Latest / The Identity Blueprint / Securing Identities from Hire to Fire

Transcript

Securing Identities from Hire to Fire · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the Identity Blueprint, where enterprise identity and access management gets the depth it deserves.
• 0:07
  SPEAKER_00: I'm Ernie Prescott, Principal IAM architect, and today Jose and I are taking everything we've built so far and putting it into motion.
• 0:15
  SPEAKER_00: In Episode 5, Securing Identities from Hire to Fire, we go deep on phase four of the IAM engagement blueprint, process and lifecycle design.
• 0:26
  SPEAKER_00: This is where the philosophy ends and the operational reality begins.
• 0:31
  SPEAKER_00: The joiner, the mover, the lever, every transition point in the human life cycle where access gets granted, recalculated, and revoked.
• 0:41
  SPEAKER_00: We're talking birthright access, separation of duties, the latency window between termination and deprovisioning, zero standing privilege, and the break glass account that wakes the CISO at three in the morning.
• 0:54
  SPEAKER_00: If you've ever wondered how a minor paperwork delay in HR becomes a fired employee draining your financial systems on a Friday night, this episode is for you.
• 1:03
  SPEAKER_00: Let's get into it.
• 1:05
  SPEAKER_02: Usually when you talk about um a medical diagnosis, there's this really comforting expectation of precision, right?
• 1:12
  SPEAKER_00: Yeah, it feels very much like engineering.
• 1:14
  SPEAKER_02: Exactly.
• 1:15
  SPEAKER_02: I mean you fall off your bike, your arm hurts, you go to the hospital, and the x-ray shows that like jagged white line right across the radius bone.
• 1:23
  SPEAKER_00: Right.
• 1:23
  SPEAKER_00: And the doctor just points at the screen and says, Well, there it is.
• 1:27
  SPEAKER_00: That's the problem.
• 1:28
  SPEAKER_02: Aaron Powell It's binary.
• 1:29
  SPEAKER_02: The bone is broken or the bone is not broken.
• 1:31
  SPEAKER_02: You put a cast on it, and the path forward is visible, it's categorized, and it's contained.
• 1:36
  SPEAKER_00: Aaron Ross Powell But then, you know, you step into the world of enterprise security.
• 1:40
  SPEAKER_02: Oh, yeah.
• 1:41
  SPEAKER_00: Specifically identity and access management, and suddenly that X-ray machine is just completely broken.
• 1:47
  SPEAKER_02: Aaron Powell You are no longer looking at a clean fracture.
• 1:50
  SPEAKER_02: We're talking about a diagnostic landscape that is just incredibly murky.
• 1:54
  SPEAKER_00: Aaron Powell Oh, absolutely.
• 1:55
  SPEAKER_00: You've got overlapping permissions, legacy systems that honestly probably haven't been updated since like 2015.
• 2:01
  SPEAKER_00: Trevor Burrus, Jr.
• 2:01
  SPEAKER_02: Right.
• 2:01
  SPEAKER_02: And those shadow IT projects that nobody ever bothered to document, plus thousands of employees shifting roles every single year.
• 2:08
  SPEAKER_00: Aaron Powell Yeah.
• 2:09
  SPEAKER_00: So you're looking at an entire digital nervous system where the signals are crossing in ways they were just never originally architected to handle.
• 2:16
  SPEAKER_02: Aaron Powell Right.
• 2:16
  SPEAKER_02: You can't just point to a single broken bone anymore.
• 2:19
  SPEAKER_00: Aaron Ross Powell No, not at all.
• 2:20
  SPEAKER_00: You're basically looking for a microscopic pathogen in the bloodstream of the organization.
• 2:24
  SPEAKER_02: Aaron Powell Which is exactly why we're pulling you into this specific deep dive today.
• 2:29
  SPEAKER_02: We are taking you right into the heart of the IAM program engagement blueprint.
• 2:34
  SPEAKER_00: Aaron Powell Unpacking the Machinery of Phase 4, which is process and life cycle design.
• 2:39
  SPEAKER_02: Now I know process and lifecycle design sounds like uh the title of a very dry seminar under buzzing fluorescent lights.
• 2:47
  SPEAKER_00: It really does.
• 2:48
  SPEAKER_02: But this is actually about preventing catastrophic digital disasters.
• 2:51
  SPEAKER_02: You know, it's the literal difference between a secure corporate network and, say, a fired employee siphoning funds out of your financial systems on a Friday night.
• 3:00
  SPEAKER_00: Aaron Powell Right.
• 3:00
  SPEAKER_00: And all because of a minor paperwork delay over an HR.
• 3:03
  SPEAKER_02: Exactly.
• 3:04
  SPEAKER_02: So in the earlier phases of this blueprint, organizations are essentially doing like philosophy.
• 3:09
  SPEAKER_02: Trevor Burrus, Jr.
• 3:10
  SPEAKER_00: Yeah, they're designing policies.
• 3:11
  SPEAKER_00: They're writing down what should happen in a perfect world.
• 3:13
  SPEAKER_02: But phase four is where those theoretical security policies are forced to actually turn into operational reality.
• 3:20
  SPEAKER_00: Aaron Powell It's the engine that runs an organization's identity security.
• 3:24
  SPEAKER_00: I mean, if your corporate policy dictates that nobody should have inappropriate access to sensitive data, which obviously every policy does.
• 3:32
  SPEAKER_00: Right.
• 3:32
  SPEAKER_00: Then phase four is the actual mathematical machinery that adds, moves, and removes that access in real time across thousands of applications.
• 3:43
  SPEAKER_02: And if that machinery is missing even a single gear, the whole philosophy just falls apart.
• 3:48
  SPEAKER_00: Completely.
• 3:48
  SPEAKER_02: So let's look at the starting line of this whole apparatus.
• 3:52
  SPEAKER_02: The journey of an identity from the exact moment someone signs an offer letter.
• 3:56
  SPEAKER_00: Historically, integrating a new human into a corporate network was just absolute chaos.
• 4:01
  SPEAKER_02: A manual, heavily siloed nightmare.
• 4:04
  SPEAKER_00: Yeah, the old way relied on what we call the frantic help desk ticket.
• 4:08
  SPEAKER_00: Right.
• 4:09
  SPEAKER_00: A hiring manager would send an email to IT on a Friday afternoon saying, Hey, we just hired a new guy, Dave.
• 4:16
  SPEAKER_00: He starts Tuesday.
• 4:17
  SPEAKER_00: Give him the same access as Sarah.
• 4:19
  SPEAKER_02: Which, you know, seems innocent enough to a hiring manager, but from a security perspective, make him look like Sarah is a terrifying instruction.
• 4:28
  SPEAKER_00: It really is.
• 4:28
  SPEAKER_00: Because Sarah might have been with the company for five years.
• 4:31
  SPEAKER_02: Right.
• 4:31
  SPEAKER_02: She might have accumulated dozens of special exception-based access permissions for projects that ended three years ago.
• 4:39
  SPEAKER_00: Exactly.
• 4:39
  SPEAKER_00: So if you just clone Sarah's profile for Dave, you are cloning a massive security vulnerability.
• 4:45
  SPEAKER_02: Aaron Powell, you are institutionalizing privilege creep on Dave's very first day.
• 4:49
  SPEAKER_00: And that is exactly why the phase four blueprint dictates a complete architectural shift.
• 4:53
  SPEAKER_00: The onboarding process, what we call the joiner process, it must never start with an email or a phone call or an IT ticket.
• 4:59
  SPEAKER_02: Aaron Powell It has to start with an authoritative HR trigger.
• 5:02
  SPEAKER_00: Precisely.
• 5:03
  SPEAKER_02: Meaning the system of record for human beings has to talk directly to the system of record for digital identities.
• 5:08
  SPEAKER_02: Aaron Powell Right.
• 5:09
  SPEAKER_00: So you have an HR information system and HRAS, like workday or SEP success factors, that is where the official employee record is born.
• 5:19
  SPEAKER_02: Aaron Powell And when HR finalizes that hiring paperwork and clicks create, that software generates an event.
• 5:25
  SPEAKER_00: Aaron Powell Yeah.
• 5:26
  SPEAKER_00: And through API connection or a specific protocol called SCEAM, which is the system for cross-domain identity management, that creation event acts like a digital flair.
• 5:36
  SPEAKER_02: Trevor Burrus It's the authoritative trigger for the identity and access management system.
• 5:40
  SPEAKER_02: Let's pause on SDM for a second, actually, because that's a concept that bridges a massive historical gap.
• 5:45
  SPEAKER_02: Aaron Powell Oh, for sure.
• 5:46
  SPEAKER_02: Trevor Burrus Before SCDUM, HR systems spoke French and IT directories spoke German.
• 5:51
  SPEAKER_02: You had to write custom, incredibly fragile scripts just to get a user's last name to port over correctly.
• 5:56
  SPEAKER_00: Aaron Powell It was a mess.
• 5:57
  SPEAKER_00: So SCGIM essentially acts as a universal translator.
• 6:00
  SPEAKER_03: Aaron Powell Got it.
• 6:01
  SPEAKER_00: It standardizes identity attributes into a clean, readable data payload.
• 6:04
  SPEAKER_00: So when the IM system, whether that's a platform like SailPoint or Microsoft under ID governance, sees that SEM payload, it doesn't need a human to interpret it.
• 6:13
  SPEAKER_02: It reads the core attributes directly.
• 6:15
  SPEAKER_00: Aaron Powell Right.
• 6:16
  SPEAKER_00: It sees Dave's department, his specific job code, his physical office location, and who his manager is.
• 6:23
  SPEAKER_02: And this is where the automation engine kicks in to calculate what the blueprint calls birthright access.
• 6:28
  SPEAKER_00: Yeah, and the hotel analogy you used earlier is perfect for this.
• 6:31
  SPEAKER_02: Aaron Powell Right.
• 6:32
  SPEAKER_02: Think of it like checking into a highly optimized futuristic hotel.
• 6:36
  SPEAKER_02: In a traditional hotel, you get a physical key to your room.
• 6:39
  SPEAKER_02: But if you want to use the gym, you have to walk back down to the lobby and ask the front desk for a temporary gym pass.
• 6:45
  SPEAKER_00: Aaron Powell And if you want into the executive lounge, you have to find a manager to authorize it.
• 6:50
  SPEAKER_02: Exactly.
• 6:50
  SPEAKER_02: You are constantly asking for permission at every single door.
• 6:53
  SPEAKER_00: Which is a deeply inefficient way to operate a business, resulting in just hours of lost productivity.
• 6:58
  SPEAKER_02: Aaron Powell But with automated birthrate access, it's as if the hotel already knows you booked the executive wellness package.
• 7:04
  SPEAKER_01: Yeah.
• 7:05
  SPEAKER_02: Before you even walk through the sliding glass doors, your digital key card is mathematically pre-programmed based on your reservation attributes.
• 7:13
  SPEAKER_02: It automatically unlocks your room on the fifth floor, the gym turnstiles, the pool gate, and the executive lounge.
• 7:20
  SPEAKER_00: You don't ask anyone for anything.
• 7:21
  SPEAKER_00: You just begin your stay.
• 7:23
  SPEAKER_02: Right.
• 7:23
  SPEAKER_02: When we map that analogy to the corporate environment, we're talking about dynamic provisioning.
• 7:27
  SPEAKER_00: Exactly.
• 7:28
  SPEAKER_00: The IAM system looks at Dave's attributes, say he's a financial analyst in the London office.
• 7:34
  SPEAKER_00: Without any human IT intervention, the system automatically creates his Active Directory account.
• 7:40
  SPEAKER_03: Wow, okay.
• 7:41
  SPEAKER_00: It provisions a Microsoft 365 E5 license, drops him into the London Office VPN security group, and grants him read-only access to the base level financial reporting dashboards.
• 7:53
  SPEAKER_02: And the blueprint outlines a very strict service level agreement or SLA for this exact process, doesn't it?
• 7:59
  SPEAKER_00: It does.
• 7:59
  SPEAKER_00: That entire provision cascade has to happen, and the account must be fully active with all birthright access within four hours of the HR trigger.
• 8:07
  SPEAKER_02: Four hours.
• 8:08
  SPEAKER_02: That ensures that when Dave actually sits down at his desk at 9 a.m.
• 8:11
  SPEAKER_02: on his first day, he can immediately begin adding value to the company.
• 8:15
  SPEAKER_00: Because the legacy era of a new hire sitting in the break room for three days, just waiting for the IT help desk to manually create an email inbox is unacceptable in a modern enterprise.
• 8:25
  SPEAKER_02: Oh, it's a massive drain on operational capital.
• 8:28
  SPEAKER_00: Absolutely.
• 8:29
  SPEAKER_02: Now there is a fascinating detail buried in the blueprint regarding how we actually handaved the keys on that first day.
• 8:35
  SPEAKER_02: The credentialing mechanism has entirely shifted.
• 8:38
  SPEAKER_00: Yeah.
• 8:38
  SPEAKER_00: We're no longer printing out a default password on a piece of paper and leaving it on his keyboard.
• 8:44
  SPEAKER_02: Or emailing a temporary password to his personal Gmail account, right?
• 8:47
  SPEAKER_00: Right.
• 8:47
  SPEAKER_00: Because emailing a static temporary password like Welcome2026 is a glaring vulnerability.
• 8:54
  SPEAKER_02: Aaron Powell Yeah, I'd imagine threat actors actively scan personal email accounts for those exact strings.
• 8:59
  SPEAKER_00: Aaron Powell They do.
• 9:00
  SPEAKER_00: So the modern onboarding standard utilizes passwordless flows from minute one.
• 9:05
  SPEAKER_02: Aaron Powell Which relies on something called a temporary access pass or a tap.
• 9:09
  SPEAKER_00: Exactly.
• 9:10
  SPEAKER_00: Instead of a password, the IAM system generates a short-lived, single-use cryptographic code.
• 9:16
  SPEAKER_02: Aaron Powell And how does Dave get that?
• 9:17
  SPEAKER_00: Well, it might send this securely to Dave's hiring manager to hand over in person, or maybe route it via SMS to the mobile device Dave registered during his background check.
• 9:27
  SPEAKER_02: Okay, so Dave uses that tape to initiate his very first login session.
• 9:31
  SPEAKER_00: Right, but the critical architectural control here is that the system immediately consumes that tate and forces Dave into a registration loop for a strong phishing resistant credential.
• 9:41
  SPEAKER_02: Like a Phyto II security key or setting up a biometric PASCE on his corporate smartphone.
• 9:47
  SPEAKER_00: Precisely.
• 9:48
  SPEAKER_00: We are establishing a zero trust baseline immediately.
• 9:52
  SPEAKER_00: A Phyto II PASCI uses public key cryptography.
• 9:55
  SPEAKER_00: Dave's device generates a mathematical pair.
• 9:58
  SPEAKER_02: A private key that never leaves his phone's secure hardware enclave and a public key that gets sent to the corporate identity provider.
• 10:05
  SPEAKER_00: Exactly, which completely neutralizes phishing.
• 10:08
  SPEAKER_02: Because if a hacker sends Dave a fake login page that looks exactly like his corporate portal, the PASCI mechanism just won't work, right?
• 10:15
  SPEAKER_00: Yeah, the fake website can't send the correct cryptographic challenge to Dave's phone, so D's phone refuses to authenticate.
• 10:22
  SPEAKER_02: That's wild.
• 10:23
  SPEAKER_02: Dave couldn't give the hacker his password even if he wanted to, because Dave literally doesn't know his own password.
• 10:28
  SPEAKER_02: He doesn't have one.
• 10:29
  SPEAKER_00: He is operating in a cryptographically secure paradigm from his very first keystroke.
• 10:34
  SPEAKER_02: And to close the loop on this entire joiner phase, the system enforces a transparency mandate, right?
• 10:41
  SPEAKER_00: Yes.
• 10:41
  SPEAKER_00: The IAM engine sends an automated notification to Dave's manager detailing the exact access Dave was just granted.
• 10:49
  SPEAKER_02: Like your new hire is fully provisioned with these specific roles.
• 10:53
  SPEAKER_02: Please validate.
• 10:54
  SPEAKER_00: Exactly.
• 10:54
  SPEAKER_00: It forces the business side of the house to acknowledge and own the risk of their employees on day one.
• 11:00
  SPEAKER_02: Which perfectly sets the stage for the next phase of the human life cycle.
• 11:04
  SPEAKER_02: Because, you know, onboarding a brand new employee is relatively straightforward.
• 11:08
  SPEAKER_00: It's a clean slate.
• 11:09
  SPEAKER_00: You're building a house on an empty lot.
• 11:11
  SPEAKER_02: But humans are dynamic.
• 11:12
  SPEAKER_02: They do not stay in the same role sitting at the same desk for 10 years.
• 11:17
  SPEAKER_00: No, they get promoted, they transfer from marketing to product development, they move from the London office to the New York office.
• 11:23
  SPEAKER_02: Aaron Powell And every time an employee moves, their risk profile fundamentally shifts.
• 11:28
  SPEAKER_02: This brings us to the mover process.
• 11:30
  SPEAKER_02: And frankly, this is where the diagnostic X-ray of an organization usually looks the most terrifying.
• 11:35
  SPEAKER_00: Without a doubt.
• 11:36
  SPEAKER_00: From a security architecture standpoint, the mover phase is the single most dangerous point in the identity life cycle.
• 11:43
  SPEAKER_02: Aaron Powell Really.
• 11:44
  SPEAKER_02: More than leaving.
• 11:45
  SPEAKER_00: Yes, because it is the primary vector for what we call privilege creep.
• 11:49
  SPEAKER_02: Aaron Ross Powell Right, because just like joining, moving triggers an HR event.
• 11:54
  SPEAKER_02: The HR system updates Dave's record to show he is no longer in marketing.
• 11:58
  SPEAKER_02: He's now a senior analyst in product development.
• 12:01
  SPEAKER_00: Aaron Powell And the IAM system catches that XCIM payload.
• 12:04
  SPEAKER_00: It sees the change.
• 12:06
  SPEAKER_02: And this is where the mathematical engine performs a delta analysis.
• 12:09
  SPEAKER_00: Exactly.
• 12:10
  SPEAKER_00: The system looks at Dave's new attributes and calculates the new birthright access he requires for product development.
• 12:16
  SPEAKER_00: He needs access to the engineering wikis, the product roadmaps, the JIRA boards.
• 12:20
  SPEAKER_02: But calculating what he needs is only half the equation, isn't it?
• 12:23
  SPEAKER_00: Right.
• 12:23
  SPEAKER_00: The system also has to look at the massive list of permissions Dave already possesses from his time in marketing.
• 12:28
  SPEAKER_02: The delta.
• 12:29
  SPEAKER_02: The mathematical difference between what he currently holds and what his new role justifies.
• 12:33
  SPEAKER_00: And that delta dictates the automated response.
• 12:37
  SPEAKER_00: The system provisions the new engineering tools, but it must systematically flag every single legacy marketing entitlement for immediate review or removal.
• 12:48
  SPEAKER_02: Because without that automated delta analysis, employees become digital pack rats.
• 12:53
  SPEAKER_02: I love that term from the source material.
• 12:55
  SPEAKER_00: It's incredibly accurate.
• 12:56
  SPEAKER_02: If you spend 15 years at a massive corporation, moving from the help desk to systems administration to finance to HR, and your old access is never actively stripped away, you accumulate a wildly toxic combination of permissions.
• 13:10
  SPEAKER_00: You end up with a mid-level HR manager who secretly retains the ability to execute root-level commands on the legacy database servers simply because they worked in IDE a decade ago.
• 13:21
  SPEAKER_02: It's the equivalent of a tenant keeping the physical front door key to every apartment they have ever rented in a city.
• 13:26
  SPEAKER_00: Yes.
• 13:27
  SPEAKER_00: There is zero justifiable reason for them to have those keys.
• 13:30
  SPEAKER_02: It makes that individual a walking security liability.
• 13:33
  SPEAKER_02: I mean, if an external attacker manages to compromise that HR manager's passkey, the attacker doesn't just gain access to the HR department.
• 13:40
  SPEAKER_00: They instantly inherit the keys to the database servers.
• 13:44
  SPEAKER_02: The blast radius of that single compromised account expands exponentially.
• 13:49
  SPEAKER_00: And that lateral movement is the ultimate goal of every advanced persistent threat group.
• 13:54
  SPEAKER_00: They look for the digital pack rats.
• 13:56
  SPEAKER_02: So the Delta Analysis engine must actively strip away what is no longer justified.
• 14:01
  SPEAKER_02: However, the blueprint introduces a human governance element here that often causes intense debate during implementation.
• 14:09
  SPEAKER_00: Oh, it causes huge argument.
• 14:11
  SPEAKER_02: I noticed this in the Mover workflow documentation, and honestly, it seems entirely backward at first glance.
• 14:16
  SPEAKER_00: Let me guess the manager review.
• 14:18
  SPEAKER_02: Yes.
• 14:19
  SPEAKER_02: When the Delta analysis flags Dave's old marketing access for removal, the workflow sends a notification to his new manager in product development to review that legacy access during a 30-day grace period.
• 14:30
  SPEAKER_02: Right.
• 14:31
  SPEAKER_02: Wait, hold on.
• 14:32
  SPEAKER_02: The new manager reviews the old access.
• 14:34
  SPEAKER_02: That makes zero intuitive sense.
• 14:36
  SPEAKER_02: The new manager has no idea what Dave was doing in marketing.
• 14:39
  SPEAKER_02: Why wouldn't the old manager in marketing do the review to see if Dave still needs it?
• 14:43
  SPEAKER_00: I know.
• 14:44
  SPEAKER_00: It is a counterintuitive mechanism until you view it through the lens of strict risk accountability.
• 14:49
  SPEAKER_02: Okay, unpack that for me.
• 14:51
  SPEAKER_00: The moment HR updates that record, Dave's old manager is legally and operationally absolved of all responsibility for Dave.
• 14:59
  SPEAKER_00: They do not own his risk anymore.
• 15:01
  SPEAKER_03: Ah.
• 15:02
  SPEAKER_00: The new manager in product development is now 100% accountable for Dave's overall threat profile.
• 15:08
  SPEAKER_02: So the new manager has to look at the total aggregate picture of what Dave is capable of doing on the network.
• 15:14
  SPEAKER_00: Exactly.
• 15:15
  SPEAKER_00: The new manager needs to make two distinct determinations.
• 15:18
  SPEAKER_00: First, does Dave need a brief, say, 14-day extension of his old marketing email groups simply to finish handing off a transition project?
• 15:26
  SPEAKER_02: Okay.
• 15:27
  SPEAKER_02: That's common.
• 15:27
  SPEAKER_02: Hence the grace period.
• 15:28
  SPEAKER_02: You don't want to break active business workflows.
• 15:30
  SPEAKER_00: Right.
• 15:31
  SPEAKER_00: But what is the second determination?
• 15:33
  SPEAKER_00: The new manager must actively ensure that Dave's legacy access does not violate separation of duties or SA within his new context.
• 15:41
  SPEAKER_02: Aaron Ross Powell Separation of Duties.
• 15:42
  SPEAKER_02: This goes all the way back to the Enron era, Sarbanne's Oxley regulations, right?
• 15:46
  SPEAKER_00: Aaron Ross Powell Precisely.
• 15:48
  SPEAKER_00: Preventing a single human from having enough power to commit fraud and hide it simultaneously.
• 15:53
  SPEAKER_02: Give me a classic Shusothi conflict so we can visualize this.
• 15:56
  SPEAKER_00: Okay, imagine Sarah moves from the accounts payable department to accounts receivable.
• 16:01
  SPEAKER_00: The Delta analysis flags her accounts payable access for removal, but gives a 30-day grace period.
• 16:07
  SPEAKER_03: Right.
• 16:08
  SPEAKER_00: If her new manager blindly approves her keeping that legacy access, Sarah now possesses the digital authority to both write a corporate check and receive a corporate check.
• 16:18
  SPEAKER_02: Wow.
• 16:19
  SPEAKER_02: She can generate a fraudulent invoice, pay it to a dummy corporation she owns, and then reconcile the ledger to hide the missing funds.
• 16:26
  SPEAKER_00: Exactly.
• 16:27
  SPEAKER_00: She possesses both halves of the fraud triangle.
• 16:29
  SPEAKER_02: So the new manager is required to view her total AXI package, recognize that toxic Susodi conflict, and immediately override the grace period to terminate the legacy access.
• 16:39
  SPEAKER_00: It is not about knowing what the old access was for, it is about owning the risk of what that access is right now.
• 16:45
  SPEAKER_02: That makes total sense now.
• 16:47
  SPEAKER_02: But let's be realistic about human behavior and corporate environments.
• 16:50
  SPEAKER_02: Managers are overwhelmed.
• 16:52
  SPEAKER_02: They suffer from a light fatigue.
• 16:53
  SPEAKER_00: Oh, massively.
• 16:54
  SPEAKER_02: What happens if this new manager just ignores the email notification?
• 16:58
  SPEAKER_02: If they don't click approve or deny, does the grace period just stay open forever?
• 17:03
  SPEAKER_00: No.
• 17:03
  SPEAKER_00: The architecture is designed to assume human failure.
• 17:06
  SPEAKER_02: Thank goodness.
• 17:07
  SPEAKER_00: If the legacy access remains unconfirmed by the manager at the end of that 30-day grace period, the system's SLA dictates an automatic revocation.
• 17:15
  SPEAKER_02: It defaults to a state of leased privilege.
• 17:18
  SPEAKER_00: Right.
• 17:18
  SPEAKER_00: The access drops, and if Dave actually needed it, he has to formally request it again.
• 17:23
  SPEAKER_02: It forces active engagement rather than passive accumulation.
• 17:27
  SPEAKER_02: I love that.
• 17:28
  SPEAKER_02: So we've joined, we've moved.
• 17:30
  SPEAKER_02: But eventually the relationship between the human and the corporation ends.
• 17:34
  SPEAKER_03: Yes.
• 17:34
  SPEAKER_02: We are pivoting from employees changing desks to employees leaving the building entirely.
• 17:40
  SPEAKER_02: Segment three of this life cycle is the lever process.
• 17:43
  SPEAKER_02: And the blueprint makes it unequivocally clear this is where the stakes reach their absolute peak.
• 17:48
  SPEAKER_00: The lever process is the ultimate stress test of an IAML program.
• 17:52
  SPEAKER_00: I mean, if your joiner process is slow, your company loses a bit of productivity.
• 17:56
  SPEAKER_00: But if your lever process fails, you are exposing the organization to immediate, highly exploitable, catastrophic vulnerabilities.
• 18:05
  SPEAKER_02: It all comes down to a metric called lever latency, doesn't it?
• 18:08
  SPEAKER_00: Yes.
• 18:09
  SPEAKER_00: This is the temporal gap between reality and the digital reflection of reality.
• 18:14
  SPEAKER_02: Meaning the exact time delay between the moment an employee officially terminates their relationship with the company and the precise millisecond their digital access is completely severed across every single platform.
• 18:25
  SPEAKER_00: Exactly.
• 18:26
  SPEAKER_00: Let's run a scenario.
• 18:27
  SPEAKER_00: HR sits down with an employee on a Monday morning at 900 AM.
• 18:32
  SPEAKER_00: Things have not worked out.
• 18:33
  SPEAKER_00: It's an involuntary termination.
• 18:35
  SPEAKER_03: Right.
• 18:35
  SPEAKER_03: They're fired.
• 18:36
  SPEAKER_00: HR updates the workday system.
• 18:38
  SPEAKER_00: But because the company doesn't have an automated phase four pipeline, HR just sends an email to the IT help desk saying, please offboard this user.
• 18:46
  SPEAKER_02: And the IT guy is swamped with server updates, so he doesn't actually log into the directory to manually disable the Active Directory account until Friday afternoon.
• 18:54
  SPEAKER_00: You have just created a massive 100-hour window of extreme risk.
• 18:59
  SPEAKER_02: For four entire days, you have a disgruntled former employee sitting at home, potentially furious, who still possesses perfectly valid authenticated credentials to your virtual private network, your customer relationship databases, and your proprietary source cloud repositories.
• 19:17
  SPEAKER_00: And the statistics surrounding this latency gap are horrifying.
• 19:21
  SPEAKER_02: Yeah.
• 19:21
  SPEAKER_02: Based on the sale point research in our source stack, over 70% of surveyed companies report instances of employees retaining inappropriate access days, weeks, or even months after their formal departure.
• 19:32
  SPEAKER_00: Wait, 70%.
• 19:37
  SPEAKER_00: And an orphaned account is basically a digital ghost.
• 19:39
  SPEAKER_02: Right.
• 19:40
  SPEAKER_00: It is an active identity profile floating in your network that no longer has a legally binding, valid human owner tied to it in the central HR system.
• 19:50
  SPEAKER_00: And it represents a dual vector threat.
• 19:52
  SPEAKER_02: The first vector is obvious.
• 19:54
  SPEAKER_02: The insider threat.
• 19:55
  SPEAKER_02: The furious former employee downloading the entire Salesforce client list on a Tuesday night to take to their new job at a direct competitor.
• 20:02
  SPEAKER_00: Or worse, a systems engineer deciding to detonate a logic bomb on their way out the door, wiping production servers in retaliation.
• 20:10
  SPEAKER_02: But I imagine the insider threat is only half the battle.
• 20:14
  SPEAKER_02: If I am an external ransomware operator and advanced persistent threat group, an orphaned account looks like a ghost ship.
• 20:20
  SPEAKER_00: Oh, it's the perfect vessel for them to board because they know for a fact that absolutely nobody is at the helm.
• 20:26
  SPEAKER_02: Because if a hacker attempts to hijack the active account of your current CFO, the CFO is going to notice.
• 20:32
  SPEAKER_00: Right.
• 20:32
  SPEAKER_00: The CFO will get unexpected multi-factor authentication prompts on their phone or notice emails marked as red that they haven't seen.
• 20:40
  SPEAKER_02: They will alert the security operations center.
• 20:42
  SPEAKER_02: The active human acts as an organic intrusion detection system.
• 20:46
  SPEAKER_00: Aaron Powell But if the account belongs to a marketing contractor whose contract ended six months ago.
• 20:51
  SPEAKER_02: There is no human checking that inbox.
• 20:53
  SPEAKER_00: Exactly.
• 20:54
  SPEAKER_00: There is no human to hit deny on the MFA prompt if the hacker bypasses it.
• 20:59
  SPEAKER_02: The external attacker can slip into that orphaned account, assume the identity of the former employee, and quietly begin exploring the network architecture.
• 21:08
  SPEAKER_00: They can map out the active directories, search for privilege escalation paths, and slowly exfiltrate data for months without ever tripping the behavioral analytics alarms that monitor active users.
• 21:19
  SPEAKER_00: It is the ultimate camouflage.
• 21:21
  SPEAKER_02: So how does the blueprint eradicate the ghost ships?
• 21:24
  SPEAKER_02: What is the technical mechanism to drive lever latency down to zero?
• 21:28
  SPEAKER_00: The SLA for the lever process removes human intervention entirely.
• 21:33
  SPEAKER_00: For involuntary terminations firings, the SLA is immediate automated disablement within one hour of the HR trigger firing.
• 21:41
  SPEAKER_02: Wow, one hour.
• 21:42
  SPEAKER_02: And for voluntary resignations.
• 21:44
  SPEAKER_00: It is same day disablement, usually triggered at 5 0 p.m.
• 21:47
  SPEAKER_00: on their final day.
• 21:48
  SPEAKER_00: The HR API communicates directly to the IAM engine, which instantly executes a revocation playbook.
• 21:54
  SPEAKER_02: But let's look at the actual plumbing of that revocation playbook because this is where legacy IT mindsets completely.
• 22:00
  SPEAKER_02: Completely fail in the cloud era.
• 22:01
  SPEAKER_00: Aaron Powell They really do.
• 22:02
  SPEAKER_02: Ten years ago, if you fired someone, you went into the on-premise server, you right-clicked their Active Directory account, you hit disable, and you physically escorted them out of the building.
• 22:10
  SPEAKER_02: Problem solved.
• 22:11
  SPEAKER_02: They couldn't log in.
• 22:13
  SPEAKER_00: But in a modern distributed cloud architecture, killing the Active Directory account does not instantly kill their access.
• 22:19
  SPEAKER_02: Aaron Powell That is a critical vulnerability that many organizations fail to grasp.
• 22:23
  SPEAKER_02: The difference between authentication and authorization.
• 22:26
  SPEAKER_00: Exactly.
• 22:27
  SPEAKER_00: When a user logs into a cloud application like Salesforce or Amazon Web Services, the central identity provider, say NTRA ID or Okta, authenticates them and issues a session token.
• 22:38
  SPEAKER_02: An O or small L token.
• 22:40
  SPEAKER_00: Right.
• 22:40
  SPEAKER_00: That token is essentially a digital passport stamped with an expiration time, often valid for 12, 24, or even 48 hours.
• 22:49
  SPEAKER_02: So if the user is sitting at a coffee shop on their personal laptop and they are already logged into Salesforce with a valid token, and HR fires them at 10.0 AM and disables their central Active Directory account, what happens to the Salesforce session?
• 23:03
  SPEAKER_00: In a legacy setup, absolutely nothing.
• 23:05
  SPEAKER_02: Nothing.
• 23:06
  SPEAKER_00: Nothing.
• 23:06
  SPEAKER_00: The central directory is disabled, meaning the user can't log in again, but the Active Salesforce session doesn't know that.
• 23:12
  SPEAKER_02: Because the token is still valid.
• 23:13
  SPEAKER_00: Yes.
• 23:14
  SPEAKER_00: The user can continue downloading customer data for the next 23 hours until that specific token naturally expires and asks the disabled central directory for a renewal.
• 23:25
  SPEAKER_02: That is terrifying.
• 23:26
  SPEAKER_02: You think you've locked the front door, but they are already inside the house and all the interior doors are still open.
• 23:31
  SPEAKER_00: Exactly.
• 23:32
  SPEAKER_02: How does phase four architect a solution to sever those acta sessions?
• 23:36
  SPEAKER_00: The modern IAM framework mandates the use of continuous access evaluation or CAE.
• 23:42
  SPEAKER_00: This is a massive architectural upgrade.
• 23:44
  SPEAKER_02: Okay, how does CAE work?
• 23:46
  SPEAKER_00: When the termination trigger hits the IAM system, it doesn't just passively flip a status bit from active to disabled in a database.
• 23:53
  SPEAKER_00: It actively generates a cryptographic revocation event.
• 23:56
  SPEAKER_02: It goes on the offensive.
• 23:58
  SPEAKER_00: Exactly.
• 23:58
  SPEAKER_00: The identity provider broadcasts a universal webhook signal out to every single cloud application integrated into the environment.
• 24:05
  SPEAKER_02: It pushes a message to Salesforce, to AWS, to Microsoft 365, to the VPN gateway.
• 24:11
  SPEAKER_00: Explicitly stating, session revoked, invalidate all existing tokens for this specific user immediately.
• 24:17
  SPEAKER_02: A universal kill switch.
• 24:19
  SPEAKER_02: The user could be mid-keystroke in a spreadsheet, and the browser simply kicks them back to the login screen permanently.
• 24:26
  SPEAKER_00: It closes the latency gap across the entire cloud perimeter in milliseconds.
• 24:30
  SPEAKER_02: Amazing.
• 24:31
  SPEAKER_02: However, the automated lever process is not solely about destruction, is it?
• 24:35
  SPEAKER_02: It also has to handle business continuity.
• 24:37
  SPEAKER_00: Aaron Powell Right.
• 24:38
  SPEAKER_00: Because if you instantly nuke a high-level manager's access, what happens to the infrastructure they were managing?
• 24:43
  SPEAKER_02: Right.
• 24:44
  SPEAKER_02: If Dave was the sole owner of a critical project's shared SharePoint drive, or he managed the primary info at company.com distribution list, if his account vanishes, does that shared drive just become locked in a digital vault?
• 24:58
  SPEAKER_00: Aaron Powell Does the business process grind to a halt?
• 25:01
  SPEAKER_00: No.
• 25:02
  SPEAKER_00: This is where resource reassignment protocols engage.
• 25:05
  SPEAKER_02: Okay, so what does the system do before deleting him?
• 25:07
  SPEAKER_00: Before the IAM system fully disables Dave's account, it scans the environment for any shared resources where Dave is listed as the sole proprietor.
• 25:15
  SPEAKER_00: Shared mailboxes, calendar delegations, external guest network sponsorships, cloud infrastructure resource groups.
• 25:22
  SPEAKER_02: And it automatically bridges the gap.
• 25:24
  SPEAKER_00: It mathematically reassigns ownership of those assets up the organizational chart to Dave's immediate manager.
• 25:30
  SPEAKER_00: Ah, that's smart.
• 25:31
  SPEAKER_00: The manager receives an automated briefing.
• 25:34
  SPEAKER_00: Dave's access has been terminated.
• 25:37
  SPEAKER_00: You have automatically been assigned ownership of the following four shared drives and two distribution lists to ensure continuous business operations.
• 25:46
  SPEAKER_02: It is the difference between taking a sledgehammer to the departing employee's desk versus using a scalpel to carefully untangle their threads from the network.
• 25:56
  SPEAKER_00: That's a great way to put it.
• 25:57
  SPEAKER_02: And what is the final disposition of the account itself?
• 26:00
  SPEAKER_02: Does the IAM system just instantly delete Dave from the server entirely to save database space?
• 26:06
  SPEAKER_00: Never.
• 26:07
  SPEAKER_00: Immediate deletion is a severe compliance violation.
• 26:10
  SPEAKER_02: Really?
• 26:10
  SPEAKER_02: Why?
• 26:10
  SPEAKER_00: Because if you delete the account object, you destroy the cryptographic anchor for all of Dave's historical audit trails.
• 26:16
  SPEAKER_03: Oh, I see.
• 26:17
  SPEAKER_00: Furthermore, if Dave decides to sue the company for wrongful termination three weeks later, the legal department will immediately issue an e-discovery hold requiring all of Dave's emails and chat logs.
• 26:28
  SPEAKER_02: And if you deleted the account, that data is gone and the company is liable for spoiliation of evidence.
• 26:34
  SPEAKER_00: Exactly.
• 26:34
  SPEAKER_00: So it goes into a freezer.
• 26:36
  SPEAKER_02: The blueprint specifies a compliance hold.
• 26:39
  SPEAKER_00: Yes.
• 26:39
  SPEAKER_00: The account is cryptographically disabled, stripped of all group memberships, hidden from the global address book, and placed in the suspended organizational unit for a retention period, typically 30 to 90 days.
• 26:50
  SPEAKER_02: And only after the legal and compliance windows expire does the automated lifecycle script permanently purge the digital identity from the directory.
• 26:58
  SPEAKER_00: Correct.
• 26:59
  SPEAKER_02: All right, let's step back and look at the whole board here.
• 27:02
  SPEAKER_02: We have covered the foundational baseline, the JML lifecycle.
• 27:05
  SPEAKER_02: Joiner, mover, lever.
• 27:07
  SPEAKER_00: Core pillars.
• 27:08
  SPEAKER_02: We have automated the birthright access upon entry, we've dynamically recalculated the risk delta during internal movement, and we've deployed the universal kill switch upon departure.
• 27:18
  SPEAKER_00: But that baseline is rigid.
• 27:20
  SPEAKER_02: Right.
• 27:21
  SPEAKER_02: It only covers what a user needs simply by existing in their role.
• 27:25
  SPEAKER_02: What happens when a user needs more?
• 27:28
  SPEAKER_02: What happens when work requires them to step outside their birthright boundaries?
• 27:32
  SPEAKER_00: This brings us to the governance engine access requests and certifications.
• 27:37
  SPEAKER_02: Segment four.
• 27:39
  SPEAKER_02: Because, you know, birthright access is strategically designed to get an employee about 80% of the way to productivity.
• 27:46
  SPEAKER_00: Yeah, it covers the ubiquitous tools, email, intranet basic department folders.
• 27:51
  SPEAKER_00: But modern enterprise work is highly dynamic and fluid.
• 27:55
  SPEAKER_02: Aaron Powell Right.
• 27:55
  SPEAKER_02: Like Dave is in marketing, but suddenly he gets pulled into a cross-functional tiger team evaluating a merger, and he desperately needs read access to a highly secure European financial projections database.
• 28:08
  SPEAKER_00: And his birthright doesn't cover that.
• 28:09
  SPEAKER_02: In the legacy model, Dave would submit an IT help desk ticket requesting access.
• 28:14
  SPEAKER_00: Aaron Ross Powell And this is exactly the paradigm the phase four blueprint actively dismantles.
• 28:18
  SPEAKER_02: It says the IT department should never be in the business of approving access requests, which, I mean, sounds completely contradictory at first.
• 28:25
  SPEAKER_02: Isn't IT the department in charge of network security?
• 28:27
  SPEAKER_02: Why wouldn't they approve who gets onto the network?
• 28:29
  SPEAKER_00: Aaron Powell Because IT is in charge of securing the infrastructure of the network.
• 28:33
  SPEAKER_00: They build the roads and the fences.
• 28:36
  SPEAKER_00: But the IT help desk analyst sitting in a cubicle has absolutely zero business context regarding the data itself.
• 28:43
  SPEAKER_03: Ah, okay.
• 28:44
  SPEAKER_00: If Dave submits a ticket asking for European financials, the IT analyst looks at it, shrugs, assumes Dave knows what he's doing, and clicks approve.
• 28:53
  SPEAKER_02: They are essentially flying blind.
• 28:55
  SPEAKER_02: They don't know if Dave is actually on the merger committee or if Dave is just being nosy and wants to look at executive salaries.
• 29:00
  SPEAKER_00: Exactly.
• 29:01
  SPEAKER_00: IT does not own the data risk.
• 29:03
  SPEAKER_00: Therefore, phase four shifts the entire access request workflow out of IT ticketing systems and into self-service portals powered by identity governance and administration platforms.
• 29:14
  SPEAKER_02: IGA tools.
• 29:15
  SPEAKER_02: So how does a self-service portal change the fundamental dynamic of approval?
• 29:19
  SPEAKER_00: It shifts the decision-making authority directly to the data or application owners.
• 29:23
  SPEAKER_02: So when Dave realizes he needs the financial data, he logs into a clean web-based internal catalog.
• 29:28
  SPEAKER_02: It looks like an internal app store.
• 29:30
  SPEAKER_00: Right.
• 29:30
  SPEAKER_00: He searches for European financial projections and clicks request.
• 29:35
  SPEAKER_00: The IGA platform knows, via its metadata tags, that the authoritative owner of that specific database is the VP of finance in Europe.
• 29:44
  SPEAKER_02: And the system automatically routes the request directly to her smartphone or email?
• 29:49
  SPEAKER_00: Yes.
• 29:49
  SPEAKER_00: And she possesses the critical business context.
• 29:52
  SPEAKER_00: She's running the merger committee, she knows exactly why Dave needs it, and more importantly, she knows exactly what level of access he requires.
• 29:59
  SPEAKER_02: She makes the approval decision, completely bypassing the IT department.
• 30:02
  SPEAKER_02: That aligns the approval authority with the actual risk owner.
• 30:06
  SPEAKER_00: But there is a crucial guardrail highlighted in the blueprint regarding these manual requests.
• 30:11
  SPEAKER_02: Yeah, by default, any access granted outside of the automated birthright must be strictly time-bound and require a logged business justification.
• 30:19
  SPEAKER_00: Permanent exception access is the archenemy of identity governance.
• 30:23
  SPEAKER_00: If Dave requests access for the Q3 merger project, the self-service portal will not allow him to submit the request without answering two forced parameters.
• 30:32
  SPEAKER_02: Why do you need this?
• 30:33
  SPEAKER_02: And how long do you need it?
• 30:35
  SPEAKER_00: Right.
• 30:35
  SPEAKER_00: If he types in merger due diligence and selects a 60-day window, the system provisions the access.
• 30:42
  SPEAKER_00: But on day 61, the access evaporates automatically.
• 30:46
  SPEAKER_02: There is no manual cleanup required.
• 30:48
  SPEAKER_00: And that typed justification is cryptographically hashed and permanently logged in the governance database.
• 30:54
  SPEAKER_02: Aaron Powell So when the external auditors arrive at the end of the year, they can see exactly who asked for the data, who approved it, and the precise business rationale behind it.
• 31:02
  SPEAKER_00: Aaron Powell It's totally transparent.
• 31:04
  SPEAKER_02: Okay.
• 31:04
  SPEAKER_02: Time-bound requests solve the problem for new exceptions.
• 31:08
  SPEAKER_02: But let's look at the reality of an enterprise that is implementing phase four for the very first time.
• 31:12
  SPEAKER_00: Aaron Powell Oh, this is the messy part.
• 31:14
  SPEAKER_02: Aaron Powell Right.
• 31:14
  SPEAKER_02: They already have thousands of employees who have been accumulating permanent access for a decade.
• 31:20
  SPEAKER_02: Even with automated movers and time bound requests, the baseline is already polluted.
• 31:25
  SPEAKER_00: Heavily polluted.
• 31:26
  SPEAKER_02: How do you clean up the historical mess that is already in the system?
• 31:29
  SPEAKER_00: That requires the heavy machinery of the governance engine.
• 31:32
  SPEAKER_00: Access reviews and certifications.
• 31:34
  SPEAKER_00: This is the recertification protocol.
• 31:36
  SPEAKER_02: Let's unpack the mechanics of a certification campaign.
• 31:38
  SPEAKER_02: What actually happens?
• 31:40
  SPEAKER_00: A certification campaign is a periodic, mandatory, system-wide validation event.
• 31:45
  SPEAKER_00: The blueprint dictates that organizations must run these sweeps on a rigid schedule.
• 31:51
  SPEAKER_02: Usually quarterly for highly privileged or sensitive access and semi-annually for standard user application access, right?
• 31:58
  SPEAKER_00: Exactly.
• 31:58
  SPEAKER_00: So mechanically, the IGA platform wakes up on the first of the quarter.
• 32:02
  SPEAKER_00: It generates a massive personalized compliance report for every single manager across the entire company.
• 32:08
  SPEAKER_02: The manager logs into their dashboard and sees an alert like here are your seven direct reports.
• 32:13
  SPEAKER_02: Here are the 85 unique applications, databases, and security groups they currently hold access to.
• 32:18
  SPEAKER_00: And they are required to review this entire matrix and actively certify whether each entitlement is still required for their current job duties or they must explicitly revoke it.
• 32:28
  SPEAKER_02: This used to be a notorious compliance nightmare in the old days of massive Excel spreadsheets.
• 32:33
  SPEAKER_00: Managers would get a spreadsheet with 10,000 rows, sigh heavily, and just reply to the email saying, Looks good to me.
• 32:40
  SPEAKER_00: It was just a rubber stamping exercise.
• 32:42
  SPEAKER_02: But modern IAM systems change the psychological enforcement mechanism.
• 32:46
  SPEAKER_02: Think of it like a consumer subscription model.
• 32:49
  SPEAKER_00: Yeah, that's a perfect analogy.
• 32:50
  SPEAKER_02: If you sign up for a basic streaming service, it operates on an auto-renewing contract.
• 32:55
  SPEAKER_02: You put your credit card in once, and if you forget about it, they will happily charge you$5 a month for the next 20 years.
• 33:05
  SPEAKER_00: Which is exactly how legacy IT environments operated.
• 33:09
  SPEAKER_00: Once a user got access, it auto-renewed forever unless someone actively fought to stop it.
• 33:14
  SPEAKER_02: But the modern certification engine treats access like a subscription that auto-cancels.
• 33:20
  SPEAKER_01: Right.
• 33:20
  SPEAKER_02: Imagine if Netflix emailed you on the 25th of every month and said, please click the secure link to confirm you actively want to watch Netflix next month.
• 33:29
  SPEAKER_02: If you do not click approve within five days, we are permanently deleting your account and wiping your watch history.
• 33:34
  SPEAKER_00: I mean, that is precisely the enforcement mechanism here.
• 33:37
  SPEAKER_00: The SLA for a certification campaign includes a strict, non-negotiable deadline for the manager.
• 33:43
  SPEAKER_02: And if the manager experiences alert fatigue and simply ignores the certification campaign, if they fail to actively click approve for Dave's access to the Salesforce database.
• 33:54
  SPEAKER_00: The IGA platform does not assume the access is fine.
• 33:58
  SPEAKER_00: It assumes the manager's silence means the access is no longer justified.
• 34:02
  SPEAKER_03: It defaults to denial.
• 34:03
  SPEAKER_03: The access is automatically revoked at the deadline.
• 34:06
  SPEAKER_00: It forces aggressive engagement.
• 34:08
  SPEAKER_00: You cannot passively allow privilege to accumulate.
• 34:11
  SPEAKER_00: The manager has to consciously put their digital signature on the line, certifying that the access is required.
• 34:17
  SPEAKER_02: And modern systems actually combat the rubber stamping problem by using machine learning analytics, don't they?
• 34:22
  SPEAKER_00: They do.
• 34:23
  SPEAKER_00: If a manager goes in and just highlights all 85 entitlements and tries to click approve all, the system will intervene.
• 34:30
  SPEAKER_02: It will flag high-risk outliers like, wait, Dave is the only person in his department with access to this specific financial server?
• 34:36
  SPEAKER_02: Are you absolutely certain you want to approve this?
• 34:39
  SPEAKER_00: It adds intelligent friction to the process.
• 34:41
  SPEAKER_00: And again, this creates a pristine, mathematically verifiable audit trail.
• 34:45
  SPEAKER_02: So when the external auditors come in to do an SOX compliance check, you aren't just showing them a static list of who happens to have access today.
• 34:53
  SPEAKER_00: You are showing them the immutable log of exactly which human manager certified that specific access, on what exact date, and passing the liability entirely to the business.
• 35:03
  SPEAKER_02: Incredible.
• 35:04
  SPEAKER_02: So we have now established tight control over the general population.
• 35:08
  SPEAKER_02: But everything we have discussed in the JML lifecycle, the requests and the certifications, all of that primarily governs standard users.
• 35:15
  SPEAKER_00: The regular employees doing their daily business tasks.
• 35:18
  SPEAKER_02: Right.
• 35:19
  SPEAKER_02: We now have to pivot to the final and arguably most critical pillar of phase four.
• 35:23
  SPEAKER_02: We are talking about privileged access management, or PAM.
• 35:27
  SPEAKER_00: Segment five, the keys to the kingdom.
• 35:29
  SPEAKER_02: We are shifting focus from the standard population to the superusers, the IT administrators, the database engineers, the senior network architects.
• 35:37
  SPEAKER_00: These are the people whose credentials do not just grant access to data.
• 35:40
  SPEAKER_00: Their credentials grant the ability to alter, dismantle, or destroy the fundamental infrastructure of the network itself.
• 35:47
  SPEAKER_02: And the stakes in this specific arena are just astronomically high.
• 35:51
  SPEAKER_02: The statistical reality is chilling.
• 35:53
  SPEAKER_02: Our sources cite that a staggering 80% of all successful corporate data breaches involve the explicit compromise and exploitation of privileged credentials.
• 36:04
  SPEAKER_00: Because if an attacker compromises Dave in marketing, they can read some confidential emails, maybe steal a client list.
• 36:11
  SPEAKER_00: It's a localized breach.
• 36:12
  SPEAKER_02: But if an attacker compromises a domain administrator, they own the entire corporate reality.
• 36:18
  SPEAKER_00: A domain admin can silently alter the central directory.
• 36:21
  SPEAKER_00: They can grant themselves access to every inbox in the company.
• 36:24
  SPEAKER_02: They can deploy a ransomware payload to 5,000 endpoint servers simultaneously with a single command.
• 36:30
  SPEAKER_00: They can delete the backups and then wipe the centralized logging servers and no one can figure out how they did it.
• 36:35
  SPEAKER_02: It is the ultimate prize for a threat actor.
• 36:37
  SPEAKER_02: So how does the phase four blueprint handle these superusers?
• 36:41
  SPEAKER_02: Because obviously, a senior network architect still needs to do their job.
• 36:44
  SPEAKER_02: They need high-level access to maintain the systems.
• 36:47
  SPEAKER_00: The blueprint introduces a radical paradigm shift in how we conceptualize administrative power.
• 36:53
  SPEAKER_00: Historically, a systems administrator essentially possessed two separate identities.
• 36:58
  SPEAKER_00: Right.
• 36:58
  SPEAKER_00: They had their standard account for reading email and browsing the internet, and they were issued a secondary permanent admin account with globally elevated privileges that they could log into whenever they wanted.
• 37:10
  SPEAKER_00: We call this architecture standing privileges.
• 37:13
  SPEAKER_02: Standing privileges, meaning the godlike power is always turned on, 24 hours a day, seven days a week, 365 days a year.
• 37:21
  SPEAKER_00: Exactly.
• 37:21
  SPEAKER_00: Always on, always sitting in the directory, and therefore always vulnerable to theft.
• 37:26
  SPEAKER_02: If the admin goes on a two-week vacation to the mountains, that high-level account is still sitting there, fully active, waiting for someone to guess the password or steal the session token.
• 37:36
  SPEAKER_00: It's an unnecessarily massive attack surface.
• 37:38
  SPEAKER_00: So the modern blueprint mandates a concept called just-in-time access or JIT, combined with zero standing privileges, ZSP.
• 37:46
  SPEAKER_02: Zero standing privileges is exactly what it sounds like, I imagine.
• 37:49
  SPEAKER_02: It dictates that in the default resting state of the network, absolutely no user possesses active administrative rights.
• 37:56
  SPEAKER_02: Zero.
• 37:57
  SPEAKER_00: Exactly.
• 37:58
  SPEAKER_02: Okay, but let's look at the practical mechanics of that.
• 38:00
  SPEAKER_02: If the senior database administrator doesn't have a permanent admin account, how on earth do they perform maintenance on a production server at 2.0 pm on a Tuesday?
• 38:10
  SPEAKER_00: They are no longer granted the persistent account.
• 38:13
  SPEAKER_00: Instead, they are granted eligibility to assume a specific role.
• 38:17
  SPEAKER_03: Okay.
• 38:18
  SPEAKER_00: When the engineer needs to perform maintenance, they log into a specialized PAM platform tools like CyberArc, Beyond Trust, or Intra-privileged Identity Management.
• 38:27
  SPEAKER_02: But at the moment they log in, they are still just a normal user.
• 38:30
  SPEAKER_02: They do not have the power yet.
• 38:32
  SPEAKER_00: Right.
• 38:32
  SPEAKER_00: They must actively initiate a workflow to request temporary elevation, like I am mathematically eligible to be a database admin.
• 38:39
  SPEAKER_00: I need to do my job now.
• 38:40
  SPEAKER_00: Please elevate my session.
• 38:42
  SPEAKER_02: They submit the digital request through the PAMI interface.
• 38:45
  SPEAKER_02: They are required to provide a valid ticketing number from the IT service desk system, proving there is an authorized change order for the work.
• 38:53
  SPEAKER_00: And crucially, they must specify a highly constrained timeframe.
• 38:58
  SPEAKER_00: They request the elevated role for exactly two hours.
• 39:02
  SPEAKER_02: Depending on the sensitivity of the target server, I imagine that request might automatically ping another senior engineer for a secondary real-time approval.
• 39:09
  SPEAKER_00: Often, yes.
• 39:10
  SPEAKER_00: Doll control workflows for critical infrastructure.
• 39:13
  SPEAKER_00: Once the request clears the policy gates, the PAM system acts.
• 39:17
  SPEAKER_02: It dynamically provisions the necessary administrative credentials on the back end, or it attaches the elevated role directly to the engineer's current session token.
• 39:26
  SPEAKER_00: The engineer steps into the superuser role, performs the database upgrade, and completes the work.
• 39:32
  SPEAKER_02: And here is the defining boundary of the just-in-time architecture.
• 39:35
  SPEAKER_02: When that requested two-hour window expires, the access doesn't just ask to be renewed, it violently evaporates.
• 39:42
  SPEAKER_00: The elevated role is mathematically stripped from the session.
• 39:44
  SPEAKER_00: The engineer instantly reverts to a standard user.
• 39:47
  SPEAKER_02: The standing privilege returns to zero.
• 39:50
  SPEAKER_02: This shrinks the attack surface to a microscopic window.
• 39:54
  SPEAKER_00: An advanced threat actor cannot compromise an administrative credential on a Saturday night if the administrative credential literally does not exist in the environment on a Saturday night.
• 40:04
  SPEAKER_02: It's brilliant.
• 40:05
  SPEAKER_02: It turns a static target into a hyperkinetic vanishing target.
• 40:10
  SPEAKER_02: But the phase four blueprint doesn't stop at just limiting the time the access exists.
• 40:15
  SPEAKER_02: It goes significantly further with a concept called session monitoring.
• 40:19
  SPEAKER_00: Right.
• 40:19
  SPEAKER_00: Because even if that window is only two hours long, you are still handing someone the keys to the kingdom for two hours.
• 40:25
  SPEAKER_02: You need absolute unblinking visibility and control over what happens inside that window.
• 40:31
  SPEAKER_02: What if the authorized engineer decides to go rogue during those two hours?
• 40:34
  SPEAKER_00: Aaron Powell Or what if an attacker managed to hijack the session at the exact moment the engineer elevated their privileges.
• 40:42
  SPEAKER_01: How do you monitor that at a granular level?
• 40:44
  SPEAKER_00: This relies on an architecture where the PM platform acts as an impenetrable proxy.
• 40:48
  SPEAKER_00: Platforms like CyberArx Privileged Session Manager, or PSM, sit directly in the middle of the connection path.
• 40:54
  SPEAKER_02: Unpack the mechanics of a proxy for us.
• 40:57
  SPEAKER_02: How does that change the workflow?
• 40:59
  SPEAKER_00: Normally an administrator would sit at their laptop, open a secure shell or remote desktop protocol window, type in the IP address of the target server, and connect directly to it point-to-point.
• 41:11
  SPEAKER_00: In a proxied PAM environment, that direct connection is physically blocked by network firewalls.
• 41:18
  SPEAKER_00: The administrator is not allowed to touch the server directly.
• 41:21
  SPEAKER_02: Instead, they log into the centralized CyberArc web portal, they find the target server in a list, and they click connect.
• 41:28
  SPEAKER_00: So they are connecting to CyberArc, not the server.
• 41:30
  SPEAKER_02: Aaron Powell Exactly.
• 41:31
  SPEAKER_02: CyberArc receives that command.
• 41:33
  SPEAKER_02: CyberArc then turns around, opens a secure connection to the target server on the back end, retrieves a heavily randomized, complex credential from its encrypted vault, and injects that credential into the server connection.
• 41:45
  SPEAKER_00: It then stitches the administrator's web interface to that back-end session.
• 41:49
  SPEAKER_02: Wait, if the proxy is injecting the credential from a vault, the human administrator never actually sees or types the password for the production server.
• 41:56
  SPEAKER_00: Aaron Powell The human never sees it.
• 41:58
  SPEAKER_00: They never type it on their keyboard.
• 42:00
  SPEAKER_00: And therefore, they can never write it down on a sticky note, they can never reuse it on another system, and a keylogger malware infection on their laptop cannot steal it.
• 42:08
  SPEAKER_02: Aaron Powell The credential remains entirely hermetically sealed within the proxy architecture.
• 42:12
  SPEAKER_02: That eliminates an entire class of credential theft vulnerabilities.
• 42:15
  SPEAKER_00: Aaron Powell But the proxy serves a second, equally vital purpose.
• 42:20
  SPEAKER_00: Yeah.
• 42:20
  SPEAKER_00: Because 100% of the administrative traffic is forced to flow through that central proxy choke point, the PAM system acts as a surveillance camera.
• 42:28
  SPEAKER_00: Trevor Burrus, Jr.
• 42:28
  SPEAKER_02: It records the entire administrative session from start to finish.
• 42:32
  SPEAKER_00: Yes.
• 42:32
  SPEAKER_00: It captures a highly compressed searchable video file of the administrator's screen.
• 42:37
  SPEAKER_00: It logs every single individual keystroke typed.
• 42:40
  SPEAKER_00: It logs the title of every window that opens and every mouse click.
• 42:44
  SPEAKER_02: So if a production database mysteriously goes offline at 3.0 PM, the security team doesn't have to guess what happened.
• 42:51
  SPEAKER_02: They pull up the literal DVR recording of the engineer session and watch the exact command being typed.
• 42:56
  SPEAKER_00: It is irrefutable forensic evidence.
• 42:59
  SPEAKER_00: It makes post-incident analysis incredibly fast.
• 43:01
  SPEAKER_02: However, modern phase four paym systems are not just passive recording devices.
• 43:06
  SPEAKER_02: They employ real-time threat analytics engines that constantly monitor the stream of data flowing through the proxy.
• 43:14
  SPEAKER_02: Give us a concrete example of what the analytics engine is scanning for in real time.
• 43:18
  SPEAKER_00: Let's say an engineer legally elevates their privileges to perform a routine software patch on a Windows server.
• 43:26
  SPEAKER_00: But five minutes into the session, the analytics engine detects the engineer opening a command prompt and typing a command designed to dump the local system registry ashes or attempting to download a known penetration testing tool like Mimicats.
• 43:40
  SPEAKER_02: That is highly anomalous, inherently malicious behavior that has nothing to do with the software patch.
• 43:45
  SPEAKER_02: What does the proxy do?
• 43:46
  SPEAKER_02: Does it just flag the video for someone to review tomorrow?
• 43:49
  SPEAKER_00: No.
• 43:49
  SPEAKER_00: A mature PAM deployment is configured for automated termination.
• 43:53
  SPEAKER_00: The system doesn't wait.
• 43:54
  SPEAKER_02: It cuts them off.
• 43:55
  SPEAKER_00: The millisecond, it detects the forbidden command string right in the middle of the keystroke.
• 44:00
  SPEAKER_00: It instantly severs the back-end connection.
• 44:02
  SPEAKER_00: It suspends the session entirely, locking the user out of the proxy, and immediately fires a critical alert to the security operations center.
• 44:09
  SPEAKER_02: It stops the breach while it is actively occurring.
• 44:12
  SPEAKER_02: That is an incredibly aggressive security posture.
• 44:15
  SPEAKER_02: It takes no prisoners.
• 44:16
  SPEAKER_00: But given that 80% of breaches rely on these accounts, aggressive intervention is clearly necessary.
• 44:23
  SPEAKER_02: Now I do have to ask one highly practical worst-case scenario question.
• 44:28
  SPEAKER_02: We have built this incredibly complex, highly automated, heavily proxied GIT architecture.
• 44:33
  SPEAKER_02: Okay.
• 44:34
  SPEAKER_02: What happens if the PAM system itself crashes?
• 44:36
  SPEAKER_02: What if the identity provider goes offline or there is a massive internal network outage, and the entire just-in-time approval workflow is completely inaccessible?
• 44:45
  SPEAKER_02: Does the IT department just lose the ability to control its own data centers?
• 44:50
  SPEAKER_00: That is the ultimate resilience question, and the blueprint accounts for it.
• 44:53
  SPEAKER_00: Every phase four design requires the implementation of a break glass emergency access procedure.
• 44:58
  SPEAKER_01: Break glass, like the little red hammer sitting next to the fire alarm in a hallway.
• 45:02
  SPEAKER_00: Precisely.
• 45:02
  SPEAKER_00: Break glass accounts are highly secured, extremely privileged credentials that are intentionally designed to bypass all the normal JIT proxies, MFA requirements, and approval workflows.
• 45:14
  SPEAKER_02: They exist completely outside the automated machinery.
• 45:17
  SPEAKER_00: Sometimes there are physical passwords split into two halves and stored in physical safes in different geographic locations.
• 45:24
  SPEAKER_00: Sometimes they are highly monitored digital vault accounts.
• 45:27
  SPEAKER_02: But they are only to be used when the primary identity infrastructure suffers a catastrophic failure.
• 45:33
  SPEAKER_02: And I imagine utilizing a break glass account is not something you do quietly.
• 45:37
  SPEAKER_00: Using a break glass account is the digital equivalent of pulling the fire alarm in a crowded theater.
• 45:43
  SPEAKER_00: The moment that credential authenticates, it triggers massive, unignorable, screeching alarms across the entire security organization, up to and including waking up the chief information security officer in the middle of the night.
• 45:55
  SPEAKER_02: And the post-use process involves intense mandatory audits where the engineers who broke the glass have to legally justify exactly why the normal procedures failed and why emergency access was required.
• 46:09
  SPEAKER_00: It is truly a mechanism of absolute last resort.
• 46:12
  SPEAKER_02: All right, we have covered an immense, complex landscape today.
• 46:15
  SPEAKER_02: Let's pull the camera back and summarize this journey.
• 46:18
  SPEAKER_02: We started this deep dive looking at a murky, chaotic, diagnostic landscape of identity.
• 46:24
  SPEAKER_00: We saw the legacy systems riddled with overlapping permissions, manual help desk errors, and toxic privilege creep.
• 46:31
  SPEAKER_02: And we've mapped out exactly how phase four of the I am blueprint brings mathematical engineering precision to that chaos.
• 46:38
  SPEAKER_02: It turns identity into an automated, highly governed machine.
• 46:41
  SPEAKER_00: It systematically tightens the security controls at every single transition point in the human lifecycle.
• 46:46
  SPEAKER_02: It seamlessly integrates the HR authoritative trigger to perfectly control the exact moment you join the organization with birthright access.
• 46:53
  SPEAKER_00: It dynamically recalculates your risk delta the day you move roles, enforcing separation of duties.
• 46:59
  SPEAKER_02: It deploys continuous access evaluation webhooks to instantly sever your access the hour you leave, permanently closing the latency window.
• 47:08
  SPEAKER_00: It forces managers to actively certify your access rather than passively ignore it.
• 47:13
  SPEAKER_02: Aaron Powell And for every elevated administrative action taken in between, it enforces zero standing privileges, proxies the connection, and records every single keystroke.
• 47:24
  SPEAKER_00: It takes the philosophical concept of zero trust and turns it into tangible operational reality.
• 47:30
  SPEAKER_02: Aaron Powell It really does.
• 47:31
  SPEAKER_02: But before we wrap up, I want to leave you, the listener, with one final highly provocative thought to mull over.
• 47:38
  SPEAKER_02: Something that builds on everything we just discussed, but points toward a very strange future.
• 47:42
  SPEAKER_00: Aaron Powell This is where it gets interesting.
• 47:44
  SPEAKER_02: We have spent this entire deep dive mapping out the human life cycle, the joiners, movers, and leavers.
• 47:50
  SPEAKER_02: We are talking about flesh and blood employees, contractors, and human administrators.
• 47:55
  SPEAKER_00: But there is a glaring statistic buried in the Okta research sources we reviewed that points to a radically different paradigm.
• 48:02
  SPEAKER_02: You are referring to the explosive rise of non-human identity.
• 48:06
  SPEAKER_02: Right now, according to Okta survey data, 91% of enterprise organizations are actively deploying autonomous AI agents.
• 48:14
  SPEAKER_02: Now, we are not talking about simple chatbots that answer customer questions.
• 48:19
  SPEAKER_00: We are talking about sophisticated pieces of code operating autonomously with valid API keys.
• 48:24
  SPEAKER_00: They are making independent decisions, pulling massive data sets, writing to databases, and executing complex tasks deep inside the corporate network.
• 48:32
  SPEAKER_02: And historically, service accounts and API keys have been managed horribly, operating almost entirely outside the strict human governance structures we just spent an hour detailing.
• 48:41
  SPEAKER_00: Exactly.
• 48:42
  SPEAKER_02: So here is the question you need to ask your own security teams.
• 48:45
  SPEAKER_02: Do we need a joiner-moverlever process for a piece of code?
• 48:49
  SPEAKER_00: Because if an autonomous AI agent dynamically changes its function, say it optimizes itself and moves from executing a marketing task to analyzing a financial task, how do you perform a delta analysis on its permissions?
• 49:00
  SPEAKER_02: Who is the manager that certifies an AI's access?
• 49:04
  SPEAKER_02: And most terrifyingly of all, if that AI agent hallucinates, goes rogue, or has its API key compromised by a threat actor, how quickly can your IAM architecture trigger an agent universal logout?
• 49:18
  SPEAKER_00: Because if you think a disgruntled human employee can do a lot of damage in a four-day latency window, an autonomous script running at machine speed with an administrative API key can dismantle a corporation in four seconds.
• 49:32
  SPEAKER_02: It is undeniably the next great frontier of identity security.
• 49:36
  SPEAKER_02: The phase four blueprint is going to have to rapidly evolve to govern the machines with the exact same rigor, if not more, than it currently governs the humans.
• 49:44
  SPEAKER_00: It is a wild, slightly terrifying thought to end on.
• 49:46
  SPEAKER_02: But that is why we do this.
• 49:48
  SPEAKER_02: Thank you for joining us on this incredibly deep dive into the machinery of identity.
• 49:52
  SPEAKER_02: Take these concepts back to your own organizations, keep questioning the legacy systems around you, keep looking for those hidden latency windows, and we will see you on the next one.
• 50:01
  SPEAKER_00: That's a wrap on securing identities from higher to fire.
• 50:05
  SPEAKER_00: We mapped the entire human life cycle today.
• 50:08
  SPEAKER_00: Joiners, movers, leavers, flesh and blood employees, and administrators.
• 50:13
  SPEAKER_00: But here's the thought I want to leave you with.
• 50:16
  SPEAKER_00: Right now, 91% of enterprise organizations are deploying autonomous AI agents, code operating with valid API keys, making independent decisions deep inside the corporate network.
• 50:28
  SPEAKER_00: A disgruntled employee can do damage in a four-day latency window.
• 50:32
  SPEAKER_00: An autonomous script with an administrative key can dismantle a corporation in four seconds.
• 50:38
  SPEAKER_00: Do you need a joiner mover lever process for a piece of code?
• 50:42
  SPEAKER_00: Who certifies an AI's access?
• 50:45
  SPEAKER_00: That's where we're heading next.
• 50:47
  SPEAKER_00: Connect with me on LinkedIn at LinkedIn.com forward slash IN forward slash Ernie Prescott and subscribe now so you don't miss it.
• 50:54
  SPEAKER_00: Until next time.