Latest / Identity at the Center / #131 - NIST 800-63 with Archit Lohokare

Transcript

#131 - NIST 800-63 with Archit Lohokare · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity of the
0:27
center podcast, I'm Jeff. And that's Jim.
0:29
Hey, Jim hey, Jeff, how are you? Oh, not so bad yourself, good.
0:32
I'm I'm good. Most respects, it's just saw
0:35
that. My Netflix plan is increasing
0:38
price. It's only a dollar, fifty a
0:40
month. I'm in the u.s.
0:42
I think it's going up and other geographies as well, but feels
0:47
like these price increases keep happening and I guess I'm not a
0:50
huge fan of that you don't like prices going up.
0:53
That's weird. I don't I really don't and you
0:57
don't like got me thinking about it for this episode is when we
1:01
did our recent episode with Adam Michael, we talked about the
1:06
social dilemma. I was watching that this past
1:09
weekend. And again, I watched it the
1:12
first time and the only paying half attention, but because it's
1:15
going to be a really good topic for us to maybe get into one of
1:19
these days on, on the identity at the center live streaming.
1:24
That we do on YouTube every week.
1:26
Yeah, idac. Dot live.
1:28
That's our newest media Venture. I guess we want to call that
1:32
still kind of slowing into it. Working out some issues and
1:35
Kinks, and figuring out how it's supposed to work.
1:37
But it was kind of cool to kind of get out there and starting to
1:40
develop a live audience. And it gives us the opportunity
1:42
again, to kind of talk with people in, you know, real-time
1:46
get comments feedback. What we're talking about cetera.
1:49
I don't know if you want to necessarily tackle social media.
1:53
I feel like it's so polarizing. From a topic perspective.
1:57
Well I guess we'll see how that goes, but as far as price
2:00
increases I think it's US and Canada.
2:02
That is have a Netflix price increases and it just, you know,
2:05
I think now we're back to the days of, you know, everyone used
2:09
to hate cable bills and the bundling and all that stuff.
2:12
But now you've essentially, instead of having one big
2:14
bundle, you've got, like, seven or eight small, bundles that
2:17
equal the big bundle. So you've got Netflix, you got
2:20
Hulu, you've got, what else is out there?
2:24
Do you think Apple TV plus if you want to have like some local
2:30
channels and things like that? Yeah I mean it it is exactly
2:34
what you're saying is it adds up?
2:35
And I've been really on the fence about grabbing Paramount
2:38
plus. I mean they've got a lot of
2:40
decent content now, but even when you bundle all these pieces
2:43
together, you don't have everything you want.
2:46
And of course, most people want. I should say, most people, a lot
2:50
of people want the streaming Sports as well, and that's you.
2:54
She's the one that's hard to get as used in a dime and I'm an NFL
2:58
guy. So I like the red zone.
3:00
Of course, I had to pay an extra like I don't know what is that?
3:02
I have Hulu with live TV. That's what I use through like a
3:05
Disney bundle. So I get like Disney plus, and
3:07
Hulu and the live sports and now I'm paying probably more than I
3:11
was for cable TV and for for the privilege of being able to
3:14
stream it on my devices and you know also in my car you know
3:18
another plug for the Tesla can watch Hulu in the Tesla.
3:21
Well the thing is, I think in the end the day of like Okay,
3:25
Netflix is going up up. Buck 50 a month for me.
3:30
I'm still not going to cancel it.
3:33
Yeah, it's kind of got to the point where these services are
3:36
ingrained and everything is a la carte to some degree but if I
3:42
don't I think about all the subscriptions.
3:43
I have 12 different things. It's quite a and I certainly
3:47
don't feel like I get it full of damage out of all of them.
3:49
For sure, there's no way. I could watch that much content
3:53
to feel like I get my value. Right, exactly.
3:55
Well, I think it's interesting this week.
3:57
We've got a guest on who works for cyber-ark, but he's not a
4:02
privileged access management Guru.
4:04
So go figure, do you want to roll with the introduction?
4:09
Yeah. So our topic for today is missed
4:12
863. It's also known as the digital
4:15
identity guidelines. It's a publication put out by
4:19
the National Institutes. I forget what stands for
4:22
standards and something for the US.
4:25
But basically kind of the The Playbook that a lot of
4:27
organizations follow when it comes to security and digital
4:31
identity. Guidelines is exactly what it
4:33
sounds like. It's the guidelines for managing
4:35
digital identity and to help us with that conversation.
4:38
We've got our chat local karere. He's the vice president of
4:42
product management at cyber-ark. Welcome to the show argit.
4:45
Thank you. Jeff.
4:46
And Jim, thank you so much for having me today.
4:47
It's an absolute pleasure to be here and I'm a big fan of your
4:50
podcast. And I love the fact that you've
4:52
invited me over and I'm participating here as Well,
4:55
thank you so much for being part of it.
4:57
And you know as I say before flattery will get you everywhere
5:00
on this show but before we get too far into 863.
5:06
One of the things that we always like to explore with our new
5:08
guests that are appearing on the show is really kind of find out.
5:12
How did they get into the identity space or maybe the
5:14
information security space? You know what their I am?
5:16
Origin story is did you find that?
5:19
You know, identity was something that you chose or did it choose
5:22
you? You know that's a great
5:23
question. Jeff, to be honest.
5:25
I would have to answer that question by saying that I think
5:27
identity really chose me, but the story is really interesting,
5:30
think of this year, was somewhere around 2004.
5:34
And I was actually in my final year doing my bachelor's in
5:38
engineering and computer science at NTU and Singapore.
5:41
And one of the courses I had taken back then was this amazing
5:45
course called cryptography, cryptography and network
5:48
security. And that was my first real
5:50
introduction to really the the inner workings of, you know,
5:53
encryption decryption mean. No security as a whole and
5:57
coming out of that course. At the end of the first
5:59
semester, I knew what I wanted to do, I wanted to be in
6:02
security, but back then, in Singapore in 2004 know, there
6:06
weren't a lot of security startups or companies as such,
6:10
you know, who would hire a computer engineer straight out
6:13
of school, right? So, I went online and I started
6:16
started searching for all these amazing startups in the Bay
6:19
Area. And I chanced upon this amazing
6:21
startup called and sent to it, which had its engine.
6:25
Hearing based out of Singapore and accentuate.
6:28
Interestingly was one of the pioneers of the identity and
6:31
access space. It was in the space called
6:33
Enterprise single sign-on. It was all about how to use a
6:36
single secure identity in order to log into all your Enterprise
6:39
applications. And so here I was, you know,
6:42
like just about to finish my first semester of my fourth year
6:46
in, in computer science. And I had six months more to go.
6:50
I ended up applying to this company, get interviewed and at
6:53
the end of the interview, when, you know, The hiring manager a
6:56
lovely. By the way you want to make an
6:58
offer, you asked me? So, when can you join it?
6:59
Tell him I'm not graduating for another six months and that's
7:03
when he says, dude, what are you doing?
7:04
Interviewing right now. You know, why don't you get
7:06
closer to the end of the year? That's when we'll start, you
7:10
know, actually talking about you coming on board.
7:12
And that's how, you know after graduation Jeff and Jim and the
7:16
joining and century and that was my first foray into security and
7:20
specifically identity and access management.
7:23
You know, at accentuate our start off an engineer You know,
7:25
my first job was really working on think of it as writing
7:28
low-level device code. You know you're basically
7:31
implementing pkcs 11 in you're implementing smart card
7:34
technology. Amazing amazing experience.
7:37
I love doing that. But we were also growing quite a
7:40
bit back that Jeff and Kim and you know as a result of that
7:43
growth especially in the United States.
7:45
I actually moved over to to New York to kind of help Drive some
7:49
of our Professional Services and pre-sales practices out of the
7:53
out of the East Coast. And then fast forward, two years
7:56
later. In 2008, we got acquired into
7:58
IBM and that really, you know, set me on the whole identity and
8:01
access management Journey at IBM.
8:03
I eventually ended up managing the entire access management
8:06
product line, which included if you guys remember, you know, the
8:09
the Tivoli portfolio which is civilly, access manager, Tivoli
8:14
Federated identity manager, Enterprise single sign on its
8:17
own so forth and then go from there.
8:19
You know, I ended up at Symantec where I own semantics Cloud
8:23
information protecting portfolio, which Parts of cloud
8:26
data loss, prevention, Cloud, authentication technology, and
8:28
so on and so forth. So it's been a long journey, you
8:31
know, from from the startup days to semantic a decade later.
8:35
And then a few years ago, I ended up, you know, joining is
8:38
the chief product officer at I dapped live, which is basically
8:42
in the think of an identity as a service space leading the entire
8:45
product management strategy function and I dapped about a
8:48
year and a half ago, you know what acquired by cyber-ark, you
8:52
know the leader in identity security, right?
8:55
With privileged access management at its core.
8:57
And that's how I ended up in cyber-ark.
8:59
And one of my goals here in roles here German, Jeff is to
9:03
really drive the access portfolio at Cyber but also help
9:06
try be identity security strategy for cyber as a whole.
9:11
So again, you know long answer to your question but that's been
9:14
my history. My for a my experience in the
9:17
identity and access management word I'd say Jeff that was
9:20
another vote for identity shows me.
9:23
I mean it's got it. Nine out of ten of us.
9:28
Our identity shows me, right? If not if not more and Jeff, by
9:33
the way, you did a fantastic job of pronouncing arches.
9:37
Last name, I mean, I think you nailed it, so congratulations on
9:41
that. And then I will fill in the
9:43
blank on this this National Institute of Standards and
9:47
technology. So you never with the name and
9:51
that probably took took away from you, on that one.
9:54
Right? Yeah, plus one minus one.
9:56
So I'll things I'm even your even so aren't you wrote a Blog
10:02
article on the cyber-ark blog? About newest, 800-630-8900 of
10:09
described it. But we're kind of in a shorter
10:12
form here and I was wondering if you could just, you know,
10:15
succinctly kind of tell us, what is 800-630-8900?
10:21
Well, absolutely Jim. And by the way, Jeff, you didn't
10:23
the old, my name. Strictly, thank you for that
10:26
full points to you for that. So don't coming back to your
10:29
question. You know what are the problems?
10:31
We're really trying to address right now at the risk of
10:34
oversimplifying caishen. These guidelines really
10:36
addressed. Three key problems and these are
10:38
related to the concept of digital identity, right?
10:41
The first problem GM, it did really address is how do you
10:45
prove it? Digital identity belongs to a
10:48
verified real-world. Individual to a very high degree
10:52
of assurance, right? That's number one.
10:54
Then now that this identity is proven, the second problem is
10:59
really that of authentication. That is at the time of log, n.
11:02
How do you verify that this user will me, for example, accessing
11:06
the service is indeed who the user or me?
11:09
Who I am claiming to be essential, right?
11:12
And this is done. We are a bunch of proof of
11:13
possession of authentication factors and a whole bunch of
11:16
other ideas and Concepts that are in the nist standard.
11:19
And then Jim, the third problem really here is related to kind
11:24
of related to the Can problem, but adds an additional Dimension
11:27
where the authentication is really done by a third party
11:30
identity. Provider, you know, and the
11:32
Technologies and the concept behind the scenes, the called
11:34
Federation. And the third problem is really
11:37
related to something called Federated identity Assurance or
11:40
Federated authentication Assurance or FAL.
11:44
So these are the three problems. Very broadly Jim that they
11:46
really seek to solve through these standards.
11:48
I've run into the level of assurance problem and this
11:53
framework in the past. Has been around for quite a
11:55
while and it's very popular in the higher ed entry.
12:00
So a lot of universities are thinking about the level of
12:05
assurance required based on the level of affiliation a person
12:11
has with the university. So you could imagine somebody
12:14
who is a Community member who needs access to library.
12:18
That's a very low level of assurance.
12:20
Somebody who's the student in needs access to certain
12:23
applications, Or even a staff member would be a kind of that
12:27
medium level of assurance of that.
12:29
You need to know who they are. For sure.
12:31
You have to have some level of assures but not the same as that
12:35
third level where you know, somebody's the administrator for
12:39
the Mainframe and write they can change grades or change pills
12:44
and things like that. And so it got me thinking higher
12:47
ed is one industry that really seems to care about level of
12:51
assurance. But are there other Industries
12:54
and Is this something that applies more to some Industries
12:57
than others? And where's your where is that?
12:59
Use case really popular? Yeah, so you know in general I
13:02
mean these use cases are more or less popular and applicable to
13:06
pretty much all Industries today, right?
13:07
We all know today, the challenges associated with
13:10
authentication you and I keep hearing about ransomware attacks
13:14
all the time that are happening, right?
13:16
But specifically Jim if I have to really say right these and
13:20
these standards are such and I'm talking about 863 a, which is
13:24
The enrollment and identity proofing, standards and 63 be,
13:28
which are the authentication Assurance standards.
13:30
They're largely applicable and extremely used in highly
13:34
regulated Industries, right? And when we talk about highly
13:36
regulated Industries, Jim, we're talking about, obviously banking
13:39
financial services and insurance.
13:42
And, you know, in BFS I as we call it, right there are new
13:45
standards. Relays related to, you know, PCI
13:48
DSS right there are new standards related to PSD to and
13:52
strong customer authentication then Like mandates that these
13:57
highly regulated Industries have and they actually require you
14:00
and the user to have a high degree of assurance.
14:03
And when I say that you're talking about bringing in two
14:05
factors of authentication, one of them being cryptographically
14:09
strong, which gives the level 3 level of assurance, right?
14:12
Jim, the other Industries examples would be health care
14:15
where you have these clinicians may give doctors nurses, who
14:18
would accessing very sensitive patient health information,
14:22
right? And you want to make sure that
14:24
the Person who's accessing these disinformation.
14:27
This critical information is who the person claims to be.
14:30
So again, when you on board these users into the system's,
14:34
that's the enrollment guidelines you're talking about, and then
14:37
when you actually have them authenticate and access that
14:40
data in real-time, that's the authentication Assurance level
14:44
Jeff, you're talking about, that's another, you know, area
14:46
and the market as such vertical where you see a lot of this,
14:50
right? And then you have manufacturing,
14:52
you have oil and gas with a lot of sensitive.
14:54
Devices that have broad impact, and they're also highly
14:58
regulated where you start to see some of these standards being
15:02
applied, quite intensively and quite religiously from a call it
15:05
that these really interesting, how you broke those two things
15:09
apart, because I think that's the essence of the sender,
15:12
right? It's one.
15:15
What is the process to proof the identity that the person really
15:20
exists that they are who they say they are all really.
15:24
Then The authentication. So at the time that they're
15:27
accessing some resource that they can prove that they are
15:31
that person who is proved. I guess I'm just so intrigued by
15:36
this identity proofing area, especially now that we're moving
15:41
more and more toward a remote virtual world.
15:45
I think we're already moving there, but the pain debacle.
15:47
He sped things up. Think of the University context
15:50
where students are taking classes of remotely.
15:53
Maybe in the past such a show up on campus.
15:57
I think that's becoming more and more difficult and there are
16:02
some use cases where frankly, there's no need to ever show up
16:06
in person. You have these documentation
16:09
type capabilities where I can use my phone to take a picture
16:14
of my ID and then do a selfie of myself.
16:18
And there's some kind of correlation that artificial
16:23
intelligence is doing behind the scenes.
16:24
It's just, I think this is a real fascinating area.
16:29
Are you seeing the same thing? I mean, it seems like it's
16:31
gaining popularity. Totally Jam.
16:34
You know, interestingly be all literally live in a post covered
16:38
world, right? I haven't actually seen the
16:41
inside of an office. I could you not for, like, a
16:43
year and a half? Well, maybe even the one time I
16:45
was in Israel, visiting the cyber-ark offices there.
16:48
But, you know, in this world trying to onboard and employee,
16:53
imagine someone joining Our company at this point in time,
16:56
they do, there is very less likelihood of did this.
16:59
Individual actually visiting the office giving the, you know,
17:03
your security teams there or your it teams there, a copy of
17:07
their drivers license in person, interacting that.
17:10
And then finally getting an employment or an employee badge
17:15
to get into the office. Those Concepts have all gone
17:18
away, right? Well, not gone away but they're
17:20
going right. And what has come as a result of
17:24
this is this Except of, how do you remotely start proofing
17:28
users today, right? Whether they are joining
17:31
companies, whether they are acting as vendors to other
17:33
third-party, companies are such right?
17:37
So, you know, in this day and age, when offices themselves are
17:40
shut down, these practices that we are starting to see also
17:44
moving online. So, similarly, you mention a
17:46
little bit about students but in banking, you know, you know, the
17:50
concept of kyc or know your customers, where, you know, if
17:52
you want to create an account In the past, I had to go to a
17:56
branch submit my driver's license may be other proof of
17:59
address and things like that in order to actually prove my
18:02
identity and then get an account none of that, you know, today
18:06
really, I mean lot of that exists but a lot of that has no
18:09
longer applicable at methods and capabilities that technology is
18:13
provided, it allows to get around that.
18:14
As an example, you know, these days when you're signing up for
18:19
some banking account, some Financial accounts, you know,
18:21
these are systems. They use information about They
18:25
use information about what your previous address has been what
18:27
your current address is. They look at device reputation
18:30
of devices that you're coming in from, right.
18:33
They ask you to upload a digital copy of your driver's license
18:37
and then do liveness checks to make sure that your face
18:40
actually is the same face in the driver's license.
18:43
So technology has evolved to a point where some of this
18:47
proofing can be done remotely even today, right?
18:50
And again this is very much aligned with nist 863.
18:53
A Identity Assurance levels, IL 1 and 2 where one is, you know,
18:59
there's no real, you can say verification, but to is where
19:02
you're doing verification according to certain standards.
19:05
Right? So that all today is
19:07
increasingly moving online. So that's the way I would
19:10
actually look at this. The third thing really here.
19:13
Jim is the data Centric methods that we talked about right?
19:16
And data-centric methods which include data from public
19:18
records, from trusted entities, you know, credit bureaus, your
19:21
credit score and information associated with that all of That
19:25
also is being used similarly or mobile phone information, that
19:28
IMEI numbers Mac addresses. So all of that data, really
19:32
applies to this whole concept of identity proofing.
19:35
And we're starting to see new technologies come to the
19:38
Forefront of users using some of this information as well.
19:41
Does it help them? Yeah, it seems to me that really
19:45
what we're talking about here is a framework for mapping the
19:51
level of assurance or kind of the barriers to entry.
19:54
Tree and the risk involved with the resources or the process
19:59
that you're doing right, you wouldn't want to run people
20:03
through that identity proofing or verification process, where
20:08
they do the ID and selfie to open up for free email address,
20:12
right? That's the user experiences.
20:14
It's difficult enough and people would just give up on it.
20:18
So I really think it's about, you know, for organizations that
20:22
are more framework based A more formal in how they approach
20:27
these problems. I think that's what it's all
20:29
about. Would you agree?
20:31
So it does, it does absolutely solve that problem, right?
20:33
And, and proofing is one part of it, right?
20:35
The other part of it is you mentioned access to sensitive
20:38
resources and things like that. The second part of the standard
20:41
which is 63 B, which is the authentication Assurance level.
20:44
That's where the second part of, it comes into the picture.
20:46
We're at the time of access your again, using proof of possession
20:52
authentication factors, but you're also starting to Use
20:55
things like your document, you know, documentation like your no
20:59
driver's license and things like that in order to get into
21:02
system. So I would definitely agree with
21:03
that chick. You know, all this talk with
21:06
assurance and authentication and different levels.
21:09
It kind of brings to mind Carta, which is Gartner's, continuous
21:12
adaptive risk, and Trust assessment.
21:14
I got that one, right. So and I'm wondering, you know,
21:18
I think there's been some overlap there and I think, I
21:21
think 863 sometimes gets some mentions with Carta.
21:25
Are there any ties that that you want to call specifically pin
21:28
card o or is that, you know, hyperbole or maybe marketing
21:31
speak when someone says? Okay?
21:32
Well, you know, if these two things are out there which are
21:35
both, you know, crafted versions 163 being in the standard and
21:40
Carter being an approach for a dunny security.
21:43
That's what Society option. Jeff, you know, and I would say
21:46
they are very much aligned together their diet very much
21:48
together, right? And you rightly said that God
21:50
our continues adoptive risking threat processes, man, it's
21:53
related to A philosophy related to methodology of how do you
21:58
secure systems and individuals right in this does more
22:01
prescriptive in, this is more static.
22:03
It gives you definitely have levels level 1 level 2 level 3,
22:07
for all these standards Carter tells you at the end of the day
22:10
that you have to continuously assess the risk of an individual
22:17
accessing a certain resource and that risk itself can follow
22:21
heartbeat pattern, it can go up, you can go down, but you
22:25
Continuously need to assess the risk and then react to it before
22:29
you authenticate the user into the system.
22:31
So imagine a scenario where, you know, you're trying to access
22:34
sensitive application. That's one of the things that we
22:37
have a product called secure web session at the released
22:39
recently, what it does is it basically continuously analyzes
22:42
what is going on inside of an application that the user is
22:46
doing. And when the risk goes up as an
22:49
example, then we can leverage authentication, strong
22:52
authentication, factors aligned with that.
22:55
Misty 863 be standard that we were talking about to make sure
22:59
that I am proving myself to be the person I'm claiming to be,
23:03
right? So really if you look at Carta
23:04
the concept which is all about continuously, assisting and and
23:07
reducing and mitigating risk is actually tied and integrated
23:11
very closely. With the concept of Nest 863, be
23:14
their authentication factors are used to high level of assurance
23:18
in order for the user credit and it's an important point to
23:21
raise. I think what we're talking about
23:22
now are really kind of the Assurance levels within 800 63
23:25
and how dynamic they can be, right?
23:28
You kind of called out the example of activity within an
23:31
app which could be potentially a raising or lowering the level of
23:36
assurance that is needed to perform a transaction of some
23:39
sort, right? Whether it's an equation, or
23:41
whatever, it might be, you know, I think this is an area that,
23:45
you know, cart has a philosophy, right?
23:47
It's basis thing a, you know, do your decisions on based on risk
23:53
and what Is true. This second might not be true
23:58
the next second so it puts companies into this weird bind
24:02
of having to try to figure out. Okay, well how do I manage all
24:04
these different variables about a user and how do I dynamically
24:08
scale authentication or even authorizations up or down based
24:12
on whatever is happening in the moment, right?
24:16
Maybe I'm connected via VPN and then the next second my V10 goes
24:19
down and I'm not connected anymore or maybe I changed
24:22
devices or all of a You know, it's a totally different
24:26
Geographic. Yeah, geography from from IP
24:28
address perspective. Great, all these pieces of data
24:30
kind of fit into that, and I think that's what's so
24:32
interesting around 863. This conversation pacifically
24:36
is, people shouldn't treat it as a static level of
24:40
authentication. There are various levels based
24:44
on what you're doing. You need to be able to identify
24:47
which level of assurance you need to be at to conduct that
24:50
transaction and I guess from your perspective am I thinking
24:53
about it? Correctly is there.
24:55
That I'm missing from that, that that you think needs to be
24:57
brought out as well. Well, Jeff, I think you're
24:59
thinking about it perfectly. I think the point you mentioned
25:01
about for each attend occasionally, even
25:03
authorization, how do you dynamically gauge the risk of
25:07
the user in that context, accessing that resource?
25:11
And then tied back to those missed levels of assurance,
25:14
right? That's actually key.
25:15
For example, if you're doing a very high value transaction,
25:18
highly sensitive transaction, you might actually Define a
25:22
policy that the user needs to, or Attend ticket to a level
25:27
three which basically, is two distinct factors of
25:29
authentication, know something. You know, something you have
25:31
something, you are three of them, right?
25:33
So, any two of them, but the second one has to be a
25:36
cryptographic method. So, you're talking about
25:39
leveraging things like a smart card or a security key, like,
25:42
yubikey, Etc. In order to prove yourself to a
25:45
high level of assurance and that again to your point, tying it,
25:49
back to the transaction and the sensitivity of what you're
25:52
trying to do. You know, in the privileged
25:54
access World by Most of our users and to be highly
25:57
privileged users, right? And one of the key things that
26:01
we talk about, when you talk about privileged users, access
26:04
is actually augmenting and ensuring your leveraging, strong
26:08
multi-factor authentication with privileged users, especially
26:12
when they're trying to access and perform these sensitive
26:14
actions. So Jeff, again, you know, you
26:16
hit the nail, you'll spot on you have to tie that concept of
26:20
continuous risk to the concept of multi-factor authentication.
26:24
According to the Miss guidelines.
26:25
So, we got this philosophy of Carter, we've got this, you
26:28
know, little more prescriptive approach or at least a standard
26:31
or a guideline through 863. Now, how about zero trust?
26:35
Where does this that fit into? Because I've heard it described
26:37
multiple ways. And again, zero trust is another
26:40
philosophy. It's not a product.
26:41
It's it's an approach to its education.
26:44
I don't remember who it was that.
26:46
I heard it from before, but the way they were describing, it was
26:48
they felt like zero, trust was a subcomponent of Carta to some
26:52
degree and I'm curious. What do you see?
26:54
Kind of interaction between 863 Carta and zero trust.
26:59
That's a great question if you know and then you know when you
27:01
talk about zero, trust again, zero trust also is is a
27:04
philosophy. It's a concept that you know,
27:07
today we definitely need to keep my mind off right as we're
27:10
implementing Security in our organizations at the Crux of it.
27:13
Jeff mean zero trust, as we all know, right.
27:15
Is, at the end of the day, you have to make sure you're
27:18
continuously, assessing, the users risk, and then not
27:22
necessary, trusting the user at every transaction.
27:23
Every transaction, Action that happens that user or the
27:27
identity proves, who the identity is, you know, the
27:30
channels between communication or encrypted is a central policy
27:33
engine and you can look at in this Frame Works by the way, 40
27:35
trust as well. Amazing amazing document there
27:38
for us to get some inspiration from.
27:39
Right to me, zero trust and Carta work hand-in-hand.
27:44
They're very similar in concept, you know, the ideas that are
27:48
propounded that are talked about in both of these concepts are
27:51
very similar at the end of the day.
27:53
It's all about not trusting. Every single action the user is
27:56
doing and continuously helping build that level of trust as the
28:00
user identities, performing actions.
28:02
And then this, if you have to tie this into all of these
28:06
missed, really at the end of the day, provides guidelines for
28:08
enrollment and proofing provides guidelines authentication and
28:12
for Federation and these are three key steps and processes in
28:16
every single aspect of zero trust and Carter that you talked
28:19
about, right? The very beginning, an identity,
28:22
which is the subject of you know, many men here You try to
28:25
access any resource that identity has needs to have
28:29
certain security guidelines and this provides that, which are
28:32
then used in conjunction with zero trust and with Carter.
28:35
So now we're talking about sonication, it leads me to
28:38
everyone's favorite topic, which is passwords.
28:40
I know Jim is a really big fan of them.
28:42
I don't really like them very much.
28:44
I think it's time for them to go away but now we're starting
28:47
into. Okay, well, password is
28:48
something, you know, right. It's one of those combinations
28:51
of factors. I guess.
28:52
Where do you, where do you see? Password Willis as part of the
28:57
163 or, you know, digital identity guideline path, right
29:02
is, is it realistic to go down to path and say, okay, we
29:06
definitely want to get rid of passwords.
29:08
We've got the technology there now.
29:10
It's really just, you know, budgets and force of will to
29:13
make changes within an organization to make it happen.
29:16
The real world are there things that we need to be considering
29:19
from a password list approach. And I mean and I mean, truly
29:22
password list not password, Dash last Where there is still a
29:26
password somewhere somewhere behind the scenes.
29:28
At someone maybe has to type in every month or whatever it might
29:31
be. I guess, you know, what are some
29:33
of the challenges that you kind of think that might be
29:36
approached or encountered, as someone think about that Journey
29:39
because I do think that we are setting getting closer to
29:42
finally clean the password. Even though I think we've been
29:44
hearing it for at least ten plus years so far.
29:47
Yeah, yeah. Jeff.
29:48
One of the things you mentioned, the word that really caught my
29:51
eye and you know, it's part on which is Journey, right?
29:55
Bass wordless at the end of the day is not a destination.
29:58
You can reach over night, it's a journey for many organizations.
30:02
Now, when you talk about nest and you talk about password
30:04
less, at the end of the day Nest is defining guidelines for you.
30:08
In terms of the three factors of authentication that you can use
30:11
right. Now many of the authentication
30:13
factors today that we see are actually password.
30:16
Let's let's take an example, you know the Fido to standard if
30:19
you're familiar with that, that basically has a number of
30:22
password is authenticators that can be used as Part of the Mist
30:26
specification. You be Keys you because you know
30:28
which allow you to get into systems using the spider to
30:31
standard by say for example touching or touching the key or
30:35
just you know using a fingerprint.
30:37
That's another example of a password is Factor yet.
30:40
Another example is what we're doing inside of our layer, or
30:43
vendor Pam technology, which is this whole concept of using QR
30:46
codes, along with Biometrics using two factors of
30:50
authentication. Both of them password list
30:52
simultaneously in a step in order to get the system user
30:57
into the system securely. That's another example of
30:59
password. Let's write and all of these,
31:02
they are very very aligned with this concept of the nist
31:05
guidelines that were talking about now you know.
31:08
So when you talk about password less when you talk about
31:10
Biometrics, you know there's a lot of new technologies or new
31:14
ideas that are coming up, right? You're talking about, you know,
31:17
biometric password as authentication with Linus
31:19
checks. To make sure that I'm actually
31:21
real person is so deep freeze and things like that.
31:23
There's a lot of interesting. Malaysian happening there, that
31:27
can be leveraged in Paso Robles as organizations grow through
31:30
their journey of being password has, does it help Jeff?
31:34
Yeah, I think so. And I guess what I'm trying to
31:36
do is kind of put the Cecil mind at ease, that password lists
31:39
degrades security or the ability to meet security concerns
31:45
compliance requirements, things like that.
31:47
I think at the end of day, anything that makes it easier
31:50
for the user to login and still meets those levels of assurance
31:54
that need to be I met from an authentication.
31:56
Standpoint is still a win. I guess that's how I'm thinking
31:59
about it. Don't Lie by the way and you
32:00
know, there's an important thing that the circulating around
32:03
these days right hackers. Don't hack in.
32:06
They just login, I think if you're a seasonal, believe me.
32:10
Passwords are probably one of if not the biggest vulnerability
32:14
your organization has today, right?
32:16
So if you're a seasoned, you're thinking of actually improving
32:18
your security, you should actually look at some of these
32:21
password less authenticators, authentication factors that are
32:24
also being About from this standard, right?
32:27
You know, the QR code example. I gave you, you know, that QR
32:30
code actually is assigned to it. You can actually go ahead and
32:34
enroll a mobile phone into this whole qr-code ecosystem.
32:38
And then the mobile phone gets a certificate.
32:40
A pki certificate that gets dropped on your mobile phone
32:44
with your device, serenity, with your user identity.
32:46
And when you're actually using the QR code to login, to a
32:49
system, if actually verifying that pki that cryptographic
32:54
standards, Nerd. The certificate that comes with
32:57
the, you know, the the mobile app itself and it's also
33:00
verifying that you're actually standing in front of that
33:04
particular computer of the particular resource and doing a
33:06
lightness check right in front of you.
33:08
Imagine the levels of security you get by using some of these
33:12
authentication factors, right? These are far higher than what
33:15
you would get by you just using a simple password, or even using
33:18
a password in combination with a non cryptographic standard, even
33:22
if you are authentication, Assurance level to write.
33:24
So, I would say as a seasonal you should be thinking about
33:27
password this password as should be front and center in your
33:30
security strategy, in your, I am strategy and I was thinking here
33:34
is we're talking to, I think there's a lot of scenarios where
33:37
being able to validate identity is really a challenge for some
33:41
organizations. I think one that I commonly, see
33:42
and Jim were probably Echo this as well.
33:44
Is someone calling into a help desk and asking for a password
33:47
to reset, you know, less mature organizations are probably not
33:52
using strong enough methods to Prevent social engineering, they
33:56
might be doing things like well, tell me who your manager is or
33:59
man, I hope they're not doing this today, but, you know, give
34:02
me the last four of your SSN, your social security number,
34:04
right. Things like that really pieces
34:07
of information that are easy to socially engineer because the
34:11
opposite to that is what challenge based questions,
34:14
right? Where you someone has to go in
34:15
instead of submit a profile and answer things, you know, are you
34:19
using the right questions? Did they use the same answer for
34:22
something else, right? Social engineering, right, all
34:24
that good stuff. Up comes out of it.
34:25
And I think of this as potentially a scenario where,
34:29
you know, if someone's calling into a service desk, they might
34:31
be able to take advantage of some of these guidelines around,
34:34
you know, technology to validate the collar.
34:37
And it could even be a step that takes place before they even
34:39
talk to a live agent. And, you know, might be a, you
34:41
know, there might be a phone queue that is, you know,
34:44
validated callers versus callers who have not validated yet and
34:48
you have, you know, EZ Pass and hard pass.
34:50
That people might be able to follow.
34:52
I think this does solve a real-world problem that is out
34:54
there. You know, how easy it is to kind
34:57
of implement and get in place for a business process.
34:59
Changes is always the question, but I feel like there's, there's
35:02
an answer here and there are questions.
35:04
How do we, how do we match them up?
35:07
Yeah, those are great points, Chef.
35:09
I do want to point out though, for anybody who maybe didn't
35:12
realize you're being sarcastic, I am not a fan with the
35:15
passports. Let's make that absolutely
35:19
crystal clear. I am all for the passwords going
35:24
away. I'm not And your Valentine card
35:26
from passwords and we'll see how that goes.
35:30
I heart passwords the arch of one thing that you brought up
35:33
several times the yubikey and this is what I ultimately wanted
35:37
to get to. So we talked about I think
35:40
you're talking about privilege a privilege users who now need to
35:45
authenticate, right? So this is the very top of the
35:48
chart in terms of level of assurance required.
35:52
And so, my question to you, You is what is the access management
36:00
standard that we should strive for to be at that?
36:04
Highest level of a shorts? Is that the yubikey?
36:07
Is it something like yubikey plus one of the other factors?
36:13
Because I think in the past were you know, I had a lot of Hope
36:16
for push authentication when it came out.
36:18
I thought this is great. You know, there's no way for a
36:21
hacker to sit there in the middle and some How except that?
36:27
That push notification, that comes up on your mobile phone.
36:30
But as recently as a couple weeks ago, we've read about a
36:34
story that came out. That hackers new methodology is
36:37
they just keep logging in with the password and people
36:42
ultimately get annoyed by it and they just accept that.
36:45
So I think that tells me that push notifications does not the
36:50
top of the chart for the level of assurance for authentication.
36:53
So it is Is you bikini? That's a, that's a very
36:57
insightful problem that, by the way you mentioned, where, you
36:59
know, people are hitting on the push notifications, just out of
37:03
frustration because it getting so many of them, right.
37:05
Don't even realize that they're actually letting potentially a
37:08
hacker. Get in the answer, your
37:10
question. Jim.
37:11
I know. So you be keys are a very strong
37:13
form of authentication. They are actually, you know,
37:15
like you rightly said, they help you get to level of assurance.
37:18
Three, once you actually combine that with, with another factor
37:21
of authentication, right? But with many Hardware keys.
37:24
With many devices. Like these that you carry, that
37:26
you need to plug into your computer.
37:28
There's always that challenge around manageability of that,
37:30
right? Click.
37:31
I have the 3ub keys with me and in the last, maybe a year, or so
37:35
I've probably lost like four of them.
37:37
Right? So having a framework around,
37:39
really managing them, revoking them.
37:42
We are showing them sending them over in this remote working
37:47
environment. These are all challenges
37:48
associated with the yubikey, right?
37:50
I think there's always a balance and the way I would look at
37:53
solving this problem, Is really looking at a combination of
37:56
things that we ubiquitously own today.
37:59
Things like mobile phones, things like, Biometrics things,
38:02
like, you know, QR codes that are easy to manage.
38:05
At the same time, they're extremely strong forms of
38:09
authentication if you're doing them or leveraging them rightly,
38:12
right? So I think there are various
38:14
combinations of different levels of authentication.
38:16
You can get by using these Technologies.
38:18
They're also extremely manageable and not losing them
38:21
by the way, Jim makes it Here from a security standpoint as
38:26
well. If you keep losing, you be keys
38:28
to get picked up by someone else.
38:30
There's always those challenges there, right?
38:32
So, I think using some of these Technologies like Biometrics
38:34
using QR codes, even leveraging standards, like Fido to.
38:39
I think tend to go a long way in securing this whole
38:42
infrastructure that an organization may have.
38:44
Yeah, one other potential control we would have is I know
38:48
a lot of access management tools are now.
38:54
Having the ability to use artificial intelligence and user
38:58
Behavior. Using the context of the user
39:01
is, in the time of day, that they're authenticating to kind
39:05
of build that risk profile. And then adjust accordingly,
39:09
obviously, I asked you about the most risky login, but you may
39:13
have a scenario where, hey, somebody's trying to login with
39:17
an impossible login scenario, or from some blacklisted
39:23
geographies where They want to log into the Mainframe as an
39:27
administrator. You're just not going to allow
39:30
it in the first place. So, I mean, do you also see this
39:33
rise in user behavior and artificial intelligence has a
39:38
way to kind of meet this higher level of insurance, don't lie?
39:42
Jim, totally no, I mean user Behavior analytics.
39:44
And leveraging Technologies like machine learning right?
39:47
When you have loss amounts of data on users that behavior and
39:51
using this technology to come up with user Behavior profile.
39:54
Files. And then using these profiles to
39:56
create Baseline risk scenarios for each user.
40:00
I think it's very key, right? Some of the things we do, for
40:02
example, right is I talked about Biometrics a little bit earlier
40:06
on, but Biometrics also has its own challenges, but when you
40:08
combine some of those strong authentication factors with the
40:12
concepts of users, you know, Network the location.
40:17
The device that the user is coming from the IP address that
40:20
the user is coming from the time of the day, at which these users
40:24
typically Leverage, or access certain systems when you take
40:28
all this data and you actually use a machine learning
40:30
algorithms, you know, clustering and things like that, what you
40:34
are able to generate at the end of the day, is a very strong
40:37
augmentation to the nist, standard, Scott education,
40:40
standards. So you're able to do what we
40:42
call as conditioner adaptive access, right?
40:45
Meaning that you actually the system when you're trying to log
40:49
into an application or log into a system, it is continuously
40:52
again, evaluating your risk. Averaging not just obviously
40:56
what you login with your authentication factors but also
40:59
your environmental attributes. What are you trying to do?
41:03
And then based on that, it actually goes ahead and
41:06
authenticate you into the system or lets you access certain
41:10
sensitive resources. So really leveraging all this,
41:13
this concept of user Behavior, analytics, machine learning,
41:16
artificial intelligence and augmenting.
41:18
The tradition authentication methods with, that goes a long
41:22
way in securing and guess what? By the way, Jim this also Oh
41:25
aligns, very beautifully with this concept of zero trust in
41:27
Carter that we talked about earlier, right?
41:29
So it's all interconnected it. All comes together.
41:31
It flows together. It is marrying itself is its
41:35
married together as well, in many ways, right?
41:37
If I may call it that. Yeah, no, it's very gone.
41:40
And I think what's so fun about this conversation is that
41:45
there's that whole aspect of the security but also balancing that
41:50
with the user experience. That's the reason why we don't
41:54
go for maximum. More Security in every use case.
41:57
We don't go for maximal identity proofing, and every use case.
42:02
And then kind of touching on that user experience is tapping
42:06
into human psychology, right? And making it so that users
42:12
actually don't mind the experience, right?
42:14
But tapping into knowing how people work, right?
42:17
That's one of the reasons why pastors are such terrible idea,
42:20
is that the human psychology is? I'm going to make this easy.
42:24
Easier for myself. One thing that we talked about
42:28
offline was the idea of using gamification in.
42:32
I am and I've always loved this idea, right?
42:34
How to incentivize people to do things in a more secure way.
42:39
And so if we talked about authentication potential for
42:44
using gamification to get people to kind of raise their Assurance
42:49
score, and you had some thoughts on that.
42:51
So I'd like to ask you to talk about that.
42:55
But definitely Jamie know I'm a huge huge fan of the concept of
42:58
gamification. You know I'm already quite a bit
43:01
and you know you have these Karma points that you get but
43:04
you know, I would classify myself more as a lurker so I
43:06
don't have much too many of these Karma's are Karma points
43:10
as such right, but gamification and applying gamification to
43:14
authentication in users. I think is extremely important
43:17
right now. We all know that users today,
43:21
look at multi-factor authentication as a hindrance in
43:24
some ways. Right?
43:25
They consider it as a deterrent. It adds friction to the process
43:29
with education but now imagine a scenario where you're basically
43:32
going ahead and you really making sure that these users get
43:37
points, if they go ahead and authenticate with higher form of
43:40
authentication. So imagine, you know mr.
43:43
Joe who's actually logging in to is systems on a daily basis, the
43:48
higher the level of authentication.
43:50
He logs in, with the more points, he or she collects as a
43:53
result of that. And then imagine having the
43:56
system that shows your leader board of the most secure people
43:59
who are logging in with the highest Assurance factors with
44:02
highest Assurance levels. Imagine having the leaderboard
44:05
like that inside the organization, that's what we
44:07
mean by gamification. Right gamify the concept of
44:10
authentication, give users Kudos give users encouragement so they
44:15
can actually go ahead and become, you know, the
44:18
superstars, you know, the Mbps of authentication the
44:21
organization and conversely by the way.
44:24
Imagine if If there are certain all individuals who have the
44:26
ability to login with low forms of authentication, use passwords
44:29
all the time. If you can actually educate them
44:32
through this, again, gamification concept on why they
44:35
should be using, you know, additional forms of
44:37
authentication. Adding those are Concepts that
44:39
can go a long way in an Enterprise.
44:41
And interestingly Jim, this one of the things we are working
44:44
internally inside of cyber ask is well, how do we encourage our
44:47
customers in their users to go ahead and you know, in a
44:52
gamification manner, learn how to use Actually and then
44:55
consistently use MFA on a daily basis.
44:58
That's great. I think the takeaway is that
45:00
gamification could potentially be applied to a lot of areas of
45:06
identity and access management. I mean even if you thought about
45:09
privileged access management I found that one of the risks to
45:14
privileged access management deployment is if the end users
45:18
don't buy in so maybe leveraging some kind of gamification to be
45:23
a mess. Method to tap into human
45:26
psychology. But one of the areas that I've
45:28
really felt it would be applicable is identity and
45:32
access governance, identity, Administration and governance.
45:34
So around doing access reviews on time, you know, doing your
45:41
approvals, on time, I mean that, you know, tapping into the end
45:44
manager so that they know that hey there, good stewards of
45:48
security within the organization, totally Germany.
45:50
But when you're talking about access governance and you're
45:52
talking about access certification, can't be that
45:54
thing. The single biggest problem is
45:56
just being overwhelmed by the number of times you need to
46:00
certify access for your employees or your team, right?
46:02
And again, going back to your point, applying gamification to
46:05
these Concepts can really go a long way.
46:07
It actually, again, engenders that encouragement it.
46:11
If it helps them as users, really adopt these practices and
46:15
then become the single biggest promoters of these practices,
46:19
right? So, I think again, tapping into
46:20
the human psychology, making this whole concept of giving
46:24
people. Apple points having
46:25
leaderboards. I think is extremely key for us
46:27
to drive security insulting to the organization.
46:30
I don't know. I mean, it sounds like a pretty
46:31
crappy game are off. I don't want to thank you that,
46:35
you know, I'm gonna put those call out there because I do like
46:37
the idea of gamification and really kind of in scenting the
46:41
user population to take advantage of the tools are out
46:43
there. And so, here's my call.
46:45
If you're doing this in the real world, somewhere, in some level,
46:49
please reach out to us on LinkedIn either gym or myself or
46:51
both of us. We would love to have a
46:53
conversation about it and Kind of learn more about how this
46:56
actually works in the real world.
46:58
You know Microsoft is in the process of acquiring Activision
47:02
Blizzard of World of Warcraft and Diablo Fame as well as other
47:07
things. Maybe that's Microsoft's veiled
47:10
approach to gamify some of their services it's probably just the
47:15
play for Xbox or game Game Pass of which I am a user member but
47:21
I will throw that out there that the maybe maybe there's sneakily
47:23
trying to come up with a Be cool.
47:25
You know, Call of Duty? I don't know.
47:28
I am version of the game for people to follow through with
47:31
well Jeff, before you say that, that's a crappy game.
47:35
Whoever thought flinging Angry Birds across the screen would be
47:39
a great game, but boy that got popular and it even made a movie
47:44
out of it. I don't know how you make a
47:46
movie out of that but, hey, yeah.
47:49
There there is something out there for everybody and that's
47:51
why the world is great. Okay, I think we've seen Cecily
47:55
derailed, the train slightly there, and that's my fault.
47:58
So why don't we go ahead and start to wrap things up?
48:00
Because I know our chat, you're very busy guy and you've been
48:03
very generous with your time. One of the things that we like
48:05
to do around here is sort of lighten the mood a little bit
48:08
and what we like to come up with this sort of a lighter note,
48:11
question something that is a little bit out of the blue could
48:14
be based on Hobbies. Is we kind of get to know each
48:17
other as I've had conversations or maybe in just something.
48:20
Totally not even related but just weird question to ask.
48:23
I think if you listen to Some of our recent episodes, still, one
48:26
of my favorites is, you know, if you were a potato, how would you
48:29
like to be prepared? And there were different answers
48:32
to that one based on all of us. But let's, let's go with this
48:36
one. If you could live anywhere in
48:38
the world for a year, where would it be Arch?
48:41
It will start with you and then we'll go over to Jim, you know,
48:45
Jeff actually let me let me tell you a story and then I'll you
48:49
know, at the end of it I'll tell you why, that place is what it
48:52
is, right? That's the place I want to live
48:53
in. So this is Around 2008 or end of
48:58
2008 or so, right. And at that point in time, my
49:01
company had just gotten acquired by IBM in the skin accentuate,
49:04
the startup. Right.
49:05
And I was in sales, engineering back there and the only person
49:11
who was kind of single in the team was me.
49:13
So I was the only person who could actually fly all over the
49:15
world at a drop of hat and then address sales calls and work
49:20
with customers and so on and so forth.
49:22
So this is about two months into the Ocean, you know, the global
49:26
head of our sales Consulting calls us.
49:28
This is here. Just I need you to be in in
49:31
so-and-so City and I'm not going to tell you the city just yet.
49:35
I want you to be in so-and-so City on Monday and I pulled this
49:38
on Friday, right? So I quickly go into our online
49:41
system. I booked a ticket to this
49:42
destination Sunday night, taking a, I was back in New York, in
49:47
Manhattan back, then a red eye and the next morning on Monday
49:51
morning. I land and I haven't slept the
49:53
whole day on, They are Sunday night because I was excited, new
49:56
city, fun city. I work through the day, go to a
50:00
customer side, you know, do a few demos, beautiful
50:03
presentations. We have a lot of fun and then
50:05
are ahead of sales Consulting in the local region tells me here.
50:08
Archerd. Why don't you go home sleep for
50:10
2 more hours and we'll meet up at 9:00 for dinner?
50:13
Right here. I was, you know, leaving the
50:15
United States 9:00 dinner that doesn't compute, you know.
50:18
I might dinner usually ends at like, 6:30, 7:00.
50:22
So anyway, I go back to my hotel room.
50:23
I, you know, Come back and at 9:00, we start at dinner and
50:28
then at you from 9 to 11, we have our dinner then we go salsa
50:32
dancing at 11 o'clock on a Monday night, right?
50:38
And now we have some more fun and we can go to bars and things
50:41
like that. And next thing, you know, it's 2
50:43
a.m. in the morning on a Tuesday morning, Monday night, Tuesday
50:47
morning, right? And I am like, haven't slept for
50:50
two days. I am feeling amazing, and I am
50:55
supposed to reach the office the next morning at 8:00 and
50:58
eventually did end up going to the office.
50:59
The next morning, did some fantastic customer presentation
51:02
and demos but that was my introduction.
51:05
Jim and Geoff to Madrid, right? And ever since then, whenever
51:10
I've been too much red whenever I have actually lived there for
51:13
about three months. I've absolutely enjoyed my time.
51:16
Whether you're looking at, you know, the fun aspects of Madrid
51:19
The Nightlife the dancing or you're looking to spend a quiet
51:23
afternoon in parque retiro. Is there a tire spark, right?
51:25
Because right in the center, it is absolutely one of the best
51:29
places in the world, but the real icing on the cake Jeff and
51:32
I want to, you know, come to an end on this long story is really
51:36
the people, the friendliest people, the most hospitable
51:40
people. People who will actually stop in
51:42
the middle of a street and give you real directions, even if it
51:45
takes, you 10 minutes to understand, that's Madrid for
51:48
you. And that's the place I would
51:50
love if I had to live anywhere in the world, that would be my
51:53
place to live it. Yeah, that's such a cool.
51:54
Marie. And I think it highlights one of
51:56
the fun things about kind of being those businesses.
51:57
You know, these sometimes you get these short notice business
52:00
travels and I'm the same way especially I'm going to
52:03
someplace new as I find it difficult to sleep on flights.
52:06
So I think it's, I think I was pretty cool and I lack of the
52:10
same thing about friendly people, you know?
52:11
But all over the world, I tend to have a positive view on
52:14
Humanity because of my interactions with them.
52:17
I'm going to hold onto that for as long as I can Jim.
52:20
How about yourself? If you could live anywhere in
52:23
the world for a year, where would it be?
52:24
Be given to tag on that. Last point that you made,
52:27
because with the pandemic, I think that's one of the things
52:31
that will suffer is that fewer people are getting experience
52:36
going in being immersed in other cultures and realizing that,
52:41
hey, this is what it's like to be the outsider going somewhere
52:45
else. And so now, when I go home and
52:48
there's the outsider, I want to make sure that I'm the person
52:51
who creates that great experience for them.
52:56
I felt like in answering this question.
52:58
I should pick somewhere that I've been, right.
52:59
I don't want to commit to living a year or somewhere that I might
53:03
not like you can pick anything you want.
53:05
I can pick anything I want, I realized that.
53:07
But so my mind went to to play sedative actually been, I've
53:11
been to Hawaii which I think one year living, there would be the
53:16
perfect amount because I really do think I would get the call
53:20
like Island fever, right? You kind of like if you get like
53:23
claustrophobic Vic from living on a couple of square miles of
53:29
land. It's just beautiful there.
53:32
The other place is Holland, you know, the Netherlands, and I
53:38
travel a fair amount in Western Europe.
53:41
And what I always struggled with when I went to other countries,
53:45
was the fact that I only speak one language which is English
53:49
and you can get around pretty good in Holland.
53:53
Speaking only English, Because the Dutch speak, generally like
53:59
34 languages per person at a minimum almost everybody speaks
54:03
English. So you can get around.
54:04
Well, I grew accustomed to the food.
54:07
It was different for me at first, but I really liked it and
54:11
the people were, you know, it's funny thing is with the Dutch at
54:14
least my experience was you know people love.
54:17
Tell me all the doctor. Rude, you know?
54:19
No, that's people would tell me. That's right.
54:21
Like we are rude. Mike Have you ever been to New
54:25
York? If you've been to Philadelphia,
54:28
like, where I grew up now, you folks are not that rude.
54:32
So, yeah, that that's my choice. One of those two places.
54:37
That's pretty cool. I think, for myself, it's
54:40
someplace that I was able to visit briefly on a work trip.
54:44
I've never actually been to London, proper, I've flown into
54:47
the airport, and then I drove out to Windsor stayed there and
54:52
had offices. And Meetings and things and
54:55
firmly, which is kind of west of the London area.
54:58
But I would spend a year in London, just because of the
55:02
history and the culture. I loved it.
55:04
The people were, were fantastic. I have a terrible story of
55:09
flying in not and it's a great story.
55:11
I flew in, got to win, got to Windsor about, I don't know, 9
55:16
a.m. or so, after an overnight flight, same, same, kind of
55:19
deal, Arch. It is yours.
55:21
I couldn't sleep. I was like, okay, and I realized
55:23
Windsor Castle, Was, you know, a walking distance from the hotel.
55:26
Is that something? Oh, that's cool.
55:28
And then I also heard like, oh, they do Changing of the Guard,
55:30
you know, that day was like, okay, that'd be cool to let go
55:33
and see, you know, kind of a new experience for me.
55:35
First time I've ever been in in the UK and I laid down at 9:15
55:41
ish. I was like, okay, I need to be
55:42
there about one and that was, that's the mistake that everyone
55:47
and I think people make is if they're tired, they lay down
55:49
next thing. You know, it's three o'clock, I
55:52
woke you up like I'm like, oh my gosh.
55:54
I'm Like miss it and I'm like, running through the streets of
55:56
Windsor, writing to the castle, trying to see the guard.
56:00
I missed it unfortunately, but I did get to go on a tour of the
56:02
castle, you know, kind of by myself got yelled at for taking
56:06
pictures of the dollhouse, which I didn't realize, we weren't
56:09
just take pictures, but they were very politely telling me
56:12
don't do that, but it was so cool.
56:14
And I think I would have just a lot of fun.
56:16
Exploring kind of that region of the world and, you know, from a
56:20
language barrier perspective. I think I could get by.
56:23
So that's I think that's Where I would end up is somewhere in the
56:26
UK, probably a base of operations and kind of the
56:28
London area, but that would give me the opportunity to travel
56:31
through the UK. And, you know, see castles and,
56:35
and kind of experience all that history.
56:37
So, I think that is a pretty good spot where maybe we can
56:39
start to wrap it up any final thoughts this week, Arch it as
56:43
we kind of had this conversation around the digital identity
56:47
guidelines that Miss has put out there specifically, they 863
56:50
stuff, what should people be taking away from this
56:54
conversation? Action that really people should
56:56
hear and kind of think about as they continue through their
56:59
Journeys in the wonderful world of identity and access
57:01
management. That's a good, that's a great
57:03
word when this Jeff, you know. And you know when people are
57:05
thinking about identity and access management about the nist
57:08
standards, I think the key Parts really is to first and foremost,
57:11
you know, do what is right by your users and by security
57:15
right? It's always a fine balance.
57:17
It's easy to, you know, make it so easy for users to login that
57:21
you know, there's no security aspects left there or it.
57:24
I think sometimes it's easy to implement extremely strong
57:27
factors of authentication, and make life, really difficult for
57:30
your users. The key is to achieve the right
57:32
balance and to leverage what we talk about, things like user
57:35
Behavior, analytics, and machine learning and all of that good
57:38
technologies that are available in order to make life easier for
57:41
your users while driving security.
57:44
I think that's the key takeaway from this if you really ask me
57:47
you know, one of the things that we're doing it cyber-ark.
57:50
If you're actually going to be you know, having a webinar just
57:53
specifically On this concept of strengthening MFA security and
57:59
the title of this webinar. By the way, is Master
58:01
authentication Factor best practice, it's going to be held
58:04
on February 10th, Thursday, that is so, I would encourage all
58:08
your listeners to take a look at that, where we are going to take
58:11
an approach where we are going to talk about list the standards
58:14
themselves, authentication Assurance levels, and we are
58:16
going to combine them with some of our ideas around user
58:19
Behavior analytics in order to help our customers and your
58:22
listeners. Also understand what the Right
58:24
direction should be. So I would really, you know,
58:27
Jeff Jim. Leave leave your readers or
58:30
listeners with that if that helps.
58:33
Yeah. And I'll put a link to that in
58:34
the show notes. I'm actually looking at my wedge
58:36
a webinar registration accepted page for that.
58:38
So I'm looking forward to that conversation and then really
58:42
kind of digging into a little more detail.
58:43
So check out our show notes wherever you're listening, there
58:46
will be links there where people can check it out.
58:49
It's also on the cyber-ark website.
58:51
I'm sure that people can find it there.
58:53
How about Jim? Final thoughts for this week.
58:56
Yeah, just really appreciate our to you being on the show.
58:58
I mean, fantastic source of information.
59:03
Your stories were very entertaining and for everyone
59:08
who's interested in has the ability to jump on the idea.
59:13
See live stream, we do it every week.
59:17
I will keep putting the word out there and we'd love to have you
59:19
join. Maybe submit a question or
59:21
comment or just lurk and enjoy. Yeah, that'd be pretty cool to
59:26
do a show for more than 0 to 1 people watching live.
59:30
I know people catch it and and you know, on replays and things
59:33
like that, we're certainly kind of growing it from from scratch
59:36
just like you did with a show, right?
59:37
I think we did podcasts two and a half years ago for, you know,
59:42
three people and it was probably myself listening to it to make
59:45
sure that came through, okay. But here we are a couple years
59:48
later and, you know, thousands of folks around the world
59:50
checking us out, which is, which is very, very cool.
59:52
And we certainly appreciate folks.
59:54
Taking the time to listen here. But also you know, would
59:58
encourage you to check out idea CDOT live that takes you right
1:00:01
to our YouTube channel and you can either watch the live
1:00:04
streams which are at varying times.
1:00:05
I don't think we've really kind of locked down a specific time
1:00:08
because again, this isn't our real jobs.
1:00:11
We have to work this in between our work schedules.
1:00:13
So the best way to know when you were going live, is to check us
1:00:16
out on Twitter at idac podcast. I usually try to post their with
1:00:21
a couple days notice if I can have one, we're going to go
1:00:24
live. But if you end up on the YouTube
1:00:26
channel, if you subscribe and hit that notify button, then
1:00:29
you'll get an email as well notifying.
1:00:31
You know, when we plan on going away going, glad as well.
1:00:34
So, hopefully we'll see some folks there and continue to grow
1:00:36
that audience and continue that as a companion.
1:00:39
Really kind of this to this podcast that we do.
1:00:43
So with that, I'm done rambling. I'm going to wrap us up for the
1:00:47
week. I appreciate Arch it taking the
1:00:49
time for us this week. Thank you so much.
1:00:51
Jim, thank you as well and to ruin listening.
1:00:54
You as well. So with that, we'll go ahead and
1:00:56
leave it and we'll talk with everyone and next one.
1:01:03
Thanks for listening to the identity at the center podcast.
1:01:06
If you like what you heard, don't forget to subscribe and
1:01:08
visit us on the web and identity at the center.com.