Latest / Identity at the Center / #406 - IDAC MailBag for February 2026

Transcript

#406 - IDAC MailBag for February 2026 · Identity at the Center

0:05
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:17
You have any idea what I'm going to hit you with today?
0:19
I have no idea, I never know. The first like 2 minutes is
0:22
usually just reacting to whatever is in that brain of
0:26
yours. OK, so we keep getting, I
0:29
shouldn't say we, I keep getting messages from listeners who say
0:34
will you guys be at the RSA conference?
0:37
And you know, I've been on your case about this for like 2
0:40
years. I think we should try to make
0:43
the effort to go, but I think you feel like it's not effort.
0:49
Well, well placed. Explain yourself.
0:53
Explain with, all right, I just think it's a giant noisy
0:58
conference. And look, we don't have any
1:00
relationships with the RSA conference.
1:02
So we don't have like any poll or anything like that where, you
1:05
know, we'll have a spot that we can like sit down and record.
1:09
So I don't see any value in going there and trying to be
1:12
part of it without that. Be honest with you, it's too
1:15
busy. The the Expo hall is just a
1:19
madhouse. It's huge.
1:21
It's two Expo halls connected by the underground tunnel in the
1:24
Moscone Center. It's great.
1:27
I think to go and just sort of like walk around the business
1:29
hall and just see what's out there and, you know, see who's
1:33
who's got what products and sort of what problems are being
1:35
addressed. But yeah, I don't know.
1:37
I just, I feel like it's just, it's not, it's not welcoming, if
1:43
that makes sense. So the reason I brought this up
1:46
and put you on the spot was I want to get feedback from
1:50
people. So in the comments, if you're
1:52
watching this on a YouTube or if you're not and you want to go
1:55
out to YouTube, put comments there.
1:59
Let us know if we should go or if you agree with Jeff that it's
2:04
fodder or hit us up on LinkedIn. After this episode goes live,
2:09
comment on the LinkedIn post. It's just an expensive location,
2:13
too. San Francisco is crazy expensive
2:15
for hotels and it's just, I just don't see the value in it,
2:20
especially when our niche's identity specifically.
2:22
Could we do something there? Yeah, absolutely.
2:24
But without having like a specific space to record from, I
2:27
just feel like it would just be kind of like just walking around
2:30
and. Yeah, I don't want to do that.
2:32
I but I just feel like my identity is at the center of
2:37
cybersecurity and that is the biggest cybersecurity conference
2:42
that I know of. Doesn't.
2:43
But biggest doesn't mean the best, especially when it comes
2:46
to conferences, right? Well, yeah, for sure.
2:49
I mean, we have look, our our niche right is identity identity
2:53
security, digital identity, identity and access management,
2:55
whatever, whatever we're calling this, you know, industry Now RSA
3:00
is a great conference. I've been to it several times.
3:03
I can't remember the last time I actually went to a session
3:05
though. You know, my pro tip is if
3:06
you're interested in going, just get a business hall pass.
3:09
They used to be cheap, like 50 bucks.
3:11
I don't know what they're what they are now, but between, you
3:14
know, prices of hotels and airfare, especially coming from
3:17
the East Coast, I just saw more value when walking around the
3:21
Expo hall and just seeing what products are out there.
3:24
Yeah, it's like the CES version of cybersecurity.
3:30
That's a, you know, that's a great way to put it.
3:31
I mean, yeah, the CES of cybersecurity, that might not be
3:36
great. Maybe that's not the analogy
3:38
they want, but I think it fits. Yeah.
3:41
But as far as conferences for us this year, we are going to, we
3:47
are going to EIC in May, we're going to Ideniverse in June.
3:52
I expect we're also going to authenticate in October.
3:56
But obviously we don't have all that worked out yet.
3:59
But I do want to mention, I saw an e-mail come out today that
4:04
March 31st is the deadline for call for speaker.
4:07
So if you have a story to tell at authenticate, make sure that
4:13
you're cognizant of that date. It looks like the conference is
4:16
going to be back at the Omni La Casa in Carlsbad, CA Bring all
4:23
that up because it's like one of my favorite conferences of the
4:26
year. It's like, definitely not the
4:28
biggest one, but how many conferences do you go to?
4:33
And it's like at like a killer resort.
4:37
Killer Resort's nice, but it's actually just a good conference
4:40
of good people. So that's like more of a draw
4:41
for me. I mean, I don't spend much time
4:43
in the room anyway, so it really doesn't kind of matter.
4:45
But we've we look, we have to go back to authenticate.
4:49
We, we cannot leave Fido feud round two unresolved like we did
4:54
last year. And so, you know, my
4:57
expectation, expectation is that we'll be back in October and you
5:01
know, round three you versus Megan.
5:04
But we still need to talk with Megan and Adrian and Andrew and
5:06
others to get things figured out.
5:08
But my hope is that we'll be back and we can we can finally
5:12
get some resolution to last year, which was a tie, which
5:14
should not happen in a game like that.
5:18
You know, so today we've got a mailbag and I kind of feel like
5:24
these mailbags come up and we just, we do them when we have an
5:28
opening on the schedule or sometimes we plant some
5:31
openings, the questions back up. So we get a lot more questions
5:37
than we're able to go through today.
5:39
We're going to try and get through, I think like 8 of them.
5:42
But to those who've sent questions, we haven't gotten to
5:46
them yet. Please don't take it personally.
5:48
It's just we get overwhelmed with this sometimes.
5:52
It's a lot and I try to answer ones and I think we and I both
5:55
do answer quick answers where we can, but sometimes the answers
5:58
are or the questions are really good.
5:59
It's like, yeah, you know what, let's let's either also address
6:02
it here or hey, you know what, that's a great one.
6:05
You know, keep listening. We're going to do a mailbag
6:07
episode and a few days, weeks, months, whatever that looks
6:09
like. And, you know, try to get to in
6:10
there. Obviously if it's something
6:12
urgent, you know, put urgent, I think in your LinkedIn message
6:15
and we'll try to respond a little bit quicker.
6:16
But for the most part, yeah, these have been queuing up for a
6:19
little while. And we've got a global mailbag.
6:23
We've got eight that we want to get to, plus a few lighter note
6:27
ones from listeners, which are always fun.
6:30
So I'm just going to kick things off, go try and keep an eye on
6:32
the clock. We try to stay around, you know,
6:34
45 minutes to an hour or so in that area.
6:36
So if we start to get long winded, you know, I might give
6:39
you the signal, like, come on, pick it up, let's go.
6:42
And the same goes for you. If I'm getting long winded, do
6:44
the same thing because we certainly like to talk.
6:45
But let's get into it. Let's see.
6:48
First up, we've got Hans from Munich, Germany, of course, AIAI
6:53
at the center at dot com, go to that URL brings you here.
6:56
With AI tools becoming a regular part of how we work, how are
7:00
identity teams thinking about governing access for AI versus
7:04
access for humans? Does the same thinking apply or
7:07
does it require a completely different approach?
7:11
Jim, what are your thoughts on that?
7:13
Well, I think you know a gentic AI is probably the thing most
7:17
people are focused on is organization within the
7:21
organization. If you get put the tools in end
7:24
users hands and they are semi technical, they start building
7:29
agents and you have to control the access to control the login.
7:34
You have to control the creation of accounts because you don't
7:37
want people just stuffing their own personal account in.
7:40
I think the question also makes me think about, you know, what
7:45
we're doing now, first of what we're going to have to do in the
7:48
future. I think there's going to be a
7:50
lot more of AI agents that are doing things in the environment
7:57
versus human beings doing those things.
8:00
And maybe it's not because the people start going away.
8:04
Maybe it's just because the multiplication of agents becomes
8:09
so great and you have this workforce that's working 24
8:12
hours a day. I also think, though, that what
8:16
we should be thinking about is that the threat actors also have
8:21
AI and that they're spinning up agents to basically find their
8:26
way into your organization, find little holes and breach your
8:31
organization. And so you have to think about
8:33
it. It's not somebody, some super
8:36
hacker on the other end typing lines of code.
8:38
It's 24 by 7, 365 agents looking for their weigh in.
8:44
I think you know, there's no sure silver bullet that's going
8:49
to solve all this, but what I think you can do is look for the
8:54
easy entry points, right? You need to be searching your
8:59
environment. ISPN is kind of the solution du
9:03
jour to identify holes in your identity infrastructure that
9:09
could be penetrated. And I think also after you
9:13
potentially are penetrated, do you have the tools in place that
9:16
can spot, identify that you have an appreciation, take evasive
9:23
action And all this has to take place in, you know, milliseconds
9:28
or seconds. You can't can't like send a
9:31
report and send it to a human being to act on.
9:34
That's way too slow for where we're at.
9:38
Your thoughts? I'm going to take it up a higher
9:41
level and just focus sort of on the macro world of governance
9:46
and, you know, human identity is built around, I think this
9:50
assumption of accountability. So there's a person behind this
9:53
access and we know who that person is.
9:57
An AI tool, you know, blends that a little bit, maybe blurs a
10:01
little bit where it could be a human still behind the the non
10:06
human access or the AI tool could be an API, could be a
10:09
bunch of things. But I think still the same
10:12
foundational principles still apply.
10:15
It's still, you know, least privilege, you know, maybe 0
10:19
standing privilege. It's still, you know, does is
10:21
the right, is the access appropriate for whatever it is
10:24
The thing is trying to do? How often do you review the
10:28
permissions on those accounts? You know, very similar to what
10:31
we would do for humans. I think you hit the one thing
10:33
for me is the scale of it and the speed of it is the other
10:36
thing is this cannot be, you know, well, we review our
10:40
accounts every month or quarter or year.
10:44
I think, you know, when we're talking about AI tools and I'll
10:47
lump in anything non human around that.
10:49
So a gentic service accounts, anything that's just not a human
10:53
behind the access is speed matters.
10:56
And so how are you governing those philosophically to make
11:01
sure that you can keep up with not only the speed but also the
11:04
scale? You might spawn a hundred, a
11:07
thousand different agents. You know, by the time we get
11:10
into this little more mature over the next couple years,
11:12
we'll probably be dangling each of us, you know, a few 100 non
11:18
human identities that are doing things on our behalf for us in
11:22
anticipation of things that we need, right, things like that.
11:26
But the behavior is still much closer to a human account than
11:29
it is to just an API, which is just the same transaction over
11:32
and over again. Those will still need to be out
11:34
there, but I think managing that life cycle will be very
11:38
important. So it'd be interesting to see,
11:40
you know, how does IGA, for example, get involved with this?
11:42
Can IGA keep up with millisecond speed life cycle needs, or is
11:48
that a different platform? You mentioned ISPM, there's also
11:52
IVIP, right? Visibility, I think there's a
11:55
bunch of these things and it wouldn't surprise me that we
11:58
come up with new acronyms for new products or plot products
12:01
maybe that blend a couple different areas.
12:03
But I think it still comes down to do you know who has access to
12:06
what with an extension of do you know not just who has access to
12:11
what, do you know what has access to what or what has
12:14
access to who? So I think it just, you know,
12:17
it's, it's going to be a very similar governance framework, I
12:20
think, but the speed and scale are going to really be the the
12:24
trouble spots for people to think about.
12:28
I think. I think you made a.
12:30
Great. No noise.
12:31
All right. So no, no, I'm not going to
12:34
argue with anything you said. So let's keep going so that we
12:37
can get through as many of these as is possible.
12:41
OK, do you want to read the next one or you want me to read it
12:44
off? Why don't you read all the
12:45
questions and then we'll take turns going first on answering.
12:48
OK, yeah, I forgot. We decided I would read them
12:50
all. All right, let's go with
12:52
Gabriella. Where is she from?
12:54
San Sao Paulo, Brazil. We keep hearing that passwords
12:58
are going away, but they are still very much reality in our
13:01
organization. What is a realistic first step
13:04
for companies that want to start moving toward password list
13:07
without disrupting everything at once?
13:10
I'm going to interject here and I want your thoughts on this
13:12
too, but I, I don't think the first step is to replace
13:15
passwords everywhere. This is very much a point
13:19
solution. It's a arrow in your quiver of
13:23
things that you can pull out and use.
13:25
But I don't think we're at the state where it makes sense for
13:28
the most people. Most of the time just say, hey,
13:31
we're getting rid of passwords. I think you trial it, maybe a
13:34
new application, you know, maybe a specific application, but I
13:37
don't think you, I don't think you focus on trying to do it all
13:40
at once. Start small, start where it
13:43
makes sense and then look to expand from there.
13:45
Thoughts. Yeah.
13:46
I mean, that's actually a lot of what they're willing to say.
13:49
But I do want to start with there's two different scenarios.
13:52
So there's passwords for your customers, there's passwords for
13:56
your enterprise. I think for your customers, the
13:59
answers like how quickly can you get pass keys in place.
14:03
I mean, that's like a very, it's becoming you a ubiquitous
14:07
solution and it's a wave to transition away from password
14:12
and create a good user experience that's more secure
14:16
than traditional passwords, even passwords plus MFA.
14:20
But I think even in that scenario, Jim, it's a another
14:23
option still for customers because not every customer might
14:27
trust pass keys yet because it's still relatively new.
14:29
They heard this thing. It's like, what is this?
14:31
It sounds secure. I was doing it.
14:33
So I don't, I don't, I don't, I haven't seen any companies yet
14:35
that are pass key only. I think what I've seen more
14:37
often than not is people are being asked to enroll a pass key
14:43
at the same time they're doing a new account creation or
14:45
password, but they still have a password.
14:47
I imagine at some point they'll probably shut that off, but I
14:49
don't know if it's necessarily like binary still, even on the
14:52
customer side. It's not from what I've seen,
14:54
and I'm happy to be wrong if somebody out there is like,
14:55
yeah, here we're doing it and it's 100% and it's great.
14:59
Hit Jim and I up on LinkedIn because I'd love to hear more
15:01
about the use case. Yeah, I mean, actually, so
15:04
Denise was running through a scenario, I think it was with
15:07
Amazon the other day. And so she has her account.
15:11
I have my account, I'm paying for prime, she's paying for
15:15
Prime. We don't need that anymore.
15:18
Twice the prime. So she went in as like, do you
15:21
want to create a pass key? And she was like, no, I just
15:24
like shut my account down. So I'm sure most companies don't
15:29
really care about that use case where people want to shut their
15:32
account down. But I agree with you, it's not
15:34
black or white on the enterprise scenario, you're potentially
15:40
have hundreds of different identity silos.
15:46
But I think what you ought to look at is trying to go password
15:51
lists on your biggest identity provider.
15:53
So your Microsoft Azure, your Okta, whatever kind of IDP you
15:59
have in place. Like that's where you're going
16:01
to get the biggest gains from replacing passwords with some
16:06
kind of hardware factor, some kind of other authenticator tool
16:13
even like a what do they call it within the Windows platform.
16:18
For what passwords? For password less, yeah.
16:22
Oh yeah, Windows Hello. Yeah, Windows, Hello.
16:25
So what I was going to say is like, I think focus on the
16:28
solution where you get the biggest bang for your buck.
16:31
But they also have kind of come up with a solution for password
16:35
less, right? So it's not like you have to
16:36
invent the wheel, reinvent the wheel.
16:38
Then I think the focus ought to be move more of your enterprise
16:42
platforms to use those for authentication rather than
16:47
trying to come up with a pastorless solution for each one
16:50
of your stand alone solutions. That may not always be possible.
16:54
You may need to look at it a different way, but I think
16:57
that's a general approach that I would recommend anything.
17:00
And I'm I'm going to get out of soapbox here because I think
17:04
most people that listen to the show are probably aware of the
17:06
website SSO. I think dot tax that shames
17:10
companies that are still charging for like SSO
17:14
functionality as an extra like no, man, if you're listening,
17:18
you're one of those companies that should be standard.
17:21
Like that is better security for everybody, including the company
17:24
that sells at selling this stuff.
17:25
So yes, get onto a single, you know, SSO as much as you can
17:29
beef up your IDP, make it strong, make pass keys an option
17:33
there. And then I think overtime, you
17:36
know, you probably run some sort of, you know, campaigns to
17:38
communicate and really truly start to kill off the password.
17:42
I think there'll be some interesting things coming out of
17:43
authenticate this year. We talked about earlier, but
17:45
they put some announcements out recently about pass key
17:48
portability and being able to transfer pass keys from one
17:51
wallet to another, which I think is huge.
17:54
You know, you're not locked in as much as you were before as
17:58
and then even as much as you were before that where you were,
18:01
you know, well, I have a Windows pass key.
18:02
Well, now I need a Mac OS pass key and now I need a Google pass
18:05
key. Now you've got password walls
18:07
going to sync that all of that together.
18:08
But there isn't really a standard yet.
18:09
But it's, it's, I think it's, it's either final or about to be
18:12
final. The first spec of being able to
18:14
transfer something. Oh, OK.
18:15
Well, I use the LastPass wallet, but I now I want to use bit
18:17
Warden or Keepass or something else, right.
18:20
As these wallets start to standardize and integrate that,
18:23
that'll make it easier from a consumer standpoint to choose
18:26
the wallet that you already like and be able to move things
18:29
around as needed. So I think that's that's where I
18:31
would start to. Yeah.
18:34
All right, let's get to. Let's see who's next.
18:36
Wei from Singapore. Hopefully I'm pronouncing that
18:38
correctly. Identity programs seem to mean
18:41
different things depending on who you talk to.
18:43
How do you define what a mature identity program actually looks
18:47
like? And how do you know when you are
18:49
getting there? What do you think?
18:52
So a couple of factors. I think you know what I think of
18:56
mature. I think of use frameworks to
19:00
guide your decisions. Use methodologies like project
19:03
management methodology. You don't just wing it.
19:07
You have KP is and other quantitative ways to measure the
19:12
success of your program. But I also think so that's kind
19:17
of like running a formal program and that will get you a tick
19:21
mark on a lot of the traditional ways to measure how mature is
19:25
your program. I think from a there's also two
19:29
other factors I want to talk about. 1 is adaptability.
19:33
What's happening in this environment or in this industry
19:36
is happening so quick. It's not just this industry,
19:39
it's a technology in general with AI really kind of being the
19:43
buzzword and not just a buzzword.
19:45
I mean I I almost hate calling AIA buzzword because even though
19:49
it gets used as a buzzword, it is a ground shift.
19:52
It's much more of a ground shift I think than cloud was.
19:56
I actually could see in the future people re bringing their
20:02
their infrastructure back on Prem.
20:04
I know that's going to drive some people crazy, but I could
20:07
see, I could see organizations doing that in the not too
20:12
distant future. I think you have to be adaptive
20:14
to these things that are changing.
20:17
I think we've always thought about identity as IGA, access
20:21
management, privilege access management.
20:23
Now it's so much more. It's all those areas we talked
20:26
about earlier ITDRISPMIVIP. All these things are also very
20:33
important is because the boundary of what was identity is
20:36
becoming bigger. The attack surface is changing
20:41
and we need to as identity program leads, we need to adapt.
20:46
We need to say, OK, this is the space of identity now with take
20:51
on more. I think along taking on more is
20:55
bring your leadership along so that they understand why you
20:58
have to take home more and why then you need a bigger budget
21:01
etcetera. The other thing is just I think
21:05
a mature environment is highly automated.
21:08
So if you find yourself in the case where you having humans do
21:13
a lot of things that could be automated away, that is a sign
21:17
of you're not running a very mature IM program.
21:22
So those are my thoughts. I'm going to slightly disagree
21:26
with the last part around automation with the distinction
21:31
of you can have a very mature program, but if you have a very
21:37
small organization, maybe under 100, maybe automation still
21:41
isn't there yet from a a value perspective, right or prospect
21:46
to be able to get the maternity investment.
21:47
You can still be mature and not be automated.
21:51
But I do agree at some point you outgrow being able to be mature
21:56
consistently from a from a governance standpoint without
22:00
tools. But tools do not mean that you
22:02
are mature from a governance or from a program standpoint.
22:05
So I think about it from like a mature identity program is not
22:09
about the most identity tools. It's consistent, it's reliable,
22:13
it's auditable, it's processes that are well documented,
22:17
standards are in place, policy's in place and the business
22:20
trusts. It doesn't necessarily mean that
22:22
it's automated though, in my mind, at least not until you hit
22:25
a certain point. I think you need to be able to
22:28
answer, you know, the basic questions.
22:30
Do you know who has access to what?
22:31
Or again, do you know who were what has access to who were
22:33
what? And that will help determine,
22:36
you know, how you how mature you are in certain areas from a
22:41
program perspective. I think at more of the people
22:44
and governance standpoint, do you, you know who owns identity
22:49
for the organization? Like if that person isn't
22:53
identified, then you've got problems.
22:55
You're not a mature organization.
22:57
You know, Jim, Hey, you know, you and I do workshops like this
23:00
all the time in our, in our day jobs.
23:01
And you know, when the first question is, oh, yes, All right,
23:03
So who owns identity? And you get a, a bunch of
23:05
different answers. You know, you might get one, one
23:08
person raises their hand and everyone agrees.
23:11
Yes. You know, Jim, you are the owner
23:13
of identity. Another scenario, right?
23:16
Because you raise your hand. The other one could be, you
23:18
know, Jim, you raise your hand because you think you own it.
23:21
Someone else in the room raises their hand and another other
23:24
person. Now you've got multiple owners
23:26
of identity, you know, or you have Jim raising your hand.
23:30
Everyone's pointing at Jim, but you're bracing your hand at
23:33
someone else or no one raises your hand because no one has
23:37
identity. So I think from a charity
23:38
standpoint, you know, if I think about this from, again, from a
23:40
program level, less about technology and more of how do
23:43
you run an efficient program, there are some foundational
23:47
questions to ask. Who owns identity?
23:49
Do they know about it? And then who are the, what are
23:52
the roles and responsibilities of the IM program?
23:55
Because a lot of people think they own identity and that they
23:59
are the A in the racy chart and they are not.
24:02
They might be an R, you know, in a certain area or certain
24:05
capability or certain delivery, but you know that there needs to
24:09
be a, a discussion internally to make sure everyone's on the same
24:11
page. I'm.
24:13
Going to push back on the automation because I one of the
24:17
lines that you, one of the lines that you like a lot is punching
24:22
above their weight. So to me, punching above your
24:26
weight as an identity program means let's just throw some
24:31
numbers at this hundred person organization.
24:34
How how big is your identity department department going to
24:36
be one person part time probably how Or say you have 10,000
24:43
people and you have an identity department of 10 people.
24:46
I don't know. How do you force multiply what
24:53
you can get done as a program without technology?
24:59
You know, if you can get technology to, you know, answer
25:04
help desk calls or do tickets in a better way.
25:08
All the things that you have to stand up, do single sign on.
25:12
Maybe remember we had the CEO of Red Block on one of our earlier
25:17
podcasts. You talked about, you know,
25:19
their their focus of using recorded videos of how to
25:24
provision and then teaching and creating connectors for
25:29
provisioning. Like that's a force multiplier.
25:32
That's how you get more done using technology.
25:35
And that's why I think automation is such a
25:37
foundational aspect to maturity, is that you can punch above your
25:44
weight. I, I, I think the force
25:47
multiplier makes sense, but if you're never going to grow
25:50
beyond 100 people, there's no reason to multiply that force or
25:55
an automation use case. Could you be more efficient?
25:58
Yes. But you can still be a mature,
26:00
I'm a very mature organization with a small amount of people
26:03
and a, you know, even small amount of people making sure
26:05
that things are getting done the right way.
26:08
But. Again, I, I, I, I guess I
26:10
somewhat agree that at some point you will outgrow manual
26:14
effort. You're still brute forcing it
26:16
with hands on keyboards and humans doing things.
26:18
At some point, if the organization is of a growth
26:21
mindset, meaning head count will grow.
26:24
And I don't, you know, the, the number is almost irrelevant.
26:27
Maybe it's 100, maybe it's 1000, maybe it's 50.
26:29
Kind of depends on the industry you're in as well and what your
26:31
regulatory requirements are that you need to be able to
26:33
demonstrate. But at some point you do need
26:36
automation, but I don't think it's the first thing that you
26:39
look at from a maturity standpoint.
26:41
I think this is where AI becomes a game changer, right?
26:44
If you're that hundred person organization, like I said, your
26:49
IT department is probably only a handful of people.
26:53
And how can you do access management?
26:57
How can you do IGA privilege, access management, all the other
27:01
things that you should be doing with you have 100 people or
27:04
10,000 people if you got, you know, valuable PII or other data
27:11
needs to be properly protected. How can you do that with such a
27:14
small number of people if you don't have a way to automate?
27:19
And I'm thinking when I said AI is just have agents that become
27:24
your identity team. I mean it's an option for sure,
27:29
but if I think about I'm going to, I'm going to go back to it
27:33
again. It's a hundred person
27:34
organization. The changeover in permissions
27:39
probably isn't taking place very often.
27:40
You're not hiring as much because your on boarding is
27:43
still around 100. You may not be doing that much
27:45
on boarding, you might not be doing off boarding because it's
27:48
a very stable organization. So the volume isn't there for
27:51
that. You know, people might shift
27:53
around roles and that's probably if I'm an if I'm an ID admin,
27:57
that's probably where I'm spending more of my time is, you
28:00
know, Jim taking on this new project, needing access to this
28:03
other thing, you know, wearing 2 hats, right?
28:05
Those sorts of things. But if I still have policies and
28:08
standards in place and people are adhering to the policies and
28:11
standards, the volume of work associated with 100 person
28:16
organization, I think it's still manageable with maybe somewhere
28:21
between 3:00 and 5:00 people doing IAM things kind of as a as
28:26
a very broad generalization. But if you grow or if you expect
28:31
that head count to grow or terminate a bunch of people,
28:34
right, yes, automation's definitely going to help.
28:37
Most organizations are looking to grow.
28:40
But I know I think there is a handful that are like, yeah, we
28:42
are like Jim, you and I are a perfect example.
28:44
We are a two person podcast. That number has not changed in
28:50
six years. Yeah.
28:51
Now we have a bookkeeper and now we have another member of our
28:54
board for the non profit. So technically we're four
28:56
people, but we are not a headcount growth organization,
29:00
right? We are very much using AI.
29:05
But not for. Using technology, we're using
29:08
technology. We're so much more mature, not
29:11
just because we have better cameras and better microphones,
29:14
but the editing that you do, the the notions that we use to kind
29:19
of shape up shows and prepare. It's like we wouldn't be able to
29:24
do the volume of shows that we're doing for the last seven
29:28
years if we hadn't grown technology wise.
29:31
But This is why we started the podcast, right?
29:35
We're going to suck on this question because we can go.
29:37
All day. I don't want to let it go.
29:39
Yeah, you don't want to let it go.
29:41
I'm good with letting it go. But This is why we started it,
29:46
right? Because we have these awesome
29:47
conversations and they usually with end of the stalemate,
29:51
right? And then we'd say a couple of
29:53
days later, like. Jim, I have to end.
29:55
I'm going to go back to Jeff. I, I got a zinger.
29:57
I I I got this debate solved. I will just say that you
30:03
mentioned AI tools, not the identity and access management
30:06
of those tools. That's a different beast.
30:10
But yes, we use AI tools, but we don't use any AI for identity
30:14
and access management. We just don't.
30:16
We don't need it. We're too small.
30:18
It doesn't matter. Like we're, we're good.
30:21
All right. And that gives me the last word.
30:23
So let's move on to the next question.
30:26
Let's go to, let's see Marcus from Toronto, Canada.
30:32
Our security team and our IT team both think they own
30:37
identity. How have you seen organizations
30:39
successfully sort out who is responsible for what and doesn't
30:42
even matter as long as the work gets done?
30:44
So I didn't even think about this question when we were
30:46
answering the first one and having different roles and
30:49
responsibility. I think that is the question.
30:52
And actually just had a conversation about this in my
30:54
day job. You know, I think it was
30:56
actually earlier today you need to sit down and talk as a group
31:00
and say, OK, who is really the A here?
31:03
Is there a difference between program ownership versus product
31:06
ownership versus infrastructure versus, you know, delivery of
31:10
services, you know, plan, build, run, you know, whatever you want
31:13
that to look like. But I think the most important
31:16
thing is getting a room or get online and hash it out, figure
31:20
it out, set up clear, clear roles and responsibilities.
31:24
What I have seen in the past is security tends to own the IAM
31:30
program, but they may not be the entire delivery of the IAM
31:36
program's capabilities. So they might be responsible for
31:39
architecture policies, standards, maybe setting the
31:41
strategy in the direction. But there might be an IT group
31:45
inside of an organization that is responsible for standing
31:47
things up like Active Directory, Entra, Octa, IGA, Pam, right.
31:52
Well, all the, all the different products and IT security might
31:56
be a customer of those services. And then you get into the run
31:59
side of things, operations, you know, that could be the help
32:01
desk, which typically is IT. One organization that worked for
32:04
a long time was we were fully 100% plan, build, run was all in
32:08
IT security for IAM. Like that was my first kind of
32:11
real major role. And we did everything.
32:13
We were a call Center for identity.
32:15
We built and ran the tools for identity.
32:18
And we also set the vision in architecture.
32:20
We're in the strategy. So I think that's a little bit
32:23
of a dying breed. So I think I see more of the
32:24
shared model, but my my advice would be just talk, get a room
32:29
and talk and figure it out and make sure it's clear what are
32:33
the roles, responsibilities and try to get to 1A but as few, as
32:37
few as accountable in that racing matrix as possible.
32:41
That'll make life a lot easier for you going down the road.
32:44
I think Marcus makes a good point.
32:46
He kind of lays out the the issue and then he says doesn't
32:49
even matter. And it's like, it's a good
32:52
point, right? Doesn't matter if everything's
32:54
getting done and there are no problems and maybe it doesn't
32:58
matter. Where this seems to crop up the
33:00
most is that there are things that go wrong and then there it
33:05
comes a matter of like whose responsibility is it at certain
33:09
points in the plan building run life cycle of projects or of
33:14
doing identity, if you will. I've always felt that identity
33:19
belonged to information security, but I'm also willing
33:23
to state that that that scenario creates a conflict of interest
33:28
because in other types of technology, so ERP or CRM or you
33:35
know, anything outside of identity or outside of security,
33:39
you have information security playing a role, which is kind of
33:43
the watchdog role to make sure that security boundaries are
33:47
being adhered to, security policies and standards are being
33:50
adhered to. When you're talking about
33:52
informational security projects like identity would be in kind
33:57
of that that scenario that I recommended you wind up not
34:03
having that watchdog. It's you're watching yourself,
34:07
your information, you are information security.
34:10
So who's making sure that you're following information security
34:13
policies? Well, you are.
34:15
And that puts your leadership in a tough position where they
34:19
might have to either miss a go live date or let things slide on
34:26
information security policy basis, right?
34:29
So it's kind of a philosophical separation of duties kind of
34:35
thing. I still think it's the right
34:37
place to put it because that's a lot of times where the expertise
34:40
lies. 20 years ago might have been different.
34:44
Where I think IT is in general, it was kind of more of a user
34:48
experience with identity. Nowadays, I think it's more
34:54
identity security and so it belongs in informational
34:59
security in my opinion. You know, it's generally the
35:01
right answer, but if it's not there and you're talking about
35:05
moving it there, then I think that's you have to make the
35:08
case. But I think for most
35:11
organizations that that I worked with anyway, there's under the
35:15
umbrella of the information security office led by the CSO
35:20
is where identity sits on that it's usually proper.
35:24
Yeah, I think so. From the program side, I still
35:25
don't. I don't necessarily care where
35:28
the infrastructure is getting built for identity, as long as
35:32
it's getting built in its following policy.
35:35
And that's the biggest, that's the biggest thing with Microsoft
35:38
Tantra as single sign on platform, because are you going
35:43
to say, oh, these certain people do access management and other
35:47
people do everything else that Entra does?
35:50
I've actually never ever seen that.
35:53
And I've worked with somebody pretty large organizations.
35:57
It's just there's no logical separation once you're in Antra.
36:01
And there might be people who are specialists or things like
36:04
that. But yeah, if if you have a big
36:08
AD environment, a big Antra environment and you know they're
36:11
going to do access management. And IT is probably going to own
36:15
that, not IT security, but IT security is going to set the
36:19
policies and standards. You bring up a very a point that
36:24
makes me very nervous. If an organization cannot trust
36:27
their IT security department, you know, to follow their own
36:30
policies, you've got other problems and you know that that
36:33
idea of watching the watchers, you know, makes sense.
36:36
But I think that's where your internal and external auditors
36:39
come in as well because they are typically not part of IT
36:42
security. They might be part of a
36:43
different risk function or maybe just even just an audit
36:45
function. You know, that could be an
36:47
option there. I also don't see very many large
36:50
IT security organizations unless there has been a conscious
36:53
decision to take in the technical work, which means
36:58
building and running and 24 by 7 OPS for all the IT things.
37:02
Which again, you're almost standing up like a duplicative
37:05
organization for security tools versus what it already has in
37:10
place. Again, I don't really care so
37:12
much as long as the roles are defined, understood and agreed
37:17
upon. Yeah, I, the only thing you said
37:20
there that triggered me was that, well, you, you know, if
37:24
you're in charge of informational security, you
37:26
shouldn't need somebody to make sure you're following the
37:29
policies. That's why separation of duties
37:31
exists. Like you shouldn't have to have
37:33
accountants, you know, split their duties because why should
37:37
they commit fraud? Well, unfortunately, people do.
37:41
Yeah, but let's, let's be real, if IT security is responsible
37:45
for all this, who is checking them?
37:47
I think it's probably internal audit followed up by an external
37:50
audit because you're not going to go and stand up another, you
37:54
know, another team to check the security team.
37:57
Like that doesn't make any sense.
37:58
That's what auditors are for. So I just like, wow, what a what
38:02
a terrible position to be in if you're the CEO and you don't
38:05
trust your IT security team. Like you got other problems man,
38:07
you got to figure that out. Yeah, no, it's true.
38:10
But you trust everyone, but it's like the whole trust but verify
38:16
if your first, second and third line of defense for a reason.
38:20
But we work for the public accounting firm during the day.
38:23
We had a steady helping of this stuff and that those reasons
38:27
those things exist. I will say this.
38:30
So my experience with audit of IT process like that, it's very
38:38
likely that you could say, heck, we didn't finish the scan with
38:44
with the level of precision that we expected to.
38:50
Should we go live anyway. And someone says, yeah, just go
38:52
live and make a executive gut decision, right.
38:57
That might not be up to self in terms of somebody auditing it,
39:01
but it's very likely that never gets audited, that never ends up
39:06
on anybody's dashboard. Yeah, maybe, maybe not.
39:10
I think the problem there is it's a little bit of a
39:15
conspiracy theory type approach. Now you're starting to think,
39:18
OK, how many people are going to keep quiet in the middle of this
39:20
thing, especially when something goes wrong?
39:21
Like people will talk, right? The only way to keep a secret
39:26
from two people is to kill the other person, right?
39:29
That's it. Definitely one move on to the
39:32
next question. Yeah, yeah.
39:34
So on that note, first of all, don't kill anybody.
39:37
We frown on that here on the Identity Center podcast.
39:41
Just make sure roles and responsibilities are clear and
39:43
everyone's operating on the same, you know, guidelines.
39:46
All right, let's get to, I think it's pronounced Lynn from Hanoi,
39:50
Vietnam. As somebody fairly new to the
39:53
IAM space, what advice would you give for building credibility
39:57
and influence when you are trying to get leadership to take
39:59
identity security seriously? Welcome to the identity
40:04
community, Lynn. Pleasure to have you here.
40:06
Come to ideniverse join ID Pro. Commiserate and learn and
40:12
celebrate with, you know, all our fellow identity people in
40:15
any of those forums. But what's your advice for
40:18
someone to build credibility influence when you're just kind
40:20
of getting started and I am? I think the biggest thing and
40:24
probably Lynn is going to be able to do this already
40:28
sometimes being too in the weeds makes us harder to do.
40:31
But speak about identity, speak about security in business
40:36
terms. How does it, you know, increase
40:40
value for the firm? How does it decrease risk?
40:45
I think if you stick to that, that's the biggest way to be
40:50
successful as a, as a leader, a business leader, you know,
40:56
focused on an identity. What do you think, Jeff?
40:58
Communication is such a huge part of it.
41:01
If you can, you know, translate, if you can take the specs from
41:05
the engineers and deliver to the customer or take the specs from
41:08
the customer and deliver to the engineers.
41:10
For all my office based fans out there, that is a, a key skill
41:16
that I don't think there's enough of being able to talk
41:19
the, the language of business and not just business, your
41:22
business understand what your business terminology stands
41:27
like. What is the translations that
41:29
you need to make? What are the risks, the cost,
41:31
the efficiencies, the things that you can tie directly back
41:36
to say, hey, if we are doing this in identity, here's how we
41:39
reduce this risk or we improve this efficiency or we enable
41:44
this capability that our customers are going to love,
41:46
right? Things like that.
41:49
It takes time. Also, this is not something you
41:50
just kind of do overnight. There's a lot to learn in
41:53
Identity. I think one of the first things
41:56
you have to figure out is, you know, what do you want to be
41:58
when you grow up in identity? Are you a technical resource?
42:00
Are you a non-technical resource?
42:02
And then start to figure out, you know, where your interests
42:04
are and and where do you think you can have the most value to
42:06
the organization or wherever you want your take take your career.
42:09
But definitely, you know, lean into understanding your business
42:14
and learning how identity impacts those business and try
42:17
to think of ways where it might not be as visible how identity
42:22
is impacting the business. It might be hidden somewhere
42:24
underneath something. IT and all the I am heroes out
42:28
there that are making these programs run are really good at
42:30
hiding pain. And the organization sometimes
42:33
doesn't feel pain that is there because it's getting hidden by
42:36
that, by the heroism by the organization.
42:39
So try to identify those things and you know, I think you'll
42:42
come a long way. And then just continue to build
42:43
up the experience network again, join ID pro ID pro.org, you
42:48
know, stuff like that. And I think you'll be on your
42:51
way. All right, let's move to Claire
42:56
from London. In the United Kingdom, we talk a
43:00
lot about least privilege in theory, but enforcing it in
43:03
practice feels like a constant battle against the business.
43:07
How do you strike the right balance between security and not
43:11
slowing people down? What do you think, Jim?
43:14
Least privilege in practice. It's a great observation.
43:18
I mean, we've been chasing least privilege for the entire time
43:23
that I've been in the industry. So I think the, the real key is
43:28
like focus on your highest risk applications and accounts.
43:34
You know, in other words, it's it's got to be a risk based
43:37
approach. So you put your focus on where
43:41
your most, where you have your most risk.
43:43
Applications that have, you know, we used this term crown
43:47
jewels talk about the importance of accounts, but I think it's
43:51
also the importance of applications or where you have
43:55
your data. So it's the crown jewel data and
43:58
your crown jewel accounts. Everything else can come after
44:01
that. I also think from a technology
44:05
or philosophical perspective, we should also be driving not only
44:08
toward the least privilege, but zero standing privilege.
44:12
I agree. I think it's harder than not to
44:16
be able to move forward with 0 standing privilege.
44:20
I think you have to, I think you have to make a definition and
44:24
make sure people are are are following the same definition.
44:29
When you say least privilege, what does that mean?
44:32
Because that's not a destination, it's a direction of
44:34
travel. And so I think making sure that
44:40
you're on the same page with what the organization desires,
44:43
wants, needs is, is important. I think you bring the business
44:48
into the conversation and help them understand what the
44:50
differences are between least privilege, 0 standing privilege,
44:54
role base access control. You know, all those, all those
44:58
things are very different. The strategy might be least
45:02
privilege, but we, we talk about the, the menu all the time, Jim,
45:07
like, you know, who cares if anybody can see what's on, you
45:11
know, the menu. Is that the best I want to
45:12
fight? No, You probably are more
45:13
interested in like segregation of duties between accounts
45:16
payable, receivable or privileged access, you know,
45:19
within, you know, specific systems, whatever that looks
45:21
like. So I think you start with that,
45:24
you start the conversation. But I think, again, I think you,
45:27
you, you, you decide as an organization what does least
45:31
privilege mean and understand is that it's not a destination.
45:36
Again, it's a direction we're going to move towards that and
45:38
then just start whittling away. I, I don't really like roles.
45:42
I think they're too hard to maintain without tools and
45:46
automation and AI at this point. I would start small, go maybe
45:50
attribute base access control, you know, try to get good data
45:53
from, from your sources of truth and try to automate off of that
45:56
sort of thing. But it's difficult without
46:00
having conversations with the business to help them understand
46:02
it. Yeah, I agree.
46:07
Yeah, everything, everything we just said there.
46:10
Let's see, let's go to the next one.
46:12
It's easy, all right, We got a couple more.
46:15
We're already at 48 minutes, so let's see how we do here from
46:18
Sydney, Australia. James says access reviews feel
46:22
like a check box exercise at most organizations that he's
46:25
worked at. Is there a better way to think
46:28
about them than that actually produces meaningful results
46:31
rather than just satisfying an auditor?
46:34
I couldn't agree more. I think for most organizations
46:38
it is a check box compliance thing that they've been told
46:40
that they have to do because the auditor or the risk person or
46:44
the security person said so. I think this is a great spot for
46:48
AI to start looking at this type of missions and maybe doing
46:51
differentials instead of just recertifying everybody every
46:54
three months or every year. Take a look at what's changed,
46:57
you know, maybe that's going to make things a lot easier and get
46:59
rid of some rubber stamps, do you think?
47:02
I think you're right on. This is like the first question
47:04
where I don't think we're disagreeing.
47:08
Yeah, I've always felt like access reviews had limited value
47:13
that they were you know we had Anthony Viggiano on he called
47:18
them security theater at one of the conferences and I think
47:23
that's usually true. I, I used to say there are
47:26
backstop for having sub optimal processes on the, you know, on
47:32
the the front end. The solution is get rid of those
47:36
suboptimal processes. I think one other thing we can
47:40
do is like, look, if someone's not using their access, access,
47:45
access away. I mean, that seems like a better
47:49
process than to bug managers to review couple 100 accounts, you
47:56
know, or couple 1000 different access profiles and stuff like
48:01
that. It's just very little squeeze,
48:05
very little juice for the squeeze.
48:08
Yeah, Yeah, let's just leave that one there.
48:11
I don't, I think we, I, I think that one is somewhat
48:14
straightforward. But in reality, I think you just
48:16
have to have conversations with the right people to make.
48:19
Sure. That I just throw one more thing
48:20
in. Of course, obviously if like if
48:24
you're being told that you need to do it from audit perspective
48:27
and you can't convince folks otherwise, then you have to do
48:32
it and voids everything we just said.
48:35
Well, there are some requirements you have to do it.
48:37
I think, you know, I like to argue with auditors around why
48:41
are we doing things if I have a better way to do it from either
48:45
capability or a process standpoint that still meets the
48:49
spirit of what they are trying to get to.
48:51
Auditors in my experience, don't necessarily care how you're
48:55
doing it. It's what you're able to
48:57
demonstrate. And so if you can demonstrate
48:59
that access is appropriate, the need for an access review, you
49:04
know, maybe goes down or is lessened and you know, maybe
49:06
there are different ways you can look at it.
49:08
So I would say don't be afraid to innovate in in your
49:12
organization and question and challenge the intent behind the
49:16
audit and see if there's a better way to do it.
49:19
OK, last one here from Chicago, IL go Blackhawks.
49:25
Darnell, how do you make the case to ACFO or ACEO for
49:30
investing more in identity security when there has not been
49:33
a breach yet? What language tends to actually
49:36
land with executive leadership? Jim, why should we spend money
49:40
on identity security if everything seems to be working
49:43
fine? Yeah, I think there's a couple
49:45
things. One is you want to avoid FUD,
49:49
but I think one of the most effective ways is to tell real
49:52
world stories, especially if you can use direct competitors to
49:56
say, hey, this organization got breached because of these
50:01
things. These are the investments that
50:03
we need to be making. I also believe there is kind of
50:08
a truth to you just don't want to be the slowest.
50:12
But when you're getting into the hyper speed of these attacks and
50:18
AI swarm, AI agent swarms that are trying to scan your company
50:22
to get in, I think it's not just being the slowest wildebeest
50:28
anymore. It's like being in the top 50%
50:31
or in the bottom 50%. You're you're still vulnerable.
50:36
I think that's how you make the cases like real world examples
50:40
and let them ask questions, really understand, like how did
50:45
these how did these breaches take place and what was the
50:50
impact on their business get people to accept the risk too.
50:55
I think there's nothing more effective than saying like,
50:59
look, I'm I'm in charge of the identity program.
51:02
You know, I've identified a number of risks within the
51:05
organization. Somebody's got to own those
51:08
risks. I'm talking about the risk.
51:11
Somebody's got to own them and it can't be me.
51:15
I think that's great advice. Get somebody to own and document
51:19
their ownership or acceptance of that risk is fantastic.
51:24
That's a little bit of A Game of Thrones, maybe some
51:26
organizations trying to get it done.
51:28
But I agree with everything you said.
51:30
Don't talk. I don't think you talk
51:31
technical. I think you talk in outcomes.
51:33
I think you try to align things with the business and the risk
51:37
that might they might be thinking about.
51:40
I think, you know, you keep using agentic identity swarms.
51:44
You've used that for like the last few episodes.
51:46
I think it's apropos because now it, you know, you definitely
51:50
want to be the slowest, but when you have swarms of things that
51:53
are attacking not you but everybody, that just means
51:57
there's more opportunities for slower people, you know, to get
52:01
gobbled up by that swarm. So there's probably, you know,
52:05
some justification there to be taught, you know, to be talked
52:08
about. I think you also need to prove
52:11
can you deliver? So I think there's a lot of
52:14
people out there that know they should be spending more money on
52:17
identity security, but maybe they haven't been successful in
52:20
delivering projects in the past. They need to figure out how
52:22
they're going to solve that part of it too.
52:25
If if Jim, you're unreliable and I can't and you don't seem to
52:28
get anything done, why would I give you money to do anything?
52:31
That's where. You are.
52:34
Thanks for clarifying that there's a.
52:36
Pause there so I can just cut right there.
52:38
Have you heard of 11 labs? Yes, of course.
52:42
Is that is that we use for the April fools episodes?
52:45
OK, so 11 Labs does a lot of AI voice generation and one that I
52:51
heard the other day was just like what?
52:54
I mean, it's getting better. I'm already talking about 20
52:57
fools episode. What's going to?
52:59
Be like in 2029 when you have AI swarms calling people's help
53:04
desks trying to socially engineer them when people are
53:09
getting socially engineered as recently as last year.
53:14
Well, the answer is. The answer is very simple, Jim.
53:17
I, I have, I have the answer. It's called AIAI is going to
53:23
defend US against the other AI and everything's going to be
53:26
good. So the AI swarms are going to
53:28
call into AI agents and they're going to bicker and fight and
53:32
where everyone's going to be happy.
53:34
This probably will certainly happen.
53:38
All right, let's wrap up on a lighter note.
53:41
We've got a few here. Let's see how many can get
53:43
through. Maybe we'll try to keep these
53:44
somewhat brief, but let's start with Portland, OR.
53:47
And Tyler, if IAM was a sport, what position would you each
53:52
play and why? Jim, what position would you
53:57
play? And I guess what's I, I guess
53:59
the position will tell me the sport, but what do you pick that
54:02
position? So it would have to be baseball.
54:05
Jeff, do you like baseball? No, I think it's boring.
54:09
I am just trying for you and. There.
54:12
And that was our first and last conversation ever.
54:15
Literally, You know, that's how we met.
54:17
Jeff, do you like baseball? Not really.
54:18
OK, Turned around and walked away from me.
54:20
All right. Nice to meet you, Jim.
54:22
Nice to meet you, oh potential client.
54:24
I don't care. So did you know even that
54:29
baseball has started like? Training pitchers and catchers
54:32
have reported yes. No, no, the games are going.
54:36
Games are going already. Yeah, it's going since the
54:39
weekend. I know they've moved everything
54:41
up a couple years ago anyway it. Just blew my mind.
54:45
I didn't realize the season had actually started.
54:47
Is that what you're saying the MLB season in the US has
54:49
started? The MLB spring training season.
54:53
Oh, spring training. OK, Yeah.
54:54
So we're still in pre season. And then World Baseball Classic
54:57
is this year. I know I'm educating you on
55:00
this. I'm not kept up with baseball at
55:02
all because I don't care. But when you said the season has
55:05
started, like what? Like, that's like, you blew my
55:09
mind there for a second. Yeah, I guess I just assumed
55:12
that everybody cares. I'd pick baseball because I'm
55:18
me. And in my earlier days I would
55:20
have picked shortstop. Remember Victor Barr, she's
55:23
always say, Jim, you're the you're my star, my * shortstop,
55:27
which is like the the hardest position on the field.
55:31
But I'm a much older man now and I probably would pick like right
55:36
field or left field where you don't have to be so fleet to
55:39
foot. About first base scoop rounders,
55:42
you don't have to be very mobile either.
55:44
Yeah, or first base. Actually I would like first base
55:47
but see. I know baseball.
55:49
At the Major League level now, because the balls get hit really
55:52
hard to get hit in the face of the ball.
55:56
I don't think anybody does. I don't think.
55:58
I don't think it's anyone's intention.
56:01
What's what position. You know, I thought about this a
56:04
little bit and I don't think at this point in my career that I
56:08
would be a player, I would be a coach.
56:11
So I would either be a head coach, maybe in the NFL or maybe
56:15
I would be the Phil Jackson and you know that the head coach of
56:19
the Chicago Bulls with a bunch of star players instead of
56:22
coordinating and strategizing and things like that.
56:24
I think that's just where I'm at right now from like a where I
56:27
where I am in identity career is more of, you know, the coach
56:32
kind of pulling the strings and strategizing and kind of making
56:36
sure everything's running the same way.
56:38
Does that count? The worst position to play The
56:41
worst position to play would be kicker.
56:45
I don't worst position. The worst?
56:47
Why? Why would it be the worst?
56:50
Let's say you move the ball, you positioned it, 20 yard field
56:54
goal. All you do is kick through, we
56:57
win or tie and you miss, OK? And what if you make it?
57:03
What if you're rocks out and you make nobody?
57:05
Cares, everybody expects you to make it.
57:08
Problem is when you you miss the kick.
57:10
Like there's a poor guy from, I'm not going to name the
57:13
college because he might be a listener or something, or Jack
57:16
might be a listener, who knows. But they didn't win their
57:22
conference championship basically because this kid
57:25
missed a field goal that was a layup.
57:29
And man, that's the worst. I mean, being like the one guy
57:35
who's like your fault. And it's almost like you want to
57:38
make the case, like, no, it shouldn't have come down to
57:40
that, but still, we know it's your fault.
57:44
You missed. You missed your play, but there
57:47
were multiple plays leading up to that that led to that
57:50
outcome. So I think in the sport, like
57:52
football, it's so much more than just last kick.
57:55
Yes, it's immediate. You dump on the kicker for
57:56
missing the field goal. It happens, But there's just as
57:59
many people who are making those field goals in those moments.
58:02
You know, this NFL season that we just had had a bunch of last
58:06
second field goals to win games and you know, they're exciting
58:09
when they happen. It's non contact, you know, for
58:12
the most part if you're kicker. So you know, you're, you're
58:14
probably going to have a little bit longer career.
58:18
There is upsides. What if you're the batter and
58:21
you strike out? You're a designated hitter.
58:23
Your entire job is to hit the ball and you miss.
58:26
Yeah, but that happens like you people strike out a lot and I
58:32
don't know, it's also there are moments.
58:35
Every sport has moments where it's like you need to come
58:38
through or we lose. You could be on the the foul
58:43
stripe in basketball or you could basically be the kicker in
58:48
football. I do have a question though, for
58:50
you about football. So it used to be that a long
58:54
kick was 50 yards, right? What's a long kick now?
58:58
Like 6065 yards. Yeah, I mean, 50 is still a long
59:01
kick, but kicker legs have gotten so strong.
59:04
The record was set this past year. 68 yard field goal by I
59:09
think it's Cam Little in Jacksonville.
59:11
A 68 yard loss. Or something?
59:13
Or what's the difference? I mean, you've, we've joked, you
59:16
know, the, the, I would say a lot of people have joked about
59:18
kickoffs for the last several seasons before they did the
59:21
kickoff rule change over the last couple years.
59:23
But, you know, you'd see kickers kicking off from the 30 yard
59:26
line, kicking them through the uprights.
59:28
Yeah, you know, on a kickoff after a score.
59:30
So it doesn't surprise me. I think it's an interesting
59:33
strategy. It's almost like, you know, I
59:34
was talking about this with another friend of mine.
59:36
It's almost like if you have a kicker that could consistently
59:39
kick 65 yard plus field goals with high degree of accuracy,
59:44
it's very similar to the tush push that Philly runs all the
59:47
time. When they are, you know,
59:48
they're, if they get down to let's call it third and three,
59:52
third and four, they almost always go for two tush pushes
59:56
and get the first down because they can consistently get one or
1:00:00
two yards on that, you know, play.
1:00:03
And nobody has been really been able to figure out how to stop
1:00:05
them consistently. So if you have, I think it
1:00:07
changes the dynamic of the game for these long, you know, long
1:00:09
ball kickers. You know, wouldn't surprise me
1:00:12
that we see 70 in the next couple of years 'cause I think,
1:00:15
you know, these kickers just have big legs and it's crazy.
1:00:20
Absolutely. Do we have time for another one?
1:00:22
Yeah, let's do this one from Matt from Denver, Co.
1:00:28
What does your, what does your non work life think you actually
1:00:32
do all day? Does anyone in your family
1:00:35
actually understand your job, Jim?
1:00:40
So I absolutely not. So I actually looked up
1:00:43
something because I was like, what if I were to say I'm a
1:00:48
cytopathologist? People say they have no idea
1:00:52
what I do. That's pretty much what it's
1:00:54
like saying you're a cyber security consultant.
1:00:58
And I usually leave it at that high level.
1:01:00
People just know, oh, cyber security is important.
1:01:04
Now, if you get to talking to somebody who's in IT or, you
1:01:08
know, somewhat reasonably connected, then there's a
1:01:12
different conversation. But if it's a person at a store
1:01:15
or, you know, like somebody's there doing cutting your hair,
1:01:21
cutting your hair, that's my big cyber security consultant.
1:01:26
That's like, oh, you must make a lot of money and you got into
1:01:30
the right field at the right time, and let's talk about
1:01:33
something else. Cytopathologist Well, you're
1:01:37
looking at cells and I think Cancer Research and things like
1:01:40
that, but. Yeah, don't you look that up on
1:01:43
AI? Well, right after I said it.
1:01:45
Or did you? Figure it out.
1:01:46
Even know if you're talking to real me or AI me so who knows.
1:01:50
True, true. I could be totally confused.
1:01:54
Go ahead, Sorry. No, I, I think some people have
1:01:58
an idea. I've been married to my darling
1:02:01
wife for over 20 years now and I think she's kind of gets it at
1:02:05
this point. I've been doing it for about 20
1:02:07
years. So I think you and I are in a
1:02:12
little bit of a unique position because by day we are identity
1:02:15
consultants, but a lot of people think we do this podcast at
1:02:18
night as our like our full job. It's actually our night and
1:02:21
weekend job. But I think most people just
1:02:24
know that I'm a security consultant and they just think
1:02:26
hackers and you know, that's it. And that's fine.
1:02:31
You know, I, I generally won't get into the specifics unless
1:02:34
they start digging into it or, or are interested in learning
1:02:36
more. Security consultant, sit in the
1:02:38
Barber chair. Hey, what do you do?
1:02:39
I do consulting. What do you do security
1:02:40
consulting? Oh, like for buildings, no more
1:02:43
for information security. Oh, OK, like hackers and
1:02:46
passwords. And then I go, OK.
1:02:47
And then their eyes glaze over and they're like, not interested
1:02:50
anymore. Yeah, I remember.
1:02:54
I just told my dad, I'm like, I do computers.
1:02:56
I was like, OK, He's like, OK, I don't know computers.
1:03:01
So good enough does computers. Jimmy does computers.
1:03:07
Jimmy does computers. I don't think we can talk.
1:03:09
Jimmy does computers. So we're going to end it there.
1:03:12
Thank you so much to everyone who sent in questions.
1:03:14
You know, keep them coming. Hit us up on LinkedIn.
1:03:17
We try to answer as many as possible.
1:03:19
For the ones we don't answer right away, we generally will
1:03:22
throw them into our Notion notebook here and you know, try
1:03:25
to pick out the best ones or ones that we think are relevant.
1:03:27
Try to keep up things, but I definitely appreciate people
1:03:29
taking the time to reach out. So you can do that on LinkedIn.
1:03:34
You can send us a contact form on our website, idcpodcast.com.
1:03:38
You can comment below with whatever player you're in.
1:03:41
I think they all pretty much have comments at this point and
1:03:44
you can like and subscribe. That also helps us.
1:03:46
So we'll go ahead and leave it there for this week and talk
1:03:50
with everybody in the next one. You've been listening to
1:03:55
Identity at the Center. We hope you've enjoyed the show.
1:03:59
Make sure to like, rate and review, and we'll be back soon.
1:04:03
But in the meantime, hit the website at
1:04:06
identity@thecenter.com. See you next time on Identity at
1:04:12
the Center.