Latest / The Identity Blueprint / Executing a Ruthless Identity Security Autopsy

Transcript

Executing a Ruthless Identity Security Autopsy · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome to the Identity Blueprint, the podcast where enterprise identity and access management gets the depth it deserves.
• 0:07
  SPEAKER_00: I'm Ernie Prescott, Principal IAM Architect, and every episode, Jose and I go deep on the frameworks, architecture decisions, and governance models that determine whether your organization's identity program actually holds up or becomes a headline.
• 0:23
  SPEAKER_00: Today we're diving into Executing a Ruthless Identity Security Autopsy, phase one of the IAM engagement blueprint, where we go keystroke level deep into discovery and current state assessment.
• 0:37
  SPEAKER_00: How to build a factual, evidence-based picture of every identity in your environment before you design a single thing.
• 0:44
  SPEAKER_00: Whether you're an IAM architect, a security leader, or an enterprise practitioner who's past the basics, you're in the right place.
• 0:52
  SPEAKER_00: Let's get into it.
• 0:55
  SPEAKER_01: Imagine for a second that you are tasked with securing a bank.
• 0:58
  SPEAKER_00: Okay.
• 0:59
  SPEAKER_00: A bank.
• 0:59
  SPEAKER_01: Right.
• 1:00
  SPEAKER_01: And you have a virtually unlimited budget, like a total blank check.
• 1:04
  SPEAKER_00: The dream scenario.
• 1:05
  SPEAKER_01: Exactly.
• 1:05
  SPEAKER_01: So you buy a state-of-the-art vault door, you install, you know, biometric retina scanners everywhere.
• 1:13
  SPEAKER_00: Absolutely.
• 1:13
  SPEAKER_01: You set up a grid of laser trip wires, and um you hire armed guards to stand at the entrance 24-7.
• 1:22
  SPEAKER_00: Makes sense.
• 1:22
  SPEAKER_00: You're locking down the front door.
• 1:24
  SPEAKER_01: Yeah, you spend millions of dollars locking down that front door.
• 1:27
  SPEAKER_01: But well, completely unbeknownst to you, you leave the architectural blueprints to a forgotten underground maintenance tunnel, just like sitting on a park bench right across the street.
• 1:37
  SPEAKER_00: Oh wow.
• 1:37
  SPEAKER_00: Yeah, that's a problem.
• 1:38
  SPEAKER_01: And the tunnel door itself, it's just hanging open on rusted hinges.
• 1:41
  SPEAKER_00: Aaron Powell Which, I mean, it completely invalidates the millions you just spent on the vault.
• 1:46
  SPEAKER_01: Right.
• 1:47
  SPEAKER_00: The attacker doesn't even bother trying to defeat your retina scanners.
• 1:49
  SPEAKER_00: Why would they?
• 1:50
  SPEAKER_00: They just pick up the blueprints, walk into the tunnel, and empty the vault from the inside.
• 1:55
  SPEAKER_01: Exactly.
• 1:56
  SPEAKER_01: And welcome to this deep dive.
• 1:58
  SPEAKER_01: Today we are taking on a massive, um, incredibly crucial mission for you all listening.
• 2:03
  SPEAKER_01: We are going entirely hands-on into phase one of the identity and access management or IAM program engagement blueprint.
• 2:11
  SPEAKER_00: Yeah, we are talking about the discovery and current state assessment.
• 2:14
  SPEAKER_01: And we aren't just gonna cover the high-level theory today.
• 2:16
  SPEAKER_01: We are going to walk you through exactly how to execute this phase, like the concrete, literal, keystroke level execution steps.
• 2:24
  SPEAKER_00: Because honestly, if your discovery process is flawed, if you don't actually know every single pathway in your environment, you're gonna end up taking a multimillion dollar identity governance implementation and well, just automating your bad data at lightning speed.
• 2:40
  SPEAKER_01: Which is terrifying.
• 2:41
  SPEAKER_00: It is.
• 2:41
  SPEAKER_00: You'll be building that state-of-the-art vault we just talked about, but standardizing the backdoor tunnel into your official architecture.
• 2:47
  SPEAKER_00: Trevor Burrus, Jr.
• 2:48
  SPEAKER_00: Yeah, cementing it in.
• 2:49
  SPEAKER_00: Right.
• 2:49
  SPEAKER_00: So before you can even begin to design a modern target state architecture, you know, you have to conduct a ruthless, evidence-based identity autopsy.
• 2:57
  SPEAKER_01: Aaron Powell Okay, let's unpack this.
• 2:59
  SPEAKER_01: Because we have to shift our entire mindset about what identity actually is in an enterprise context today.
• 3:05
  SPEAKER_01: Like 10, maybe 15 years ago, your identity directory was basically just a corporate phone book.
• 3:10
  SPEAKER_00: Aaron Powell Just names and extensions, right?
• 3:12
  SPEAKER_01: Exactly.
• 3:12
  SPEAKER_01: But in the modern, heavily distributed cloud native architecture we operate in today, identity isn't a directory.
• 3:22
  SPEAKER_01: It is the control plane.
• 3:23
  SPEAKER_00: Trevor Burrus, it's the whole thing.
• 3:24
  SPEAKER_01: Trevor Burrus, Jr.
• 3:24
  SPEAKER_01: It is the absolute primary security perimeter.
• 3:28
  SPEAKER_01: So if you are listening to this and you're sitting in a security operations center or, you know, an architecture review board, understand this foundational reality.
• 3:37
  SPEAKER_01: If you do not know your identity population with total certainty, you do not have a security perimeter.
• 3:43
  SPEAKER_01: Trevor Burrus, Jr.
• 3:43
  SPEAKER_00: Yeah.
• 3:43
  SPEAKER_00: That is the ultimate truth of modern infrastructure.
• 3:45
  SPEAKER_00: I mean, the identity autopsy is about building a factual picture.
• 3:48
  SPEAKER_00: Trevor Burrus, Jr.
• 3:48
  SPEAKER_01: Facts, not feelings.
• 3:50
  SPEAKER_00: Exactly.
• 3:50
  SPEAKER_00: We don't care what the IT director believes is happening.
• 3:53
  SPEAKER_01: Right.
• 3:53
  SPEAKER_00: We don't care what the incredibly well-formatted visio diagram from 2021 says should be happening.
• 3:59
  SPEAKER_01: I've seen those diagrams.
• 4:00
  SPEAKER_01: They're basically fiction.
• 4:01
  SPEAKER_01: Trevor Burrus, Jr.
• 4:01
  SPEAKER_01: Pure fiction.
• 4:03
  SPEAKER_00: We care about what the raw telemetry and the directory databases prove is happening right now.
• 4:09
  SPEAKER_00: You cannot govern what you cannot see.
• 4:11
  SPEAKER_00: And well, you cannot protect an asset if you don't even know it holds access rights.
• 4:15
  SPEAKER_01: Aaron Powell So we begin the autopsy.
• 4:17
  SPEAKER_01: And the first cut we make is into domain one, the identity inventory.
• 4:21
  SPEAKER_00: Yes, domain one.
• 4:22
  SPEAKER_01: Before we even look at the access rules, before we look at the authentication logs, we have to figure out exactly who or what exists inside the blast radius.
• 4:31
  SPEAKER_01: You know, we are hunting for the ghosts in the machine.
• 4:33
  SPEAKER_00: Aaron Powell The very first pulse check you perform as an architect during this inventory phase is the count-to-head count ratio.
• 4:40
  SPEAKER_01: Aaron Powell Which sounds simple.
• 4:41
  SPEAKER_00: The math is beautifully simple, yeah.
• 4:42
  SPEAKER_01: Yeah.
• 4:43
  SPEAKER_00: But the results usually terrifying.
• 4:45
  SPEAKER_01: How does it work?
• 4:46
  SPEAKER_00: You take the total number of user objects across all of your Active Directories and Cloud Identers, and you just divide it by the actual human headcount on the HR payroll.
• 4:55
  SPEAKER_01: Right.
• 4:55
  SPEAKER_01: And I've seen environments where um they have maybe 5,000 actual human employees getting paychecks, but their UNTRA ID tenant has like 14,000 active enabled accounts.
• 5:08
  SPEAKER_00: Yeah, leaving you with a ratio of what, 2.8 to 1?
• 5:11
  SPEAKER_01: Something like that, yeah.
• 5:12
  SPEAKER_00: Aaron Powell An account to headcount ratio greater than two to one is a massive flashing red indicator of systemic architectural rock.
• 5:20
  SPEAKER_01: It's a huge red flag.
• 5:22
  SPEAKER_00: Huge.
• 5:23
  SPEAKER_00: The immediate unavoidable question you have to ask the client is who exactly is holding the keys for those extra 9,000 accounts?
• 5:30
  SPEAKER_01: Aaron Powell Right, because you don't spontaneously generate 9,000 extra people in the cafeteria.
• 5:35
  SPEAKER_00: Aaron Powell You really don't.
• 5:36
  SPEAKER_00: Those are your shadow identities.
• 5:37
  SPEAKER_01: Shadow identities.
• 5:38
  SPEAKER_00: Yeah.
• 5:38
  SPEAKER_00: And finding them is a primary objective of domain one.
• 5:42
  SPEAKER_00: Shadow identities exist, well, completely outside of the formal governance lifecycle.
• 5:47
  SPEAKER_01: Aaron Powell Like who?
• 5:48
  SPEAKER_01: Give me an example.
• 5:49
  SPEAKER_00: Aaron Ross Powell They're the third-party contractors whose project ended nine months ago, right?
• 5:53
  SPEAKER_00: But the project manager never submitted the manual service now ticket to offboard them.
• 5:57
  SPEAKER_01: Aaron Powell Uh so their VPN access is still just sitting there live.
• 6:01
  SPEAKER_00: Still live.
• 6:02
  SPEAKER_01: And don't forget the developer test accounts, I mean, I I see this constantly in the audit logs.
• 6:07
  SPEAKER_00: Oh, the test accounts are the worst.
• 6:08
  SPEAKER_01: Right.
• 6:09
  SPEAKER_01: A senior engineer creates an account named um something like test user admin prod because they are troubleshooting a stubborn microservice in the production environment at like 2 a.m.
• 6:22
  SPEAKER_01: Yep.
• 6:22
  SPEAKER_01: They figure out the bug, they push the commit, and they completely forget to delete the test account.
• 6:26
  SPEAKER_00: Of course they do.
• 6:27
  SPEAKER_01: And three years later, that account is sitting there with standing global admin privileges.
• 6:33
  SPEAKER_01: It probably has a password set to, you know, welcome 2023 exclamation point.
• 6:38
  SPEAKER_00: Or just password 123.
• 6:40
  SPEAKER_01: Exactly.
• 6:40
  SPEAKER_01: And it definitely isn't tied to any active MFA policy.
• 6:45
  SPEAKER_00: Aaron Powell, which is exactly how massive breaches begin.
• 6:48
  SPEAKER_00: The attacker scans the directory, finds that forgotten test account, and realizes hey, they don't need to break your zero-day defenses.
• 6:55
  SPEAKER_01: They just walk through the front door.
• 6:56
  SPEAKER_00: They just log in.
• 6:57
  SPEAKER_00: So to solve this shadow identity crisis, your discovery phase has to map every single identity back to an authoritative source.
• 7:05
  SPEAKER_00: Yeah, we have to draw a hard, unforgiving line between a source of truth and a source of record.
• 7:10
  SPEAKER_01: Okay, let's break that down for the listener.
• 7:12
  SPEAKER_01: We all know that human resources should be the authoritative source.
• 7:15
  SPEAKER_00: Aaron Powell Right, theoretically.
• 7:16
  SPEAKER_01: The HR system, whether it's workday or SAP success factors or bamboo HR, is the only system that legally and financially knows who works for the company on any given Tuesday.
• 7:28
  SPEAKER_00: Aaron Powell Because they're the ones cutting the checks.
• 7:30
  SPEAKER_01: Aaron Ross Powell Exactly.
• 7:31
  SPEAKER_01: But when you actually look at the plumbing, the assessment usually reveals that the workday to active directory provisioning bridge is well, it's held together by digital duct tape.
• 7:41
  SPEAKER_00: Digital duct tape is a great way to put it.
• 7:43
  SPEAKER_00: Precisely.
• 7:43
  SPEAKER_00: Active directory or intra-ID or Okta, these are downstream targets.
• 7:49
  SPEAKER_00: They're sources of records.
• 7:50
  SPEAKER_01: Sources of record, right?
• 7:51
  SPEAKER_00: They record the account so it can be used for authentication.
• 7:54
  SPEAKER_00: But the assessment often reveals a completely broken manual life cycle.
• 7:59
  SPEAKER_01: Yeah.
• 7:59
  SPEAKER_00: You'll find that instead of an automated API trigger coming straight from workday, the creation of an AD account is triggered by like a hiring manager sending an email to a generic help disk inbox.
• 8:10
  SPEAKER_01: Oh man, or a messy CSV file export from HR.
• 8:14
  SPEAKER_00: Yes.
• 8:14
  SPEAKER_01: That gets manually uploaded by a sysadmin using this brittle ancient PowerShell script.
• 8:19
  SPEAKER_00: Written by a guy who left the company four years ago.
• 8:21
  SPEAKER_01: Exactly.
• 8:22
  SPEAKER_01: And when someone has, say, a hyphenated last name, the script just breaks, so the account gets provisioned manually anyway.
• 8:30
  SPEAKER_00: Exactly the kind of friction we look for in discovery.
• 8:33
  SPEAKER_00: If IT is manually creating accounts, it means they're relying on human memory to disable them.
• 8:38
  SPEAKER_01: And humans forget.
• 8:39
  SPEAKER_00: Always.
• 8:40
  SPEAKER_00: That is the genesis of your two-to-one account ratio.
• 8:44
  SPEAKER_00: Documenting that specific manual disconnect establishes the organization at a level one maturity state for the inventory domain.
• 8:52
  SPEAKER_01: But let me push back on this human-centric view for a second.
• 8:54
  SPEAKER_00: Sure.
• 8:54
  SPEAKER_01: We're talking a lot about HR, workday, and payroll, but the sources are screaming about a completely different demographic.
• 9:00
  SPEAKER_00: The non-humans.
• 9:01
  SPEAKER_01: Right.
• 9:02
  SPEAKER_01: In a modern cloud native ecosystem, it's not just humans requesting access tokens.
• 9:07
  SPEAKER_01: We have workload identities.
• 9:08
  SPEAKER_00: Yeah, we do.
• 9:09
  SPEAKER_01: We have serverless functions, CICD pipelines, automation bots, and microservices.
• 9:14
  SPEAKER_01: I mean, the blueprint explicitly states that non-human identities outnumber humans 10 to 1 in modern environments.
• 9:20
  SPEAKER_00: It's a massive scale.
• 9:22
  SPEAKER_01: So if a Python script running an ETL job doesn't have a workday profile, it doesn't get a paycheck, how do we even begin to govern it?
• 9:29
  SPEAKER_01: Doesn't the whole authoritative source model just fall apart?
• 9:33
  SPEAKER_00: What's fascinating here is that the lack of an HR record is precisely the reason workload identities represent the largest unmanaged attack surface in the enterprise.
• 9:42
  SPEAKER_01: Really?
• 9:43
  SPEAKER_01: The largest.
• 9:44
  SPEAKER_00: By far.
• 9:44
  SPEAKER_00: You are entirely correct.
• 9:46
  SPEAKER_00: A Kubernetes pod doesn't get a paycheck.
• 9:48
  SPEAKER_00: But it still needs an identity to authenticate to the back-end Postgres database.
• 9:53
  SPEAKER_00: It still requires an authorization token.
• 9:55
  SPEAKER_01: And how are they getting those tokens right now, you know, in a low maturity environment?
• 10:01
  SPEAKER_00: Well, in the absence of a proper machine identity platform, developers take the path of least resistance.
• 10:07
  SPEAKER_00: They rely on embedded secrets.
• 10:08
  SPEAKER_00: Oh no.
• 10:09
  SPEAKER_00: Oh yes.
• 10:10
  SPEAKER_00: They will literally hard code a highly privileged username and a static password strain directly into the application's source code.
• 10:17
  SPEAKER_01: Just sitting there in plain text.
• 10:18
  SPEAKER_00: Or they will drop it into an unencrypted configuration file right on the server.
• 10:22
  SPEAKER_00: And because it's hard coded, there is zero lifecycle management.
• 10:26
  SPEAKER_00: There is no password rotation schedule at all.
• 10:29
  SPEAKER_00: That embedded secret might remain static for five, six, seven years.
• 10:33
  SPEAKER_01: Which is horrifying because if an attacker breaches the perimeter, or honestly, if they just get read-only access to the internal Git repository, they just grep for the word password.
• 10:42
  SPEAKER_00: Yep.
• 10:43
  SPEAKER_00: Simple search.
• 10:43
  SPEAKER_01: They find the embedded secret and they instantly hold the keys to the production database.
• 10:47
  SPEAKER_00: That is why your discovery assessment is fundamentally flawed if it only counts human beings.
• 10:52
  SPEAKER_00: Right.
• 10:53
  SPEAKER_00: I mean, if you aren't hunting for service accounts, API keys, and managed identities across the cloud estate, you are missing upwards of 90% of the actual risk.
• 11:03
  SPEAKER_01: Wow.
• 11:04
  SPEAKER_01: So what is the architectural fix?
• 11:05
  SPEAKER_01: How do you um how do you tether a ghost?
• 11:08
  SPEAKER_00: The required architectural principle we assess against in phase one is the human in the loop ownership model.
• 11:14
  SPEAKER_01: Human in the loop?
• 11:15
  SPEAKER_00: Yes.
• 11:15
  SPEAKER_00: Every single non-human identity, every service account, every bot must be cryptographically and organizationally tethered to a named human owner.
• 11:24
  SPEAKER_01: A specific person.
• 11:26
  SPEAKER_00: Not a department, not a generic iTadmins distribution list, a specific employee in the HR database.
• 11:31
  SPEAKER_01: Okay, I see the logic.
• 11:33
  SPEAKER_01: If the human owner loses the company, the HR system fires the termination trigger.
• 11:38
  SPEAKER_00: Exactly.
• 11:39
  SPEAKER_01: The identity governance system sees that this human-owned, say, 12 different service accounts running in AWS and it immediately flags those accounts, sets them to a suspended state, and forces a workflow to reassign ownership to a new active employee.
• 11:56
  SPEAKER_00: You got it.
• 11:57
  SPEAKER_00: And if they aren't claimed, they are permanently destroyed.
• 12:00
  SPEAKER_00: Finding orphan workload identities, you know, service accounts with no active human sponsor is a critical deliverable of domain one.
• 12:07
  SPEAKER_00: They are essentially loaded weapons just left lying around the data center.
• 12:11
  SPEAKER_01: So we've secured the front gate, we've mapped the inventory, we know who the humans are, and we've tethered the bots.
• 12:16
  SPEAKER_00: Step one complete.
• 12:17
  SPEAKER_01: Right.
• 12:18
  SPEAKER_01: Now we have to figure out how these entities are proving they are who they say they are.
• 12:22
  SPEAKER_01: We transition to domain two, the authentication landscape, and the hunt for legacy bet.
• 12:27
  SPEAKER_00: This domain requires a very, very uncomfortable conversation with the chief information security officer.
• 12:32
  SPEAKER_01: I can imagine.
• 12:33
  SPEAKER_00: Because for the past decade, the industry standard advice has been a binary checklist.
• 12:38
  SPEAKER_00: You just ask, do you have MFA turned on?
• 12:40
  SPEAKER_00: Check the box.
• 12:41
  SPEAKER_00: Check the box.
• 12:42
  SPEAKER_00: But the threat landscape has evolved drastically.
• 12:44
  SPEAKER_00: Simply asking if MFA is enabled is no longer a valid assessment question.
• 12:49
  SPEAKER_00: We have to evaluate the phishing resistance of the entire authentication stack.
• 12:54
  SPEAKER_01: Okay, let's break down the mechanics of why standard MFA is failing.
• 12:57
  SPEAKER_01: I think a lot of people assume that if they get a six-digit SMS cloud, or if their authenticator app pops up asking them to hit a approve, they are like bulletproof.
• 13:08
  SPEAKER_00: They're absolutely not bulletproof.
• 13:09
  SPEAKER_00: Let's look at the mechanics of fatigue attack or MFA prompt bombing.
• 13:13
  SPEAKER_01: Okay.
• 13:14
  SPEAKER_00: An attacker purchases a compromise username and password from the dark web.
• 13:17
  SPEAKER_00: They script an automated login attempt at 2.0 AM local time.
• 13:21
  SPEAKER_01: Sneaky.
• 13:22
  SPEAKER_00: Right.
• 13:23
  SPEAKER_00: The target's phone buzzes with a push notification.
• 13:26
  SPEAKER_00: But the target is asleep, so the request times out.
• 13:29
  SPEAKER_01: But the script doesn't sleep.
• 13:30
  SPEAKER_00: The script never sleeps.
• 13:31
  SPEAKER_00: It immediately fires again and again and again.
• 13:34
  SPEAKER_00: 100 times in three minutes.
• 13:36
  SPEAKER_00: Oh my god.
• 13:36
  SPEAKER_00: The user's phone is just vibrating violently on the nightstand.
• 13:40
  SPEAKER_00: The user wakes up disoriented, annoyed, and they just tap approve on the screen to make the buzzing stop so they can go back to sleep.
• 13:49
  SPEAKER_01: Wow.
• 13:49
  SPEAKER_01: And the attacker is in.
• 13:50
  SPEAKER_01: They bypass the MFA entirely by weaponizing human psychology.
• 13:54
  SPEAKER_00: Exactly.
• 13:55
  SPEAKER_00: Or consider an adversary in the middle or ATM attack.
• 14:00
  SPEAKER_01: ATM?
• 14:01
  SPEAKER_01: How does that work?
• 14:02
  SPEAKER_00: The attacker sets up a proxy server and sends the user a highly convincing phishing email.
• 14:07
  SPEAKER_00: The user clicks a link, lands on a fake login page that looks, I mean, identical to their corporate Microsoft 365 portal.
• 14:15
  SPEAKER_01: All right, pixel perfect.
• 14:16
  SPEAKER_00: And they enter their password.
• 14:17
  SPEAKER_00: The proxy passes that password to the real Microsoft server, which triggers the SMS code.
• 14:22
  SPEAKER_01: Aaron Powell Okay, so the user gets the real text message.
• 14:24
  SPEAKER_00: Exactly.
• 14:24
  SPEAKER_00: The user gets the real SMS code and types it into the fake site.
• 14:28
  SPEAKER_00: The proxy captures the session cookie, passes it to the real server, and the attacker steals the fully authenticated session token.
• 14:35
  SPEAKER_01: The SMS code didn't protect them at all.
• 14:37
  SPEAKER_00: Not even a little bit.
• 14:38
  SPEAKER_00: This is why the assessment must evaluate the adoption of hardware-backed FIDO2 security keys or device-bound pass keys.
• 14:46
  SPEAKER_01: So how is FIDO2 different from the SMS code?
• 14:49
  SPEAKER_00: FIDO 2 fundamentally changes the underlying protocol.
• 14:53
  SPEAKER_00: It relies on a cryptographic challenge response mechanism.
• 14:57
  SPEAKER_01: Okay.
• 14:57
  SPEAKER_01: Cryptographic.
• 14:58
  SPEAKER_00: When the server asks for authentication, it sends a challenge.
• 15:01
  SPEAKER_00: The hardware key, the FIDOQ token signs, that challenge using a private key stored in a secure hardware enclave.
• 15:07
  SPEAKER_01: Right.
• 15:08
  SPEAKER_00: But here's the critical part.
• 15:09
  SPEAKER_00: It only signs the challenge if the relying party ID, the actual web domain in the browser, exactly matches the registered service.
• 15:17
  SPEAKER_01: So if the user is sitting on like Microsoft LoginUpdate.com.
• 15:21
  SPEAKER_00: The hardware key looks at the domain, realizes it's a fake, and silently refuses to sign the challenge.
• 15:26
  SPEAKER_01: That's brilliant.
• 15:27
  SPEAKER_00: The phishing attack fails mathematically.
• 15:29
  SPEAKER_00: It doesn't rely on the human noticing the typo in the URL.
• 15:32
  SPEAKER_01: Aaron Powell, which is why we rely heavily on the NIST SP 8633 framework during this assessment.
• 15:38
  SPEAKER_01: Specifically, we map the environment against the authenticator assurance levels, or AAL.
• 15:43
  SPEAKER_01: Let's walk through the mechanics of those levels because scoring the organization's AAL compliance is a mandatory part of the final deliverable for you listeners out there.
• 15:52
  SPEAKER_00: Aaron Powell Absolutely.
• 15:52
  SPEAKER_00: So NIST defines three escalating levels.
• 15:55
  SPEAKER_00: AAL1 provides basic assurance that the claimant controls an authenticator.
• 16:00
  SPEAKER_00: Historically, this is just a password.
• 16:02
  SPEAKER_01: Just a password.
• 16:02
  SPEAKER_00: In today's threat landscape, AAL1 is considered negligent for any corporate access.
• 16:07
  SPEAKER_01: Yeah, ALL1 is just hoping the attacker guesses wrong.
• 16:10
  SPEAKER_00: Exactly.
• 16:11
  SPEAKER_00: Then you have AAL2.
• 16:12
  SPEAKER_00: This requires proofs of possession and control of two distinct authentication factors.
• 16:17
  SPEAKER_01: This is your standard MFA.
• 16:19
  SPEAKER_00: Right.
• 16:20
  SPEAKER_00: A password combined with a time-based one-time passcode or an app-based push notification.
• 16:25
  SPEAKER_00: It provides high confidence, but as we just discussed with fatigue and proxy attacks, it is not immune to sophisticated phishing.
• 16:32
  SPEAKER_01: Which brings us to the gold standard, AAL3.
• 16:34
  SPEAKER_00: Yes.
• 16:34
  SPEAKER_00: AAL3 requires proof of possession of a key through a cryptographic challenge response protocol.
• 16:40
  SPEAKER_00: It requires a hardware-based authenticator.
• 16:42
  SPEAKER_01: The FIDO2 keys.
• 16:44
  SPEAKER_00: Exactly.
• 16:44
  SPEAKER_00: It is highly resistant to man-in-the-middle attacks, phishing, and token replay.
• 16:49
  SPEAKER_00: During the discovery phase, you map the organization's critical assets, the financial ledgers, the source code repositories, the infrastructure control planes, and you verify whether access to those specific assets strictly enforces AAL3.
• 17:02
  SPEAKER_01: But enforcing ALO3 on the front door doesn't matter if the back door is wide open.
• 17:06
  SPEAKER_01: We have to talk about identity debt, specifically the architectural poison of legacy authentication protocols.
• 17:11
  SPEAKER_00: Legacy authentication is often the most shocking revelation for an IT team during the current state readout.
• 17:17
  SPEAKER_00: We are talking about protocols that were designed decades ago: basic auth, POP3, IMP without modern authentication capabilities, and legacy SMTP A use.
• 17:35
  SPEAKER_00: Let's hear it.
• 17:36
  SPEAKER_01: It was built in an era before SAML tokens or OIDC claims even existed.
• 17:40
  SPEAKER_01: The protocol is literally hard-coded to only understand two fields, a username and a password.
• 17:45
  SPEAKER_01: That's it.
• 17:46
  SPEAKER_01: When your massive, expensive, UNTRA-ID conditional access policy steps in and says, Hey, I see you logging in, but you're coming from a new IP address, so I need to challenge you for a multi-factor token.
• 17:58
  SPEAKER_01: The POP3 protocol doesn't even have the vocabulary to receive or process that request.
• 18:02
  SPEAKER_00: It doesn't know what to do with it.
• 18:04
  SPEAKER_01: Right.
• 18:04
  SPEAKER_01: It just fails open or bypasses the check entirely.
• 18:07
  SPEAKER_00: That is the perfect explanation.
• 18:09
  SPEAKER_00: Legacy protocols simply cannot negotiate modern security challenges.
• 18:13
  SPEAKER_00: And attackers know this.
• 18:14
  SPEAKER_01: Oh, they definitely know it.
• 18:15
  SPEAKER_00: They use automated AI-driven enumeration tools to constantly scan enterprise perimeters.
• 18:20
  SPEAKER_00: They aren't trying to break your FIDO2 implementation.
• 18:23
  SPEAKER_00: They are looking for a forgotten service account that still responds to a basic IMAP request.
• 18:28
  SPEAKER_01: So, as the architect sitting at the console, how do you actually find these leaks?
• 18:32
  SPEAKER_01: Walk us through the exact execution steps for hunting legacy debt in a MicroCroft Entra ID environment.
• 18:38
  SPEAKER_00: Sure.
• 18:38
  SPEAKER_00: You cannot rely on surveys or interviews.
• 18:40
  SPEAKER_00: You have to dive into the raw telemetry.
• 18:42
  SPEAKER_00: You log into the Microsoft Entra Admin Center, you navigate to the identity blade, open monitoring and health, and access the sign-in logs.
• 18:50
  SPEAKER_01: Okay, I've got the logs open in my mind.
• 18:52
  SPEAKER_01: Now what?
• 18:53
  SPEAKER_00: You need to isolate the noise.
• 18:55
  SPEAKER_00: You apply a specific filter for client app.
• 18:58
  SPEAKER_00: Within that dropdown, you intentionally select all of the legacy authentication clients.
• 19:03
  SPEAKER_01: All the old stuff.
• 19:04
  SPEAKER_00: You check the boxes for Exchange, ActiveSync, Auto Discover, POP, IMF, SMTP, and the Catch All Other Clients.
• 19:11
  SPEAKER_01: Aaron Powell And when you hit apply and the query runs, what does the JSON output usually reveal?
• 19:18
  SPEAKER_00: Oh, it usually reveals thousands of authentications bypassing your security perimeter every single day.
• 19:24
  SPEAKER_01: Thousands.
• 19:25
  SPEAKER_00: Yes.
• 19:25
  SPEAKER_00: You export that raw data into a log analytics workspace like Microsoft Sentinel, and you start grouping the logs by IP address and user agent string to identify the culprits.
• 19:35
  SPEAKER_01: And who are the usual suspects?
• 19:37
  SPEAKER_00: The number one offender is almost always office multifunction printers.
• 19:40
  SPEAKER_01: The scanner in the hallway.
• 19:42
  SPEAKER_00: The big scanner sitting in the hallway that the HR team uses to scan tax documents.
• 19:46
  SPEAKER_00: He uses legacy SMTPA youth to send the scanned email PDF, authenticating with a basic service account password.
• 19:52
  SPEAKER_01: The second massive offender I see is Custom Line of Business Applications.
• 19:56
  SPEAKER_01: An internal inventory tool built by an intern in like 2014 that hard codes a credential to read and exchange mailbox.
• 20:05
  SPEAKER_00: Oh yeah.
• 20:05
  SPEAKER_00: And don't forget, older mobile devices running native mail clients that still utilize legacy exchange ActiveSync instead of the modern Outlook mobile app.
• 20:16
  SPEAKER_01: Right.
• 20:16
  SPEAKER_00: The urgency here is absolute.
• 20:19
  SPEAKER_00: Microsoft, Google, and other major identity providers are aggressively deprecating these protocols.
• 20:25
  SPEAKER_01: Turning them off.
• 20:26
  SPEAKER_00: Turning them off completely.
• 20:27
  SPEAKER_00: If you don't find these dependencies during phase one discovery, the day the vendor flips the switch, your corporate printers and custom apps will simply stop functioning.
• 20:36
  SPEAKER_01: Alright, so we finally secured the front door.
• 20:38
  SPEAKER_01: We know the inventory, and we've confirmed the right people are getting in using hardware-backed cryptography.
• 20:43
  SPEAKER_00: We're doing good so far.
• 20:44
  SPEAKER_01: But getting in is only half the battle.
• 20:46
  SPEAKER_01: What happens if a perfectly authenticated, perfectly legitimate employee walks in, turns left, and decides to open the payroll vault?
• 20:53
  SPEAKER_00: That's where things get messy.
• 20:54
  SPEAKER_01: Now we have to map the blast radius.
• 20:57
  SPEAKER_01: We transition to domain three, unpacking the authorization and access model.
• 21:02
  SPEAKER_00: Authorization is where the real complexity lives because it is inherently messy and deeply political.
• 21:08
  SPEAKER_01: Very political.
• 21:09
  SPEAKER_00: We start by assessing the maturity of the role-based access control or RBAC framework.
• 21:16
  SPEAKER_00: The fundamental question we are trying to answer is are access entitlements granted based on a mathematically defined business role, or are they granted ad hoc based on whoever yelled the loudest in a help desk ticket?
• 21:28
  SPEAKER_01: I'd actually push that further.
• 21:30
  SPEAKER_01: It's not just who yelled the loudest, it's the clone model, which is the bane of identity governance.
• 21:34
  SPEAKER_01: Explain the mechanics of the clone model and why it destroys RBAC.
• 21:38
  SPEAKER_00: The clone model occurs when a manager submits an onboarding ticket that simply says, make the new hire's access look exactly like Sarah's.
• 21:45
  SPEAKER_01: Classic.
• 21:46
  SPEAKER_01: Just copy Sarah.
• 21:47
  SPEAKER_00: Exactly.
• 21:48
  SPEAKER_00: The IT administrator, lacking any defined role templates, looks up Sarah's account in Active Directory.
• 21:53
  SPEAKER_00: They see Sarah is a member of 60 different security groups.
• 21:56
  SPEAKER_00: The admin simply highlights all 60 groups and copies them to the new.
• 22:01
  SPEAKER_01: But the admin doesn't know Sarah's history.
• 22:03
  SPEAKER_00: No context at all.
• 22:04
  SPEAKER_01: Sarah has been with the company for eight years.
• 22:06
  SPEAKER_01: She has worked in three different departments.
• 22:08
  SPEAKER_01: Forty of those security groups are legacy artifacts from old projects, temporary task forces, and deprecated file shares.
• 22:16
  SPEAKER_00: Exactly.
• 22:17
  SPEAKER_00: And now the IT admin has instantly duplicated eight years of excessive toxic privilege to a brand new employee on day one.
• 22:27
  SPEAKER_01: Incredible.
• 22:28
  SPEAKER_00: This practice leads directly to the phenomenon of group sprawl.
• 22:32
  SPEAKER_00: It is entirely common to assess an enterprise with 10,000 employees and discover 50,000 active security groups.
• 22:39
  SPEAKER_01: But the flat number of groups isn't the terrifying part.
• 22:42
  SPEAKER_01: Whenever I look at group sprawl, the thing that keeps me up at night is the nested quirks.
• 22:46
  SPEAKER_00: The dark matter.
• 22:47
  SPEAKER_01: The dark matter of IAM.
• 22:48
  SPEAKER_01: The idea that a group is hiding inside another group like a Russian nesting doll.
• 22:52
  SPEAKER_01: So if I put the temp contractors group inside the global admins group, I've basically just handed the keys to the kingdom to every temporary worker, right?
• 23:00
  SPEAKER_00: Yes, and the terrifying part isn't just that it happens, it's that the transitive property of that access is entirely invisible to standard audit tools.
• 23:08
  SPEAKER_01: Wait, invisible?
• 23:09
  SPEAKER_00: A flat list audit report of the global admins group will only show the direct members.
• 23:14
  SPEAKER_00: It might show five named IT directors.
• 23:17
  SPEAKER_00: The auditor checks the box and says the environment is secure.
• 23:20
  SPEAKER_01: Because the standard PowerShell export doesn't recursively unpack the nested group SIDs, the security identifiers?
• 23:27
  SPEAKER_00: Precisely.
• 23:28
  SPEAKER_00: And at a protocol level, excessive nesting literally breaks authentication.
• 23:32
  SPEAKER_00: Oh so when a user logs in, Kerberos generates a ticket granting ticket, or TGT.
• 23:38
  SPEAKER_00: That ticket must contain the SID of every single group the user belongs to, including all nested inheritances.
• 23:44
  SPEAKER_01: Right, the token size.
• 23:46
  SPEAKER_00: Exactly.
• 23:46
  SPEAKER_00: If the user is deeply nested in hundreds of groups, the token bloats.
• 23:50
  SPEAKER_00: It exceeds the maximum header size limit in the web server, and the user experiences a mysterious HTTP 400 bad request error just trying to log in.
• 23:59
  SPEAKER_01: It's architectural collapse, so how do we actually find this dark matter during the assessment?
• 24:04
  SPEAKER_00: This is where modern identity governance and administration or IGA platforms prove their worth.
• 24:09
  SPEAKER_00: Tools like SailPoint Identity Security Cloud utilize an identity graph.
• 24:13
  SPEAKER_01: Here's where it gets really interesting.
• 24:15
  SPEAKER_00: It does.
• 24:16
  SPEAKER_00: The graph doesn't rely on flat lists, it calculates and visualizes the inheritance pathways as a node-based map.
• 24:24
  SPEAKER_00: It mathematically traces the lines, allowing a security team to physically see that the low-privileged contractor group intersects with a legacy help desk group, which inherits permissions from a nested infrastructure group, ultimately resulting in domain admin rights.
• 24:38
  SPEAKER_01: It visualizes the hidden blast radius.
• 24:40
  SPEAKER_01: It's like turning on the lights in a dark room.
• 24:43
  SPEAKER_01: Okay, so we look at the roles, we hunt down the nested groups.
• 24:47
  SPEAKER_01: What about standing privilege?
• 24:48
  SPEAKER_01: The outline specifically mandates evaluating standing versus JIT privilege.
• 24:53
  SPEAKER_00: Right.
• 24:53
  SPEAKER_00: Standing privilege is a legacy operational model.
• 24:56
  SPEAKER_00: If you are a database engineer, you possess administrative rights to the production SQL servers 24 hours a day, 365 days a year.
• 25:03
  SPEAKER_00: Even while you are on vacation, your account holds the power to drop production tables.
• 25:07
  SPEAKER_01: Which means if an attacker steals your session token while you're asleep, they also hold the power to drop production tables.
• 25:14
  SPEAKER_00: Exactly.
• 25:14
  SPEAKER_00: The modern target state is just in time, or JIT privilege.
• 25:17
  SPEAKER_00: We assess the environment's capability to enforce time-bound access.
• 25:21
  SPEAKER_01: How does that work?
• 25:22
  SPEAKER_00: In a JIT model, leveraging tools like Microsoft Entra-Privileged Identity Management, the database engineer operates with standard, low-privileged user access by default.
• 25:32
  SPEAKER_01: And when they need to perform maintenance, they essentially have to request the superhero suit.
• 25:36
  SPEAKER_00: Yes.
• 25:36
  SPEAKER_00: They initiate an elevation request.
• 25:38
  SPEAKER_00: They must provide a valid business justification, often linking directly to an approved change management ticket in service now.
• 25:46
  SPEAKER_01: Okay, so there's a paper trail.
• 25:48
  SPEAKER_00: A strong paper trail.
• 25:49
  SPEAKER_00: And they are forced to satisfy a step-up MFA prompt, usually requiring an AAL3 hardware key.
• 25:56
  SPEAKER_00: Once approved, the system dynamically provisions the elevated role.
• 26:00
  SPEAKER_01: But the crucial part is that the suit has a timer.
• 26:02
  SPEAKER_00: The elevation is strictly time-bound.
• 26:04
  SPEAKER_00: After two hours or the duration of the change window, the system automatically strips the elevated permissions.
• 26:10
  SPEAKER_00: The blast radius shrinks back to zero.
• 26:12
  SPEAKER_00: Evaluating the breadth of JIT deployment is a massive indicator of an organization's maturity level.
• 26:18
  SPEAKER_01: We also have to assess separation of duties, or SOD.
• 26:21
  SPEAKER_01: This is incredibly complex, especially in heavily regulated financial environments.
• 26:26
  SPEAKER_00: So D is about mathematically preventing toxic combinations of access.
• 26:30
  SPEAKER_01: Toxic combinations.
• 26:31
  SPEAKER_01: Give me an example.
• 26:32
  SPEAKER_00: The classic textbook example is the procure-to-pay life cycle.
• 26:35
  SPEAKER_00: The user identity that possesses the entitlement to create a new vendor profile in the SAP ERP system cannot mathematically be the same identity that possesses the entitlement to approve invoice payments to that vendor.
• 26:48
  SPEAKER_01: Because if one person holds both granular entitlements, they can create a fake shell company, approve a million-dollar payment to it, and commit massive corporate fraud without ever triggering an external approval workflow.
• 27:01
  SPEAKER_00: The phase one assessment analyzes whether the organization has actually mapped these toxic combinations, and more importantly, whether the IGA platform has preventative guardrails configured to block an access request that would violate an SOD policy.
• 27:14
  SPEAKER_01: And as we assess this access model, we can't limit our scope to the shiny new cloud apps.
• 27:19
  SPEAKER_01: The sources heavily emphasize the danger of the ugly 20%.
• 27:22
  SPEAKER_00: Ah, yes, the deep hybrid gap.
• 27:24
  SPEAKER_00: Modern identity providers like Intra ID or Okta are fantastic at federating access to modern SAUS applications using SAM or OIDC.
• 27:32
  SPEAKER_00: Super easy.
• 27:33
  SPEAKER_00: But when you walk into a Fortune 500 enterprise, you hit the ugly 20%.
• 27:38
  SPEAKER_00: You find IBM mainframes running RACF security.
• 27:42
  SPEAKER_00: You find AS400 systems.
• 27:44
  SPEAKER_00: You find highly customized on-premises Oracle ERP deployments that haven't been patched in a decade.
• 27:49
  SPEAKER_01: And standard cloud native visibility tools just bounce right off those systems.
• 27:53
  SPEAKER_01: They don't speak REST API.
• 27:55
  SPEAKER_01: They are absolute black boxes to the cloud directory.
• 27:58
  SPEAKER_00: Which is why assessing the integration capabilities of the current architecture is critical.
• 28:02
  SPEAKER_00: You must determine if the organization has deployed the necessary lightweight agents or connectors to reach deep into that on-premises infrastructure.
• 28:10
  SPEAKER_00: Because if you don't, if you cannot govern access on the mainframe with the same rigorous JIT and SOD policies that you apply to Salesforce, you are ignoring the exact systems where the most sensitive financial and customer data resides.
• 28:23
  SPEAKER_01: Okay, we're moving deep into the anatomy of the organization now.
• 28:25
  SPEAKER_01: We've mapped the identities, the authentication protocols, and the complex web of authorization.
• 28:30
  SPEAKER_01: But access isn't a static snapshot frozen in amber.
• 28:34
  SPEAKER_01: It breathes and morphs as human beings move through their careers.
• 28:39
  SPEAKER_01: We have to evaluate domain four, the identity life cycle.
• 28:43
  SPEAKER_00: The joiner, mover-lever process, or JML.
• 28:47
  SPEAKER_01: And this is where the political friction really starts to grind the gears of the architecture.
• 28:51
  SPEAKER_01: Let's start with the joiner.
• 28:53
  SPEAKER_00: The joiner assessment focuses on velocity, consistency, and the elimination of manual human intervention.
• 28:59
  SPEAKER_01: Aaron Powell What's the metric we're looking at?
• 29:00
  SPEAKER_00: The primary metric we evaluate is the time delta between the HR system officially logging the hire event and the moment the employee achieves productive day one access.
• 29:10
  SPEAKER_01: We've all seen the absolute worst case scenario here.
• 29:13
  SPEAKER_00: Oh, absolutely.
• 29:14
  SPEAKER_01: A new hire arrives on Monday morning, they sit at an empty desk, they can't log into their laptop, they don't have an email inbox, and they can't access the internal wiki.
• 29:22
  SPEAKER_00: Just twiddling their thumbs.
• 29:23
  SPEAKER_01: They spend their first three days shadowing someone else because the IT help desk is buried under a backlog of manual provisioning tickets.
• 29:30
  SPEAKER_00: That is a fundamental failure of the IAM program, and it represents a massive quantifiable loss of business productivity.
• 29:38
  SPEAKER_00: We assess whether the architecture supports automated birthright access.
• 29:43
  SPEAKER_00: Birthright access defines the baseline bundle of entitlements: an AD account, an exchange mailbox, access to the corporate intranet, basic sauce apps that an employee requires based solely on their job code and department attribute in the HR payload.
• 30:00
  SPEAKER_00: Right.
• 30:01
  SPEAKER_00: The goal is zero-touch provisioning.
• 30:03
  SPEAKER_00: The HR system triggers the API, the identity platform reads the attributes, and it provisions the birthright access automatically without a human in IT ever clicking a mouse.
• 30:13
  SPEAKER_01: But joining the company is just the starting line.
• 30:15
  SPEAKER_01: The real chaos begins when people start changing jobs internally.
• 30:19
  SPEAKER_01: Let's dig into the mover process.
• 30:21
  SPEAKER_01: We touched on the clone model earlier, but explain the exact mechanics of privilege creep when someone actually gets promoted.
• 30:26
  SPEAKER_00: This is where we encounter massive political resistance.
• 30:29
  SPEAKER_00: Imagine a scenario.
• 30:30
  SPEAKER_00: David is a senior data analyst in the finance department.
• 30:32
  SPEAKER_01: Okay, David in finance.
• 30:34
  SPEAKER_00: He has deep, granular access to the payroll databases, the corporate financial ledgers, and the secure accounting file shares.
• 30:42
  SPEAKER_00: David performs exceptionally well and accepts a promotion to become a director in the marketing department.
• 30:47
  SPEAKER_01: A great career move for David.
• 30:49
  SPEAKER_00: But an absolute nightmare for the identity architecture.
• 30:52
  SPEAKER_01: Why?
• 30:53
  SPEAKER_00: Here is what happens mechanically.
• 30:55
  SPEAKER_00: HR updates David's job code and department string and workday.
• 31:00
  SPEAKER_00: The identity platform detects the delta.
• 31:02
  SPEAKER_00: It triggers the joiner workflow for his new role.
• 31:05
  SPEAKER_00: It provisions his access to the marketing automation platforms, the CRM, and the creative asset libraries.
• 31:11
  SPEAKER_01: That part works perfectly.
• 31:12
  SPEAKER_01: He gets his new tools.
• 31:13
  SPEAKER_01: But what happens to the old tools?
• 31:15
  SPEAKER_00: In 90% of organizations, absolutely nothing happens to the old tools.
• 31:19
  SPEAKER_00: Nothing.
• 31:19
  SPEAKER_00: Nothing.
• 31:20
  SPEAKER_00: The system adds the new entitlements, but it lacks the logic to remove the legacy access.
• 31:25
  SPEAKER_00: The organization lacks a zero-based provisioning process.
• 31:29
  SPEAKER_01: Let's define zero-based provisioning because this is where the architect usually ends up in a shouting match with a vice president.
• 31:34
  SPEAKER_00: Zero-based provisioning means that when an identity changes roles, their access is mathematically reset to zero and then rebuilt strictly based on the birthright entitlements of the new role.
• 31:45
  SPEAKER_01: But business units hate this.
• 31:47
  SPEAKER_00: They despise it.
• 31:48
  SPEAKER_00: The VP of Finance will say, David is moving to marketing, but we haven't hired his replacement yet.
• 31:53
  SPEAKER_00: We need him to have a transition grace period where he can still run the end-of-month payroll reports.
• 31:57
  SPEAKER_01: And the architect says, Okay, we'll grant an exception for 30 days, but there is no automated revocation trigger for that exception.
• 32:04
  SPEAKER_00: Exactly.
• 32:05
  SPEAKER_00: 30 days becomes three years.
• 32:07
  SPEAKER_00: And suddenly David, the marketing director, still possesses full administrative read-write access to the company's financial ledgers.
• 32:16
  SPEAKER_01: He has accumulated the toxic privileges of two entirely separate verticals.
• 32:20
  SPEAKER_00: The assessment must rigorously evaluate if the mover process enforces automated delta analysis and a ruthless revocation of obsolete entitlements.
• 32:28
  SPEAKER_01: Which brings us to the most dangerous lifecycle transition of all.
• 32:32
  SPEAKER_01: The lever.
• 32:33
  SPEAKER_01: Domain four mandates an assessment of the deprovisioning gap.
• 32:37
  SPEAKER_00: This is the highest risk area in the entire life cycle, Bar none.
• 32:41
  SPEAKER_00: When an identity is terminated, we are measuring the latency gap between the HR termination timestamp and the absolute revocation of network access.
• 32:49
  SPEAKER_01: And the risk profile changes drastically depending on whether it's a voluntary exit, like a planned retirement, or a hostile involuntary termination.
• 32:57
  SPEAKER_00: Precisely.
• 32:58
  SPEAKER_00: Let's analyze the hostile termination scenario.
• 33:00
  SPEAKER_01: Okay.
• 33:00
  SPEAKER_00: HR conducts the exit interview at 9 0 a.m.
• 33:03
  SPEAKER_00: on a Tuesday.
• 33:04
  SPEAKER_00: The employee is escorted from the premises.
• 33:07
  SPEAKER_00: But the architectural plumbing is broken.
• 33:09
  SPEAKER_00: HR relies on sending a manual email to the IT help desk to disable the account.
• 33:14
  SPEAKER_01: Oh no.
• 33:14
  SPEAKER_00: The ticket gets routed to the wrong queue, or the sits admin is busy patching a server.
• 33:19
  SPEAKER_00: The Active Directory account isn't disabled until 4.0 DOPM on Friday.
• 33:23
  SPEAKER_01: That is an 80-hour latency gap.
• 33:25
  SPEAKER_01: That is a catastrophic window of risk.
• 33:27
  SPEAKER_01: The terminated employee is sitting at home angry, and they still possess a fully active VPN profile, access to their corporate email, and standing privileges to internal file shares.
• 33:37
  SPEAKER_00: They can systematically download customer databases, exfiltrate intellectual property, or intentionally deploy ransomware.
• 33:43
  SPEAKER_01: Which is why the Blueprint strictly demands an automated API-driven lever process.
• 33:48
  SPEAKER_00: Yes.
• 33:49
  SPEAKER_00: When the HR database updates the user status determinated, that event must instantly trigger a webhook or an API call to the identity platform.
• 33:58
  SPEAKER_00: The platform must immediately execute a disable command across the entire ecosystem within seconds.
• 34:03
  SPEAKER_01: Not hours, not days.
• 34:04
  SPEAKER_01: Seconds.
• 34:05
  SPEAKER_00: Seconds.
• 34:06
  SPEAKER_01: But here is a critical question, and it loops all the way back to our domain one shadow identities.
• 34:11
  SPEAKER_01: If the automated system successfully disables the Active Directory account, how do we guarantee that access is revoked across the entire decentralized ecosystem?
• 34:20
  SPEAKER_01: What about the shadow IT applications that aren't federated with Enter ID?
• 34:24
  SPEAKER_00: If we connect this to the bigger picture, this is exactly why the architectural tech stack mapping is so vital.
• 34:30
  SPEAKER_00: If a third-party SAS application is not integrated into your centralized identity provider via SAML for authentication, and it isn't integrated via SCM 2.0 for automated lifecycle provisioning, then the centralized termination trigger simply will not reach it.
• 34:44
  SPEAKER_01: The Active Directory account goes dark, but the local account within the siloed Sauce app remains fully active.
• 34:50
  SPEAKER_01: Yes.
• 34:51
  SPEAKER_00: So the terminated employee loses their corporate email, but they can just open a web browser, navigate directly to the marketing SAS platform, log in with their local credentials, and continue accessing corporate data.
• 35:03
  SPEAKER_01: Yes.
• 35:03
  SPEAKER_01: Those are orphaned accounts.
• 35:06
  SPEAKER_01: Without a comprehensive deprovisioning strategy that leverages Cloud Access Security Broker, or CASB, logs to discover Shadow IT and forcefully integrate those apps into the centralized governance platform, the organization is permanently expanding its attack surface every time an employee resigns.
• 35:23
  SPEAKER_00: Okay, the complexity of this autopsy is staggering.
• 35:25
  SPEAKER_00: We've assessed the technical life cycle, but who is actually watching the watchers?
• 35:29
  SPEAKER_00: Who holds the steering wheel?
• 35:31
  SPEAKER_00: We transition to domains five and six, governance posture and the technology stack map.
• 35:36
  SPEAKER_01: Governance is frequently relegated to an afterthought, treated as an annoying administrative burden rather than the core security function.
• 35:42
  SPEAKER_00: True.
• 35:42
  SPEAKER_01: The assessment asks a blunt question.
• 35:44
  SPEAKER_01: Does the organization possess a formal executive-backed identity steering committee, or is IMM policy just dictated by whatever the help desk manager decides to do on a Friday afternoon?
• 35:55
  SPEAKER_01: And the absolute proving ground for governance maturity is the access review process.
• 36:00
  SPEAKER_01: The blueprint notes we need to assess the reality of these reviews.
• 36:03
  SPEAKER_01: Are they actually generating security outcomes or are we just witnessing compliance theater?
• 36:08
  SPEAKER_00: Compliance theater is the exact terminology we use.
• 36:11
  SPEAKER_00: Let's look at the mechanical reality of a standard low maturity access review.
• 36:15
  SPEAKER_01: Walk me through it.
• 36:16
  SPEAKER_00: Once a year, to satisfy an external auditor, a business manager receives an automated email containing a massive spreadsheet.
• 36:23
  SPEAKER_00: It lists 500 rows of complex technical entitlements for their 20 direct reports.
• 36:29
  SPEAKER_01: They are looking at strings of text like AWSIM rolls, three bucket prod red rate, or school debate badman group seven.
• 36:36
  SPEAKER_00: Exactly.
• 36:37
  SPEAKER_00: And the business manager who is under intense pressure to hit their quarterly revenue targets has absolutely no idea what those technical strings mean.
• 36:44
  SPEAKER_01: No context.
• 36:45
  SPEAKER_00: They lack the context to make a valid security decision.
• 36:47
  SPEAKER_00: So they take the path of least resistance, they highlight the entire column, click the approve all button, and submit the form just to get the annoying task out of their queue.
• 36:55
  SPEAKER_01: They are rubber stamping the review, and the auditor looks at the digitally signed log, checks the box, and declares the organization compliant.
• 37:02
  SPEAKER_00: But the actual security posture hasn't improved by a single millimeter.
• 37:06
  SPEAKER_00: That is the audit trap.
• 37:07
  SPEAKER_00: An audit trap.
• 37:08
  SPEAKER_00: Passing a point-in-time compliance audit for SOX, IPPAY, or PCI DSS does not mathematically equate to a secure IAM architecture.
• 37:18
  SPEAKER_00: True governance requires continuous compliance.
• 37:21
  SPEAKER_01: What does that look like?
• 37:22
  SPEAKER_00: It requires an IGA platform that translates technical AD groups into human readable business descriptions.
• 37:29
  SPEAKER_00: It requires microcertifications triggered by high-risk events, not just an annual spreadsheet dump.
• 37:34
  SPEAKER_01: As part of that governance evaluation, the blueprint circles back to the NIST SP 800, the 633 framework, this time focusing on identity proofing or the identity assurance level IAL.
• 37:45
  SPEAKER_00: Yes.
• 37:45
  SPEAKER_00: The authenticator assurance level IAL evaluated how you log in.
• 37:49
  SPEAKER_00: The identity assurance level IAL evaluates how the organization mathematically proved you are who you claim to be when they first handed you the digital keys.
• 37:57
  SPEAKER_01: It's the digital equivalent of requiring a passport and a utility bill to open a bank account rather than just trusting someone who walks in off the street.
• 38:06
  SPEAKER_00: Precisely.
• 38:07
  SPEAKER_00: NIST defines three levels.
• 38:09
  SPEAKER_00: IALN1 is entirely self-asserted.
• 38:12
  SPEAKER_00: You type a name into a web form, you provide an unverified email address, and the system provisions an identity.
• 38:18
  SPEAKER_01: No proof.
• 38:19
  SPEAKER_00: There is zero cryptographic link to a real-world human.
• 38:23
  SPEAKER_01: Which is perfectly acceptable for signing up for a retail marketing newsletter, but grossly negligent for provisioning VPN access to a corporate network.
• 38:31
  SPEAKER_00: Exactly.
• 38:31
  SPEAKER_00: Then we move to ILL2.
• 38:34
  SPEAKER_00: This requires verifiable evidence that supports the real-world existence of the claimed identity.
• 38:39
  SPEAKER_01: How do they do that remotely?
• 38:40
  SPEAKER_00: In a modern remote work environment, this usually involves mobile app workflow where the new hire scans their government-issued driver's license, takes a live biometric selfie, and the system runs a real-time algorithmic comparison while checking the data against authoritative credit bureaus.
• 38:55
  SPEAKER_01: And IAL 3.
• 38:56
  SPEAKER_00: IAL 3 is the absolute strictest level.
• 38:59
  SPEAKER_00: It requires mandatory in-person verification by a highly trained, credentialed representative.
• 39:05
  SPEAKER_00: The subject must physically present themselves with multiple forms of tamper evident documentation.
• 39:12
  SPEAKER_00: Wow.
• 39:12
  SPEAKER_00: Assessing an organization's IAL maturity, especially regarding how they proof remote contractors before mailing them a corporate laptop, is a vital component of domain five.
• 39:23
  SPEAKER_01: Speaking of vital components, we need to map the actual plumbing.
• 39:26
  SPEAKER_01: Domain six is the tech stack inventory, but I want to emphasize a critical warning from the blueprint to the listener.
• 39:32
  SPEAKER_00: Oh, this is important.
• 39:33
  SPEAKER_01: This phase is not a product evaluation.
• 39:35
  SPEAKER_01: You are not operating as a vendor sales engineer trying to prove that Okta is superior to Entra ID or that SalePoint is better than seven.
• 39:42
  SPEAKER_00: Aaron Powell Absolutely not.
• 39:43
  SPEAKER_00: This is a purely architectural inventory.
• 39:45
  SPEAKER_00: You are acting as a cotographer, you are mapping what software exists, how it's currently configured, and crucially, the specific integration protocols that connect the disparate systems.
• 39:54
  SPEAKER_00: Right.
• 39:55
  SPEAKER_00: You map the directory forests, the identity providers, the IGA platforms, and the privileged access management vaults like CyberArc.
• 40:01
  SPEAKER_01: Aaron Powell I always explain the tech stack map using a plumbing analogy.
• 40:05
  SPEAKER_01: We aren't judging the brand name stamped on the side of the copper pipes.
• 40:08
  SPEAKER_01: We're looking at the joints.
• 40:10
  SPEAKER_00: The joints, yes.
• 40:11
  SPEAKER_01: We are analyzing where the pipes connect, verifying if they actually route back to the main water supply, and most importantly, we are hunting for the slow leaks behind the drywall.
• 40:21
  SPEAKER_00: Aaron Powell That is a highly accurate representation.
• 40:24
  SPEAKER_00: Architectural fragmentation is the ultimate enemy of identity security.
• 40:28
  SPEAKER_00: The telemetry indicates that large enterprises juggle an average of five independent identity repositories and four distinct network access solutions.
• 40:37
  SPEAKER_01: Aaron Powell It's a chaotic patchwork.
• 40:39
  SPEAKER_01: The discovery phase maps the seams between these silos.
• 40:42
  SPEAKER_00: Aaron Powell Because the seams are where the threat actors live.
• 40:45
  SPEAKER_01: Yeah.
• 40:45
  SPEAKER_00: They don't attack the heavily defended core.
• 40:47
  SPEAKER_00: They slip through the misconfigured API connection between the HR database and the on-premises AD server.
• 40:53
  SPEAKER_01: Precisely.
• 40:54
  SPEAKER_01: You have to document the exact integration protocols.
• 40:57
  SPEAKER_01: Is the organization still relying on legacy LDIP syncs and custom PowerShell scripts that break every time a server reboots?
• 41:03
  SPEAKER_00: Hopefully not.
• 41:04
  SPEAKER_01: Or have they modernized to standardized REST APIs like SCIM 2.0?
• 41:10
  SPEAKER_01: The sources highlight that platforms like Entra ID now act as SCIM service providers.
• 41:15
  SPEAKER_00: Aaron Powell Which is a game changer.
• 41:16
  SPEAKER_01: It is.
• 41:17
  SPEAKER_01: This allows an external IGA tool to execute, create, read, update, and delete operations using a standardized, predictable API payload, entirely replacing the brittle scripts of the past.
• 41:30
  SPEAKER_00: Okay.
• 41:30
  SPEAKER_00: We are entering the final stages of the autopsy.
• 41:33
  SPEAKER_00: We've mapped the technology, the integrations, and the governance frameworks.
• 41:36
  SPEAKER_01: But the most expensive, perfectly designed identity architecture in the world will spontaneously combust if the human element operating it isn't capable.
• 41:45
  SPEAKER_00: That is so true.
• 41:46
  SPEAKER_01: This brings us to domains seven and eight, organizational readiness and the threat landscape.
• 41:51
  SPEAKER_00: You cannot solve a deeply rooted organizational dysfunction simply by purchasing more software.
• 41:56
  SPEAKER_00: You can deploy the most advanced AI-driven identity governance platform on the market, but if your IT staff's expertise is historically concentrated entirely in legacy active directory administration.
• 42:07
  SPEAKER_01: If they only know on-prem.
• 42:08
  SPEAKER_00: Right.
• 42:09
  SPEAKER_00: If their entire worldview is limited to on-premises, domain controllers, group policy objects, and Kibero's tickets, they are going to be completely paralyzed trying to engineer a modern identity fabric based on OpenID Connect, Samilo Federation, and Eskim provisioning.
• 42:27
  SPEAKER_01: This requires a massive reality check.
• 42:29
  SPEAKER_01: Let me speak directly to the listener for a second.
• 42:31
  SPEAKER_01: Your board of directors might have authorized the budget to buy a Formula One Ferrari.
• 42:36
  SPEAKER_01: You might have procured the absolute top-tier quadrant leading identity security suite.
• 42:40
  SPEAKER_01: Yeah.
• 42:41
  SPEAKER_01: But if your operations team only knows how to drive a horse and buggy, that implementation is going to crash into a wall on day one.
• 42:48
  SPEAKER_01: You have to aggressively assess the operational skills gap.
• 42:50
  SPEAKER_00: You also have to assess the organization's psychological capacity for change management.
• 42:54
  SPEAKER_01: Well, change management is huge.
• 42:56
  SPEAKER_00: Rolling out these identity transformations, like forcing 10,000 employees to abandon passwords for FIDO II hardware keys, or stripping away standing administrative privileges and forcing senior engineers to request JIT elevation for every task.
• 43:09
  SPEAKER_00: These are massive, highly disruptive cultural shifts.
• 43:12
  SPEAKER_01: People hate losing access.
• 43:14
  SPEAKER_00: They generate intense internal friction.
• 43:16
  SPEAKER_00: If the organization lacks a dedicated executive-backed change management function to absorb that friction, the user pushback will completely derail the program.
• 43:25
  SPEAKER_01: And let's talk about the actual budget.
• 43:27
  SPEAKER_01: The blueprint points out that we must evaluate the financial reality of the IAM program.
• 43:32
  SPEAKER_01: Does identity have a dedicated protected budget line, or is the CIIS constantly forced to cannibalize the general IT spend, fighting for scraps against the team trying to upgrade the office Wi Fi routers?
• 43:43
  SPEAKER_00: It happens all the time.
• 43:44
  SPEAKER_01: If IAM isn't funded as a multi year strategic imperative, it is doomed to fail.
• 43:50
  SPEAKER_00: This organizational readiness score directly dictates the velocity of the strategic roadmap you will design in phase two.
• 43:56
  SPEAKER_00: You simply cannot mandate a jump to advanced zero trust capabilities.
• 44:00
  SPEAKER_00: Abilities like continuous access evaluation, where tokens are revoked in real time based on risk signals.
• 44:05
  SPEAKER_00: If the operational team doesn't even comprehend the architectural difference between an authoritative source of truth and a downstream replica, you have to throttle the transformation to match the organization's metabolic rate for change.
• 44:17
  SPEAKER_00: Which is tied directly to the final assessment domain, the threat context.
• 44:22
  SPEAKER_00: We have to map the actual exposure surface.
• 44:25
  SPEAKER_01: Let's get into it.
• 44:25
  SPEAKER_00: We must establish the historical and current threat baseline.
• 44:29
  SPEAKER_00: Has the organization suffered documented credential compromises in the past 24 months?
• 44:34
  SPEAKER_00: Do they expose a high volume of legacy, internet-facing applications with direct authentication portals?
• 44:41
  SPEAKER_01: And most critically, does the Security Operations Center actually possess the telemetry to detect an identity-based attack currently in progress?
• 44:49
  SPEAKER_00: Right.
• 44:50
  SPEAKER_00: If an attacker successfully executes a token replay attack or triggers an impossible travel alert, where an account authenticates from an IP address in New York and then 12 minutes later authenticates from an IP address in Beijing, do the security tools actually trigger an automated block?
• 45:05
  SPEAKER_01: Or is the organization completely blind?
• 45:08
  SPEAKER_00: If the enter ID sign-in risk policies are configured to report-only mode out of fear of locking out legitimate users, which is so common.
• 45:16
  SPEAKER_00: Or if the authentication logs aren't being actively ingested and analyzed by a SIM like Sentinel or Splunk, the organization is flying blind.
• 45:25
  SPEAKER_00: Assessing this detection deficit provides the necessary urgency to secure executive buy-in for the quick wins.
• 45:32
  SPEAKER_01: Okay.
• 45:32
  SPEAKER_01: We have completed the autopsy.
• 45:34
  SPEAKER_01: We have methodically dissected all eight domains.
• 45:37
  SPEAKER_01: That's a lot of work.
• 45:38
  SPEAKER_01: We have mapped the shadow inventory, the legacy authentication protocols, the nested group dark matter, the massive latency in the lifecycle, the compliance theater, the brittle tech stack, the skills gap, and the active threat vectors.
• 45:51
  SPEAKER_00: We are sitting on a mountain of terrifying telemetry.
• 45:54
  SPEAKER_01: So how do we package these raw findings into actionable deliverables that the C-suite will actually read, comprehend, and most importantly, sign a check to fix?
• 46:03
  SPEAKER_01: We arrive at segment seven, delivering the factual baseline.
• 46:06
  SPEAKER_00: The output of phase one is a highly standardized set of deliverables.
• 46:10
  SPEAKER_00: You do not just walk into a boardroom and hand the C-suite a raw to JSON log dump.
• 46:14
  SPEAKER_01: They'd throw you out.
• 46:15
  SPEAKER_00: You must synthesize the data into business reality.
• 46:19
  SPEAKER_00: The primary deliverable is the current state assessment report.
• 46:23
  SPEAKER_00: This is typically a dense, 40 to 60 page factual document.
• 46:28
  SPEAKER_00: Factual.
• 46:29
  SPEAKER_00: It must be ruthlessly cited.
• 46:30
  SPEAKER_00: Every single claim made in the report must be backed by irrefutable evidence gathered during the discovery phase.
• 46:36
  SPEAKER_01: You can't just write a bullet point that says the internal transfer process is broken.
• 46:40
  SPEAKER_01: You have to write analysis of 150 internal employee transfers executed in Q3 demonstrated that in 100% of cases, the employees retain their legacy access rights, as evidenced by the conflicting Active Directory Group memberships detailed in Appendix B.
• 46:56
  SPEAKER_00: Exactly.
• 46:56
  SPEAKER_00: It must be an evidence-based prosecution of the current state.
• 46:59
  SPEAKER_00: Alongside the narrative report, you deliver the maturity scorecard.
• 47:02
  SPEAKER_01: What's the scale on that?
• 47:04
  SPEAKER_00: This takes the eight domains we just analyzed and plots the organization on a standardized scale from level one to level five.
• 47:10
  SPEAKER_00: Level one is initial or ad hoc, meaning operations are reactive, chaotic, and heavily reliant on manual heroics.
• 47:17
  SPEAKER_01: And level five.
• 47:18
  SPEAKER_00: Level five is optimized, meaning the architecture is fully automated, API driven, and capable of continuous, dynamic risk evaluation.
• 47:27
  SPEAKER_00: This scorecard establishes the undeniable baseline.
• 47:30
  SPEAKER_01: It provides a literal map showing them exactly where they are standing.
• 47:33
  SPEAKER_01: But a 60-page architectural analysis can induce paralysis.
• 47:38
  SPEAKER_01: Executives want to know how to stop the bleeding today.
• 47:41
  SPEAKER_00: Which is why the third deliverable is the quick win register.
• 47:44
  SPEAKER_00: This is a highly tactical list of action items that can be executed in under 30 days, requiring minimal engineering effort, but delivering outsized risk reduction.
• 47:53
  SPEAKER_01: Give me an example.
• 47:54
  SPEAKER_00: We are talking about immediately disabling the top 100 oldest inactive contractor accounts, or deploying a conditional access policy to block legacy authentication for all accounts that haven't utilized it in the past 90 days.
• 48:06
  SPEAKER_00: It generates immediate momentum for the program.
• 48:09
  SPEAKER_01: But the ultimate deliverable, the true translation layer between technical architecture and boardroom finance is the IAM risk register.
• 48:16
  SPEAKER_00: The risk register forces prioritization.
• 48:19
  SPEAKER_00: It strips away the technical jargon and outlines the specific vulnerabilities in the language of business risk.
• 48:24
  SPEAKER_01: How does that look?
• 48:25
  SPEAKER_00: For example, the lack of an automated SCIOM deprovisioning connector for the Salesforce instance leaves orphaned accounts active.
• 48:33
  SPEAKER_00: It mathematically assigns a likelihood score.
• 48:35
  SPEAKER_00: It defines the business impact, such as high risk of customer data exfiltration by terminated sales representatives, and it outlines the recommended architectural mitigations.
• 48:45
  SPEAKER_00: This is how you secure funding.
• 48:47
  SPEAKER_01: So what does this all mean?
• 48:48
  SPEAKER_01: It means you have taken an impossibly complex, heavily fragmented, highly political technical environment, and you have distilled it into a clear, mathematically undeniable picture of corporate exposure.
• 49:03
  SPEAKER_00: You really have.
• 49:03
  SPEAKER_01: You are looking the board of directors in the eye and showing them exactly how vulnerable the organization is while simultaneously handing them the tourniquet to stop the bleeding.
• 49:12
  SPEAKER_00: But this brings us to the ultimate climax of the discovery phase.
• 49:16
  SPEAKER_00: This raises an important question, undeniably the most critical question of the entire blueprint engagement.
• 49:21
  SPEAKER_01: What's that?
• 49:21
  SPEAKER_00: What happens if you present this meticulously researched 60-page report and the stakeholders simply refuse to accept reality?
• 49:29
  SPEAKER_00: What happens when the IT director looks at the nested group analysis and says, Our RBAC model isn't that bad, we just have a few exceptions.
• 49:39
  SPEAKER_00: Or the HR director aggressively defends their manual processes.
• 49:43
  SPEAKER_01: This is the decision gate.
• 49:45
  SPEAKER_01: And the blueprint is brutally explicit about what the architect must do in this moment.
• 49:50
  SPEAKER_00: The weed architect must halt the engagement.
• 49:53
  SPEAKER_01: Halt it.
• 49:54
  SPEAKER_00: Do not, under any circumstances, proceed to phase two strategy and target state design without formal executive level sign-off and acceptance of the current state assessment report.
• 50:04
  SPEAKER_01: Stand your ground.
• 50:05
  SPEAKER_00: The entire purpose of the autopsy is to establish a shared factual baseline.
• 50:09
  SPEAKER_00: If the stakeholders dispute the telemetry, you must pause the engagement and resolve those disputes immediately, forcing them to look at the raw evidence you collected.
• 50:17
  SPEAKER_01: Because if you do not agree on the exact coordinates of where you are standing right now, you will never ever agree on the map to the destination.
• 50:24
  SPEAKER_01: I've seen it happen.
• 50:25
  SPEAKER_00: It happens too often.
• 50:26
  SPEAKER_01: Why do massive multi-million dollar identity governance projects implode two years into deployment?
• 50:31
  SPEAKER_01: Because the consultants skipped the hard, uncomfortable conversations at phase one.
• 50:36
  SPEAKER_01: They tried to architect a pristine zero trust framework on top of an unacknowledged rotting swamp of shadow identities and broken manual processes.
• 50:45
  SPEAKER_00: Building a shared, undeniable, mathematically proven baseline is the only path forward.
• 50:50
  SPEAKER_00: The identity autopsy is painful, it exposes failures, but it is the absolute prerequisite to building a secure, resilient architecture.
• 50:59
  SPEAKER_01: And that brings us to the end of our incredibly deep dive into phase one of the IAM engagement blueprint.
• 51:04
  SPEAKER_01: We have explored the mechanics of everything from the mathematical ratio of shadow identities to the cryptographic failures of legacy protocols, the dark matter of nested group sprawl, and the absolute architectural necessity of the HR termination trigger.
• 51:18
  SPEAKER_00: It is a massive amount of technical and organizational data to process, but mastering the rigorous execution of this discovery phase is the definitive line that separates a triumphant identity transformation from a catastrophic career-ending failure.
• 51:31
  SPEAKER_01: Before we sign off, I want to leave you with a final lingering thought to evaluate within your own environment.
• 51:36
  SPEAKER_01: We spend millions of dollars and countless hours obsessing over highly sophisticated nation-state threat actors utilizing advanced AI-driven zero-day exploits to breach our outer perimeters.
• 51:49
  SPEAKER_00: We really do.
• 51:50
  SPEAKER_01: But what if the greatest existential threat to your corporate architecture right now isn't an outside adversary at all?
• 51:56
  SPEAKER_01: What if the real threat is a forgotten, vastly overprivileged machine identity?
• 52:01
  SPEAKER_01: A silent ghost running in an abandoned test cluster that hasn't been audited in four years, just sitting in the dark, waiting for a single port scan to discover it.
• 52:10
  SPEAKER_00: That is exactly why we demand the autopsy.
• 52:12
  SPEAKER_01: Indeed.
• 52:13
  SPEAKER_01: Thank you for joining us on this deep dive.
• 52:15
  SPEAKER_01: Stay curious, stay rigorous in your assessments, and we'll catch you on the next one.
• 52:20
  SPEAKER_00: That's a wrap on executing a ruthless identity security autopsy.
• 52:25
  SPEAKER_00: On our next episode, Jose and I are going to get into identity strategy and target state design, taking everything the autopsy uncovered and turning it into a deliberate architecture with a clear destination.
• 52:39
  SPEAKER_00: You won't want to miss it.
• 52:40
  SPEAKER_00: If you want to connect, find me on LinkedIn at LinkedIn.com forward slash in slash Ernie Prescott.
• 52:47
  SPEAKER_00: I'd love to hear your thoughts on today's episode and what identity challenges you're dealing with in the real world.
• 52:53
  SPEAKER_00: Subscribe wherever you listen to podcasts so you never miss an episode.
• 52:57
  SPEAKER_00: Until next time.