Latest / Identity at the Center / #1 - Introduction to an IAM Strategy Framework

Transcript

#1 - Introduction to an IAM Strategy Framework · Identity at the Center

0:04
Welcome to the identity at the center podcast.
0:06
This is the first of what we hope will become a routine.
0:08
Look at the world of identity and access management.
0:11
My name is Jeff Stedman and I'm here with Jim McDonald.
0:14
We're both strategic identity and access management
0:16
Consultants with a denture peas, advisory practice, Jim and I
0:19
have each been in the eye in space for over 15 years and have
0:23
been in the trenches of real-world identity management,
0:26
programs appointments and operations as far as my back.
0:30
Around you know I've worked for several large companies running
0:33
I am operations globally. Jim don't talk a bit about your
0:36
background. Sure hi everyone.
0:39
Jim McDonald year. I joined the dish would be seven
0:42
years ago and I've been in the advisory Services Group, as well
0:45
as I started and ran the forgerock practice for a while.
0:51
For drock is a I am vendor focused on external identity and
0:56
access management. I really that's kind of my area.
1:00
Our Specialties. So, my first I Am project was
1:04
focused on as actually. One of the manufacturing company
1:09
was responsible for the dealer portal.
1:10
So it's kind of a web server and web application guy has more on
1:15
the technical side of the house but I was transitioning in my
1:19
career into getting into more project management program
1:22
management. The time I was just getting
1:25
started with getting my MBA at Rutgers University.
1:29
I shot out there and, you know, I got this opportunity to take
1:36
our dealer portal and expanded across multiple brands are
1:40
taking a bunch of different web applications that were used for
1:44
doing business functionality, like ordering and ordering
1:47
complete machines and parts and submitting warranties and things
1:51
like that and had to pull it all together into one portal.
1:56
We had our dealerships across the United States and Someone
2:00
somewhere outside the United States and made a lot of these
2:04
applications that some users would have accounts and all the
2:08
different applications with different usernames, some things
2:11
like that, our drive to start with was to get to one ID and
2:16
password per person and that's a bigger challenge than you.
2:21
Then you realize when you start going down that road.
2:24
And so that's how I got into identity and access management
2:27
because we came to find out this is Is actual space.
2:30
You know, this is something that people are creating solutions
2:33
for, and maybe that's Captain Obvious today.
2:35
But 15 years ago, it wasn't at least for me.
2:39
So, that's how I got into the space and I always say, you
2:43
know, everybody's got their own story, how they got into, I am,
2:47
you know, most of us stumbled into it.
2:50
I doing some other job and then found that hey, we're all of a
2:54
sudden, I Am project and got into it at the right time there
2:59
or even today. I think you know this is some
3:01
depending on where you are in your career if this is like an
3:05
area that you're looking to get into, it's something I think
3:09
that pretty much anybody with a business background or technical
3:12
background can get into I am and just you know everybody has
3:18
their own career pathway. I think in this space You know,
3:23
it's interesting is that so I was at the end of verse
3:26
conference, this past week in Washington DC and whenever I'm
3:31
in the process of writing a Blog article about this, but it's
3:34
funny that you mentioned, how you got into I am because I
3:36
don't know anybody who got into. I am starting with I am, right?
3:41
I mean, they started maybe on the network side or help desk
3:44
side like myself. I started helpdesk kind of move
3:46
over to and and ID administrator and before moving in.
3:50
Yeah, man. At, but it's I don't know
3:53
anybody in the I am space that started and I am.
3:57
Do you know anybody that fits that bill?
4:00
I can think of one person which was Mario dousai who's now with
4:05
see we transmit security now. Yeah, I think so.
4:09
And yeah, he was a developer, we brought him in and for the bank
4:15
that I was working for, we brought him in as a developer
4:19
and that was like five years. To go and that's what I think
4:22
the you know the my answer your question was 10 years ago, the
4:28
answer would have been no. But I think more and more now
4:30
it's like I am spaces has gotten so big and we one of the things
4:35
that we are always talking about is, you know, the need for more
4:39
talent to get into this, into this area.
4:43
And I think I am is now in the place where it's like, you know,
4:47
what kind of a cottage industry where we have to go out and Take
4:51
people who nests don't necessarily have the skillset
4:54
you know, people fresh out of college and get them into.
4:57
I am another example is Fletcher, Eddington from our
5:01
company, he was hired as an intern and use doing technology
5:06
deployments in the imc's and now he's on the sale side but he's
5:13
built his entire career around I am.
5:15
So I think it's more of a kind of a recent phenomenon.
5:19
May be within the past five years, Maybe a little bit more
5:22
but if you know, people who've been in the space for a long
5:26
time, most of us kind of stumbled into it one way or
5:28
another. Right.
5:30
Yeah. It's interesting.
5:31
You mentioned the intern thing. It when I was at the conference
5:34
and we were having a an ID Pro organizational, meeting kind of
5:38
a get-together meeting, IE drinking at a bar, and we're
5:43
talking with a couple of folks from IBM and actually have a, an
5:48
intern kind of process. Well, they'll bring people Lynn
5:52
and have them kind of work around the different engagement.
5:57
Not engagements. I like different apartments in
5:58
the. I am kind of Consulting that
6:01
they do and they're trying to get more younger Talent, you
6:05
know, into those groups as well. So they actually have a
6:08
dedicated program to find those people get them exposure and
6:13
kind of help them figure out where they are in space.
6:15
They might fit if they sit right?
6:17
They don't, you know, they kind of move on but they're a big.
6:21
Company and they're looking to get support and, you know, from
6:25
a talent perspective and actually have a kind of Dicky
6:28
program, which I thought was pretty cool.
6:29
And it's probably as something, I would imagine lends itself
6:33
more to the Consulting space, right?
6:35
Bringing in folks and trying to get people my email, I don't see
6:38
you. I can Enterprise bringing people
6:39
in and letting them kind of figure out where they want to
6:42
be. You have to that level but you
6:45
know those Folks at some point end up in the industry.
6:48
I'll be probably. Yeah, almost You know, one when
6:51
I first got into it about 20 years ago, there were a lot of
6:55
different ways you could get into it and kind of build a
7:00
career. So there was, you know, you
7:03
could be a network engineer, you could be a server engineer,
7:06
things like that, but a lot of those spaces have become
7:10
commoditized and they didn't, you know, smaller companies,
7:15
mid-sized companies just Outsource server hosting or Or
7:20
network network setup or voice over IP phones, you know, phone
7:25
systems. That was another entry point
7:28
into it back in my day. But, you know, today there's
7:34
fewer and fewer those, they're being commoditized and, you
7:37
know, not necessarily moved out of the United States, but in the
7:41
bigger companies that I'm sure they have internship programs
7:45
and things like that to get into as well.
7:47
But I am is been one of those spaces where It's evolving so
7:51
rapidly and a lot of small companies move into the space
7:55
and it gives opportunities for newbies or new people to move
8:00
into the space and really build a career.
8:03
And one of the things that I've always loved about I am, is that
8:07
the people who I think are the most successful have, you know,
8:12
really good business skills. But enough technology skills to
8:15
be dangerous or vice versa, they've got really good
8:19
technology. Skills and they understand
8:21
business. Just enough to be dangerous or
8:23
obviously, if you're, if you're really experience with.
8:26
Oh, that's great. But you're solving business
8:30
problems with I am, you know, you're really having to look at.
8:33
How do you do things today? How do you want to do them
8:36
compare that with how to software work out of the box and
8:40
having the business sense to know that you don't want to take
8:43
something that you bought that works out of the box and
8:46
customize the, you know, customize it too much.
8:49
And then Start with kind of a Frankenstein system.
8:53
Yeah I mean there's so much more to I am than just technology
8:57
right? I mean it's there's there's
9:00
management, there's marketing, there's you know, communication,
9:03
relationship building, there's all and I think maybe it's not
9:07
clearly obvious, unless you've been in the space for a while,
9:10
it's not just knowledge musician.
9:12
You know, I don't consider myself overly technical.
9:14
I know enough probably the dangerous, but I'm not going to
9:17
go out and, you know, write your code and, you know, install and
9:21
configure your system. But I certainly understand, you
9:23
know, the macro Concepts, how things are gonna work together.
9:27
How does this work in the real world that, you know, large
9:29
companies and change boards, and software review, boards and kind
9:33
of all the company governance, the tends to go around, you
9:37
know, big projects. You know, how to Market out
9:39
there and you know why things I always say during our
9:41
engagement, Right. Is, you know, from a program
9:43
manager perspective, have your job is out there doing diplomacy
9:47
kissing babies, right? Nicky relationships.
9:49
People making people aware of one of the services that you're
9:52
offering. So that's probably a topic that
9:54
will Maybe cover in a future. You know what?
9:56
Makes good. I am program manager.
9:59
I think that's an excellent topic.
10:01
May be good on the right Road at some point.
10:06
So what are we want to talk about today?
10:08
I think what we should try to cover today is something that's
10:11
kind of near and dear to what we do because we can discuss them
10:16
and based on a real world experience.
10:18
But putting together an IM strategy and, you know, with the
10:24
role that you and I are in it just to be clear to everybody
10:26
what we do is were the advisory Services cement, I'd entropy.
10:30
So, we parachute in with our clients who are kind of come To
10:36
the realization that we need. And I am strategy and then they
10:41
had some point. Discover we don't know how to
10:44
make an IM strategy. So I think we could talk about
10:47
your the framework that we follow and kind of the process
10:50
that we go through. Because I know every
10:52
organization on a real, I am program manager can afford to go
10:57
out and bring consultants in and help with the process, but I
11:01
think the process is something that anybody could take on and
11:05
there might be some folks. There who are interested in just
11:07
kind of understanding what we do and how we do it.
11:11
So what I was going to kind of talk about was our framework
11:18
and, you know, I really like to break down what we do into three
11:23
major parts, so it's assess recommend and roadmap.
11:28
And so let me go through those three parts and and break them
11:32
down further. But the assessment phase is
11:35
really Understanding how things work today and I think this is
11:40
important to understand where your starting point is and
11:43
really it's it's going to help you develop kind of where we're
11:50
at today and what we want to accomplish which is going to be
11:53
that recommend phase and then realizing the amount of work
11:56
that needs to happen to go from point A to point B.
12:00
So normally with the assessment where we started, as we do a lot
12:04
of we do, ask Finger exercise. So we call it as our put chart,
12:09
the put chart is essentially processes user types and Target
12:14
systems, the whole idea and why we do that is to go through what
12:20
is the scope of the? I am program because I am can
12:22
mean many different things to many different people.
12:26
But if you get an exhaustive list of like, here are the
12:30
processes that we want to go after whether it's things
12:33
related to managing privileged identities.
12:36
User onboarding user off-boarding authentication into
12:40
applications, whatever it maybe it's not all those things.
12:44
Maybe it's you know just password management and it's a
12:47
more finite scope but realizing what your scope is, kind of the
12:51
starting point and one of the great things that comes out of
12:54
that exercise is that as you go through something like who are
12:59
the user type. So in other words we're the who
13:02
are we doing these? I am processes for, you're going
13:05
to So here are the stakeholders that we need to get involved.
13:08
We're talking about external customers.
13:11
For example, we need to get people who within our within our
13:15
organization is respond, are the person who's responsible for,
13:21
you know, communication to those users, things like that, who
13:24
provides them support. And other words, when a user
13:26
runs into an issue where they turn only, that's the service
13:29
desk, talking about employees for probably giving HR and
13:34
involved, if them As we go into Target system, this ASAP or
13:40
Salesforce is on the list. Well, we need to get people
13:43
involved from from those stakeholder groups.
13:47
Now, all those people that we identified, we then want to get
13:51
them involved in a workshop and a workshop would be, you know, a
13:55
series of meetings, where we understand from, folks.
13:58
What? You know, how do things work
13:59
today? What's working?
14:01
Well, what's not working? Well, what ideas do you have for
14:05
how to make? Things work better.
14:07
And so that's kind of the starting point is, I guess to
14:11
break down the assess phase. Its, you know, identifying
14:15
scope, identifying stakeholders and then meeting with the
14:19
stakeholders going through the workshop activities and that
14:22
might be a future podcast, as well as like what are these
14:25
workshops look like? How do we structure the workshop
14:28
sort of the questions but what I like to do in the workshop.
14:31
So way I like to see workshops during this for them to be very
14:34
interactive. It's not for us to kind of be
14:37
interrogating or just asking one way questions and just taking
14:42
notes. So the more that we're
14:43
interacting and white boarding or going through diagrams and
14:47
process flow charts the better and then coming out of that and
14:51
kind of the reason we use the term assess is that some things
14:55
are going to jump out at you right away.
14:57
Like you know this process is broken or this process works
15:01
really well is the strength within the organization is a
15:03
weakness, want to make sure we die.
15:06
Come in all those and then kind of be able to tell the story.
15:09
You know what is it that needs to improve?
15:13
What are the drivers for this program?
15:16
Why is it important to do something?
15:19
So I don't know. What are your thoughts on that,
15:20
Jeff? Yeah, yeah, that's right on.
15:23
I think one of the things that typically ends up being with the
15:26
hardest parts of the engagements that we work through, with our
15:28
customers is trying to get that attendance.
15:32
Right? For those workshops and having
15:33
people be available, It is an investment of time, right to get
15:37
those folks in there, but it's certainly beneficial, you know,
15:42
definitely for the customer and definitely for us, they will
15:44
understand. Well, how does it really work
15:46
today, right? Because you can have things that
15:47
are written down on paper and processes Etc.
15:50
And that's great, but that may not actually capture what's
15:54
really happening, right? So if we can get folks in the
15:56
room you know set up a safe space, right to have those
15:59
conversations and and figure out, you know, how do we solve
16:03
some of the issues that we hear at?
16:06
UPS out quite a bit. You know, when you talk about
16:08
the assessment, I always find interesting and I know we both
16:11
asked this question a lot, you know, from an assessment
16:15
perspective, you know, are we right on, you know, do they
16:18
does, the does, the customer agree with us or do they have a
16:21
different perception? So it's always interesting to
16:23
kind of have that conversation. So, yeah, we knew that we
16:26
weren't doing so great here. And, you know, that's, that's
16:29
kind of what we're expecting. I don't think I've ever come
16:32
across one. Where, you know, we've done an
16:35
assessment. Aunt and provided, you know,
16:37
here's why we think your ex and the customer saying, well,
16:41
you're totally wrong. This is why.
16:42
We're we're so much better than what you think, right?
16:46
It's we're usually pretty right on with that.
16:48
I don't know if you've ever encountered that from an
16:50
assessment perspective, but I think companies kind of break
16:53
you to brace themselves for the worst and maybe some tens or
16:56
pleasantly surprised or, you know, they agree with the
16:59
assessment. But I've never seen the opposite
17:01
where they thought they were doing a lot better than you.
17:05
Maybe what they really were. I've done, I think you're right
17:09
on with that point. I think you're right on with
17:11
that point. One thing that I are two points
17:14
that I wanted to throw out there.
17:16
One is this my perspective is like this is your strategy
17:21
because a lot of times will and so that drives a certain
17:24
perspective well you don't need to know every iota of detail or
17:30
make a strategy. You need to know we're going to
17:32
give areas of improvement, you know?
17:34
If the the way Passwords are managed is a problem.
17:38
You don't need to know every different aspect of the password
17:42
management policy or, you know, from a strategic perspective.
17:47
If you know that the tool is the problem, the tool needs to be
17:51
replaced, then that really ought to drive the strategy.
17:54
So you don't want to get burdened with too much detail.
17:57
And I think a lot of times in the projects that we've worked
18:00
on some of our clients. Thank you guys are here.
18:03
You need to know every detail we need to meet Every stakeholder,
18:06
anybody who has anything to do with passwords, and it's just
18:10
not the case. The other point I wanted to
18:13
bring out is that, you know, we talked about it as a workshop
18:16
and, you know, at least from a denture, we perspective, these
18:20
are engagements. So we're going in and, and we
18:23
want to try and get all of this information in a week.
18:27
So we try to schedule all the meetings in a week.
18:30
I feel like if our listeners are going out and trying to do this
18:35
on their own, Own. They should take that same
18:37
perspective. If you spread these meetings out
18:39
over several weeks or much worse of several months, you're going
18:44
to lose momentum, I'll get it done.
18:47
You'll never get it done. You'll forget things.
18:49
So it's going to be one more person to talk to, and it
18:52
doesn't create an event. It doesn't create, like, one of
18:56
the things I think about when folks hire us is that the
19:01
Consultants are coming in? They're going to be here this
19:03
week. You need to be ready, right?
19:05
Yourself available, right? Yeah, make yourself available
19:08
going to do one off exceptions. You can do a phone call next
19:11
week. If you can't be there, you're on
19:13
vacation or whatever. The reason is, we don't let it
19:17
drag out three weeks. It's kind of like if you can't
19:20
talk for three weeks, your perspectives not going to be
19:23
included. And you know, I don't mean to be
19:24
so harsh and you know, you don't really need to be that harsh,
19:27
but if you have several groups or saying like yeah, you know,
19:31
if it's just not important enough for them, that's a bigger
19:35
problem. And so that that is it to me as
19:39
like you've got to kind of create an event, you've got to
19:41
have these be a sense of urgency around it, right?
19:46
I mean, what's perfect. Let's get people in the room.
19:48
Let's get this conversation. We know it's an issue.
19:50
We've got these, you know, high-powered Consultants coming
19:54
in. You know, what's take advantage
19:55
of their time set aside the time to so we can get this done.
20:01
That's typically why I think it's why the hardest parts right
20:03
trying to get those folks to buy into that?
20:05
Says get availability, you know, the bigger the team, the bigger
20:09
the number, or larger number of stakeholders, just becomes that
20:11
much more difficult. So, the other thing to think
20:14
it's, we try to keep it more core and bring in other folks as
20:17
needed that sometimes can help with that as well.
20:19
Because most companies they typically have like a core kind
20:22
of I am T whether or not, they're truly a team or not, you
20:26
know. There's, there's typically a
20:27
handful of people really know how it works.
20:29
And then you've got supporting characters around that might be
20:32
subject matter expert experts in a given area that don't
20:35
necessarily need to be there full time, but we certainly
20:38
would like to have an hour, two hours, three hours of their
20:40
time. So that we can, you know,
20:42
understand their side of it. But that definitely comes into
20:44
place, right? Right.
20:47
And so, you know, moving on from the assessment, I think you made
20:50
a good point. We like, to, with our
20:53
assessment, bring it back to the client, have them review.
20:56
It verified that it's comprehensive and complete.
20:59
We didn't forget something. We didn't state facts
21:03
incorrectly. Usually that's not the case.
21:06
It's good to do a quality check and then we move on to making
21:11
recommendations and our recommendations are typically
21:14
based on best practices. So we know what the problems are
21:18
in the environment and we know what are the common industry
21:22
Solutions, but more so than just Technology Solutions, it's
21:28
there's some major themes that we generally look toward like
21:32
centralization automation. You know, consistent processes.
21:38
So that you know say you're working with a large
21:40
organization, they do things, different ways in different
21:43
departments, trying to drive toward once.
21:46
One common way of doing things is those are the typical
21:50
drivers. I'm not going to say that.
21:52
You know there's work for a hundred percent of organizations
21:56
but probably high 90s, you know, doing things from a central
22:00
perspective or at least having certain things done from a
22:03
central perspective. You know, it's not always the
22:07
case that you want to automate something, but you don't have a
22:10
framework for automating where it makes sense.
22:13
So that's really what we do from a recommendation standpoint.
22:18
And of course, you know, Jeff and I have a lot of experience
22:21
in the space. So we kind of a lot of these
22:25
things are second nature to us, but a lot of the, the benefits
22:30
that you get and kind of some of these best practices.
22:32
Like I talked about are also if Think about any kind of
22:36
Enterprise projects you're looking at and active directory
22:40
project or something like that, it would be the same kind of
22:43
theme centralization automation. So so those are our, the drivers
22:49
one of the ways you can, you know, if you're not working with
22:52
a consultant that you can start to get some ideas on how the
22:55
industry solves these problems would be to start to bring
22:58
vendors in, you to, you know, present them.
23:02
Here are the problems. What are your, you know, how
23:05
would you go? Solving these problems that's
23:07
going to give you some information now from the
23:10
adventure of your perspective. That's not how we operate
23:13
because we do it from a vendor agnostic, premium cream of mind.
23:17
We you know we want to say you know if we were in your shoes is
23:21
how we would do it. We based it on our experience.
23:24
So I think anybody could implement the framework but
23:28
nobody can Implement Jim McDonald's experience except for
23:31
Jim McConnell because I'm the only one who has my set of
23:34
experience in Jeff is the only one who has his and everybody
23:37
who's listening is the only person who has there's Rob but
23:40
you know. So that's kind of how we go
23:42
about the recommendations, kind of some of the major elements of
23:46
recommendations are going to be you know, people process and
23:49
Technology. What are the things that would
23:52
go about solving kind of the assessment doing kind of a gap
23:56
down analysis. You know, here are the gaps and
23:59
here the recommended Solutions. Another thing I would say is a
24:04
lot of things that are going to come out of.
24:05
Assessment have nothing to do with technology.
24:08
They just have to do with how you're running your IM program.
24:12
One of our recommendations is always gotta run.
24:15
I am as a program. I'm sorry.
24:17
Jeff, go ahead, no, no, I mean, you're right Honest, this is an
24:20
area. I think that it's, it's easy to
24:22
become overwhelmed, right? It's there's so many things that
24:25
might come out of just recommendations, but a lot of it
24:29
typically doesn't tend to be technology-based, right?
24:31
It's more on the process side. You know, one of the Questions
24:36
that we like to ask. You know, why do you do, what do
24:38
you do with that way? And sometimes no one really has
24:41
a good reason, why rights? No one, no one figured out or
24:44
wanted to kind of rock the boat. And, you know, maybe we play bad
24:48
cop. He was part of the part of the
24:49
part of the process, the same people.
24:51
Why you do it that way, what about this?
24:52
And kind of ask those questions. You know, you don't ask those,
24:56
you'll never get either a path for sometimes, but it's easy to
24:59
get overwhelmed, especially, you know, with some of our larger
25:02
engagements, where, you know, you may end up with like over
25:05
100 What'd you know, individual recommendations?
25:08
You can't solve everything all at once and you know, that
25:11
probably leads us into the next part.
25:12
Here, we talked about roadmap of, how do you prioritize?
25:15
You know what goes first? You know, is self-service
25:18
password, reset more important because your help desk is, you
25:21
know, drowning in those calls or is privileged access management,
25:26
you know, more important because you're not doing anything there,
25:28
right? How do you figure out you know
25:30
which which area comes first? Yeah, well there's there's
25:34
really no Silver Bullet for that.
25:36
I mean then you've got to look at what are the drivers in the
25:39
organization. Let's just say, you know, you
25:42
think the drivers automation we go into certain clients and we
25:45
just say my God you guys are drowning in Risk, right?
25:49
So another organizations are driven by risk and you know it
25:54
say Wow you guys could be doing the doing everything so much
25:58
better if you just had some automation, but usually it's a
26:01
balance of all those. That's risk.
26:03
It's automation, it's opportunity for, you know,
26:08
enabling new technologies and and certain things are going to
26:12
Bubble to the top. One thing that I think almost
26:15
never wants to be heard but is the cases that you're going to
26:21
introduce a lot of new technology footprint.
26:23
So say you're going to put an access management single sign-on
26:26
system in place. You're going to have some one
26:30
call it heavy lifting but there's some That needs to be
26:33
laid down. There's going to need to be some
26:36
basic work put into play to configure the system, you're
26:40
going to have to do, you know, Implement maybe one system as
26:44
kind of a proof of concept. Just to make sure that, you
26:49
know, nobody wants to do a big bang approach, even the smallest
26:52
Enterprises, don't want to do big bang.
26:55
So you've got to think about things in phases, but I'd say,
26:59
you know, more and more is moving to the cloud.
27:02
You can. The structure of a is is either
27:05
eliminated or shrunk down considerably but not everything
27:09
is moving to the cloud and this is a good blog topic for our
27:12
podcast, topic. For the future is to talk about,
27:15
you know, access management. Single sign-on is something that
27:19
is moving out to the cloud dramatically quicker than the
27:24
identity governance and administration space.
27:26
That's because companies the way they do identity Administration
27:32
and governance. Varies much more from
27:34
organization organization, the fields.
27:36
They have to manage and govern and provision it just it there's
27:43
so much more variance or a single.
27:45
Sign-on has really driven towards some of these Federation
27:48
protocol standards like saml 2.0 and open ID, open ID connect and
27:57
there's things have been able to move out to the cloud.
27:59
And there's now integration patterns that will be able to
28:02
take Cloud-based single sign-on and connected to applications,
28:07
that are even on-premise hosted. So, You know, I guess what the
28:14
point that I was making was, you know, don't forget kind of
28:17
infrastructure phases. Don't think that you can just
28:21
say our Phase 1 is going to be it just integrating applications
28:25
because you're going to have to get those confused early
28:28
configurations and maybe see a structure sign up as well.
28:32
That's kind of the traditional element, but they'll change to
28:35
write a mean. What if you're working on a road
28:37
map and especially if it's like any roadmap Beyond a year,
28:41
Right. There's gonna be changes that
28:42
come along the way. So you need to be able to be
28:44
flexible and adapt as things comes down down the penguin.
28:50
I think if somebody's out there listening and say, well, how do
28:53
I apply this to me because they can afford to go out and get
28:55
Consultants? How am I going to build my?
28:57
I am strategy and I think the hardest part is less coming up
29:02
with what the, you know, I think anybody may not anybody but most
29:08
of us can look at these problems.
29:10
Look at the vendor solutions that are out there.
29:14
Read what they say on their website, a watch their YouTube
29:16
videos. And say, I think this will solve
29:19
the problem. The hard part is being confident
29:23
that, yeah, it'll solve the problem is.
29:26
So that's why I think that, you know, why, or one of the reasons
29:29
why organizations want Jim and Geoff to come in to help is
29:33
that, you know what we've seen, and we can base it on our
29:36
experience to say, yeah, yes, we have to be very confident, you
29:40
don't. To come up with the strategy
29:41
that you're not 100% confident. If you don't have that
29:46
experience, if you don't have that experience, I think it
29:49
really you're going to have to go the extra mile and tap into
29:52
whatever, whatever resources you have available to you.
29:58
And one of the best ways. One of the ways, I learned a lot
30:01
about identity access management was tapping into my colleagues
30:06
at other companies, and my friends who were in the space
30:10
and message boards and things like that because, you know,
30:13
there are people out there who Ooh, love sharing information,
30:16
Jeff you and I are doing this podcast today because we love
30:19
sharing information, there's ways to get the information on
30:22
ways to get people's opinions. I'd say also within your
30:26
organization I am is you know, I am as a technical Beast unto
30:31
itself but a lot of the architecture design are going to
30:35
do you know pulling some of the Enterprise architecture team or
30:40
if you have other resources like that you can tap into to help
30:44
you. Sure that you're following good.
30:45
Architecture design principles, right?
30:48
What's that experience? I think that's, that's the
30:49
important thing. But, you know, this is one of
30:52
the reasons why I moved into Consulting was when you work for
30:55
a single company, you know, how they do it and, you know, the
31:00
tools that they used and when you're in Consulting you're
31:03
saying how way more companies do it?
31:06
You're getting a you know, much broader exposure to a larger
31:09
number of tools and you get to see much quicker what works what
31:13
doesn't work How particular issue might have been solved in
31:17
one organization and, you know, that's where that experience
31:19
Factor comes in. And you pull that, you know,
31:22
situation over and say, okay, this is very similar to what we
31:24
saw at company X. Now that we're company.
31:27
Why? Yeah, you know what we've seen
31:28
something similar to that? Let's talk about how this might
31:30
work, that certainly helps. And that goes back to reaching
31:36
out to your network, right? Trying to figure out everyone
31:40
struggles, with very similar problems, you know, for the most
31:42
part, it's Very rare that not very rare, but a lot of
31:48
companies struggle with very similar problems, which is see
31:50
that, that right? If you can talk with more folks,
31:52
in your networks etcetera and see how they solved it, there
31:55
may be components of their solution that might be able to
32:00
apply to fix your own. And, you know, once you talk to
32:03
enough folks and try to get enough data points, you start to
32:06
build that that confidence level that.
32:07
Yeah, okay. Here's the right way to approach
32:09
it. So, having that broad Network
32:13
and being able to talk with, Folks, you know, go to
32:16
conferences, you know, commiserate with the folks
32:18
there. Yeah, I think I'm going to just,
32:20
you know, be straight up and up front with some of the vendors,
32:23
right? So if you bring in a bender and
32:24
you guys specific problem, tell them what it is and see how they
32:28
would solve it right. That might help you understand
32:30
it sure they're gonna try and sell you their product but take
32:33
the information and as you're comparing different vendors see
32:36
how each one handles it. You may find that a you know the
32:40
vendor a is better at what you're looking for.
32:42
Specifically specifically the vendor be Even though vendor me
32:45
might be the big dog right in the industry.
32:48
So there's no, there's no Silver Bullet like you put it before.
32:52
Yeah. So after we go through a says,
32:55
recommend and roadmap now you have your strategy.
32:59
I think the final step now is communicate communicate
33:03
communicate tell everybody about your strategy presented to your
33:08
peers presented back to the folks that participated in
33:14
helping you You define what's working well, and what's not
33:17
working? Well, get by in, right?
33:20
And I would really start if you can kind of at more of the
33:23
Grassroots level, the people who participated and then work your
33:28
way up the channel. So that you're presenting to you
33:30
an executive team, letting them know that you have buy-in leg
33:34
them, know how you got to build the strategy who you talked
33:38
with, and that you've gone back to those teams and they're
33:41
buying in and it, my Experienced executive teams are going to
33:47
want to know. Does everybody agree with?
33:48
Does everybody agree that this is is the solution and then
33:52
they're going to want to know how much does it cost, everybody
33:57
agree. And how much does it cost,
33:58
right? Yeah.
34:00
But I mean and and again probably a another topic for
34:04
another time is really going about communicating, but that's
34:08
kind of the soft skills, right? It's about marketing, right?
34:12
It is that, when you're at, that point is all about.
34:14
Marketing. You got to be able to
34:16
communicate approval and you start going into projects.
34:19
That's where the technology is going to be technical skills are
34:22
going to be even more valuable because if you're a program
34:27
manager and you're running projects, you don't want to get,
34:31
you don't want to get technobabble to death or or
34:34
tricked. You want to be able to evaluate
34:39
that yourself and make sure that you get it.
34:42
That was always my thing, you know, there's Was
34:45
technology-related that was you know, outside of my expertise.
34:52
I see explain it to me until I understand it and eventually I
34:56
would not either understand it or they couldn't explain it to
34:59
me in a way that I understood and then I didn't want anything
35:01
to do with it. Yeah.
35:03
You can't articulate the value of whatever it is.
35:07
You're trying to do and it's obviously extends Beyond just I
35:10
am but you can actually fit articulate.
35:12
The value of what the i m Prime is going to bring what your
35:14
Trying to do, you're not gonna get the money to do anything.
35:17
I mean, right? I mean it's you have to be able
35:20
to tell the story of why we're doing this.
35:24
What's the benefit for it? How does it make our life
35:26
better, right? The trains that will get you the
35:29
money. Theoretically.
35:31
All right, you know, how much money is always up for today?
35:33
I mean budgets are always a, you know, hot button item, some
35:38
companies, you know may have, you know, set aside already
35:42
money for that or some haven't really in some I've been
35:45
thinking about it for a while and you know the longer you
35:47
wait. Typically the more you got to
35:48
spend up to get caught up, so to speak, but if you can't
35:51
articulate the value or what you're trying to do, nobody's
35:55
going to approve, any type of spending for that.
35:58
Yeah. So you want to be able to start
36:00
and start to master that communication strategy of what
36:03
is, what are we trying to do here?
36:04
Why are we doing it in? And why is it important, right?
36:08
Those sorts of things. I think that provides a pretty
36:12
good summary of our process. Could probably leave it there
36:15
for now. I agree.
36:17
I think you know our goal I think today was kind of Kick
36:21
this thing off, right? Just started.
36:24
And these are the types of conversations will have dive
36:27
into some more of these areas will, you know, this really the
36:31
plan part that we talked about today we'll talk about build
36:34
projects about how to run operations environment.
36:39
Does the kind of top Topics that people are interested in.
36:43
I think they'll still enjoy this podcast.
36:46
Yeah, I'm a really, you know, creates a wide range of topics,
36:49
anything it's really Identity or related.
36:51
It's probably in scope for us. That's current events topics
36:56
that we see come up during our own advisor engagements that
36:58
were working on and you have items that we might come across.
37:00
That people might find interesting.
37:04
And if those us, particularly, if there's a particular, you
37:06
know, topic or if you've got a question or just general
37:09
feedback, you can always email us.
37:11
That questions at identity at the center.com, awesome.
37:22
Jeff. I think it was great.
37:24
I think that was it for our first one so we're going to call
37:28
it there and thanks all for listening to take care.