there's AIML tools that hopefully your vendors are
• 54:38
  starting to build to help with administering and managing the
• 54:41
  stuff, right? So think about access
• 54:44
  certifications when you think about governance, right?
• 54:46
  Like for years they talked about identity intelligence.
• 54:50
  I think now we have the technology for vendors to apply
• 54:54
  that to give you a better idea, be like anticipate all these
• 54:57
  recertifications I need to do so I don't have to do it manually.
• 55:01
  That would be nice. Or short circuit like can I
• 55:04
  interface with a chat bot where I'm like, how do I set up this
• 55:08
  certain policy within this product?
• 55:10
  And I can just type in two things and boom, it tells me
• 55:12
  what to do. So that's where I see the first.
• 55:16
  I've seen many. I've been briefed by many
• 55:18
  vendors and that's where I see a lot of the quote UN quote,
• 55:21
  innovation right now today. But the other aspect is how that
• 55:25
  technology can be used to fight bad actors.
• 55:29
  So monitoring machine identity behavior, and then if something
• 55:34
  happens it's weird. Then it can respond either by
• 55:37
  terminating that machine. Or pause the transaction, pause
• 55:41
  exactly or stop and get more information.
• 55:44
  So it's similar with like risk based authentication on the
• 55:47
  human side going back to what you're saying as well with with
• 55:51
  the, you know the the 70 some percent of of people saying
• 55:55
  machines should have MFA. Hopefully that's what what you
• 55:58
  know people were thinking as well they should have risk based
• 56:01
  kind of authentication for these machines as well and if
• 56:04
  something's weird they're just just stop it.
• 56:06
  That's where I see AI now, also helping the fight here.
• 56:10
  Excellent. So we'll start to wrap up
• 56:12
  because we're about to hit an hour here and I want to be
• 56:14
  respectful of your time, but you may be super jealous this
• 56:18
  morning when you started showing me some pictures on your phone.
• 56:20
  No, not like that. Star Wars Rise of the
• 56:24
  Resistance. You went to this?
• 56:27
  This is Disneyland. Disneyland.
• 56:30
  Yep. And I want to know everything
• 56:32
  about it. Yeah, yeah.
• 56:34
  So you give me two minutes. No, no, no.
• 56:37
  You got as much time as you need so recently did did a did an
• 56:40
  amazing family trip to to Disneyland and we were lucky
• 56:45
  enough to make it on the ride. I would actually say it's it's a
• 56:49
  ride. It's also an experience.
• 56:52
  Star Wars, Rise of the Resistance.
• 56:54
  I think I got the name right and it was Rise of the Resistance
• 56:56
  Usually it's a long wait you know we we we got in at with
• 57:01
  decent decent timing amazing ride.
• 57:04
  So it's themed after kind of the newer Star Wars movies.
• 57:08
  So like Kylo Ren and all that and the the story and I don't
• 57:11
  want to ruin it but the premise is, is that you you kind of come
• 57:15
  in and and the cast members at Disney, they're all in character
• 57:20
  and they don't break their character.
• 57:22
  You know you they're like, hey you you're thank you for joining
• 57:25
  the resistance. You're part of the Resistance.
• 57:26
  We're going to share with you a secret base location.
• 57:30
  And then you go on some, you go outside, you see all this cool
• 57:33
  stuff, you go on the ship, you're flying and then suddenly
• 57:37
  the Star Destroyers with Kylo Ren, they board you because they
• 57:40
  believe that you have the location of some base, but you
• 57:43
  deny it. Then you're on like a Star
• 57:45
  Destroyer with like hundreds of Stormtroopers on this.
• 57:47
  It's amazing. And then, you know, then you go
• 57:50
  on kind of the ride, if you will, so.
• 57:52
  So when you say on like you're you're not talking about like
• 57:56
  watching a video, right? You're in this thing or you're
• 58:00
  help me understand the perspective here.
• 58:02
  You're in this thing. You're seeing stuff.
• 58:06
  You're it's a blend of multimodal multimedia.
• 58:11
  Wind blows on you and stuff like, oh, you feel everything,
• 58:15
  See shakes, Yeah, you feel everything.
• 58:17
  It it it goes beyond just a ride that you get on it just it takes
• 58:22
  you somewhere or you sit in something and hear music and it,
• 58:25
  I mean it, it really does try to tap into all your senses and and
• 58:29
  everything. And I was blown away.
• 58:32
  Probably one of the most enjoyable experiences you know,
• 58:36
  I've had after. Honestly, after we did that, I
• 58:38
  think we did it around midday, a full day at Disneyland.
• 58:41
  I was like that's it. Everything right now, right?
• 58:44
  Yeah. I mean, everything else is
• 58:45
  great, don't get me wrong, but I was like, if we went home now, I
• 58:47
  I wouldn't be disappointed. That'd be fine.
• 58:49
  How long was the experience? That's a good question.
• 58:54
  It probably felt like it. If it, if it, if I feel like if
• 58:57
  it's a good experience and you're into it, it goes fast,
• 58:59
  right, 'cause you're engaged throughout the whole time?
• 59:02
  Is it 5 minutes? Is it like half an hour?
• 59:04
  To me it it felt so. I I I agree with you like it
• 59:07
  definitely had experiences where it felt you know like good ones.
• 59:11
  It felt like it went by fast. It didn't feel like it went by
• 59:13
  fast. It it felt to me like it was 15
• 59:19
  minutes long. It probably wasn't.
• 59:20
  It was probably like 5 but. You're so into it and it's such
• 59:23
  a good experience. Felt like 15 minutes and just
• 59:26
  everything that you're that, that that your senses pick up
• 59:29
  when your body picks up. It just was that.
• 59:31
  And if you love those movies and just Star Wars genre, not all,
• 59:36
  not only is that experience and ride great, but the whole
• 59:39
  environment around it because you you walk into Star Wars
• 59:42
  Galaxy edge and it's like it's a new world.
• 59:45
  Even the restaurants are seemed like indoor.
• 59:48
  We had Endorian chicken, which is another thing, right?
• 59:51
  It tastes like chicken and they have blue milk there too, like
• 59:53
  blue milk and everything. It's really, really cool.
• 59:56
  But when you when you when you go on it's like you're on the
• 1:00:00
  bridge of a or you're in you're in the hangar Bay of a Star
• 1:00:03
  Destroyer. It it's really cool and how the
• 1:00:06
  the backdrop behind the stormtroopers looks like a
• 1:00:08
  shield with space raw space behind them.
• 1:00:11
  They did a good job. I really have to applaud the the
• 1:00:14
  team at at Disney for for doing that because it you know, it it
• 1:00:18
  goes back to the, you know, the Imagineers I guess, right.
• 1:00:22
  And I just think you know, amazing amazing job.
• 1:00:25
  We need some Imagineers to come in and help us in the IM space.
• 1:00:28
  I think you know. Can you imagine an Identity and
• 1:00:31
  Access Management theme park? Oh yeah, that what that would
• 1:00:35
  even like. Yeah.
• 1:00:37
  Well, we would have, you know, Disney has the magic bands.
• 1:00:40
  We would have like our pass key bands, you know?
• 1:00:44
  What would be like the the top drawing ride?
• 1:00:46
  That's a good question, Jim. What do you think?
• 1:00:49
  I think humbersome, this is so lame.
• 1:00:54
  Although I will say my my son said he looked at me and he and
• 1:00:57
  again he's a teenager and he goes, hey daddy why don't why
• 1:01:01
  don't they have like Austin Powers land you know or like
• 1:01:04
  Towers Land, Beetlejuice Land or like he just started dropping
• 1:01:08
  these other like cool kind of movies like you know, I said
• 1:01:12
  what about Anchorman lands or you know.
• 1:01:14
  They spent a lot of money for the Star Wars.
• 1:01:17
  Be dead. It's unfortunate they shut down
• 1:01:19
  the the, the hotel. I think though there was like a
• 1:01:21
  hotel experience and I think I heard that they decided to shut
• 1:01:24
  it down. It wasn't, yeah, I think.
• 1:01:27
  I've heard really good things about it and I guess it was too
• 1:01:30
  expensive or something. I don't know.
• 1:01:32
  Just can't. I missed out on that one.
• 1:01:33
  I can't always have nice things. I know I missed out on that too.
• 1:01:36
  I remember talking about that. But then COVID happened.
• 1:01:39
  I don't know. I don't know if it had.
• 1:01:40
  Who knows? But But either way, I would
• 1:01:43
  highly recommend. I haven't been to Disney World.
• 1:01:47
  I haven't experienced their Star Wars thing.
• 1:01:50
  So it was just Disneyland. So that one's in kind.
• 1:01:52
  Of difference is Disneyland is in.
• 1:01:54
  California and Disney World is Florida, correct.
• 1:01:56
  So the weather is going to be a lot better in California, yes.
• 1:01:59
  But it's not as big. I mean, Disney World is huge.
• 1:02:01
  I've been to both. It's not even close.
• 1:02:04
  No, it's not even close. I think I've spent.
• 1:02:07
  More multiple parks. In in Florida, Yeah, you've got
• 1:02:11
  M was it MGM, Epcot, Disney itself, plus you got all the
• 1:02:15
  resorts things. I mean, it's a whole thing, but
• 1:02:18
  I think what? Between the two, I actually
• 1:02:21
  prefer Disneyland better because I think the quality is higher
• 1:02:25
  even though there's fewer things compared to Disney World in
• 1:02:28
  Florida, which is there's a ton of stuff to do, but the quality
• 1:02:31
  is very inconsistent. Like for me, Space Mountain and
• 1:02:35
  Disney World Classic, but I don't care about anything else
• 1:02:39
  there. When my.
• 1:02:39
  Kids were very young, was when Cars was the movie.
• 1:02:42
  Cars was hot, and there's Hollywood studios, and they had.
• 1:02:47
  Cars everywhere. It was like my.
• 1:02:49
  Kids were just drawn in, so they have that.
• 1:02:53
  So I actually, I should, I should say this, but it was kind
• 1:02:57
  of cool, ran into a YouTube in the park and he was like so Cal
• 1:03:01
  Disney dad. And we got so many great tips
• 1:03:04
  from watching his video in the lead up to us doing this trip.
• 1:03:07
  So it was like my kids were kind of excited when they saw him.
• 1:03:10
  You know, it's like, because he's like an influencer, much
• 1:03:14
  like you guys as well, right? And so it's no, it's it's true.
• 1:03:18
  It's right. You don't know.
• 1:03:19
  Go on. But it's really cool.
• 1:03:23
  And so so but what he said was he's like, you know, Disney
• 1:03:28
  World is very cool, but he's like one major pro when you come
• 1:03:33
  to California because it's California Adventureland and
• 1:03:38
  right across, like you could throw a football from one gate
• 1:03:43
  to the other. Disneyland's on the other side
• 1:03:46
  and downtown Disney's there. So you don't have to take all
• 1:03:49
  these shuttles everywhere. Like you can get a really nice
• 1:03:53
  Disney experience and I will, I will further it with Disneyland
• 1:03:57
  is the original Disney park and it's like one of the most
• 1:04:03
  original theme parks, I think in the world.
• 1:04:05
  I mean, someone can correct me if I'm wrong, but YouTube videos
• 1:04:08
  that I've watched on it, it's pretty amazing.
• 1:04:09
  And all the tricks that Disney had to do like that that used to
• 1:04:12
  be an orange Grove that was flat with nothing there and that was
• 1:04:16
  transformed and and I wish I remember the name, but there's a
• 1:04:19
  really, if you're really interested in Disney, the story
• 1:04:22
  I find of what Walt Disney went through to get that park there
• 1:04:27
  was incredible. Like he almost ran, ran out of
• 1:04:29
  money. Everybody said this is an insane
• 1:04:31
  idea. Why would people come to a theme
• 1:04:33
  park? Like what does that even mean?
• 1:04:35
  What is? What is the theme park?
• 1:04:37
  Yeah, and he almost ran out of money.
• 1:04:39
  We do the same thing in Orlando, right?
• 1:04:41
  It was the original drain, the swamp.
• 1:04:43
  It was like all swampland that you bought.
• 1:04:44
  That's right. Yeah, yeah, I don't think he
• 1:04:47
  even lived to see Disney World happen, right.
• 1:04:51
  But anyway, But yeah, no thanks for asking.
• 1:04:54
  It was unbelievable experience and highly recommended if you
• 1:04:57
  love Star Wars. Well, I do and I don't.
• 1:05:00
  And you don't. But I probably would enjoy the
• 1:05:02
  ride. I mean the experience, right?
• 1:05:04
  I mean, I think you can appreciate.
• 1:05:06
  I can appreciate experience. I'd like to go to a star Star
• 1:05:09
  Trek One star. Trek One, I'll go both.
• 1:05:12
  I don't discriminate. I'd like to go into the hollow
• 1:05:15
  deck. I mean, that's where we're going
• 1:05:17
  with things like VR and AR and things like that.
• 1:05:21
  Eventually, someday. That's it.
• 1:05:23
  You can have experiences with that without actually being
• 1:05:26
  there, Yeah, yeah, exactly. All right.
• 1:05:31
  Let's go ahead and wrap it up. David, thank you so much for
• 1:05:35
  taking time with us. Nice to see you.
• 1:05:37
  Looking forward to your talking. You can find us on the web,
• 1:05:41
  idacpodcast.com, Twitter at IDAC Podcasts.
• 1:05:45
  I have a link for David and his LinkedIn if you want to share
• 1:05:48
  Disney tips or machine identity tips or whatever, along with the
• 1:05:52
  link to transmit security so you'll learn more about stuff
• 1:05:55
  that he works on. What else?
• 1:05:57
  We're on Mastodon at IDAC podcast, at infosec dot
• 1:06:00
  exchange, connect with Jim and I at LinkedIn, like subscribe.
• 1:06:05
  That's all the stuff that people can do to help us out.
• 1:06:08
  Get us on the mainstage again at Keynote for for Authenticate,
• 1:06:11
  which is very cool. Definitely a podcast highlight.
• 1:06:14
  I think of kind of making it from 2 dudes in their basements
• 1:06:18
  to now or you know, on a stage somewhere.
• 1:06:21
  I think it's all of our Mastodon followers.
• 1:06:24
  Yeah, I don't know about that one.
• 1:06:25
  We have it out too. We have no, we've got several.
• 1:06:29
  By far, LinkedIn is the best way to you know that we get the most
• 1:06:32
  engagement. But I don't know.
• 1:06:34
  I think Mastodon came along at the right time, but the
• 1:06:37
  usability isn't quite there yet for the masses.
• 1:06:40
  Let's wrap it up. Thanks everybody for listening
• 1:06:43
  and we'll talk to everyone in the next one.
• 1:06:45
  You've been listening to Identity at the Center.
• 1:06:49
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:06:53
  review and we'll be back soon. But in the meantime, hit the
• 1:06:56
  website at identity@thecenter.com and find
• 1:07:01
  us on Twitter at IDAC Podcast. See you next time on identity at
• 1:07:08
  the center.