Latest / Identity at the Center / #258 - IDAC Mail Bag for January 2024

Transcript

#258 - IDAC Mail Bag for January 2024 · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with
• 0:10
  IAM, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Stedman. Welcome to the Identity at the
• 0:22
  Center podcast. I'm Jeff and that's Jim.
• 0:24
  Hey, Jim. Hey, Jeff, how are you?
• 0:26
  Oh, not so bad yourself. Good, good.
• 0:29
  I'm wondering if anybody else can hear my breathing.
• 0:31
  Right before we went on, you said heavy breathing.
• 0:33
  I'm like, darn it. Sound like Darth Vader?
• 0:36
  Yes, Jeff, I am your father. You are not my father, that I
• 0:42
  saw like Maury Povich. Yeah.
• 0:45
  Or what is what was that, that TV show that was real popular in
• 0:51
  the 90s? Which one?
• 0:53
  Yeah, we're the Jerry Springer. Oh, yeah, Springer.
• 0:56
  Sorry. That's that's what I was
• 0:57
  thinking. Yeah.
• 0:58
  Yeah. You're not my father or you're
• 0:59
  not the father. You're you're not the father.
• 1:03
  Yeah. So yeah, you've been on the
• 1:05
  road. You're actually, we're
• 1:07
  connected. And you're in a hotel room.
• 1:09
  Another bland hotel room. Shocking, right?
• 1:13
  Yeah, I am currently in Reno, NV and was in Las Vegas earlier
• 1:19
  this week. Was at the sale point sales
• 1:21
  kickoff for kind of all the partners and stuff like that.
• 1:23
  First time attending one of those was kind of interesting
• 1:26
  and fun. Met a lot of great people and
• 1:29
  give a shout out to Bobby, Alec, Katz, Ahmed, Ashley.
• 1:34
  I'm sure there were others. Those are kind of the immediate
• 1:36
  people that were sitting around us.
• 1:38
  We went to dinner one of the night, so it's kind of a lot of
• 1:40
  fun to kind of talk with them and see what's going on in the
• 1:43
  real world and from their perspective, But it's
• 1:45
  interesting. Vegas was surprisingly empty for
• 1:50
  what I'm used to. Usually there's a lot of people
• 1:52
  there, and it just seemed like it was like the calm for the
• 1:54
  storm before the Super Bowl arrives there in a couple weeks.
• 1:58
  So yeah, it was interesting to just not be inundated with
• 2:03
  people ever. It was.
• 2:04
  It was actually kind of, kind of pleasant.
• 2:07
  Yeah. Don't you think it's interesting
• 2:09
  how the whole world is fixated on whether or not Taylor Swift
• 2:13
  is going to be able to make it to the game?
• 2:15
  I mean, like, that's what everybody's talking about.
• 2:18
  Did you see that the embassy in Japan put out a press release.
• 2:22
  I read this this morning. They put this out that basically
• 2:25
  says there is plenty of time for Taylor Swift to make it to the
• 2:29
  Super Bowl. And because she's playing a a
• 2:32
  show in Tokyo the night the the night before.
• 2:35
  But because of time changes and stuff like that, if she leaves
• 2:38
  after the show, she should be getting there in plenty of time.
• 2:41
  But there was like concern that you know, would she be late,
• 2:45
  will she cut the show short to try and make it?
• 2:48
  I mean it's just it's gotten pretty ridiculous.
• 2:51
  I've never, I don't think I've. I can't really.
• 2:52
  Last time there was like this phenomenon around somebody, an
• 2:55
  individual that was really impacting the NFL world.
• 3:00
  It's kind of crazy. What do you think of Taylor
• 3:02
  Swift? Are you a fan?
• 3:03
  Nah, I didn't. I don't really care.
• 3:06
  Or another. I'm sure she's a talented singer
• 3:08
  or songwriter, but I don't really listen to anything.
• 3:11
  Yeah, yeah, I I think she has some catchy.
• 3:14
  Songs that I like and But You're a Road Warrior.
• 3:19
  You're I mean, like I used to say I've been a road warrior for
• 3:22
  20 years, which I kind of feel was true.
• 3:25
  I mean I wasn't like the elite traveler like you are today.
• 3:29
  But I mean I was one to three weeks on the road every month
• 3:33
  for like 20 years. You're like you live out of out
• 3:37
  of your suitcase now. Yeah, I think it's just this I I
• 3:40
  think that's kind of a little bit of my role at the moment.
• 3:43
  So kind of utility player doing what I need to do but definitely
• 3:47
  not something that has been historic.
• 3:50
  Historical at least for me last year is really kind of when it
• 3:53
  picked up. But I enjoy it gets me out
• 3:55
  talking to people which is what I like to do and talk to a lot
• 3:58
  of really smart people. Got to have a really nice dinner
• 4:01
  with friend Bert who I used to work with so way back in the day
• 4:05
  and kind of listen to him. I am trying like heck to get him
• 4:07
  on the show. We actually were sitting there,
• 4:10
  we were talking over dinner and just kind of catching up because
• 4:13
  it had been a while since we'd seen each other.
• 4:15
  And he's, he was talking about keeping your vendors accountable
• 4:20
  and honest and making sure you get the most value out of the
• 4:23
  products that you're buying. I was like, that's it.
• 4:25
  That's our episode right there. So yeah, that's that's one I've
• 4:29
  been working on for a while. And hopefully, Bert, if you're
• 4:31
  listening, we got to get you on, man.
• 4:34
  Yeah, let's face it, Bert is sounds like he's the he's the
• 4:37
  person or exemplifies living in the real world of identity.
• 4:42
  He's the practitioner out there making it happen, but he doesn't
• 4:46
  really think. Of himself as an identity
• 4:47
  person. I mean he's a he's a siso and
• 4:50
  that's happened. I used to work for him back in
• 4:52
  one of my prior roles and you know I it's it's interesting.
• 4:56
  You know it's like well, I don't really, you know, I'm not I'm
• 4:58
  not an identity. It's like yeah, we, but we talk
• 5:00
  about so many other information security things as well, right.
• 5:03
  Identity's part of information security.
• 5:04
  It's one of the, in my mind, one of the pillars from a security
• 5:07
  strategy like there is you. Could say there are things.
• 5:09
  We can talk about it is Epicenter for sure.
• 5:12
  We heard it from this. So you know Ryan?
• 5:15
  Yeah, Ryan, Ryan, last episode really nailed that.
• 5:22
  But we were talking about, I was in a meeting, I think I was with
• 5:24
  you and someone was talking about, you know, Microsoft and
• 5:28
  all their different offerings, like a Venn diagram of
• 5:31
  overlapping. And I was thinking to myself,
• 5:33
  hey, I I know what the center of that Venn diagram is.
• 5:36
  It's the identity. Yeah, I mean, it's everywhere.
• 5:41
  You can't escape it. Like, what industry do you
• 5:43
  specialize in Friday? All of them.
• 5:46
  Every industry uses it. So, I mean, that's obviously
• 5:49
  maybe my selfish view of the IM space, but everybody is doing
• 5:53
  identity and there are a lot of overwrap in use cases.
• 5:57
  You know, I hate to say it, but not everyone is special, right?
• 6:01
  There are certainly some unique use cases, but there's a lot of
• 6:05
  common things that stretch across no matter what industry
• 6:08
  or vertical or size of organization, everyone is
• 6:11
  dealing with things in the identity world.
• 6:13
  Yeah, so we've been teasing this episode for a while.
• 6:16
  It's the five questions that we were asking people to leave us
• 6:22
  voicemails with questions. We got a lot more than five.
• 6:26
  We only pick five because we're giving away some donated codes
• 6:34
  to download the e-book Learning Digital Identity by Phil Winley.
• 6:38
  Phil's gracious enough to get us those codes.
• 6:42
  So today's the day where we're going to play those questions
• 6:46
  and then answer them the best we can.
• 6:51
  Yeah, it was. I mean there were a lot of good
• 6:53
  questions. So it's kind of hard to like
• 6:55
  choose those. Oh, that's a great was like
• 6:56
  maybe we should do a whole show around that or, you know, I love
• 6:59
  that for for different reasons. But yeah, these are the ones
• 7:02
  that we kind of settled on. And I don't know how do we want
• 7:05
  to go into this? Do we want to go into that, do
• 7:07
  everything else we want to cover before we start going to
• 7:09
  voicemail? Yeah, we should talk about
• 7:11
  Identity Week, right? I mean, those are upcoming and
• 7:14
  we've got a fantastic discount code.
• 7:16
  So we've got Identity Week is a conference that hits Europe,
• 7:21
  Asia and America. So Europe is in Amsterdam June
• 7:25
  11th through 12th, America's in DC September 11th and 12th, and
• 7:29
  we'll be at that one Singapore. We'll be at the sorry in
• 7:32
  America, so we'll be at the. We'll be at the 1:00, we'll be
• 7:35
  there and then Asia is in Singapore, October 22nd and
• 7:40
  23rd. Wish we would be there, but I
• 7:42
  don't think we're going to be anyway.
• 7:44
  That discount code is IDAC 30. It gives you 30% off for
• 7:49
  registering for any or all of those those conferences.
• 7:54
  So that's one of the things that we do is like we're going out
• 7:57
  there and trying to get these discount codes.
• 7:59
  We don't benefit directly from them, but you know, we're doing
• 8:04
  it for the folks who listen and hopefully they can get save
• 8:07
  their organizations a few bucks or if they're paying for it out
• 8:10
  of their own pocket, save for themselves.
• 8:13
  Yeah, yeah. And then come check us out.
• 8:16
  Jenny Week, America or the other ones.
• 8:17
  It's kind of cool. The code works around the world
• 8:19
  because I know we've got folks listening all over the place.
• 8:20
  So, you know, there's three different conferences, 3
• 8:23
  different regions. I I enjoyed my time there last
• 8:27
  year. So I'm looking forward to
• 8:28
  continue to grow and expand. We'll have a little more of a
• 8:31
  podcast presence this year. So we're working with the
• 8:32
  conference organizers to help with that as well.
• 8:34
  But yeah, I, I, I like where that that conference is going.
• 8:39
  So I think there's plenty of room for learnings and to get
• 8:42
  together as groups and kind of you know, hear from from folks
• 8:46
  of how they're tackling some of these challenges that we see out
• 8:48
  there. Yeah, I think also just, you
• 8:50
  know, I've seen conferences do this a few times where they try
• 8:53
  and go regional. And what is great about the
• 8:55
  regional aspect is people who normally wouldn't get to go to a
• 8:59
  conference can go if it's, you know, local and they don't have
• 9:03
  to hop on a plane or necessarily get a hotel or they can minimize
• 9:08
  that. The cost of their organization,
• 9:10
  they can get to go. So I think that's real valuable.
• 9:13
  So I think with like Identity Week, America being in DC,
• 9:17
  there's just kind of a a increased focus on kind of the
• 9:21
  Beltway and everything that happens inside or near the
• 9:24
  Beltway. Yeah, I think historically it's
• 9:27
  been a government focused, kind of more government focused
• 9:30
  conference. But I think they're trying to
• 9:32
  expand, right. And the way to expand is to get
• 9:33
  more people involved, different viewpoints and like I said I I
• 9:37
  I'm encouraged by the direction of it.
• 9:38
  I think it's still a growing thing, which is great.
• 9:41
  There's there's definitely room for that and it's a good time of
• 9:44
  year because there's really nothing else I think from
• 9:46
  identity perspective taking place in the US around around
• 9:49
  that time. Now, before we get into those
• 9:51
  awesome questions, I know you had found this post on Reddit.
• 9:55
  You sent it to me during the week, and I was just like, oh,
• 9:58
  that's really cool. We need to talk about that
• 10:00
  during the podcast. So what do you tell everybody
• 10:03
  what that was? And then we'll jump into the
• 10:06
  questions. Yeah, I just happened to
• 10:08
  randomly be scrolling through Reddit as one does.
• 10:10
  I'm mostly a worker, and I subscribed to the identity
• 10:14
  Management subreddit, and there was a topic that said what are
• 10:17
  your top five cybersecurity podcasts and newsletters that
• 10:20
  especially focus on identity and access management?
• 10:24
  And it's like, oh, OK, that's kind of cool.
• 10:26
  Let me see, you know what's in there?
• 10:26
  What are people saying? And the first one was a comment.
• 10:30
  Identity at the center is the only one I'm listening to.
• 10:32
  And then the original poster put a comment that's top shelf.
• 10:35
  So yeah, I had to comment on that one.
• 10:37
  I normally don't really kind of get involved, that kind of
• 10:40
  thing, but it was very flattering to kind of see it out
• 10:42
  there. And I just happened to catch it.
• 10:44
  I think it was just, it wasn't like I was looking for anything.
• 10:47
  It was just, oh, OK, you know, what's up there?
• 10:50
  And yeah, there we are so Reddit famous, I guess, which is very
• 10:54
  cool. So if you're on Reddit, you're
• 10:56
  listening. Thank you so much.
• 10:57
  If you're not on Reddit and listening, thank you so much.
• 11:00
  Yeah, what I liked was there were six up boots and so
• 11:03
  subtracting the up boot that you put and that the original poster
• 11:08
  probably put, you know, four people loaded it up.
• 11:12
  Yeah, not a very heavily trafficked subreddit, but
• 11:15
  occasionally there's some Megan's in there and some
• 11:17
  interesting questions and kind of things like that.
• 11:19
  I think. I think it's one of those things
• 11:21
  where that subreddit seems to get a lot of like what I would
• 11:24
  call like spam advertising and sort of like sponsored branded
• 11:29
  posts and things like that. But every once in a while, you
• 11:31
  get one that seems kind of legitimate.
• 11:33
  That could be annoying. You know, one of the things I'll
• 11:35
  do a lot is, you know, type whatever I want to search and
• 11:39
  Google, and if I don't want to just get sponsored content, then
• 11:43
  I'll put the word Reddit just to see what comes back.
• 11:48
  And you sometimes get some real human beings, like what you used
• 11:52
  to get when you would search, you know, 20 years ago.
• 11:56
  Yeah, I mean there's there's a lot of sponsorship and
• 11:59
  advertisement. I've read it for sure.
• 12:01
  But this one I choose to believe was legitimate because I
• 12:04
  actually ended up having a conversation with one of the the
• 12:06
  posters on there, training some linked messages back and forth.
• 12:09
  So that was kind of cool. But yeah, very, very cool to see
• 12:12
  that out there. People obviously still
• 12:13
  discovering us and for the folks who are sharing that out there,
• 12:16
  definitely appreciate it. Why don't we get to some
• 12:18
  voicemails? Yeah, that sounds great.
• 12:20
  I one thing I want to say before we start the voicemails is we're
• 12:23
  going to go through 5 today. We had lots of them.
• 12:26
  The ones that we don't go through today, we're saving for
• 12:30
  future episodes. Like Jeff said, some of them
• 12:32
  were, we didn't want to like punish, but they're good enough
• 12:36
  questions that we can base the whole episode on the question.
• 12:39
  So we did save some for that reason.
• 12:42
  But also it's not like the voicemail lines are now closed.
• 12:46
  Keep putting questions out there.
• 12:48
  We'll use them for future episodes.
• 12:49
  So yeah, please keep doing that and then, you know, spread the
• 12:54
  word, let people know. That's how the podcast is
• 12:57
  growing, is, you know, a lot of times I'll talk to people who
• 13:00
  are practitioners in our space like, oh, you have a podcast
• 13:03
  identity at the center. I never heard of it before.
• 13:05
  Like, oh man, this is somebody who should already know about
• 13:08
  this. So, you know, spreading the word
• 13:10
  is certainly appreciated. Yeah, lots of good ones.
• 13:13
  I was surprised only one spam slash, not even like trolley,
• 13:18
  because it was funny. There was one from So whoever
• 13:20
  put in the Chip chipperson one, I got you.
• 13:22
  I know who chip chipperson is. So my thought process is like,
• 13:26
  either they know that, I know that, or they're just a fan of
• 13:29
  Jim Norton, who is a comedian and that's like his alternate
• 13:32
  persona. So I got a kick out of that,
• 13:34
  whoever set that in. But sorry, you didn't win a
• 13:36
  book. I did recognize it.
• 13:40
  Yeah, and then, well, I guess it's not validated, but I
• 13:43
  thought the person's e-mail address said
• 13:45
  likechipchipperson@aol.com. And I was like, wow, did they go
• 13:49
  through the effort of creating that e-mail address too?
• 13:52
  Or did they just put it in there and it doesn't just put it in
• 13:56
  there? Yeah, home run chipper.
• 13:57
  So good job. All right, The first one up is
• 14:01
  Andrew Champ, the phone. So that's a nice one.
• 14:03
  So let me play that clip and then and then we'll respond.
• 14:05
  Hey Jack and Jim, a new champ on here.
• 14:07
  Just friend of the show and I'm asking you guys about the
• 14:12
  barrier of entry and identity access management.
• 14:15
  There seems to be so many companies are looking for
• 14:18
  talent, but it's hard to come by, especially entry level roles
• 14:23
  and that seems to be a struggle around the industry today.
• 14:27
  There's not many people who can get sell point experience
• 14:30
  because they're not on projects that will do sell point.
• 14:33
  Yes, sell point did open up their identity university to
• 14:37
  people, but it seems to be still a gap.
• 14:39
  What do you think are some changes that need that need to
• 14:42
  happen in terms of companies giving actual level of people a
• 14:46
  shot into? I am because I just don't feel
• 14:49
  like there's an easy answer to it.
• 14:51
  Thanks guys. Letter of D what you guys doing
• 14:52
  and hope to see you guys soon on the show.
• 14:54
  Bye. All right.
• 14:54
  So, Andrew, definitely in front of the show, seeing that a
• 14:56
  couple actually saw my identity week in Merkel last year.
• 14:59
  Good question. I like this question because I
• 15:01
  think a lot of times we focus on people who've been in the space
• 15:04
  for a while. But this is an area that I think
• 15:07
  is interesting is how do you actually get into identity?
• 15:11
  I feel like hands on as the best teacher and how do you get an
• 15:15
  entry level you know I am position where you are hands on
• 15:19
  with the tech with the technology.
• 15:21
  What are your thoughts, Jim? Yeah, great.
• 15:24
  Great question from Andrew and I also really appreciate what he's
• 15:28
  out there doing to try to help people get these entry level
• 15:32
  rolls. And so this is right in his his
• 15:34
  lane. I think one of the questions is
• 15:36
  like if you're starting off what what do you can define as entry
• 15:40
  level? In other words, you're already
• 15:41
  in the company, you're already working in some kind of
• 15:44
  technology or customer support or is this somebody who is just
• 15:48
  out of whatever training they're doing and decided like IMS for
• 15:52
  me. And I think First off, First
• 15:55
  things first, like you need to know what you want to do, like
• 15:59
  where you want to go or have at least some idea, right.
• 16:01
  That be open to the idea that it's going to change if you're
• 16:05
  in that role, where are you in that space where you don't have
• 16:09
  a role yet? I think you just need to get
• 16:11
  that first role and you have to be open minded.
• 16:13
  Like yeah, I'd like to learn Cell point might be your entry
• 16:16
  point, but you might get in a company that doesn't have Cell
• 16:18
  Point, it might have something else.
• 16:20
  And it's like then be open to learning a different area of IAM
• 16:25
  because you can learn it all if you give it time and you get the
• 16:29
  experience. If you're already in a role and
• 16:31
  you want to move up within, you know, to be willing to take on
• 16:36
  new opportunities and learn outside of work.
• 16:40
  I know everybody's life situation is a little bit
• 16:42
  different. But most companies don't want to
• 16:44
  pay people to just sit there and learn, right.
• 16:46
  They want to pay people to do a job.
• 16:48
  So you're going to have to spend some of your own free time kind
• 16:52
  of improving your skills. I think getting those years of
• 16:56
  experience under your belt, that's key.
• 17:00
  I think going and doing a good job, that's key and keeping your
• 17:04
  eyes open and being somebody who is a sponge and is learning.
• 17:09
  Those are all the the keys to kind of building yourself up.
• 17:13
  You know, I think everybody kind of looks at us like, oh a cell
• 17:16
  point engineer. They can make 6 figures.
• 17:20
  I want to become a cell point engineer, but it's not really
• 17:23
  that easy, right? You have to kind of pay your
• 17:25
  dues So you know those entry level positions, you know they
• 17:29
  might not look like cell point engineer that they may get your
• 17:32
  foot in the door, give you the opportunity that where you're
• 17:34
  getting a paycheck doing something close and you're
• 17:37
  building the skills and then when they need somebody to step
• 17:40
  up and do some more things, put yourself in that position.
• 17:44
  What do you think, Jeff? Yeah, I think you've got to be
• 17:47
  able to, you have to really invest your own time to this.
• 17:50
  No one's going to hand this to you.
• 17:51
  So I think you're going through training, you got to work your
• 17:54
  network, try to find those, those entry level positions.
• 17:57
  I think sometimes if you're doing like a career change or
• 18:00
  career pivot, you got to be willing to take a step
• 18:02
  backwards. If you don't know anything, no
• 18:04
  one is going to pay you 6 figures to do that work.
• 18:08
  This doesn't happen, right. So you have to be able to take a
• 18:11
  step back and say OK why don't anything.
• 18:12
  But I'm willing to invest the next couple years getting that
• 18:14
  experience to that eventually get to you know, the higher
• 18:17
  paying role or whatever it may be.
• 18:19
  But I think you hit something very early on that I think is
• 18:21
  important and that is the what do you want to be when you grow
• 18:24
  up? Question because there's a lot
• 18:26
  of different ways to get into the IM space.
• 18:28
  There's technical and there's non-technical roles.
• 18:31
  What do you want to do if it's a technical role?
• 18:34
  Well what does that even mean? Is it IGA?
• 18:37
  Is it privilege access management?
• 18:38
  Is it authentication, authorization, password lists,
• 18:42
  verify credentials, decentralized right.
• 18:45
  There's a lot of stuff to kind of know and kind of figure out
• 18:47
  but I think you really have to kind of figure out where what do
• 18:50
  you think you want your role to be in the IM space?
• 18:53
  If it's time to go, great, go out and do whatever self
• 18:56
  learning you can, collect whatever certifications you can,
• 18:59
  you know try to find the entry level engineer role.
• 19:01
  I think the ones that immediately come to mind if
• 19:04
  you're looking for that kind of role is 2 consult is 2 areas.
• 19:07
  The 1st is consulting. A lot of consulting shops are
• 19:10
  looking for kind of entry level people to train up and develop
• 19:15
  and sort of augment their more senior staff and that's
• 19:18
  primarily around a cost basis. You can't have you know senior
• 19:21
  level people doing all the work. That's just it's very expensive
• 19:23
  to do it that way. So you're always looking for you
• 19:27
  know, fresh talent to kind of come in and start to learn the
• 19:30
  ropes and kind of offload some of the administrative things or
• 19:34
  you know, basic configuration items that go on with any kind
• 19:37
  of technologies. The other is actually going to
• 19:40
  the technology companies themselves.
• 19:42
  If you've, you know a lot of these folks are looking for
• 19:46
  sales engineers and for Level 1 supports and people they can
• 19:50
  transfer themselves. So there's a a specific
• 19:52
  technology that you're looking at.
• 19:54
  Check out their website and see if they're hiring for those
• 19:56
  types of roles. You know that's another option
• 19:58
  that that you can take a look at.
• 19:59
  But I really do think you kind of start with what are, what do
• 20:02
  you want to be when you grow up in the IM space and then figure
• 20:07
  out what you need to get there. The role that you start with may
• 20:10
  not be a 100% match, but if it puts you in position to either
• 20:15
  get to that, you know whether it's with that company or in
• 20:18
  others. I think you've got to figure
• 20:20
  that out. And that's different for
• 20:22
  everybody. Everyone's got a different.
• 20:23
  Situation. I think there are also some
• 20:25
  certain intangibles that if you have these things, you're more
• 20:30
  likely to get a position. I really want to be a part of a
• 20:33
  team. I really like to encourage
• 20:36
  others and, you know, provide leadership.
• 20:39
  Wherever I have the ability to lead.
• 20:43
  I don't feel like I need a title to lead some of those, to tell
• 20:47
  me those things. I'm like, this person's got the
• 20:51
  right stuff now, Do they have enough technical skills to do
• 20:54
  the job that I'm looking for? I don't know.
• 20:57
  That might be a separate decision.
• 20:58
  But if you can make the person know that, like you've got the
• 21:04
  right intangibles, you know, being a good team member,
• 21:10
  looking for opportunities to lead, you know, I think those
• 21:15
  are those are great things. Those are coming to me that
• 21:17
  people don't hate you. All right, yeah, We just be a
• 21:20
  decent human being. All right.
• 21:24
  Should we move on to the next one?
• 21:26
  Let's do it. All right, so this one comes
• 21:28
  from Alex Suarez. Hey Jim and Jeff, My name is
• 21:31
  Alex Suarez and I am an I am domain Architect.
• 21:34
  The question that I have is, given the increasing
• 21:37
  complexities of each slice of Identity and Access Management,
• 21:40
  should a single I AM Architect encompass the entire domain?
• 21:43
  Meaning should an I am Domain Architect focus in all aspects
• 21:46
  of Access Management, Pam, IGAMFA, etcetera?
• 21:51
  And therefore could there be an opportunity to have an
• 21:53
  equivalent of an Enterprise Chief Architect role but solely
• 21:56
  focus on the I am Domain as a whole?
• 21:58
  What are your thoughts? Thank you.
• 21:59
  Interesting question. What do you think, Jim?
• 22:02
  Yeah, my initial reaction is different.
• 22:07
  Part of it's going to depend on what the organization needs, how
• 22:11
  big their architecture group is, things like that.
• 22:14
  I mean, Alex points out something that it's become very
• 22:18
  obvious to me that the IM space is growing.
• 22:21
  There's all these different domains, there's so much to
• 22:23
  know. I usually don't think that
• 22:26
  architects need to know the intricacies of every technology
• 22:30
  that they're involved with. But I guess that would also
• 22:34
  depend on the organization, right?
• 22:36
  So if you are like a consulting organization, you really need to
• 22:41
  provide expertise at the architect level for your
• 22:45
  clients. You do need to have a certain
• 22:48
  level of expertise. If you're the architect at a
• 22:52
  company, you probably have to be more a Jack of all trades and
• 22:58
  and have a good understanding of how these things work.
• 23:00
  So I think it kind of depends which is the consulting answer.
• 23:05
  You know if you're roll up your sleeves do I am every day you're
• 23:09
  probably you might just focus on access management or something
• 23:14
  like that or identity governance for sure ITDR.
• 23:18
  But I think if you're working for a firm that you know it's
• 23:22
  like a say GE or a bank or something like that, you're
• 23:26
  probably going to have to have a broader scope.
• 23:28
  It's just they just don't have enough architects to, you know,
• 23:32
  specialize too much. Yeah, I like the I hate to say
• 23:35
  it, but I like the depends asset.
• 23:36
  It depends answer and that's what kind of mind is.
• 23:39
  Is there enough of work to support someone working only as
• 23:43
  an identity architect? And that's got to be a massive
• 23:46
  organization. It's got.
• 23:48
  Or maybe it's a massive identity footprint that you're trying to
• 23:52
  pull together. I like the idea of it, but I
• 23:54
  don't know if I necessarily see it in the real world yet.
• 23:56
  Maybe as we move things along and identity becomes more.
• 24:01
  Larger. You know, more spread out across
• 24:05
  the organization, maybe some things like that.
• 24:06
  But I find it difficult right now to say, OK, I only focus on
• 24:11
  identity architecture. That might be a focus for a
• 24:14
  couple weeks, a couple months, maybe a year as you're kind of
• 24:17
  standing something up. But once you've got the
• 24:19
  architecture in place, then what, like what do you do?
• 24:23
  As I say, it goes back to the question of like is there enough
• 24:25
  work to support someone working only on identity architecture
• 24:30
  for five years, 10 years? I don't know.
• 24:33
  I think you'd have to be a really massive identity product.
• 24:36
  I could see maybe something like that at like you know a meta, a
• 24:40
  Google, large ID, PS Microsoft, right?
• 24:44
  Things like that. A normal organization, probably
• 24:47
  not. And I say normal.
• 24:48
  Just meaning identity is not their secret sauce.
• 24:52
  It's not their products, right? To deliver to others.
• 24:55
  Maybe a massive e-commerce type thing maybe something like
• 24:59
  Amazon you know might have something like that but I think
• 25:03
  it's an interesting conversation and and then should a chief IM
• 25:06
  architect exist. I think the second part of the
• 25:08
  question again kind of goes back to is there enough work to
• 25:12
  support that? What does a chief identity
• 25:14
  architect do? That means are there sub chiefs
• 25:18
  right, Are there other identity identity architects and there's
• 25:21
  one person who's kind of like in charge of all those.
• 25:23
  I mean that to my my mind is like how much how big is your
• 25:26
  identity architecture to multiple people in a long term
• 25:30
  role to keep that up and running?
• 25:32
  I think if you have an identity consulting firm, you definitely
• 25:36
  could have that kind of structure, right?
• 25:38
  I mean, we worked at a company where there were several cell
• 25:41
  point architects, so you could see something, but they were.
• 25:44
  Focused on cell point, right. Yeah, that's all they did.
• 25:49
  Yeah, Yep. But we also had people who were
• 25:51
  architects in access management. So I yeah this is one of those
• 25:57
  depends on, So sorry Alex. Yeah, I hate to say it depends.
• 26:01
  I think if you understand the identity space and you're able
• 26:04
  to combine architectures and understand how authorization,
• 26:10
  authentication, privilege, access, identity, governance,
• 26:12
  ITDR, you know all that stuff kind of comes together.
• 26:15
  I think that's great that obviously, you know, makes I
• 26:18
  think it's very valuable to have that skill.
• 26:20
  I just don't know if there's enough.
• 26:22
  That's a question only your your organization can answer, right?
• 26:24
  Is there enough work where you only focus on identity
• 26:28
  architecture? Maybe there is and I'm happy to
• 26:30
  be wrong because I would definitely want to promote the
• 26:32
  identity space, but I I just haven't seen it yet where
• 26:36
  there's been one dedicated identity architect.
• 26:38
  Usually it's a shared architect type role where they they know
• 26:43
  the identity side but they also know some the other things going
• 26:45
  within the organization. Yeah, like an infosec architect
• 26:49
  who also understands like the logging architecture, because
• 26:53
  look at itdr, it's it straddles that line between identity and
• 26:58
  threat detection. All right.
• 27:00
  Next up we've got Tim Ritter, so here he goes.
• 27:04
  Jim and Jeff, Tim Ritter from Cloud Identity wishing you guys
• 27:08
  a great 2024. I'm sure you guys have great
• 27:11
  plans both personally, professionally and with the
• 27:14
  podcast here, but wanted to touch on the hiring front.
• 27:18
  Cloud Identity, obviously a global leader in IAM and Pam
• 27:21
  staffing and some advice for people looking out there.
• 27:26
  If you do have your current role, be grateful.
• 27:29
  Layoffs have created fierce competition for roles for
• 27:32
  numbers as everyone is seen on LinkedIn, and now is definitely
• 27:36
  not the time to be looking for that dream job.
• 27:39
  If you need income right now, utilize your skill sets and look
• 27:42
  at rules. That may not be exactly what
• 27:45
  you're looking for if you do need income, but the good news
• 27:49
  is, is our clients have projects starting and we're seeing
• 27:53
  identity projects throughout the landscape that are getting under
• 27:56
  way. So we're anticipating around
• 27:58
  Q3Q4. You know, there'll be a good
• 28:01
  flow again on the hiring front within the sector.
• 28:04
  But my question for you guys is with all these breaches
• 28:08
  happening in the introduction of AI, what do you think the most
• 28:11
  influential roles will be inside for 2024?
• 28:15
  Is it the SISO? Is it our technical talent,
• 28:18
  functional leadership? I'd like to hear your guys
• 28:20
  opinion, but again wishing you guys all the best for 2024 and
• 28:24
  hopefully she you either at Gertner, IAM or Identiverse.
• 28:28
  Take care guys. All right.
• 28:29
  So Tim's a friend of the show, definitely stuck a commercial in
• 28:31
  there, but we'll allow it. Anything that gets Identity
• 28:34
  people up and working and employed, I'm in favor of.
• 28:38
  I think the first part of his statement really is kind of like
• 28:41
  the job market and competition and things like out there.
• 28:43
  I mean, I think that's it's a very competitive market that
• 28:46
  we're in. Identity, I think there's always
• 28:48
  people looking for folks, but I definitely agree that it we've
• 28:51
  seen a little bit of a slowdown with organizations taking a step
• 28:54
  back. You know there's been layoffs
• 28:56
  have taken place you know within the identity space as well.
• 28:59
  So I think I'm encouraged by it. I think the last year a lot of
• 29:02
  this was driven by the economy, especially the first half of the
• 29:04
  year in the US and starting to see that pick up.
• 29:07
  So a lot of things that people really want to get started maybe
• 29:11
  in first, second quarter of 2023, they kind of had to punt
• 29:14
  for a little bit, figure out what the US economy is going to
• 29:17
  do and it seems like Q4 and then now we're into Q1 of 2024, I'm
• 29:21
  definitely starting to see that pick up as well.
• 29:23
  So totally get that. As far as the influential roles
• 29:26
  when it comes to AI, and I am, what do you think, Jim?
• 29:32
  Well, yeah. First I did want to say like I
• 29:34
  thought that was a good input from Tim.
• 29:39
  You know, as far as like here's the state of the current job
• 29:42
  market, but he sees a pick up coming.
• 29:44
  That would be great news. You're still seeing layoffs, but
• 29:47
  that was big reason why we wanted to play this question was
• 29:51
  like there's a tidbit of information from somebody who's
• 29:54
  actively, you know, looking to place people all the time as far
• 29:59
  as kind of those influential roles.
• 30:01
  I I still think, you know, as far as AI, let me put that off
• 30:05
  to the side for a second. I still think that it's the CISO
• 30:08
  who has access to the board and has to keep educating them on
• 30:13
  this evolving threat landscape. Organizations cannot just take a
• 30:17
  hiatus from investing in informational security.
• 30:21
  And what at least what I'm seeing is that I we've been
• 30:25
  calling Identity at the center of this podcast has been going
• 30:27
  for nearly five years, but it just becomes more true every
• 30:31
  year. The investments in the identity
• 30:35
  landscape need to continue. In fact they need to increase.
• 30:41
  So it's those Csos and them being able to influence and help
• 30:48
  the board understand that this is a real threat to the
• 30:50
  business. I mean being shut down for a
• 30:53
  couple of days or a week, it's kind of like a, a death knell
• 30:58
  for a lot of organizations. So putting money into that is,
• 31:03
  it really is an investment. It's not FUD factor either.
• 31:06
  I mean, we've seen organizations that, you know, go offline for
• 31:10
  several days when they they suffer a massive breach.
• 31:13
  So I think they're influential, but everybody's influential.
• 31:18
  You know, the, the engineers, the architects, they have a
• 31:21
  voice within the organization. They need to be letting the see
• 31:25
  so know, here's what we're seeing.
• 31:27
  This is what's happening. This is, you know, the state of
• 31:30
  affairs that we're in. You know, as far as like AI, the
• 31:35
  the impact of AII think is going to probably impact engineering,
• 31:42
  the engineering and operations the most.
• 31:45
  Because the role I see AI playing in identity is that we
• 31:49
  can do more with fewer people. So we can, you know, manage
• 31:54
  bigger landscapes, you know, or say, with the same number of
• 31:58
  people, keep the same number of people, but basically have the
• 32:01
  software be able to do more and accomplish more.
• 32:05
  And rather than taking a year to roll out a software platform,
• 32:09
  maybe it only takes a couple of months, right?
• 32:11
  There's still more to technology rollouts than just technology.
• 32:15
  There's communication, there's user training, things like that.
• 32:18
  But I see AI impacting all those areas and making it easier to
• 32:24
  communicate effectively, to train people as well as to
• 32:28
  manage complex systems at a larger scale.
• 32:32
  Yeah, you hit everything that I was going to say he wants to add
• 32:35
  other than. I slow your Thunder.
• 32:37
  Yeah, you totally did. And I I think you were thinking
• 32:39
  alike on this one. You know, influence in an
• 32:42
  organization takes many shapes and forms.
• 32:45
  So whether you are the CSO or you are an engineer, an
• 32:49
  individual contributor or part of the board, I think being
• 32:53
  aware of how it's impacting not only you know life at large, but
• 32:59
  specifically for your organization, How are you going
• 33:02
  to be able to leverage the capabilities that it has?
• 33:06
  What are the threats that you see that you need to defend
• 33:09
  against? I think it's, I think it's an
• 33:13
  important area. It's definitely going to change
• 33:16
  the way that Identity works for on a number of fronts.
• 33:20
  You know, my we've talked about this before is how am I going to
• 33:22
  use AI to configure or set up connections between maybe you
• 33:27
  know different applications. Hey, I use a, you know, natural
• 33:32
  language interface and it's using large language models to
• 33:34
  convert my basic statement of I want to connect this to that, do
• 33:39
  it right and it it it's able to kind of infer that.
• 33:43
  How do you know that it's doing it correctly?
• 33:46
  Is it configured? Is it set up and secured
• 33:48
  correctly? Right.
• 33:49
  Things like that. I think that's still the area
• 33:51
  where I I would imagine, especially engineers in this
• 33:54
  area are really going to take a look at.
• 33:56
  Can you trust the model or the AI or whatever it is to do it
• 34:01
  correctly and to keep doing it correctly?
• 34:04
  And when it doesn't do it correctly, why did it do it
• 34:07
  wrong? What did it do wrong, and how do
• 34:09
  you correct that behavior going forward?
• 34:11
  And then, you know, I think that trickles up.
• 34:13
  But obviously you know as you as engineers are talking amongst
• 34:16
  themselves and they're working maybe with the CSO or maybe
• 34:18
  they're working with the board, right, whatever it is, I think
• 34:21
  that influence goes up front. But I think we've got to make
• 34:23
  sure that we don't get stuck in the fun factor, you know fear,
• 34:26
  uncertainty and doubt is let's be honest and open about the
• 34:30
  benefits and the negatives, you know, that will come come with
• 34:34
  us and be prepared for it. So I think that's, I think
• 34:37
  that's the only thing that I'll kind of add to what you just
• 34:39
  said. All right, let's get to Pedro's
• 34:42
  next. I like his question.
• 34:43
  So let's Harriet. Hi I'm Pedro, I'm a Service
• 34:47
  security architect based in Brazil and specialized in IAM
• 34:51
  and my question is regarding regarding ITDRI would like to
• 34:56
  know if there's a better solution to my ITDR
• 34:58
  implementation in ways like is it it would be more recommended
• 35:04
  for me to use my ITDR capabilities of my IEM solution
• 35:09
  for example using Microsoft Intra Identity Protection as as
• 35:14
  part of the Microsoft Intra Solution suite.
• 35:19
  Or would be better if I have a dedicated ITDR solution to to
• 35:25
  monitor all my all my my IEM in in spam solutions?
• 35:31
  Or even or even if it would be a good approach to have both
• 35:37
  solutions working together using my native capabilities of my IEM
• 35:41
  solution and my my dedicated solution of ITDR?
• 35:47
  Thanks. I think this is a question that
• 35:49
  everyone struggles with is do you use what you've already got
• 35:53
  and do, or do you need to get something else?
• 35:56
  Or maybe some combination go you go first Jim.
• 36:01
  OK. Well, we weren't talking about
• 36:03
  ITDR 2 years ago. Now it's like all we can talk
• 36:08
  about. And I'm really bullish on my
• 36:10
  TDR. But how many ITDR solutions
• 36:14
  exist today? There are a lot of them.
• 36:17
  I'll just say there's more than a dozen.
• 36:19
  And so you you think you're so OK, Well two years from now, how
• 36:23
  many were the will there be? I think part of it is Pedro hit
• 36:28
  on a great point is that a lot of products are now being built
• 36:32
  with ITDR features. And when I think about TDR
• 36:36
  features, I think of two things. One is looking at your identity
• 36:40
  system and when we talk about built in, I'm just going to say
• 36:44
  system, I'm not going to say systems because if you're say
• 36:48
  running Octa and you're leveraging what they're
• 36:52
  developing from an ITVR perspective, it's not going to
• 36:55
  also work against your like your cell point system or your cyber
• 37:01
  arc system, right. It's just going to work for just
• 37:04
  Okta. It's going to look at like how
• 37:07
  vulnerable is your system configured?
• 37:11
  Do you have certain patterns that are well known that could
• 37:15
  be attacked, but it's also looking at, from a life
• 37:19
  perspective, what's happening in the environment, how the
• 37:24
  identity system being used And are you potentially hitting on
• 37:30
  suspicious behaviors. That action needs to be taken
• 37:36
  like the response. In other words, we detect that
• 37:39
  it looks like some hackers trying to use one of the
• 37:41
  accounts and we're going to respond by you know disabling
• 37:46
  that account etcetera. So again like specific solution
• 37:51
  built just for that identity system is going to be just for
• 37:55
  that identity system. And if you're looking at the
• 37:57
  true ITDR that are I should say a standalone ITDR that's
• 38:02
  independent of an underlying product, then it should cover
• 38:06
  essentially all of your identity system.
• 38:08
  So it really depends on the position that you're in.
• 38:11
  I I suppose I haven't gotten far enough down that path to say
• 38:16
  whether or not and I think a lot of the ones that are being built
• 38:19
  into products are not at the maturity level that a dedicated
• 38:23
  product would be. So I kind of think you're going
• 38:27
  to do both, right. You're not going to ignore the
• 38:29
  features that your system has, but they're probably not going
• 38:33
  to be enough for just their own product but also for you know
• 38:38
  products outside of that product.
• 38:41
  So that's what my answer would be.
• 38:43
  Both. Your answer is both, so having
• 38:47
  both technologies in place to cover everything essentially.
• 38:52
  Yeah, I think you need an ITDR to do ITDR things.
• 38:55
  But if your system has ITDR capabilities, like if you have
• 39:00
  Octa and it has ITDR capabilities, you should not
• 39:03
  ignore those. It's kind of like Microsoft has
• 39:06
  privilege identity management. OK, so should you get a
• 39:11
  privilege identity or privilege access management system?
• 39:14
  Well, you need it for everything else other than the Microsoft
• 39:16
  stuff, right? But if you do have one of those,
• 39:19
  does that mean you don't use the Microsoft privilege identity
• 39:21
  management? No.
• 39:23
  You can use both, right? They can all fit into one
• 39:26
  program. So I kind of see it in a similar
• 39:28
  fashion. This stuff costs money.
• 39:31
  So before you add a new tool and see if I read, how do you
• 39:35
  justify that sort of thing? Because this stuff isn't isn't
• 39:37
  cheap. You know, if you're, we're
• 39:39
  talking specifically about Entra, if you're a 100%
• 39:42
  Microsoft shop and you can live in that world, yeah, go for it.
• 39:46
  I'm, you know, everything's taking place from a Microsoft
• 39:48
  perspective. It's probably a good fit.
• 39:50
  If you've got stuff that bleeds out of that, I think you got to
• 39:53
  decide, is it worth the cost to add another technology into your
• 39:58
  environment. You're going to have to pay
• 40:00
  licensing fees, You're going to spend money to get it up and
• 40:03
  running, and then you're going to spend time and resources
• 40:06
  monitoring. Yet another thing.
• 40:08
  Does Entra feed into that tool? Maybe.
• 40:10
  Maybe it doesn't. I think there are.
• 40:14
  Opportunities here for, you know, thinking about it from a
• 40:17
  smart spend perspective, yeah, if you have 80% coverage through
• 40:21
  Entra, great, Is it worth it to go that extra 20%?
• 40:25
  I think all you can decide, I think you need to figure out is
• 40:28
  the business going to justify the spend to cover that
• 40:32
  additional 20%. And those are just arbitrary
• 40:34
  numbers, right? Maybe Entra is only 25% of your
• 40:36
  environment. And yeah, you definitely do need
• 40:38
  something else, you know, to collect things without really
• 40:41
  knowing the details on the architecture side of things and
• 40:43
  kind of what use cases you're looking to address or are at
• 40:47
  least covered through the Microsoft stack, what are the
• 40:49
  gaps that come out of it? It's just been my experience
• 40:51
  that if you are, if you're all in a Microsoft, that's really
• 40:54
  the only thing you're using. Yeah, they've got great tools
• 40:56
  and you should absolutely be leveraging it.
• 40:58
  Don't go and spend money just because it's, you know, the hot
• 41:01
  kind of thing right now. Save that, you know save that
• 41:05
  conversation and over that that budget for other things in a
• 41:09
  space. Have have you gone password list
• 41:11
  yet? Have you implemented session
• 41:13
  monitoring, recording in the privilege access management
• 41:15
  space? You know have you automated
• 41:17
  onboarding, offboarding like all this other stuff.
• 41:19
  So I think there's other things to think about as well.
• 41:22
  I don't like spending money just to spend money.
• 41:24
  You know, this is, you know, a conversation we have all the
• 41:26
  time. But if there truly is a gap, is
• 41:30
  it justified or not? I don't know.
• 41:32
  I think that's. I think that's my answer is I
• 41:34
  don't know. Only you can really decide that
• 41:36
  because it's if it's a small gap, you might be OK with
• 41:39
  accepting that risk. That might be OK, right.
• 41:41
  Maybe there's a manual way to kind of close the loop.
• 41:43
  But if it's critical to your business, if it's maybe you got
• 41:48
  a history of security issues, right, things like that.
• 41:50
  You just have the visibility. Yeah, maybe it's worth it.
• 41:52
  I can see certain industries, you know, are are more prone to
• 41:57
  attacks and therefore need to be more secure.
• 41:59
  They are the place as well, especially, you know, finance
• 42:02
  for example, regulations, you know that they have to, yeah,
• 42:06
  adhere to and stuff like that. Yeah, we don't disagree much.
• 42:09
  I think we do disagree on this, but I think it's because we're
• 42:12
  looking at it from different contexts.
• 42:14
  I think we you're right for a small organization that's all in
• 42:19
  on Entra and it's covering 8580% plus of all authentication, you
• 42:26
  might be able to get by with that.
• 42:27
  I'd say first, well you know, is this just checkbox compliance
• 42:31
  ITDR or is it like a true, you know, full-featured ITDR for
• 42:37
  intra. The second thing I would look at
• 42:40
  is like I've worked with a lot of organizations where their
• 42:44
  management of privilege access management is very
• 42:46
  decentralized. In other words, things that are
• 42:49
  integrated with the Windows environment are very much like,
• 42:53
  yeah, you've got to use your Windows environment to get
• 42:56
  privilege access. They're still sending standing
• 43:00
  privileges, but you know, put that off to the side for now.
• 43:04
  But then there's other pockets that are very important where
• 43:06
  you have like standalone accounts and databases are in
• 43:09
  the cloud. And you know, maybe you have 15
• 43:14
  different pockets where privilege exists.
• 43:16
  And I think potentially that's where ITTR could give you a way
• 43:21
  to have some central program of privilege management without
• 43:27
  having centralized command and control.
• 43:32
  You know when when you're in one of those environments and like
• 43:35
  your mandate isn't centralized command and control, but at the
• 43:39
  same time you have responsibility to keep the
• 43:41
  environment secure. Monitoring is a fantastic way to
• 43:44
  do that. And I think standard monitoring
• 43:46
  of like monitoring you know security logs and IP based
• 43:52
  events, it's just far short of the modern threat landscape
• 43:57
  which is much more focused on identity based threats.
• 44:00
  Where in other words I saw a statistic the other day was like
• 44:04
  42,000,000 credentials for sale on the dark web.
• 44:08
  It's like what and? They're probably like $6.
• 44:11
  Yeah, and they're cheap. They're cheap, right?
• 44:14
  And if they don't work, then you get your money back.
• 44:17
  I doubt Bitcoin. Yeah, I don't.
• 44:19
  I don't know if there's a there's a money back guarantee
• 44:21
  on stolen credentials. I look at it from a business
• 44:24
  perspective. You want to spend money?
• 44:27
  Tell me what I'm going to get for that money.
• 44:29
  Is it reduction of risk? How are you going to use the
• 44:31
  tools? They.
• 44:32
  A lot of organizations buy tools just because and then they send
• 44:35
  on a shelf or they don't get full value out of it.
• 44:38
  I'm in. Look, if you've got the budget,
• 44:39
  go for it, right. I'll never say no to adding more
• 44:42
  capabilities, but just be careful about adding
• 44:45
  capabilities that don't get ever get used and unwise spend.
• 44:49
  Just make sure you've got a good story and a good understanding
• 44:52
  of what you're getting into and how are you going to give those,
• 44:54
  how are you going to use those tools in your environment, you
• 44:56
  know, demonstrate the value. All right.
• 44:58
  Next up we've got Chris Power, another friend of the show.
• 45:02
  He actually sent in a couple. So this is kind of a a good way
• 45:05
  to get like you know, 3 for one. The first one was wrong goals.
• 45:09
  So I'll play that here. Hi.
• 45:10
  Jeff and Jim. I love your podcast.
• 45:13
  This is Chris Power. We've talked many times at a
• 45:16
  couple conferences and really appreciate the insights that you
• 45:20
  give us. My question for the day is it is
• 45:23
  goal setting season for most of us in January, both on a
• 45:29
  personal level as well as on a department level.
• 45:33
  I would love to see what you think is the most impactful
• 45:37
  goals in the identity space for both people as a individual as
• 45:43
  well as teams as a whole. I hope this comes in as a good
• 45:46
  question. And.
• 45:48
  Look forward to hearing your answers.
• 45:50
  Well, it definitely comes in as a good question.
• 45:52
  I think this is you're totally right.
• 45:53
  I think a lot of organizations operate on like a calendar year
• 45:56
  and say all right, you know, go into whatever your system is and
• 45:58
  start setting up your goals. Jim, what are your personal and
• 46:03
  professional goals for this? Like what do you for the
• 46:06
  identity space? Like what have you thought about
• 46:08
  you know, what is your next year look like yet?
• 46:10
  Yeah. So I think going into, you know,
• 46:15
  when I set my my work goals, I tried to set goals that I feel
• 46:22
  like are, you know, high likelihood that I will achieve
• 46:26
  them. Because, I mean, who wants to
• 46:29
  have that conversation with your career advisor at the end of the
• 46:32
  year? And you haven't achieved your
• 46:33
  goals, so that would so try to set.
• 46:36
  This is the art of low bar goal HR.
• 46:39
  You know HR goal setting, right? You got to pick something that's
• 46:42
  like good but attainable, right? Because you don't want to miss
• 46:45
  those, not. Sandbagging.
• 46:46
  But you know what I mean. For personal goals though, I
• 46:50
  think it's good to make them, you know, aggressive.
• 46:55
  I think that you should be thinking about big things and
• 46:58
  you know, I've got a, you know, a lot of goals for the podcast
• 47:03
  and getting out there and building my network.
• 47:06
  I think building your network is probably one of the biggest
• 47:08
  investments you can make in yourself, going out, meeting
• 47:12
  people and and doing it in a genuine way.
• 47:15
  If you're, if you're not comfortable just, you know,
• 47:17
  going and introducing yourself and I mean look you you're going
• 47:22
  to face some rejection, right? And that's unfortunate, but
• 47:25
  that's part of, you know, going out there.
• 47:28
  But I think you'll face a lot less rejection then you think
• 47:32
  you're going to. You just go up and like you
• 47:35
  know, insert yourself in a conversation or just stand it.
• 47:38
  You know, there's Circle people there seeing Glazer and some
• 47:40
  other Identity folks that I follow on LinkedIn.
• 47:45
  And you know, I'm, I'm not at their level.
• 47:48
  I mean, I kind of had some of those thoughts early on, right?
• 47:52
  Like, but then when you go and you stand there and you meet the
• 47:55
  people who are, they're totally normal people and very
• 47:59
  welcoming. So to me.
• 48:01
  And quotation marks. Let's put that we got some real
• 48:03
  weirdos in the space. There there's sure.
• 48:06
  There's, and I, and I mean that in a fun, jest, jesting way.
• 48:09
  Absolutely, But you might consider yourself a weirdo.
• 48:12
  So. I'm definitely weirdo for sure.
• 48:14
  Yeah, but welcoming is is definitely true.
• 48:18
  And the more I reach out for guests for this podcast, I mean,
• 48:21
  I I can't, I can probably count on one hand the number of times
• 48:25
  I've been rejected by people to be a guest on the podcast.
• 48:29
  And you got to remember at one point we probably had like 50
• 48:33
  subscribers, you know, I mean, so it was zero.
• 48:37
  Yeah, we started with 0. Sure.
• 48:38
  So anyway, that's my goal is to, you know, build my network is
• 48:42
  probably one of the biggest ones.
• 48:43
  And I really want to see the podcast.
• 48:46
  You know, we we doubled our listenership every year since
• 48:50
  we've been around. Jeff, I want to do that again
• 48:53
  this year. It gets harder every year,
• 48:55
  right? Because the number gets bigger
• 48:56
  doubling it. At some point we'll have
• 48:58
  critical mass too. It's like there's only there's
• 49:00
  only so many people who are interested in identity.
• 49:02
  Eventually get to 8 billion and you're like, wait, everybody on
• 49:05
  Earth listens to identity at the center.
• 49:08
  Yeah, my goal is to show up in Google News as having signed an
• 49:11
  exclusive $250 million contract with, you know, some audio firm
• 49:16
  right to do the podcast. What's a good goal for the Yeah,
• 49:21
  that's that's a good goal for a team.
• 49:23
  So if I'm an IAM team, what's a goal that I would be setting?
• 49:27
  Like what's impactful to improving IAM in an
• 49:31
  organization? Well, it's got to be about the
• 49:33
  business, right. You got to achieve things for
• 49:35
  the business. I think you can have like I mean
• 49:38
  look we all want to have team building exercise and everything
• 49:41
  and those are important. But I don't really think those
• 49:44
  would be goals that you would set that that Chris was talking
• 49:47
  about. But I think like achieving
• 49:49
  things that are actually impactful for the business would
• 49:53
  be right. And I think you know trying to
• 49:56
  focus it on like improvements and metrics that are actually
• 50:01
  you can measure against, I think that's important.
• 50:04
  What were you thinking about? I guess I was thinking about it
• 50:07
  for like a maybe a capability standpoint.
• 50:09
  We keep hearing about everybody hates the password.
• 50:12
  Set a goal, go password less, enable it for some population.
• 50:16
  I feel like that's low hanging fruit at this point.
• 50:18
  It's built into a lot of the ID PS that a lot of us are using
• 50:21
  already. There are specific tools and
• 50:24
  vendors out there that offer, you know, maybe enhanced
• 50:27
  versions of that. But let's stop talking about how
• 50:30
  much we hate it and actually like, start fixing it.
• 50:32
  I don't know anybody who's like, Oh yeah, you want to take my
• 50:35
  password away and make it easy for me to log in.
• 50:36
  Please don't do that. And if you've got the funding
• 50:39
  and you've got you know, the right, you know, team in place,
• 50:41
  go for it. Even if it's just for like a
• 50:43
  small group, prove it out, Show that it works.
• 50:45
  You know, work work the, you know the issues out of the
• 50:48
  process so that you're ready to go live with more people.
• 50:52
  I think that's a that's a team goal.
• 50:54
  I think I'd like to see more people is take advantage of it
• 50:56
  is take advantage of things like passkeys and Fido and you know
• 51:00
  the work that's been done in that area.
• 51:01
  Look at how you're going to help the business.
• 51:04
  Go password list. Nobody likes it.
• 51:06
  So stop talking and do something individually.
• 51:11
  You know, I think this is kind of a tough question.
• 51:14
  Does everyone has whatever they want to, you know, work on and
• 51:19
  the I think you have to decide what is going to help you
• 51:23
  individually from a professional standpoint.
• 51:25
  It might be technical training. It might be, you know, speaking.
• 51:31
  It might be communications. It might be writing.
• 51:34
  I think if you're going to be well-rounded and really move
• 51:36
  forward in your career, you do need to be able to communicate.
• 51:39
  You do need to be able to come and comfortable to talk in front
• 51:42
  of people. You need to have domain
• 51:44
  expertise. You know, which of those things
• 51:47
  do you need to work on? Again, you've got to kind of
• 51:49
  pick with this, but I think, you know, be your own worst critic
• 51:53
  and say, OK, well, how can I get better at that?
• 51:54
  What are things that I need to be doing to improve this aspect
• 51:58
  of it? I never wanted to talk in front
• 52:01
  of people, whatever. And, you know, here we are,
• 52:03
  we're doing a podcast for, you know, billions of people around
• 52:06
  the around the Galaxy. And, you know, that's not
• 52:09
  something that I ever thought that I would be doing.
• 52:11
  Am I great at it? I don't.
• 52:12
  I I think I'm OK. But you don't get better.
• 52:15
  Yeah. Thank you very much.
• 52:16
  I appreciate your natural check's in the mail, but I think
• 52:18
  this is an area where you get better the more you do it, get
• 52:21
  reps doing it right. The people that we see on stage
• 52:23
  is at Identiverse at Gartner. They started in the same boat.
• 52:27
  It was, you know, there are certain people who are naturally
• 52:30
  gifted and others that have to work at it.
• 52:32
  I'm in the latter category and that's just one example.
• 52:36
  You know, if it's technology based, you'll get a
• 52:37
  certification. If you are looking to get more
• 52:40
  advanced and identity, is there a specific tool or technology
• 52:43
  you want to go for or is there, you know, a broader identity
• 52:47
  certification like CID Pro from idpro.org, right.
• 52:50
  Things like that. Or is it a soft skill?
• 52:53
  You know, can you articulate, you know, can you build a
• 52:55
  PowerPoint slide that doesn't look like crap?
• 52:58
  Because that's the method that your organization uses to
• 53:00
  communicate, you know, amongst each other, You know, stuff like
• 53:03
  that I think is important. And I think people need to be
• 53:07
  willing to spend time on YouTube, self study and learning
• 53:11
  and trying to figure out how things work.
• 53:14
  And whatever that thing is doesn't necessarily have to be a
• 53:16
  technical thing. It can be a process.
• 53:18
  It can be, you know, a mindset, whatever that is.
• 53:21
  Yeah, look at us. Like the other thing is put
• 53:24
  yourself out there. Yeah, you know, let's look at
• 53:26
  us. We, it's not like we're experts
• 53:28
  on every subject and that's why we have guests or anything or
• 53:31
  anything, right. That's why we have guests come
• 53:33
  in who are experts. But we put ourselves out there
• 53:38
  and take a chance that we're not going to, we're not going to
• 53:41
  know what we're talking. About I think it's I think it's
• 53:45
  that is easier said than done. I certainly recognize not
• 53:49
  everyone is comfortable doing that and that's fine.
• 53:52
  Like, I don't think everybody has to be out there all the
• 53:55
  time, but I think if you find your your tribe right and you
• 53:58
  start to communicate with those folks and if you're a solo
• 54:01
  person, that's great too, right? Think about what's going to help
• 54:04
  you as well. But you know Jim, you said it
• 54:08
  kind of up front. The industry is very welcoming.
• 54:11
  Walk up to people, hey, I just want to walk over introduce
• 54:13
  myself. I'm Jeff, you know, I follow you
• 54:15
  here or hey, I really liked what you wrote about that thing.
• 54:17
  Just want to let you know that's it doesn't have to be anything
• 54:19
  fancy. You don't have to like, you
• 54:21
  know, have some sort of secret handshake or curtsy or bow or
• 54:25
  whatever it is, You know, most of the people that I've talked
• 54:28
  to have been very welcoming around that.
• 54:30
  All right. So Next up, Chris, again,
• 54:33
  another good question. So we're going to keep it
• 54:35
  rolling with him. Good morning, Jeff and Jim.
• 54:37
  Chris Power from Indianapolis IN.
• 54:39
  My question of the day is as more products become web-based,
• 54:45
  more both identity and security related issues and then bundled
• 54:50
  as a service from those particular vendors or partners,
• 54:54
  how do we avoid issues where where it becomes a situation
• 54:58
  where one problem that happens in one place happens to all of
• 55:02
  us now because we all have, we're all running the same
• 55:06
  policies and procedures and processes.
• 55:08
  I see this as a situation where, from a security point of view,
• 55:13
  we're now becoming more regimented but also more
• 55:17
  predictable in the minds and the eyes of attackers and others
• 55:22
  that are meant to do us harm. What questions or concerns could
• 55:25
  you get out of that, as well as what answers do you have to make
• 55:30
  myself feel better about this going forward?
• 55:32
  So I kind of see this as a question of, hey, an attack
• 55:35
  against a large service provider that a lot of people are using.
• 55:38
  What the heck do you do about that?
• 55:41
  Hopefully I kind of distilled it down, but what happens when
• 55:44
  Microsoft or Okta or Google or Apple, you know, have some sort
• 55:50
  of issue that affects the number of people?
• 55:52
  What do you do about that, Jim? I think a lot of those services
• 55:56
  are quote UN quote too big to fail.
• 55:59
  I mean the the amount of impact is so broad reaching that it's
• 56:07
  really hard to imagine Microsoft Azure going down for a week or
• 56:15
  Amazon Web. Now the fortunate part is these
• 56:17
  bigger services are spread out over a geographic landscape and
• 56:24
  even smaller services generally leverages infrastructures and
• 56:28
  managed in a globally load balanced kind of way.
• 56:31
  So the likelihood of something like that happening from, you
• 56:35
  know, a pure disaster perspective like an earthquake
• 56:39
  or something like that, taking down the grid is is less likely.
• 56:44
  But from a security attack perspective, I mean like we
• 56:47
  don't know. I think the only thing we can do
• 56:50
  is like plan for these things. Like what would happen, your
• 56:54
  tabletop exercise planning what would happen if these things
• 56:59
  were to take place, if our Okta system went down, if our
• 57:03
  Microsoft system went down, what will we do and what if it came
• 57:07
  back up in various states. And then I think the other thing
• 57:10
  to think about and plan for is the the shared security model
• 57:18
  because I've talked with clients in the past where it's like, oh,
• 57:22
  that's outsourced, we don't have to worry about that, our vendors
• 57:25
  responsible for it. Well, do you, Are you sure, Are
• 57:28
  you sure you understand what your responsibility would be in
• 57:31
  that scenario? Would you be expected to?
• 57:35
  You know, what if? What if the problem was because
• 57:37
  of something that you did? In other words, you had the
• 57:40
  administrator account. Somehow the administrator
• 57:43
  account ended up on the dark web.
• 57:46
  They got in with the administrator account, wiped out
• 57:48
  all the data or change the data in such a way that locked you
• 57:54
  out. What's your recourse?
• 57:55
  Well, maybe it is that they would restore and you'd be back
• 57:58
  up and running. But again, planning around that
• 58:01
  and understanding exactly how it would work and not just, you
• 58:05
  know, saying we don't have to worry about that.
• 58:07
  Yeah, I like the idea of tabletop exercises.
• 58:09
  I think a lot of times people think about tabletop exercises
• 58:12
  like a breach, right? Or something like that.
• 58:15
  It can be anything you want. I mean, it can be done as a
• 58:17
  dragon as far as I'm concerned. But walk through the process,
• 58:21
  yeah. What happens if our IDP goes
• 58:23
  down? What do we do?
• 58:24
  How do we get people in? How are administrators going to
• 58:26
  get in to assess and diagnose? How are those things you know
• 58:31
  secured in case somebody does get access to I think having
• 58:35
  layers and different you know parts of the the onion right as
• 58:39
  we look at it from a security perspective is dispense in
• 58:41
  depth. It shouldn't be down to just one
• 58:44
  control one password and you know you're you're you're
• 58:47
  breached or you're popped. What are your different
• 58:50
  compensating or layered controls to make sure that if there is a
• 58:54
  breakdown somewhere, you know the the the blast radius is is
• 58:59
  limited or the impact of the breach or whatever it be.
• 59:02
  If it's something where you know you're talking about internal
• 59:05
  infrastructure or your Active Directory goes down, OK, great.
• 59:09
  You know what is the plan? Do you have ADR plan?
• 59:11
  Do you have a, you know business continuity approach to it?
• 59:14
  Have you done tabletop things like that.
• 59:17
  I think you have to kind of go into it with the mindset of what
• 59:19
  if, what if this happened and sometimes there's an answer,
• 59:24
  sometimes there's not. And I think you have to be kind
• 59:26
  of OK with that and it's OK to go through the process and say
• 59:30
  that you know This is why we're doing this exercises.
• 59:32
  We don't know what we would do if there was a issue with X.
• 59:37
  Let's talk about it. What can we do, you know get
• 59:39
  people in the room and start talking about it.
• 59:41
  And we had the architect question earlier, maybe that's a
• 59:43
  great time to pull up. You know you're if you've got 1A
• 59:46
  Chief Identity Architect to kind of come back and say hey you
• 59:48
  know what are the dependencies that we need to consider here,
• 59:51
  What needs to be up and running for identity work.
• 59:54
  I think just being open to having the conversation and just
• 59:57
  talking about it is probably the biggest thing that I would I
• 1:00:00
  would recommend here is talk about it.
• 1:00:02
  Work as a group and try to figure it out.
• 1:00:05
  There are, there may be levels of survival that you're willing
• 1:00:08
  to accept for a certain amount of time and that might be OK,
• 1:00:11
  right. We have limited processing
• 1:00:12
  capability or limited functionality, you know, things
• 1:00:16
  like that. And that might be OK.
• 1:00:17
  If it's a mass out, you know, outage.
• 1:00:20
  You know Microsoft gets picked on a lot.
• 1:00:21
  You know, teams goes down. You know half half the
• 1:00:24
  organizations can't do anything, you know, from a meeting
• 1:00:26
  standpoint. OK, well what do you do?
• 1:00:28
  Do you just? All right.
• 1:00:30
  Well, we'll just meet later. Yeah, maybe It's not business,
• 1:00:31
  you know, mission critical. If it is mission critical,
• 1:00:34
  what's your what's your plan to get up and running quicker?
• 1:00:37
  Yeah. I think the other thing is like
• 1:00:38
  sometimes the business goes out and procure services without
• 1:00:43
  checking with identity or informational security first.
• 1:00:46
  They just go out and get it and now you've got some, you know,
• 1:00:51
  software as a service that you've never heard of and they
• 1:00:54
  don't have like a complex disaster recovery strategy in
• 1:01:01
  place, like a say a sales force or an Octa or something like
• 1:01:04
  that. Dig in anyway, especially if
• 1:01:07
  that is a mission critical, a mission critical system.
• 1:01:12
  Yeah. So we're already up over an hour
• 1:01:16
  and we probably want to get start to wrap things up.
• 1:01:18
  But Jim, I know you reached out to Phil, we had sort of like
• 1:01:22
  this famous question this has become of, you know, what's the
• 1:01:25
  difference between digital identity and identity and access
• 1:01:28
  management. So I'm going to play that here
• 1:01:30
  and then we'll start to wrap things up.
• 1:01:31
  Hey, Jim, Jeff, on the question of what's the difference between
• 1:01:36
  Digital identity and identity and access Management or IAM,
• 1:01:42
  I've usually thought of Digital identity as a broad overarching
• 1:01:46
  topic, whereas Identity and Access Management is more
• 1:01:50
  applied. You know, actually solving the
• 1:01:53
  problems of a specific company's identity needs would be identity
• 1:01:58
  and access management. Whereas you know conferences
• 1:02:02
  tend to talk about lots of different things.
• 1:02:04
  So maybe they're about digital identity.
• 1:02:05
  An analogy might be the difference between biology and
• 1:02:10
  gene splicing. Although that might be two,
• 1:02:14
  those might be two different in terms of broad field versus a
• 1:02:19
  specific application. Anyway, I I think of I am I if I
• 1:02:25
  pick up a book on IAM, I'm expecting to see chapters that
• 1:02:29
  are like how to, you know, solve your authentication problem for
• 1:02:33
  your users or, you know, how does authorization help you with
• 1:02:37
  your application, that kind of thing.
• 1:02:39
  Whereas in a digital identity book, I'd expect to see, you
• 1:02:43
  know, maybe a broader coverage of what are the problems of
• 1:02:46
  digital identity, how do we solve them, you know, what are
• 1:02:49
  the basic technologies that we have in our hand in order to do
• 1:02:53
  this. So that's how I think about it.
• 1:02:55
  So I think still kind of aligns with kind of what I've been
• 1:02:57
  thinking is I see kind of like digital identity as the top as
• 1:03:01
  sort of like the macro concept or discussion.
• 1:03:06
  And then down from there are the different parts of that I AM,
• 1:03:10
  CI, AM, yeah, etcetera, etcetera.
• 1:03:13
  So I think again another slightly different answer.
• 1:03:18
  I don't know if everybody's answered it quite the same way,
• 1:03:20
  but still it's kind of like where I'm thinking is generally
• 1:03:23
  speaking, what do you think? Yeah, no, I I this is the way I
• 1:03:27
  organize digital identity and I am is like I am being a set of
• 1:03:32
  functions within digital identity.
• 1:03:36
  I but I still go back to that original episode that we did
• 1:03:40
  where we had like 5 practitioners kind of come on
• 1:03:44
  and answer this question. And one was Adam Michael from
• 1:03:48
  Texas A&M University and he took the opposite approach, which was
• 1:03:53
  IMS at the top. And your record, Jeff Stedman,
• 1:03:57
  is your digital identity within my Identity and Access
• 1:04:00
  Management ecosystem. And I thought that was really
• 1:04:04
  interesting. And I'm not.
• 1:04:05
  I'm not putting myself in a position to say that either one
• 1:04:08
  is right or wrong, because I don't think that there's the set
• 1:04:12
  answer that everybody agrees with you.
• 1:04:14
  Yeah, context matters. I I absolutely get where he's
• 1:04:17
  coming from and totally legit, totally valid.
• 1:04:22
  I'm not going to, I'm not going to go either way with it.
• 1:04:23
  I think context matters and I think based on your use cases,
• 1:04:28
  you might have a different, you know, viewpoint of it and that's
• 1:04:30
  great. I think that's a great part of
• 1:04:31
  of the idea of spaces. And probably maybe a little bit
• 1:04:33
  of the frustrating part is like we just, we're really good at,
• 1:04:36
  like disagreeing and not coming together with like, yes, this is
• 1:04:40
  what this means and we've settled on it.
• 1:04:42
  And then that doesn't happen and it changes.
• 1:04:45
  And then I'm like, OK, well, what do you mean by identity?
• 1:04:47
  Are you talking about physical identity, digital identity,
• 1:04:49
  your, you know, your persona online or in your wallet or
• 1:04:54
  whatever that look like so makes it for an interesting industry
• 1:04:58
  to be in. All right, let's go ahead and
• 1:05:00
  wrap up on a lighter note and in keeping with the trend since
• 1:05:03
  Chris sent so many, we're going to play his lighter note and he
• 1:05:08
  actually called her a lighter note.
• 1:05:09
  So I feel like we're OK with that.
• 1:05:12
  Let him ask the question and then it'll answer.
• 1:05:13
  Hi, Jeff and Jim. This is Chris Power from
• 1:05:15
  Indianapolis, IN. Really enjoy the podcast.
• 1:05:19
  For a lighter question, I'm going to ask what is your
• 1:05:23
  favorite IAM analogy? Recently I heard Identity is
• 1:05:28
  like gravity, which is really resonated with me as well as
• 1:05:32
  Identity is the Nexus between security and IT.
• 1:05:36
  What other ones have you heard that really seem to sink in?
• 1:05:41
  Look forward to hearing the. Discussion.
• 1:05:42
  All right. So Jim, you said you had
• 1:05:43
  something for this one, so. I have something for this one,
• 1:05:46
  so it's you're only one I am misconfiguration away from a
• 1:05:51
  breach. That sounds like a maxim, like
• 1:05:54
  this is like a truth. It's like in a book.
• 1:05:57
  I think you can probably convert that into like a haiku or
• 1:05:59
  something like that. Oh yeah, that's a great idea.
• 1:06:02
  But I yeah, I know it's not really, it's not really an
• 1:06:05
  analogy. But I heard it on another
• 1:06:08
  podcast and I was like, I've been saving it up to use it on
• 1:06:13
  our podcast and you may hear me say it again puts a lot of
• 1:06:18
  weight on the I am practitioner like, oh man, 1
• 1:06:22
  Misconfiguration. How many configurations do I
• 1:06:25
  have in my environment? Millions.
• 1:06:28
  So I don't know that it's a truth.
• 1:06:32
  It's kind of a truth, but it also puts a lot of pressure if
• 1:06:36
  it is the truth, and it puts a lot of pressure on the I am
• 1:06:40
  practitioner. What was that other podcast?
• 1:06:41
  Let's give him some. Credit that was the Google
• 1:06:45
  Security podcast with Anton and I can't remember his last name,
• 1:06:49
  but really good podcast, especially if you're in the if
• 1:06:54
  you're doing things in Google right?
• 1:06:56
  I mean because they do talk about Google Cloud and Google
• 1:07:01
  out Google Suite, G Suite. Yeah, G Suite or Workspace, I
• 1:07:06
  think had a few different names, but I get where you're going
• 1:07:10
  with it. Yeah.
• 1:07:12
  Yeah, I I I like to tell stories.
• 1:07:14
  I like to try to distill things that'll help people understand
• 1:07:17
  it. And I think the analogy or the
• 1:07:19
  example that I'll tend to use is there's a couple.
• 1:07:22
  There is the story of how we get into an airport.
• 1:07:26
  So if I'm trying to say look at Denny's like this, right, you're
• 1:07:29
  trying to do this thing, it's look, if you're you're going to
• 1:07:32
  go on a flight, you have to show ID.
• 1:07:35
  You have a credential, you have a boarding pass that gives you
• 1:07:38
  authorization to go to get on to a certain plane, a certain gate,
• 1:07:42
  right. And there's a bunch of different
• 1:07:43
  steps to go through there. And I think, you know, the
• 1:07:45
  analogy for me is like this is this is what identity is.
• 1:07:47
  It's a set of, you know, rules and structure that get you to
• 1:07:51
  where you need to go in a safe and secure manner.
• 1:07:54
  Another one that I'll use is sort of a story of around like
• 1:07:57
  a, a sports arena. Same idea, right?
• 1:07:59
  You've got tickets to get in. You've got seat numbers with
• 1:08:03
  where you're authorized to sit, certain areas that you really
• 1:08:06
  can't go. You shouldn't be on the field,
• 1:08:08
  right? That's privilege access.
• 1:08:09
  That's only for for the players or coaches or you know, other
• 1:08:13
  designated admins, right, so to speak.
• 1:08:16
  You've got cameras maybe in a corner that are counting where
• 1:08:19
  people are going or tracking things, right?
• 1:08:21
  Maybe that's behavior analyst, maybe it's ITDR, right?
• 1:08:24
  Maybe it's flow that you're saying hey what's a lot of
• 1:08:29
  people are going to the hot dog stands and not as many people
• 1:08:31
  are going to the sushi stand. Let's try to shift balance right
• 1:08:34
  things around that and using kind of metrics.
• 1:08:35
  So I think there's there's a few different analogies, but I like
• 1:08:38
  to base it on real life things that I think people easily
• 1:08:42
  understand. I think probably the most common
• 1:08:44
  one is like the house, right. You've got a key to get on the
• 1:08:46
  front door and then which rooms can you go into?
• 1:08:49
  I think you whatever it is I think you've got to be able to
• 1:08:52
  make it something that's relatable to your audience.
• 1:08:55
  So I like to use a few different examples like that.
• 1:08:56
  I I like I I'm trying to figure out the identity is like gravity
• 1:09:00
  one. I'm not sure what that means.
• 1:09:03
  I'll have to look at that Chris, next time.
• 1:09:04
  Next time we chat, maybe an Identiverse.
• 1:09:07
  You can walk me through that one.
• 1:09:09
  I like I I it sounds cool. I want to understand it before I
• 1:09:12
  start using it. So I just thought of an analogy.
• 1:09:15
  I'm going to throw it out there. So the Winchester Mystery House
• 1:09:18
  in San Jose, CA. And if you ever go to it, all
• 1:09:24
  the rooms are decorated in a different style, painted
• 1:09:27
  different colors and a lot of like trapdoors and things like
• 1:09:32
  that. And so I think the so I think
• 1:09:35
  the back story is Winchester like the gun brand, the the
• 1:09:41
  person who began that his widow became paranoid that people were
• 1:09:46
  going to kill her because her family was responsible for
• 1:09:50
  creating these guns that kill all these people and that
• 1:09:53
  somebody would be mad and want to kill her.
• 1:09:55
  So she designed the house so that if they came into the house
• 1:09:58
  they would never be able to find her.
• 1:10:00
  And so where I've used that analogy from an IM perspective
• 1:10:03
  is when you kind of come in and come, he's got all these
• 1:10:07
  different portals like think from a customer perspective, all
• 1:10:10
  these different portals and you never know if you're in the
• 1:10:13
  right one. And they all look a little bit
• 1:10:15
  different and trying to get down to a more common layout, you
• 1:10:21
  know the rooms feel the same, you have one key to the front
• 1:10:25
  door etcetera etcetera so. I like that one because it it's
• 1:10:31
  it's an interesting story. I can kind of start with that
• 1:10:33
  and it's entertaining, right? You're not going to lose.
• 1:10:36
  Hopefully you don't lose people right away.
• 1:10:37
  I think that's the the one thing is you want to keep people's
• 1:10:39
  attention. So I like that one.
• 1:10:40
  That's a good one. Yeah, you have to make it
• 1:10:42
  relatable, especially when you're presenting about I am to
• 1:10:44
  people who don't know I am at all.
• 1:10:48
  Yeah, like us, we're dummies. Let's wrap it up.
• 1:10:55
  I, I really appreciate everyone who sent stuff in.
• 1:10:57
  Again, it was there was lots that came in and you know Jim
• 1:11:00
  and I had some difficult decisions to make.
• 1:11:02
  Jim, you're in charge of reaching out to you know our
• 1:11:05
  winners. So Andrew, Alex, Tim, Pedro and
• 1:11:08
  Chris be on the lookout for messaging from Jim.
• 1:11:12
  Zio How you can get a copy of the of the book from Phil and
• 1:11:17
  let's see we're on the web idacpodcast.com we're on
• 1:11:20
  Twitter. X, whatever it's called.
• 1:11:22
  IDAC Podcast Mastodon at IDAC podcast at infosec dot exchange.
• 1:11:28
  We're on LinkedIn. Keep sending those messages in.
• 1:11:31
  Hit that like and subscribe button and follow us on YouTube.
• 1:11:35
  What other YouTube or whatever self promotion can we do.
• 1:11:38
  Oh, don't forget about Identity Week America.
• 1:11:40
  Our discount code IDAC 30. So if you're going to any of the
• 1:11:45
  conferences, Europe, America or Asia, Friday, any week, you can
• 1:11:48
  use that code and get 30% off. So we'll have link in our show
• 1:11:50
  notes as well for to make it easy for people to find.
• 1:11:53
  So with that, we'll go ahead and leave it for this week.
• 1:11:56
  Thanks everyone for listening and we'll talk with you all in
• 1:11:58
  the next one. You've been listening to
• 1:12:01
  Identity at the Center. We hope you've enjoyed the show.
• 1:12:05
  Make sure to like, rate and review and we'll be back soon.
• 1:12:09
  But in the meantime, hit the website at
• 1:12:12
  identity@thecenter.com and find us on Twitter at IDAC Podcast.
• 1:12:19
  See you next time on Identity at the Center.