Latest / Identity at the Center / #318 - SailPoint Navigate 2024 - SSF, CAEP, RISC, and SCIM Events with SailPoint’s Mike Kiser

Transcript

#318 - SailPoint Navigate 2024 - SSF, CAEP, RISC, and SCIM Events with SailPoint’s Mike Kiser · Identity at the Center

0:00
I kind of disagree with that. I think much better is kind of a
0:04
a network of informed actors all sharing information, right?
0:08
Do you have risk? Yes.
0:09
Do you have a risk assessment? Yes.
0:10
Do you have an idea of what's dangerous or not?
0:13
You do as well. And so let's share information,
0:15
kind of like dolphins saying, hey, the fish are coming to talk
0:19
about dangerous actions or identities that aren't trusted
0:21
anymore or people aren't using trusted devices or whatever
0:25
else. And saying whoever is listing,
0:28
we're broadcasting this information out so that you,
0:31
another component in my client's infrastructure, can take the
0:34
appropriate informed action. Now, just like the dolphins and
0:38
the Fisher people, the dolphins give the signal.
0:41
The Fisher people don't have to throw their Nets.
0:43
They have complete volition. They have complete control,
0:46
right? They can just sit there and do
0:48
nothing if they want. Shared signals is a way of
0:51
sharing information about identity context that let gives
0:55
that freedom to the receiver of the information.
1:03
This is identity at the center if it has anything to do with
1:08
IAM. This is the go to podcast now
1:13
your hosts Jim McDonald and Jeff Steadman.
1:23
Welcome to the Identity of the Center podcast.
1:25
I'm Jeff, and that's Jim. Hey, Jim.
1:26
Hey, Jeff, how are you? Not so bad yourself.
1:28
I'm doing good, man. I've got all my beverages lined
1:31
up. I've got coffee, Pepsi, water.
1:34
I'm all set. You got a.
1:36
Primary, a secondary and a tertiary beverage.
1:38
Yes, in terms of caffeine order. OK, and this is a crinkly water
1:43
bottle that's going to drive me crazy when you try to open that
1:44
later. Oh, yeah.
1:46
Oh, yeah. That's.
1:46
You see, Jeff, I do things to drive you crazy.
1:49
Yeah. I think all of the listeners and
1:51
viewers know that by now. Yeah, I think it's an accurate
1:55
statement, yeah. So in for those of you who are
2:00
watching on YouTube, you'll see I'm wearing my white jacket with
2:04
black lapel. So it's a, it's like a white
2:07
tuxedo jacket. And Ian Singh made a comment on
2:10
one of the pictures of us from the Authenticate conference that
2:13
said, I've never seen Jim and Jeff wearing the same jacket.
2:17
And that's because I'm kind of known for wearing silly jackets.
2:20
It's actually not silly. It's just a nice jacket.
2:22
But, you know, it's kind of like within the spectrum.
2:26
It's off the spectrum in terms of, you know, bold style.
2:30
It is definitely a bold style choice or as I am, more of a
2:34
traditional, you know, blue spore coat.
2:36
I love the blue, the the blue polo.
2:38
This is my my jam. So I'm happy when I don't have
2:40
to wear a jacket or anything like that.
2:42
You like to do it Me now, I'd rather be cool temperature wise
2:47
before I'm not going to give you that opening to get out.
2:48
I'd rather be cool. So we're here at Sale Point
2:51
navigate 2024 in Orlando, which, you know, is my favorite place
2:56
in the world. Yeah, exactly.
2:57
When it's 70°, you're hot. Yeah, it was last night.
2:59
It was 70° and it was like, I think 146% humidity.
3:04
So there was like, you know, water.
3:05
What are we just forming in the air?
3:06
But yeah, most of the time we're spent indoors in air
3:08
conditioning, so that's good. Yeah.
3:11
And The thing is like the allergy, you know, people don't
3:14
tune into the podcast here about the allergies, allergy forecast
3:17
in Orlando. So we can probably cut right to
3:19
the good stuff. I will say that one of the
3:22
requests I got from a person named Rainer was a navigate
3:26
discount code. By the time this airs, it's
3:29
going to be too late for that to for this information to be
3:33
valuable. But what I will commit to is
3:35
that I'm going to keep that in mind thinking about
3:38
international conferences and getting discount codes.
3:40
But I think that's one of the reasons people listen to the
3:43
podcast, right, is that we're able to get these special
3:46
discount codes, put them all in one place.
3:48
And what we always commit to is that we won't publish a discount
3:52
code unless it's the best one that's out there.
3:53
Yeah. We don't want to be in
3:54
competition with better codes. That's a losing argument for us.
3:58
So I do keep them on our website.
4:00
So if you go to our website, idacpodcast.com, you Scroll down
4:03
a little bit, you'll see whatever the current discount
4:04
codes are. So I have them in there.
4:06
Identity Week actually gave us discount codes from around the
4:09
world. So when they had their Europe,
4:11
the America and the Asia conference that that same code
4:14
work for all that. But yeah, we, we will keep that
4:16
in mind and try to get as many as it can.
4:18
Doesn't cost anything for us, doesn't cost anything for, you
4:21
know, the person who uses it. And if somebody wants to partner
4:24
with us to promote their conference or whatever and shoot
4:27
us a discount code. You know, it does cost money as
4:30
us getting here. It does does cost money to get
4:32
here. So thanks to sale points and
4:34
thanks to RSM for bringing us out here and sponsoring this.
4:38
So we're we're upping our video games slightly.
4:40
We've got ARSM logo on that one. When we get to our guests,
4:43
you'll see an RSM thing logo for that.
4:45
So that is our day job that Jim and I do and we are actually
4:48
sponsors here at Navigate. So Full disclosure, right, We're
4:50
part of that Sale Point ecosystem when it comes to
4:54
integration, things like that. So yes, thank you to Sale Point
4:57
RSM. And then before we get to our
4:59
guests, we're going to talk about Gartner.
5:01
Yeah. So the Gartner I am Summit is
5:03
coming up. It's December.
5:05
What is that 6th through 9th? I don't know.
5:08
I don't want to start like a disinformation campaign as
5:11
someone shows up in the Grapevine, TX area and there's
5:14
no conference. So check the it's in early
5:19
December and we have a discount code IDAC 375.
5:22
Guess how much that saves you? I'm.
5:24
Going to guess $375. That's a good guess.
5:27
I know I'm just a savant when it comes to those numbers.
5:29
So we will have a link to the registration in the show notes.
5:33
And let's get on to today's main topic in our awesome guest who
5:38
we I've been dying to get on this podcast for a long time.
5:41
Yeah, I'm really surprised. This is the first time we've had
5:43
him on the show. We're going to talk about SSF,
5:45
We're going to talk about Cape, we're going to talk about risk,
5:48
we're going to talk about skim events and a whole bunch of
5:52
other IAM acronyms. Let me welcome to the show for
5:54
the first time, Mr. Mike Kyser. He's the director of Strategy
5:57
and Standards at Sale Point. Welcome to Dining at the Center.
6:00
Thanks for having me guys, pleasure to be here.
6:03
This has been a long time coming.
6:04
While we actually spent a lot of time last week for the
6:07
Authenticate conference and that was great.
6:10
I want to talk about that. And then you're going to speak
6:13
here tomorrow in real time. So today for us is Tuesday,
6:16
October 22nd, but you're actually speaking tomorrow and
6:19
this episode is not going to come out till middle November
6:21
ish. Just the way things kind of work
6:23
out. But I want to get into that.
6:25
But tradition, first time you're on the show, we always like to
6:28
find out our identity backstories.
6:30
How did you get into the world of identity?
6:32
Is it something that you chose or did it choose you?
6:35
Good question. I think like most people like
6:37
kind of chose me, right? I started out in my early days,
6:43
back in ancient history, looking to be a physicist,
6:47
astrophysicist, astronaut, politician.
6:50
There's a whole a whole thing there, a real Renaissance man.
6:54
You. Know or drunk for a thirst for
6:56
power or something, right? Eventually though, I did some
7:01
some stuff in in those arenas. Not the politics stuff, but the
7:04
physics and astrophysics. But eventually wound up
7:07
graduating from the glorious University of Texas gym with a
7:11
computer science degree and then looked around for kind of hard
7:16
problems. And one of those was security.
7:19
And so kind of thinking, thinking about how to make sure
7:24
people had the right access, but more from a authorization
7:29
authentication perspective. And then kind of did different
7:32
things with IBM for about 16 years and wound up at sale
7:35
point. So it wound up combining
7:39
multiple streams of what I've done over the years, the
7:42
technology side, but also the culture impact to what's called
7:47
normal people side. I love things that combine
7:51
different areas and different angles on the same problem
7:56
because it it just helps people understand it and grasp it.
7:59
And I like questions that have no real straight up solid
8:02
answers. So I.
8:03
Think you have the job where a lot of people are like, I wanted
8:06
to do that. I want to spend all my time
8:07
working on standards and getting on stage and speaking at
8:11
conferences like how does somebody become Mike Kaiser?
8:15
How does somebody work their way into a role like?
8:17
That First off, that's a terrible idea to become Mike
8:20
Kaiser. I, I think that you always see
8:24
the surface level of everything. So I think while speaking and
8:29
writing is very visible, unless you're doing something of
8:32
substance on the back end, it's kind of all for naughty, right?
8:37
I grew up with a father who is in public relations.
8:40
And so I grew up speaking and writing.
8:42
And then I also had the technical side.
8:44
But I've always tried to to find things that kind of combine
8:48
those, right? Putting things in ways that
8:52
people can understand and grasp and, and use and talk about the
8:56
next dinner party and not bore the entire room, right?
9:00
That's all kinds of things. So having substance working on
9:03
something either as standards or developing products or educating
9:07
people, whatever it is, and then doing the other things on top of
9:10
it is possibly the way to go. I've got to figure that there's
9:14
a lot of like doing the extracurricular right?
9:17
Because I'm, I'm trying to get for somebody who's trying to
9:21
figure out the path to become in the position or the type
9:26
position that you're in. It's, this is my belief is that
9:30
it's working a lot of overtime. Not overtime, like for a job,
9:34
but volunteering to be part of these groups, the Kantara
9:37
initiative, things like that and getting in the know, but meeting
9:43
people, networking, things like that.
9:45
Yeah. And there there's a place for
9:46
everybody, I would say. I think it's one of the things
9:48
that ID Pro does really well is it gives that community where
9:52
you can come in and say how does this work?
9:55
Where is my place? Your place might be standards or
9:58
it might be doing technical stuff, might be architecture or
10:01
consulting or implementation. It might be education, writing.
10:06
The danger is saying, oh, I want to be like that person, so I
10:09
have to be exactly like that person.
10:12
That's not really true. If you look at most of the
10:14
people in our industry who people know, most of them didn't
10:17
start outgoing into identity. They kind of took a random path.
10:21
I think that random path kind of like you're implying Jim pays
10:24
off right. If you're interested, if you're
10:26
curious about lots of different things, then I think that that
10:30
pays off in in the longer term, right?
10:33
Because now you're more well-rounded person.
10:36
You see different angles, you see the implications for for
10:40
usage and everyday and and that kind of thing.
10:42
So. But that's identity, right?
10:44
I mean, identity is made-up of a whole bunch of different
10:46
backgrounds, people, experience, etcetera.
10:49
So all of those contribute really to the success of the
10:52
industry itself is we need those viewpoints.
10:55
Because if you get into your little bubble, you start to
10:57
design only for your little bubble, and it falls apart very
11:00
quickly when you hit the real world where you have all those
11:02
other parameters you have to account for.
11:04
Yeah, completely, completely agree.
11:06
So you were at Authenticate last week with us.
11:09
You gave a fantastic presentation that's I don't even
11:12
know how to describe it. I want you to describe it
11:14
because it was a Sonic presentation and it included
11:20
bolero and graphics that you made.
11:23
We were geeking out about After Effects earlier.
11:26
Take people through who who weren't there, haven't seen
11:28
this. Tell us about that presentation.
11:30
Sure. It's I wanted to talk about a is
11:35
impact on authentication and authenticity and culture, right.
11:41
And so I had heard about in talking about doing homework,
11:44
I'm always listening for ideas and stories.
11:47
There's a writer named Michael Korost who writes for Wire
11:49
magazine. And a couple of years ago, he,
11:52
he posted an article talking about how he had a hearing
11:55
deficiency, had hearing aids from a young age, but he loved
11:58
Bolero and he could, he had had difficulty enjoying music except
12:02
for this one piece. And Bolero is repetitive and
12:05
it's clear and it's easy to grasp and it's got a clear
12:08
message. And he heard it when he was 15,
12:10
loved it, became part of his kind of authentic identity.
12:14
In 2001, within 4 hours, he went completely deaf.
12:17
He couldn't hear anything anymore.
12:20
And he went and got cochlear implants.
12:22
And when he did that, he turned on Bolero again.
12:25
Instead of hearing his beloved melody, he heard nothing but
12:29
kind of distorted static, the signals coming to his brain.
12:32
The way cochlear implants work as they bypass your outer ear
12:34
and go right into your brain directly, your brain can't
12:37
really handle the change and the side effects of technology
12:40
adoption. Easy translation to AI, right?
12:43
We're rushing to adopt AI, in particular generative AI, and
12:47
we're dealing with the side effects as a culture.
12:49
It's kind of eroding authenticity.
12:51
You combine Cross Story with the story of Bolero, which pits
12:56
technology with a rhythm section and a recurring melody for 18
13:01
long minutes. It builds up into this conflict
13:03
with you in the middle trying to decide what's going to win.
13:06
You know, classic late afternoon thriller.
13:08
Is technology going to destroy humanity or is humanity going to
13:11
survive? Right.
13:13
Listen to the song. It's pretty great.
13:14
I think. Jeff, you did recently that
13:18
poses the same questions we should be asking yourself.
13:20
What is being ceded to AI and technology and these kinds of
13:25
things. So I was raising some of those
13:26
issues from claiming authorship versus using AI as a tool to
13:31
wholly ceding control. There's a a mayoral candidate in
13:36
Cheyenne, WY you can vote for Who's Day chatbot literally or
13:39
dealing with grief and loss through AI creations.
13:43
It's all those questions we need to ask what's being seated
13:45
technology and then the end the end of The thing is I've totally
13:48
ruined my whole talk is that cochlear patients actually they
13:52
remember their brains remember what the truth was that they
13:55
knew the sound to be and so the signals eventually get remapped
13:58
in their brain to that truth. And so my argument was we need
14:02
to remember our authentic humanity and embrace those use
14:06
cases, whether it's a personal assessment of what we do or
14:10
using ethics canvases to guide our use of AI or supporting data
14:14
provenance efforts through things like watermarking and,
14:17
and the like, or combating disinformation campaigns.
14:20
Or the closest one in my heart right now is the death and
14:23
digital estate with the Open ID Foundation, where we're trying
14:26
to give people volition over their digital life and their
14:29
digital identity, even after they're gone, how they're
14:32
represented, how they're preserved or not, how to get
14:35
their to their controls or the resources, all that kind of
14:37
stuff. And so like I said, I wasn't
14:40
trying to say, hey, here's the easy solution because I don't
14:42
think there's necessarily an easy solution.
14:44
It's more of a let's think about this and as a collective, as a
14:48
community, have these discussions so that we can try
14:51
and safeguard as much of what I would consider to be authentic
14:54
humanity as we could so. It was a really good
14:57
presentation. And you gave homework at the
14:58
end. I did.
14:59
And if we have time at the end of the show, I want to get back
15:02
into that homework because I shared with you kind of before
15:05
we hit record, here's kind of what I thought, but I'm curious
15:07
to see and have that kind of recreate that, that discussion.
15:11
And you're, you're here at sale point navigate just like
15:13
obviously we are and you're going to give a conversation
15:15
tomorrow around Cape risk and skin events.
15:18
Give us a preview of what we can expect to see for that.
15:21
Yeah. So with that talk, I'm starting
15:24
from kind of the ground up with the shared signals framework
15:27
and, and what that implies for all of us as practitioners.
15:32
Since this isn't going out till later.
15:34
I can tell you what I'm basically I'm talking about
15:37
dolphins. The reason I'm talking about
15:39
dolphins in South America, there is a pod, pod of dolphins, pod
15:45
of dolphins, OK, nailed it. Pod of dolphins that cooperates
15:49
with Fisher people on the coast to the point where the dolphins
15:54
swim up. People with Nets are waiting on
15:56
the shore. The dolphin gives a signal.
16:00
Fishermen cast their net, the the dolphins drive the school of
16:03
fish in the Nets descend, they get they catch fish as they do,
16:07
dolphins come in and take a couple fish and everybody's
16:10
happy. Scientific paper released this
16:13
year early last year shows that that cooperation makes people
16:18
catch more fish, makes a dolphin survive longer because they're
16:22
not caught up in other fishing mechanisms.
16:25
So mutual cooperation is the name of the game and benefits
16:29
both. Combine that with the idea that
16:31
the dolphins are giving a signal, saying hey, you need to
16:34
know the fish are coming and they take action on that is a
16:38
great stand in for shared signals.
16:40
Because the whole idea is to say for far too long we've been
16:43
isolated in our knowledge base. Vendors tend to say we have all
16:48
the information you need, just buy from us or our suite of
16:51
products and we'll solve every problem you have.
16:54
I kind of disagree with that. I think much better is kind of a
16:58
a network of informed actors all sharing information, right?
17:02
Do you have risk? Yes.
17:03
Do you have a risk assessment? Yes.
17:04
Do you have an idea of what's dangerous or not?
17:07
You do as well. And so let's share information,
17:09
kind of like dolphins saying, hey, the fish are coming to talk
17:13
about dangerous actions or identities that aren't trusted
17:15
anymore or people aren't using trusted devices or whatever
17:19
else. And saying whoever is listing,
17:22
we're broadcasting this information out so that you,
17:25
another component in my client's infrastructure, can take the
17:28
appropriate informed action. Now, just like the dolphins and
17:32
the Fisher people, the dolphins give the signal.
17:35
The Fisher people don't have to throw their Nets.
17:38
They have complete volition. They have complete control,
17:40
right? They can just sit there and do
17:42
nothing if they want. Shared signals is a way of
17:45
sharing information about identity context that let gives
17:49
that freedom to the receiver of the information.
17:52
It's it's not prescriptive, it's descriptive.
17:55
This is going on heads up, you choose what you want to do
17:59
right? And that's important and
18:01
important to the success of the standard.
18:03
But we've a tool originally talked about Cape at an Internet
18:06
identity workshop. I was there, it was really great
18:09
and he kind of launched this discussion.
18:11
But as it's grown, I think those kinds of keys help with the ever
18:16
present struggle within standards of incentives, right?
18:19
What's the incentive for a vendor to support it or
18:21
something to adopt the standard? It has to be mutually
18:24
beneficial. And so I think that's that's
18:25
really helpful if that makes sense.
18:27
So I love the analogy because that brings it to a level that I
18:30
think everybody can understand. Like, OK, what are we aiming
18:33
toward? What I want to talk about is the
18:36
shared signals framework. So this framework, who are the
18:40
actors in the framework? Who's providing the information?
18:42
Is that applications, its infrastructure?
18:46
Give us some examples. Who's receiving it?
18:49
What are they doing with that information?
18:51
And then from a framework standpoint, is this going to be
18:55
like an industry standard for? Is that how you see it playing
18:59
out? Yeah.
19:00
I think it's important to sense that a lot of times people
19:04
conflate some of these terms. They combine them and think they
19:06
mean the same thing. You'll hear Shared Signals
19:09
framework, you'll hear Cape, which is Continuous Access
19:12
Evaluation protocol. You'll hear RISK, which I don't
19:16
remember what the actual expansion of that acronym is.
19:19
Ranks risk and incident sharing and collaboration.
19:22
There's a lot. Of ands in that one right.
19:24
And so you'll kind of hear those together, especially Cape and
19:26
shared signal. So first thing I want to say is
19:28
that shared signals is the transport layer kind of pub sub
19:31
sender, transmitter, receiver kind of vibe.
19:34
Cape is the one that focuses on some of the session based use
19:38
cases, which is great because Pete, that's where as you're
19:40
implying people say, OK, why do I need this?
19:43
What is the OR some use cases that benefit me?
19:46
Some examples say there is a single sign on provider that
19:53
knows that an identity has travelled impossibly or done
19:56
something else, that they're going to take action now and
19:59
they revoke all of that identity sessions within their their
20:03
vision of the world. They send out a session revoked
20:05
event, say to an IGA vendor. Now we get that event and we
20:11
decide what to do based off of that, right?
20:13
We can say, well, we could just say this is a high risk user,
20:16
you know, take a stereotypical case CFO or something and we're
20:19
just going to suspend all of his identities.
20:22
Throughout the enterprise, because we want to start a
20:24
certification or do some other sanity checks or we can wait
20:28
until we get multiple of those, right?
20:30
And then we can kick off a workflow and start a
20:33
certification or suspend or it really depends on each side.
20:38
The the event can be shared and then the actions on each side
20:41
are best practice for that sphere of influence.
20:45
So I think about traditionally your SSO vendors, anyone with a
20:49
authorization Oauth token or single sign on or in play, but
20:55
also additional people, people that know about the network or
20:58
about the device. They're all kind of in play as a
21:02
transmitter or a receiver now, depending on.
21:04
Either one, right? Right.
21:05
And you can be both. And I think most likely in my
21:08
ideal world, everyone's going to be a bit of both.
21:11
In other words, it's like from an IGA perspective, just because
21:14
that's because that's my world, right?
21:17
If, if I I want information about devices, are you on now on
21:21
an untrusted device, maybe I change your access.
21:25
From an IGA perspective, maybe I lock you out from particularly
21:29
applications because you need to be on a trusted device for that.
21:34
And the other way around too, if I suspend an identity, what
21:38
happens? Well, I use my connectivity
21:40
layer to go out and suspend accounts throughout.
21:42
But even if I do that immediately, and that takes
21:44
effect immediately, a lot of those identities have Oauth
21:48
tokens or some kind of session token with a time to live.
21:51
And until that expires, Jeff can happily be Jeff, even though
21:55
he's no longer trusted by the enterprise, right?
21:58
And so it's those kinds of use cases where people are like, oh,
22:01
we don't already have that today.
22:04
And like you do in places with specific API, you know,
22:08
endpoints and that kind of thing.
22:09
And there are other movements as well, but there's a lot of
22:11
motion to kind of to make these all work together.
22:14
So, and it's not just the extreme use cases either.
22:17
You can change levels of access. If something changes in an
22:23
attribute about a user changes, you can send out an event
22:26
saying, hey, you probably want to re evaluate all the tokens
22:30
for this user because their access has changed.
22:33
And so moving to a continuous or event based to pick who you're
22:38
talking to, right, The particular flavor of it, it's a
22:42
continuous process of evaluation.
22:43
Every time I access something in an ideal world, I want the
22:47
latest information, the latest attributes, the latest version
22:49
of the policy, all of that to be evaluated.
22:52
And that's kind of what this what this does.
22:55
So it's the idea then to have essentially instead of a, a, you
22:59
know, a vendor specific, this is what we do for security.
23:02
And I think we're familiar with things like, you know, the
23:03
impossible travel conditional assets, right?
23:05
Any authentication provider typically will have that sort of
23:08
thing is let's open this up to really the identity ecosystem or
23:12
security ecosystem and say, hey, we've collected this data, we
23:16
have this thing and we're both a, a sender and a receiver of
23:19
this information. So that leads me to believe that
23:21
there is something that is sort of outside of a specific
23:25
technology stack to collect all this information.
23:29
That's how it works. It's a standard.
23:31
So if you were going to do this without shared signals, I would
23:34
have to call up every vendor I wanted to integrate with.
23:36
I have to say, what are your APIs?
23:38
What are my APIs? My legal department would have
23:40
to get involved. We all have to.
23:41
It's a long road. And then anytime your API
23:44
changed or my API changed, now we have to do it all over again,
23:48
regression testing, etcetera, etcetera.
23:50
Using a standard to share this information means I can hook in
23:53
really easily without that overhead, right?
23:56
And so I, I don't think there's necessarily a, a centralized
23:59
repository for this information. It's more like, hey, I know
24:02
this, you might want to know. And the receiver signs up to
24:05
say, Hey, these are optionally the, the users I'm interested in
24:09
or the groups of users I'm interested in.
24:11
And here are the event types I'm interested in.
24:13
And so you subscribe, you basically set up a, a pipeline
24:16
to call the stream basically saying I want all your these
24:20
types of events for this class of users or just all these
24:22
events period. And then they either get pushed
24:25
or pulled across the across the pipe.
24:27
See, I think it opens up an opportunity for another part of
24:29
the market and we're kind of infringing here now in the SIM
24:32
space, right or other sort of event and logging and monitoring
24:35
type tools where you know it is historically been well, let me
24:39
send you my Windows logs or applications logs and it goes to
24:42
the central spot. Now we've got a standard and
24:44
say, OK, this is how technologies can interact very
24:49
similar to like SAML, right? And this is how we want to
24:52
authenticate. Now we've got something to
24:53
provide data around events that are taking place in a
24:58
standardized way to say if I wanted to, I could build a
25:01
product that is ASSF type product or maybe I'm a Splunk or
25:07
some other, you know, SIM that someone I can think of as.
25:10
Well, sure. Where I say, OK, we want to be
25:11
able to, you know, pull those into our system because it's
25:15
it's great to have it in one spot.
25:16
But I think the power here is what if we could leverage our
25:19
IGA platform and our IDP and our privileged access and maybe even
25:25
a non security platform like a work day maybe where our people
25:29
data is. Let's pull that all together and
25:31
have sort of like this overarching ecosystem and say
25:34
here's Mike, Mike is in Orlando. We know that here's what IGA is
25:38
going to do You guys do your own thing.
25:40
But by the way, if we know this about Mike, let's put this
25:42
somewhere where people can, you know, receive that data and do
25:45
other things with that. You, you will see, I do think
25:48
you'll see a space pop up for transceivers, trans, you know,
25:53
translators of some of these signals, relays, those types of
25:56
things and architectural choices.
25:58
I think that the impact I see is avoiding a single point of of
26:05
this is where this is the keeper of the Kingdom.
26:09
Just to have some of that. If I were an identity
26:11
practitioner, I want a team working together right now.
26:16
Each of them are going to have a different perspective.
26:18
IGA is going to have a different perspective than my SSO will,
26:21
then my VPN will, then my HR system, then my sales force,
26:25
whatever. You're relying party kind of
26:27
application. But what it does is it provides
26:31
an event oriented, close to real time process for sharing
26:35
information that didn't exist before.
26:37
I'm sure people will suck it into a SIM, right?
26:40
I mean, I feel like that's the natural inclination of a
26:43
security team in an enterprise environment is we want all the
26:46
data and we want to do something with it.
26:50
Right, I think the I think the power to me, the usefulness
26:53
right now is actually giving that real time response and
26:59
control to all these individual distributed players.
27:02
I don't picture a centralized hub for controlling everything
27:06
about identity and organization. I picture to use a, you know,
27:11
lingo identity fabric kind of approach where there are
27:14
deciders everywhere and informed understandings of thing
27:18
everywhere, right. So it's, it's, it's more like
27:21
that. And then when you when you
27:22
couple on things that aren't just session based, then you
27:27
start to touch more and more, not just Cape which does
27:31
continuous access evaluation, but more account level things
27:34
and the risk stuff, suspending accounts, activating accounts.
27:38
And then the more recent stuff, which I'm particularly about
27:42
excited about, which is the skim events, which could optionally
27:45
sit on top of this. And now you're starting to
27:48
impact a broader and broader spectrum.
27:52
Yeah. So I want to back up to some of
27:54
these that are, this is about developing a standard.
27:57
And I heard Heather Flanagan say there's two approaches to
28:01
developing a standard. One is kind of got an ideal of
28:06
how the technology should work, you can develop a standard.
28:10
The other is there's all the, it's already been deployed, it's
28:13
out in the wild. Everybody's doing it now.
28:16
You're trying to pull it together into a standard.
28:18
I think this is like the latter, right?
28:21
This is trying to build a picture of what it should work
28:23
like. Or is it the other way?
28:25
I think I, it's a good question up for debate.
28:28
I think it's the first way actually, only because people
28:31
were kind of doing this a little bit, but they're one off
28:34
integration. So maybe that's not even up for
28:36
the second way. But I think this was such a
28:39
different way of saying, why don't we just straight up share
28:42
this data and not hold on to it really tightly and say we're the
28:46
only option here. So in that sense, I feel like
28:49
there was a lot of idealism in the original assessment, but the
28:54
use case was so strong that your session needs to needs to change
28:59
in in close to real time and share information about that,
29:02
that it was powerful enough to to pull people in, I think.
29:06
I think it gets to the question though is are these logs?
29:09
Are these identity bits of data that we're collecting?
29:11
Is that secret sauce for a vendor, for example, or is it
29:15
something that, yeah, a vendor is willing to share with others?
29:19
Obviously, you know, you're not sharing code, but you're
29:21
sharing. You have, if you have an API
29:23
connection or a standard to say, hey, this is what sale point is
29:26
collecting and here's what we're going to do with it.
29:30
But we have an API or we've got a shared signals framework that
29:33
you can tap in to say if you want to do other things with it,
29:36
with other things, be our guest. Right.
29:40
And I, what you're hearing me too, is that you're hearing me,
29:43
the idealist talking because that's usually how I approach
29:46
standards. It's not, you know, how can we,
29:49
it's always like, oh, what if we could do this, wouldn't that be
29:51
cool? And then I have to think about,
29:53
well, how does this monetize itself?
29:54
Right? I, I think you're right.
29:56
I think it's, it's the we're going to take this knowledge
29:59
that we know and we are also trying to monetize internally as
30:04
a vendor, as a vendor, and we're going to make that known for
30:07
other people to use. And I think that's the only way
30:10
for us to protect. I'd use identity to protect
30:13
things in real time. So that's that even kind of
30:16
rules out a little bit of the same, same kind of stuff because
30:19
it's a little bit more after the fact.
30:21
This is more right now. How can I share information for
30:25
you so you can take a more informed choice.
30:27
And if I know there's a danger, now everybody knows there's a
30:30
danger. And that's got to be the way to
30:32
go. Team sport would be my.
30:34
On take and that's my I guess that's the key part here is this
30:37
is a real time. This is a a quicker way to get
30:40
that information right. Because what we don't want to do
30:43
is where we've been for the last 20-30 years is hey, there's data
30:46
sitting in our SIM yeah, we didn't do anything about it
30:49
because what is the average bridge takes like half a year to
30:52
even discover right? The name of the game is speed.
30:55
So yes, I want my IGA platform to detect this thing and I want
30:59
it to move very quickly to mitigate risk that that event
31:04
might indicate. But the quicker that I can get
31:07
it not just in my IJ platform, but into other platforms, right?
31:11
How do I control my IDP? Do I prompt for an extra MFA?
31:14
Do I shut down access to a privilege access management
31:18
vault, Right? There's all kinds of stuff that
31:19
can happen. And that orchestration really, I
31:22
don't think can happen unless there is this standard to
31:25
communicate that these events are even taking place, right?
31:27
Totally, totally. And what you're also seeing in
31:29
the industry is a slow move to event based architectures, and
31:35
this is a reflection of that as well, right?
31:37
Are you going to use shared signals to do everything and
31:40
every identity and every application?
31:43
No, right. Because it's not worth it.
31:45
There's right now it's not probably in your best interest
31:49
because of speed and scale and other reasons to put event based
31:52
architectures everywhere. Some applications, some portions
31:55
of them. Yeah, I think it makes a lot of
31:57
sense. And so while you're seeing
31:59
vendors in the Interop, right, I think you're going to see more
32:04
and more relying parties and application owners and that kind
32:08
of stuff adopted as well 'cause like, oh, that information is
32:11
available to me, 'cause if you think about it, say, say skim
32:16
events where you're updating information about the account,
32:18
about the attributes, about the identity, right?
32:21
If you have that in place, well, now I've got a policy in my
32:25
application that's only as good as the last update of that
32:29
information, right? So it's like updating a policy
32:32
information point saying, hey, the attributes about Jim have
32:36
changed. Everyone needs to do this so
32:38
that when you go make the decision, you're making the
32:40
right choice, right? And so that is really powerful
32:43
because now we're into the authorization space, we're into
32:45
the policy space we're in. It's all of this working
32:49
together, right? The stuff that's going on in
32:51
Oauth, the stuff that's going on in shared signals, stuff that's
32:54
going on in Skim and, and all these various working groups
32:57
kind of combining to. So, so Jeff made the point about
33:01
having one place. I want to go even further and
33:05
say why? Because I think you're talking
33:07
about within your enterprise, but why is, why couldn't there
33:11
be one place that everybody goes to get these signals, right?
33:16
Or maybe the maybe there's a commercial landscape where a
33:19
couple companies focus on this and it's pulling signals from
33:23
all the major ID PS social networks, you know, Microsoft
33:29
and pick building 1 picture of, you know, these are the
33:32
identities that look to be compromised.
33:34
Rather than it being kind of a competitive advantage, Why not
33:40
all kind of row in the same direction?
33:42
Because we're all trying to to solve the same problem, which is
33:46
don't get compromised, right, right.
33:48
And if everybody's contributing, everybody's pulling it, it seems
33:53
maybe I'm being too idealistic. What do you?
33:55
Think well, I think is a First off is a distributed approach,
33:58
right. So we're not going to have
33:59
necessarily one repo with all the stuff it's live events being
34:04
sent back and forth. So that kind of to have one
34:08
repository kind of defeats a little bit of the, the way that
34:12
the approach is done. Secondarily, not every vendor is
34:15
going to buy in, not every app is going to buy in, right?
34:18
And so to that end, there are major vendors that are not doing
34:23
shared signals right now and they have their reasons and
34:25
their incentives for doing so. The idealist in me is like, why
34:30
don't we all do this and just set it up right?
34:32
And then as a practitioner, what am I doing?
34:35
I'm looking at my environment and my business policy and
34:39
saying this is really what I want to see.
34:41
And then I'm setting up those relationships.
34:44
The technology is secondary. The technologist enables me to
34:47
do this and share information in near real time, right?
34:52
But it's really the policy and what I want to have give people
34:55
access to and updating that near real time.
34:58
That's the, the key for me as a practitioner.
35:00
So just like single sign on, right is commoditized right now,
35:03
right? I, the policies, I want access
35:05
to these five things, SSO and SAML is just the technology that
35:09
lying behind that, right? And so as a practitioner, I get
35:12
to decide, I want these people groups, these identities, people
35:15
groups, these identities and, and these events.
35:18
And I want this to happen and that to happen.
35:20
When I talk, people are like, well, what, what's going to
35:22
happen when I do this? And I say, well, each end is
35:25
going to make their own choices. Each application and each
35:29
vendor, whoever it is, it's going to say this is the default
35:31
action. We see something happen, we're
35:34
going to suspend you, we're going to send out these events,
35:36
and then the other side takes it in and has probably a default
35:39
approach. But again, if I'm an identity
35:42
owner, I wouldn't control over what that actually looks like,
35:46
right? Just because you sold me a
35:48
product that sends these massive alerts anytime anyone goes out
35:51
and gets a Taco, maybe I don't want, you know, Trisha, you'll
35:54
have to go get a Taco. I don't want to shut down your
35:56
whole thing. So I'm.
35:57
Talking events that I can get behind, I want to know.
35:59
Where this Taco is so. Let me know how do I subscribe
36:02
to? That event as an event, right?
36:04
Tacos service. How about that?
36:06
Yeah, there we go. So yeah, there's, there's,
36:08
there's balance there, right. I think there will people be
36:11
people that suck all these things in and put them in a
36:13
repository. I don't think that's really the
36:15
idea because we're trying to move to a real time distributed
36:20
kind of approach rather than let's build 1 big repository.
36:24
And I think you can be an aggregator and keep it real
36:27
time. And that was like, I guess I
36:30
live with that minor point. My bigger point was, you know,
36:34
it feels to me like we need big tech to get behind this, to say,
36:39
all right, we've got massive numbers of authentication
36:43
events. We have this repository of what
36:46
we think are compromised accounts I think.
36:50
Some of that is secret sauce for those vendors.
36:52
That's the. Service that people pay for,
36:54
that's what I hate and and it it it, it, it, it does sound
36:59
altruistic to say, hey, why don't we all do the same thing?
37:01
But the reality is there are different vendors that are
37:03
paying that are they've done the work and they are trying to
37:06
monetize that. They're saying, hey, if you join
37:08
our IDP network, not only are you going to get this product,
37:13
but we also have these other events and we can help do an
37:17
internal sort of product specific thing around that.
37:20
I'm with you. I wish there was more openness
37:22
around that. And I think it's coming.
37:24
I think there are large enough people in the working group,
37:27
large enough people in the Interop in December that I
37:32
certain standards survive or die because of adoption, right?
37:36
Look at SPML, may die in a dumpster fire forever, but Skim
37:41
had a lot more success. Has it been 100% successful?
37:44
Not at all right? But I think shared signals and
37:48
the event types that sit on top of it Cape risk Skim events
37:53
someday. Like I think those have enough
37:56
backing to pressure organizations to adopt and
38:01
incentives, like I said, incentives matter, right?
38:03
So I expect some vendors to say, no, we're not going to
38:06
participate until enough large customers say no.
38:11
We have to have this until analysts like Gartner at the
38:14
last Interop in March said you need to demand this from your
38:18
vendors. That helped tremendously, I
38:21
think, right. And so it's all a, a, a push
38:24
together of paving the way technologically, paving the way
38:28
politically, paving the way for demand, customer demand, right?
38:33
So, and you can still keep your secret sauce, 'cause just
38:37
because I tell you an account is compromised, it's not like I'm
38:40
saying, and here's all the Intel I have and all the data.
38:43
Now you get this event saying I have taken this action, you
38:47
might want to do something about it.
38:49
And optional additional reasons or something, but you're not
38:53
getting my internals. I've taken a section you do.
38:58
You right, right. And instead of us, instead of me
39:00
building this API based thing to go into your system and cause
39:04
action, now I'm like, let's do this standards wise.
39:08
And the person who owns both of our products will demand it.
39:11
They own both. So they can say you're going to
39:12
do this and you're going to do this and you're going to like it
39:15
or I'm going to walk away and take my money to another vendor,
39:18
you know, or another offering is my is my ideal anyway.
39:21
Well. I think the important thing
39:22
there is customers need to demand it.
39:25
That's really who's going to drive the adoption.
39:26
If you're listening to this and you are probably a customer of
39:31
an identity solution or a security solution, that's where
39:34
that's where the sport's going to come from.
39:36
Put it in your RF PS and your RF fives, put it in your requests
39:40
for whatever and say, hey, does your product support shared
39:43
signals framework? How does IT support it?
39:46
And and really that's, you know, it's, it's almost like a
39:49
grassroots campaign, right? You've got smart people who are
39:52
really thinking about this. You mentioned a tool.
39:54
There's Sean yourself other Yeah, exactly.
39:58
So there's there's a lot of thought behind this.
40:01
There's only so much creating the standard can do.
40:04
People have to actually ask for it and desire it and want it.
40:08
Right. Just like the fishing and the
40:10
dolphins, right? Both parties benefit, I think in
40:13
the long term we all benefit from this level of cooperation
40:16
because just like the dolphins gets more fish and the Fisher
40:20
people do as well. The same thing is here is true
40:23
here. If if our goal is securing the
40:25
enterprise via identity, then let's cooperate and I think we
40:30
all catch more fish or something.
40:33
So we. Promised we'd get you out of
40:34
here at a certain time. But they do have one more
40:36
question. So we've had one of our most
40:39
popular episodes. We had several folks like
40:42
yourself help us out with a question.
40:44
So we've talked about what's the difference between I am and
40:48
digital identity. But now this term identity
40:51
security has become popular. To me, this feels like it's the
40:55
definition of identity security because it's taking the
41:00
cybersecurity area and digital identity and combining it into a
41:06
solution. Am I on the right track?
41:09
How do you see it? Yeah, I think so.
41:10
I think, you know, identity security is, is the idea that,
41:15
you know, identity is the key, right?
41:17
Identity is, is that the center? Yeah, it's the old working my
41:20
way to you. I know my audience.
41:23
Yeah. So I I think that information
41:26
becomes power and becomes the operational knowledge on which
41:30
to take action or not, right. And so now we're saying I've got
41:33
identity information, you've got identity information.
41:35
Let's share it and and use it together.
41:38
It's one aspect of that right now whether it fits into a
41:42
particular market segment defined by someone or some of
41:45
the other, sure, I think you'll see it in different places.
41:49
You'll see it in base platforms. I think in the long term, in the
41:52
short term, you'll probably see it in more risk based or ITVR
41:58
environments, that kind of stuff.
42:00
Do I care where it exists? Not really.
42:03
As long as we have it right. I, I want it, I want it in
42:05
places and I want it pushed because I, I think the obvious
42:09
statement that we've already made is obvious that identity is
42:12
the new key. It's not just the network, it's
42:15
everything. And how you define identity
42:18
becomes the second question of that right.
42:20
Is it, does it include device? Does it include location?
42:23
Does it include past action or past behavior?
42:26
Does it include the weather in Caracas?
42:29
It might, right? It depends on how you define the
42:32
identity for that person, which by the way, was also part of my
42:36
talk at Authenticate as well. It's like how you define
42:38
identity influences how your policy expresses itself, and
42:44
ultimately how you safeguard all that kind of stuff.
42:47
So I want to go back to the authenticate conference to close
42:50
out the conversation you gave homework at the end, and then to
42:53
listen to the whole 15 minutes of Bolero.
42:57
And what did people get? Well, tell me what the homework
43:02
was and I'll tell you what I got of it and we can have a
43:04
conversation with it. So during the the presentation,
43:08
the talk I was giving, I played snippets.
43:11
It's 18 minutes long. I had a 25 minute slot.
43:14
I couldn't play the whole song. Find a very long song and just
43:17
play that. It's like playing a movie when
43:18
you're in school. Right.
43:20
So I played some and I and I played the rhythm section, which
43:22
represents technology and I played the melody, which
43:24
represents humanity, and they get louder and they get
43:27
basically opposing each other. And I described the ending of
43:30
Bolero as amazing and crazy and brilliant and really fascinating
43:36
and shocking. And then I told them I wasn't
43:38
going to play it for them to the audience, which people groaned,
43:41
which is what I wanted them to do.
43:43
But I said go home and find 18 minutes and carve out the space
43:49
and just listen to it end to end.
43:51
You know, I didn't say this, but you either love Bolero or you
43:54
hate Bolero. But the homework I gave was,
43:57
given my premise, just running with my premise that it's
44:00
technology versus humanity. These two different sections,
44:03
half the orchestra, 1/2 the orchestra, the other.
44:05
The ending, I feel like gives a particular point of view that
44:11
Rebel has about which will win out.
44:14
Will technology destroy humanity or humanity preserve itself
44:17
against technology? And so I said go home and listen
44:19
to it and see what you think, and then come back and find me
44:24
and tell me what you think Ravel's point of view was.
44:28
So I did it. I did the homework because I'm a
44:31
very good student. Good job A plus.
44:34
A+ for me. Here's what I got of it was two
44:38
things triumph and finality. So it Chris ends and ascends
44:45
throughout this entire, you know, track essentially.
44:49
And the way that I perceived it was humanity overcomes and it's
44:55
triumphant at the end, but there's an abrupt end.
44:59
It's final and we're done. And then you got me thinking
45:03
earlier today, I was like, well, is the final because we lost?
45:07
My thought was OK, We we won. It's triumphant.
45:10
Humankind has always risen up and somehow evolved or, you
45:15
know, accommodated or figured out right how to survive.
45:17
We've made it this far. And then there's that finality
45:21
of it. Yeah, but.
45:23
We're going to be final unless you lost.
45:25
Well, that's, that's see, that's what that's the thinking part of
45:28
it right too. Right.
45:30
What what's really fascinating also about Valero is there's an
45:33
article that came out a couple years ago.
45:35
He and Edgar Allan Poe were contemporaries.
45:39
And this person thinks or argues that Ravel was influenced by
45:44
Poe, who had written this piece about how you create a work of
45:47
art. And Bolero mimics the Raven from
45:52
Edgar Allan Poe, where there's 18 repetitions in each.
45:56
There's the Raven saying never more, never more.
45:58
And in Poe's poem and you have this rhythm section that is
46:01
inevitable and just going to hunt you down like a dog,
46:03
wherever you are. Whether or not that's true, I
46:08
think it it gives insight. I don't think Poe was nursely an
46:11
upbeat kind of vibe. And so that kind of does.
46:15
He's like the original goth, yeah.
46:17
It kind of shades it shades how I think about it maybe, but the
46:20
the ending of Bolero after 18 minutes of the same thing over
46:24
and over again, building up it it's always in this one, the key
46:28
of CI believe the whole time right near the end it changes to
46:32
a a different key, which you're like, Oh, finally some change in
46:35
this piece that's been beating me down.
46:37
And then it the melody of the rhythm section.
46:41
But then, like you said, this is chaos at the end that like
46:46
trombone's going to worm or worm and just noise and then all of a
46:49
sudden it goes BAM and silence. So I feel like he's worried that
46:57
the machines are winning or that they've they've won.
47:00
I would, I was telling you earlier, I feel like if, if the
47:03
humanity angle was winning, you'd have this like.
47:08
Like a soft landing almost. I would feel relaxed at the end
47:10
of Bolero and instead I feel myself holding onto the table.
47:14
So, Mike, what minute are we in right now?
47:18
Of. Of like in humankind.
47:22
What are we in 32? We are somewhere in the rising
47:27
crescendo part of it. I think we're hearing more and
47:31
more reverberations, right? I think culturally we're only
47:34
beginning and technology always outstrips culture and our
47:39
ethics. And I think that while AI and
47:43
Gen. AI, it's neither good nor bad
47:47
inherently, it's just technology.
47:49
It's how people use that that influences things, right?
47:53
And I do think, as I said last week, that our authenticity is
47:57
is suffering. It's not irretrievably lost.
48:01
We will change as a result of this adoption of technology.
48:05
Is that more of who we already were or is that because of the
48:09
technology? I, I think it's more revealing
48:11
just of who we already were and technology is just accelerating
48:15
and adding to, but we're getting into deeper waters.
48:18
I would. Say deep thoughts.
48:19
I feel like this is this is just the cycle of humanity right now.
48:22
It's AI. Yeah.
48:23
Before it was electricity, it was running water, it was cars,
48:27
it was horses, it was Spears. Nang.
48:29
Indoor plumbing, I don't trust it right?
48:31
Well, as someone who was living it lives in Asheville area,
48:34
indoor plumbing is very important and I'm happy to have
48:37
my back. So all right, let's send on a
48:40
high note here. Thank you so much for taking the
48:42
time with us. It was a fantastic conversation,
48:45
both this but also again, just really well done to the
48:47
authenticate conference. I hope actually you'll do it
48:49
again so more people can experience it at some point.
48:51
Is it on YouTube? Not.
48:53
Yet I think it will end up probably in the authenticate.
48:56
Somewhere of some sorts, yeah, it's still I think for attendees
48:59
for a while, but if anyone wants to hear it again, I'm hoping to
49:03
do it again, so. There we go.
49:05
All right, so we'll wrap it up there for this week.
49:08
You can find us on the web idacpodcast.com.
49:10
We're on YouTube, idacpodcast.tv.
49:13
Gotta make sure to get that out for Jim this.
49:15
Is very I'm I'm just here making sure that making sure we forget
49:18
YouTube. Got our checklist, connect with
49:20
us on LinkedIn. We'll have a link in our show
49:22
notes for people to connect with Mike and to learn more about
49:24
Sale Point if you're not familiar with Sale Point as
49:26
well. And yeah, don't forget to like
49:28
subscribe, do all those fun social media things to help us
49:30
continue to grow the show and get great guests like Mike.
49:33
So thanks for joining us and thanks everyone for watching and
49:36
or listening and we'll talk with you all in the next one.
49:41
You've been listening to Identity at the Center.
49:44
We hope you've enjoyed the show. Make sure to like, rate and
49:48
review, and we'll be back soon. But in the meantime, hit the
49:52
website at identity@thecenter.com.
49:56
See you next time on Identity at the Center.