Latest / Identity at the Center / #351 - Jerome Thorstenson on B2B Identity First Security

Transcript

#351 - Jerome Thorstenson on B2B Identity First Security · Identity at the Center

0:00
If you go to a mom and pop shop and say, hey, bring your own
0:03
identity, they're just going to be looking at you.
0:05
Like, yeah, sure. Here's my driver's license,
0:09
Yeah. Exactly.
0:10
Here's my passport. Yeah, have fun, right.
0:13
And then it is the the matter of how do you actually control who
0:19
has which access is in your system.
0:21
So let's say you on board a partner, they are predominantly
0:27
doing something, some infrastructure project for you.
0:31
How do you ensure that that project doesn't give them access
0:35
to, to confidential information? If you have a milk supplier who,
0:42
who brings in fresh milk every day, right?
0:46
How do you make sure that they have access to their sales
0:51
numbers and and all that, but can't see the the competitive
0:55
competitors information? So.
0:58
So yeah. So Eve Mailer was on the stage
1:01
yesterday. She talks about treating
1:04
identity as a product, right? Because you have all these
1:07
different stakeholders who want different things and essentially
1:10
become a product manager. You know, you're a security
1:15
practitioner in one sense, but you're also thinking about
1:19
marketing and the the customer experience and prioritizing
1:24
that. Did a lot of what she talked
1:26
about yesterday bring true from your perspective of how do I
1:29
balance all these stakeholders to get to what I'm going to be
1:34
releasing next month? From an enhancement perspective,
1:38
how do you keep up with the authentication or the delegated
1:42
administration or hey, the users are having a problem with this,
1:47
like how do you balance all that?
1:54
This is identity at the center if it has anything to do with
2:00
IAM. This is the go to podcast now
2:04
your hosts Jim McDonald and Jeff Steadman.
2:14
Welcome to the Identity Center Podcast.
2:16
I'm Jeff, and that's Jim. Hey, Jim.
2:17
Hey. Jeff, how are you?
2:18
Oh, not so bad yourself. Doing great EIC 2025.
2:23
Berlin, Germany. We made it to the stage.
2:25
We made it to We're on the keynote stage.
2:27
We are on the keynote stage with an audience of literally four
2:31
people. I think.
2:32
Yes, exactly. So, yeah, good time.
2:35
So thank you very much to Marina, who is just over there
2:37
behind the camera. Give us a thumbs up for helping
2:39
us set this up. Obviously, Martin, for, you
2:41
know, inviting us out here and it's been a great conference so
2:43
far for first time being in Berlin, first time being at AIC,
2:47
I'm sure. No surprise, this is one of the
2:50
best organized conferences I've ever been to.
2:53
Everything's like clockwork. And you know me, the snacks.
2:58
Let me do a rating of the snacks right now.
3:00
Fantastico the the cooler with the soda.
3:05
Pop, that's the highlight for me because I don't drink coffee, I
3:07
don't drink tea, but if there's cola or something like that
3:10
where I can get my coffee, chips, orange soda, thumbs up
3:13
for that. I will say I'm so far been
3:15
disappointed by one thing and that is the lack of cookies.
3:19
I everyone knows I judge the conference on the quality of
3:22
their cookies and I have not seen a cookie yet.
3:24
Maybe they'll make an appearance.
3:25
This is only two. Different cookies here they're
3:27
they're over by the coffee. That's a problem.
3:29
OK all. Right, I stand corrected.
3:32
Apologies to. Wonderful butter cookies this
3:35
morning. Oh, you missed out.
3:36
OK. All right, why don't we get into
3:39
it? Because we have our gentleman
3:40
guest sitting here next to us. He is Jerome Thorsensen.
3:42
He is the I am architect with Selling group.
3:44
We're going to find out what that means, but welcome to the
3:46
show. Thanks.
3:48
So thank you guys for having me. It's been a pleasure to meet you
3:52
in in life a long time listener. So I was really psyched when you
3:57
guys reached out and and asked me to come on the show.
3:59
Well. We're so appreciative you taking
4:01
the time. I know that this is a busy time.
4:03
You're going to be giving a a presentation I think later this
4:06
week we're going to talk about that.
4:07
But if you're a listener, you know what our first question is
4:09
going to be. Oh yes.
4:10
How did you get into identity? Is it something that you chose
4:13
or did it choose you? I think we kind of trauma bonded
4:18
identity and, and I so back in the day, I started out as a
4:23
techie, I was heavy into infrastructure, servers, some
4:27
network firewalls, all that stuff.
4:30
And if you asked me like 10 years ago that if I saw a future
4:37
in I am, I might have been smiling and saying, Nah, that's
4:42
just user management right? Then I I've got on boards doing
4:48
cybersecurity, did a pen test on a fairly big international
4:54
client and to my horror I was like 5 minutes in doing it
5:01
enumeration on Active Directory where I started pulling out
5:05
passwords and clear text in the description fields and found
5:09
custom attributes with initial password set.
5:12
So people always hear about this story, right?
5:14
Oh, there's clear text passwords.
5:16
Yeah, it is legit. It happens in real life.
5:19
Oh yes, Oh yes, to this day it. Still happens.
5:23
So for people not familiar with selling group, give us a little
5:25
bit about what selling group is. And I just realized my
5:27
microphone was like over here. So I'm going to try to make this
5:29
a little bit better for me. Yeah.
5:31
So selling group is kind of a fun size.
5:34
So to to compare it for the US listeners, it is kind of like
5:40
having a parent company that operates Target, operates
5:46
Nordstrom, operates LD, Trader Joe's, stuff like that, right.
5:52
So we have 5 major labels that we fully own.
5:58
And then we do franchises for stuff like Starbucks, we do some
6:03
flowers, food delivery servers, fresh fish to your doorstep,
6:08
stuff like that. And we are located in
6:13
Scandinavia, so we have the HQ in Denmark.
6:17
We are represented here in Germany, Poland, and we just
6:22
acquired Remy Baltic, so now we're in the Baltics as well,
6:27
heavily. So it's a small company is what
6:30
you're. Trying to say small company
6:31
72,000 employees. Oh, that's it.
6:33
All right. Yeah.
6:35
So tell us about you're here to present.
6:39
You'll be on this very stage Friday, right?
6:42
Yeah. And you're going to be talking
6:43
about securing and navigating B to B.
6:48
So that's. Your focus within the identity
6:50
suites, Well, tell us about that, that presentation, what is
6:55
the main topic? Oh, I'm, I'm going to be
6:59
standing here on the stage and, and sharing my, my pain points
7:02
with the managing B2B. So basically it is all about how
7:07
do you take your supply chain and making sure that they are
7:12
just as compliant and as, as secure as you are, because it,
7:17
it comes down to, to trust at the moment.
7:21
Then we have the the NS-2 hitting us.
7:26
It's just a past as a law in Denmark like 2 weeks ago or
7:29
something like that. So it is the whole how do you
7:32
fast track and this to implementation?
7:36
How do you make sure that you have cybersecurity resilience
7:41
within your supply chain and how do you on board and off board
7:45
vendors because we have everything from small mom and
7:48
pop shops to to big corporate climates.
7:52
So I knew said the the title of your presentation starts with
7:56
identity first, which I think really means their identity at
8:00
the centre. I think they're somewhat
8:02
interchangeable. Feel free to disagree with that,
8:07
but why did you start the presentation title identity
8:10
first? Well, because I'm a strong
8:12
believer that the identity first approach is the key in this
8:18
modern tech stack we we worked in today.
8:21
I mean, we don't have any perimeters anymore.
8:24
We moved everything or slowly moving everything to, to the
8:27
cloud. So that parameter is long gone.
8:31
And that's why you you need to kind of look at.
8:33
So how can I manage security and what are the, this, this stuff I
8:42
can deal with, right? So for us it is definitely
8:45
identities. We can manage and control access
8:51
on identities and on devices and all that more easily today than
8:59
than just applying the old logic of perimeter first rank.
9:02
So there's a lot of, I guess, struggle sometimes where you
9:06
have these external partners and I guess how do you make sure
9:11
that they're on board with what it is that you're doing?
9:14
So, you know, it's a challenge is you've set up this, you know,
9:18
maybe it's a federation or maybe you're studying up SAML or open
9:20
ID connect or whatever it may be, but you're still reliant on
9:25
the vendor, the partner, the B to B side of things or B, you
9:27
know, whatever it may be to actually hook up and then follow
9:31
your own policies and standards. How do you essentially train
9:35
your partners to do it that way with you?
9:38
Oh, it's a headache. It's a headache.
9:41
No so, so you usually if you look at retail, we are really
9:44
good at doing something like private label or white labeling
9:47
stuff. So instead of a fully on boarded
9:52
partner, we could potentially say, let's say we have a line of
9:57
products that we sell at a discounted price because it's
10:00
our brand, but all the, all the product descriptions and
10:07
everything we get from whoever made the product.
10:11
So we would like to onboard them and say, OK, so if any product
10:14
changes happens, then you have the ability to to go in and and
10:19
edit this. I won't say real time, but but
10:22
close to, to real time, right? And the thing here is for a big
10:29
company or supplier, it is easier for them to hook up to
10:34
doing single sign on or Samo or something like that, right?
10:40
And that's perfectly fine. But if you go to a mom and pop
10:43
shop and say, hey, bring your own identity, they're just going
10:47
to be looking at you. Like, yeah, sure.
10:49
Here's my driver's license exactly.
10:51
Here's. My passport have fun right and
10:55
then it is the the matter of how do you actually control who has
11:01
which access is in your system. So let's say you on board a
11:06
partner, they are predominantly doing some some infrastructure
11:11
project for you. How do you ensure that that
11:15
project doesn't give them access to to confidential information?
11:20
If you have a milk supplier who who brings in fresh milk every
11:27
day, right? How do you make sure that they
11:29
have access to their sales numbers and and all that, but
11:35
can't see the the competitive competitors information?
11:40
So. So yeah.
11:41
So Eve Mailer was on the stage yesterday.
11:44
She talks about treating identity as a product, right?
11:48
Because you have all these different stakeholders who want
11:51
different things and essentially become a product manager.
11:55
You know, you're a security practitioner in one sense, but
11:59
you're also thinking about marketing and the the customer
12:03
experience and prioritizing that.
12:07
Did a lot of what she talked about yesterday bring true from
12:10
your perspective of how do I balance all these stakeholders
12:13
to get to what I'm going to be releasing next month?
12:18
From an enhancement perspective, how do you keep up with the
12:22
authentication or the delegated administration or hey, the users
12:27
are having a problem with this, like how do you balance all
12:30
that? It rings true in, in my world, I
12:34
am a firm believer that you can actually put I am as a business
12:41
enabler. So it's, it's, it's kind of a
12:48
fun balance you are looking at we.
12:53
So no, actually let me rephrase that.
12:55
So what we're looking to do is providing our vendors with a
12:58
self-service portal. So let's say you buy or get
13:03
access for for 10 people in your organization to have access to
13:07
to our system. For whatever reason, we would
13:12
actually prefer to give self-service portal saying here
13:16
is the general framework. This is how we run business and
13:21
we are going to rely on you managing your employees access.
13:26
We are just sitting in the background on doing the final
13:30
tracks right. That's right.
13:32
Now, Jerome, this is the one thing that I was interested in.
13:34
I had a chance to talk to Eve was all right, as as the
13:38
identity practitioner, the owner of identity.
13:41
Is it my responsibility to, you know, kind of work with all
13:47
these folks and take all their inputs, get them to work with
13:50
each other and understand? Because one of the keywords she
13:53
had in her presentation yesterday was to get the
13:57
stakeholders to empathize with the needs of the other
13:59
stakeholders. In other words, marketing to
14:01
understand the needs of security and vice versa, which I thought
14:05
was tremendously insightful. But I wonder, is it our job to
14:09
kind of orchestrate and to facilitate all of that?
14:13
It seems to fall on us a lot. It falls on us a lot, yes.
14:17
And I, I'm also a firm believer that it is part of our
14:21
responsibility because I believe that we are kind of in a unique
14:27
situation where we understand where they're coming from and we
14:32
know where they're heading and, and stuff like that.
14:35
So we are kind of the, the in between a lot of vendors and us
14:44
and our suppliers, right. So we're kind of navigating this
14:48
as that's collaboration. Yeah, well.
14:52
Let me pull something else out there.
14:53
What happens if no if? If you don't do it, who does?
14:56
If the I am person doesn't do it except who's doing it?
15:00
That's why I think we usually wind up because I think I am or
15:05
identity, digital identity attracts a lot of people who
15:09
are. Not a good looking people.
15:11
Yeah, identity, people of the greatest.
15:13
Let's, let's just start there. No, I think a lot of people who
15:16
are are leaders. I think being a leader in
15:20
today's day and age isn't just barking out orders.
15:22
It's getting people to the table, getting them to empathize
15:27
with one another. And I think it's just natural
15:29
for many of us to step into that role.
15:32
So basically leading without Oh, what's it called without?
15:38
Leading without title. Right.
15:39
Exactly. Yeah, absolutely.
15:41
Yeah. So no, I think there is the
15:44
whole human aspect of it. And I think if you look at the
15:48
classical set up where you have security, they are more
15:51
compliance based. They are more, these are the
15:54
rules, stay within the boundaries we set and go have
15:58
fun. And we are kind of more
16:01
concerned with, yeah, that's fine.
16:03
But we we also need to to put a human angle on it and be like,
16:07
OK, but this will affect you in this and this this way.
16:11
And if it is very bad, it's simply us who's going to be
16:16
having that conversation with security and say, OK, guys, we
16:20
know this is best practice, but come on.
16:22
If we need to to get our day-to-day jobs to work, can we
16:27
relax this policy a little bit and then enforce it?
16:30
Yeah. Try to negotiate.
16:32
Yeah, exactly. So I wanted to point something
16:35
else out that you wrote an article last year and it's so if
16:41
folks connect to you on LinkedIn, they can see you
16:44
posted it and get to the article.
16:46
But it was about A back in the context of B to B.
16:50
And I think you called it a game changer.
16:54
And I wanted to ask you why do you think a back is game changer
16:59
which is attribute based access control?
17:02
Yeah, so we we've all been messing around with role based
17:05
access control for for years now, right.
17:08
It came out in the 90s. The struggle is.
17:10
Real in the years. Yeah, exactly.
17:13
So no, what I'm my approach was I was managing a huge stack of
17:19
security groups. So if you do the classical RBAC,
17:23
you have one security group that links to an application and and
17:28
role within the application. Now imagine you have two and a
17:33
half thousand stores already. You, you just bought, you just
17:39
had two and a half thousand security roles by default.
17:43
Now Add all the applications. Let's just pick a #1600.
17:49
We'll see how that that spins out of control real fast, right?
17:53
To to put some real world numbers on I'm I'm managing just
17:57
close to 61,000 users at the moment.
18:02
And that's just that. Is that everybody?
18:04
Is that B to B? Is no, that's, that's, that's
18:07
core employees. OK, Yeah, I have 67,000 security
18:13
groups. Which sounds about right.
18:15
You have more security groups and you have users.
18:17
That's totally normal part. Exactly.
18:20
But if you don't flip, flip it and go to ABAC, then you're
18:24
looking at attributes. So now you can do stuff more
18:28
dynamically. So you don't have this rigid
18:32
security group structure. You don't end up with security
18:36
groups nested in security groups because that's how we did it in
18:39
the old days, right? I can't believe anybody would
18:41
ever do that. That doesn't happen.
18:44
You're at full of battle scars here.
18:47
So how do you track? So attribute based access
18:49
control is obviously very dependent on attributes, data,
18:55
data quality, data timeliness, all that stuff.
18:58
How do you manage getting that data into a spot where you are
19:02
comfortable to say, OK, yeah, attribute, we've got it and we
19:06
can automate or make policy decisions off it, whatever that
19:09
may be. But talk about the data part of
19:11
the attribute side and how you manage that.
19:14
Honestly, it's it is a struggle. So we all know the the pain of
19:20
having clear and concise data, right?
19:23
So first of all, it's the wonderful discussion with the HR
19:29
on what attributes we use for, for what, right.
19:32
Then it is in our situation where we have a third of our
19:38
workforce that is 18 or younger. We also have some, some privacy
19:44
issues. So we don't want to pull in too
19:45
much information, just enough. And based on that subset of data
19:50
we have, we, we do our very best to, to say, OK, how much of this
19:57
can we actually control on pure ABAC?
19:59
How much of this needs to be reliant on RBAC?
20:04
It's that happy mix of these two that we, we live in.
20:07
So we, we can't sit here and say, Oh yeah, we're purely a
20:11
back. Because honestly, I don't think
20:13
it's ever going to happen. But if you have, let's say, 9
20:19
predefined roles in your organization, well, that is a
20:22
perfect fit for, for our back. And then you can always tighten
20:28
security and and find a sweet spot with a back.
20:31
Yeah. You know, I've kind of an out of
20:34
band question for that, but I was thinking, so really it's the
20:39
you have the delegate administration, so the customers
20:42
say, well, I just hired this new person.
20:45
That's got to also be you've got to have high volume in terms of
20:49
turnover. I would imagine that's a big
20:52
part of what you deal with. But so let me get to my question
20:57
first. So I was wondering because most
21:00
of your footprint is in Europe, so many different languages, do
21:06
you do all the front end with English only?
21:10
Because I would think as you get out to retail in maybe some of
21:14
the more rural areas, people don't speak English maybe.
21:20
So I'm in that lucky position where we we're in a company
21:25
where we said our company language is English.
21:29
So that makes my life a little easier.
21:31
OK. But fortunately we are heavily
21:35
represented here in in Germany and and and Poland and they're
21:38
fairly good at at English. So, so it's not a huge issue,
21:43
but we do run into it and then we rely on on people in the
21:47
store just to get back on the other party you.
21:50
Mentioned the high turnover. Yeah.
21:53
So we do have a high turnover just before summer break.
21:57
We on board something like 2 1/2 thousand employees and our mid
22:03
of August they're heading out the door again.
22:08
So, so yeah, we, we actually have vendors compare us to
22:13
something like universities in the, in our approach to, to on
22:17
board and off board people. That's got to be a busy time.
22:22
No one can take vacation then, right?
22:25
Well, the in Europe that would be tough to say.
22:27
No one take vacation in August, right?
22:29
Oh yeah, yeah, that's not going to happen.
22:30
That's not the vacation's happening.
22:32
That's for sure. Right.
22:33
Yeah. No.
22:33
But I mean, I think a rule of thumb is we we do something like
22:39
turnover between 200 and 500 employees a month.
22:43
So it's a big river balding door, yeah.
22:47
How do you manage those terminations?
22:48
Do you keep them around for a certain amount of time?
22:52
I guess you know, there's probably errors that are made
22:54
sometimes, like, oh, didn't mean to terminate this person or
22:56
there's a change in mind and they come back.
22:58
Do you totally deconstruct the ID?
23:00
Do you put it into some sort of dormant status for a little bit?
23:04
How does the management of the ID behind the scenes work?
23:07
Well, that's the the great thing about the GDPR.
23:10
So we just lean up against the framework saying, OK, generally
23:14
we keep you around for 30 days. So let's say you're terminated
23:19
on your current contract because you're starting in a new store
23:22
or something. So we off bought you on the last
23:25
day of the month and, and the night before you start again,
23:29
we, we basically strip you down and, and build you up again with
23:32
your new role. And I don't see.
23:35
And then we have a rule saying we, we don't keep user data
23:39
around for, for more than the, the absolute amount of time we
23:43
needed. So 30 days, give or take.
23:47
OK. Sounds like one of those
23:48
situations where the compliance is also in line with doing
23:52
things more securely. I think sometimes folks think
23:55
it's one or the other. Yeah.
23:57
No, it's you. You got to find the sweet spot
24:00
between the compliance and and usability, right?
24:04
Because I mean, there's no sense in off boarding, let's say 500
24:11
on the last day of the month just to to rebuild them the day
24:16
after. Yeah, totally.
24:18
Yeah, I mean e-mail addresses and stuff like that, you would
24:21
definitely hit that magic dorm and state on the e-mail address
24:25
saying, oh, it's already been assigned.
24:27
You can't have your own e-mail address, e-mail address back and
24:29
stuff like that. How do you handle duplicates?
24:31
A number? A middle initial?
24:33
Different spelling of the name? Oh, I'm picking a, I'm picking a
24:36
wound here it sounds like, right?
24:37
Yeah, tough. Questions here.
24:39
Yeah. So, so no, luckily what we, we
24:43
do is we say depending on which position you're hired in, then
24:49
you are given an e-mail address or not.
24:52
So if you're just stuck in shelves, you might not need an
24:55
e-mail address. So that helps us a long way.
24:59
But yes, we're stuck in the same situation as everybody else with
25:04
your name, some random number or something, right?
25:08
OK. Yeah.
25:08
I want to talk a little bit about IGA because you're one of
25:11
the few people that I snooped on that has done IGA twice.
25:16
So you had an IGA product and we're like, this isn't about
25:19
product, this is more about the shift.
25:20
So at some point there was a decision made to say, OK, this
25:23
IGA isn't meeting our needs and we need to move to this other
25:27
IGA, whatever that might be. I think a lot of people are
25:29
probably in this state where they're like, OK, well, when you
25:32
essentially pull the plug and say, OK, it's not it's time to
25:35
RIP that Band-Aid off or do whatever.
25:36
Talk to me a little bit about the that transition.
25:39
How did you make the decision? What was the decision like?
25:42
You know, as an organization said, OK, it's time to move from
25:45
one platform to another. And for people who are out there
25:48
listening, you know, what are some tips that they should be
25:50
thinking about if they're considering, you know, that
25:53
journey? Yeah, well, you guys are
25:55
consultants. So you, you've seen all the, the
26:00
fun stuff that people use to, to an IGA system, right?
26:03
So what ours was what I would consider legacy.
26:07
It was around 10 plus years old, right?
26:10
They had basically mangled the system to do anything from Weld
26:15
underwater to brew your coffee to do your I am.
26:18
So it's very custom then? Oh yeah.
26:19
Which means it's going to be hard to find something that's
26:22
apples to apples or a straight comparison.
26:24
And I do have a consultancy background and I love the whole
26:29
concept of keeping it lean and keeping it close to whatever
26:33
commercially off the shelf product you have, right.
26:36
And I, I am a big advocate for keeping stuff agnostic.
26:43
So if you want to go ahead and change the, the engine of your,
26:47
your IM in in three years time, then you should be able to swap
26:54
that engine fairly easily. And that was kind of one of the
26:59
drivers for for this because we were looking at a legacy
27:02
product. We are looking at an
27:05
organization that was moving into, I would say cloud first
27:10
strategy. So we suddenly were in a
27:13
situation where we needed to either create custom connectors
27:18
or switch a product and say, OK, should we actually get ahead of
27:23
this and say if the organization is adopting a cloud first
27:27
strategy, let's jump on that wave and see what we can
27:30
actually do and what we can actually achieve and manage
27:34
users in a smarter way. So if I should give a tip, then
27:42
it's all about knowing what you have and it's about looking at
27:50
where you want to go. And then MVPS, minimal viable
27:55
products all the way. I mean if you do it right you
27:59
can do a transition in like 6 weeks.
28:02
That's pretty quick. Oh yeah.
28:04
But but if you know what you have and where you want to go,
28:09
it is a fairly simple exercise and saying OK, so how do I get
28:13
there? How ruthless do you need to be
28:15
when you're making that transition to plan to say we are
28:18
not going to carry this over to the new system?
28:20
Oh, good question. I was Mr. Unpopular.
28:25
Let's just put a little bit like that.
28:27
So. So yeah, I got very good at
28:30
saying no. So what?
28:33
Gave you the confidence to say no, though, because I think
28:36
there's this natural desire to say yes.
28:38
Let's figure out how we can do that, yes.
28:40
How do you say no in a way that hopefully keeps keeps people
28:45
relatively happy? What's the diplomatic response
28:47
there to say? No.
28:47
So, so the diplomatic response is you listen to their their
28:51
issues, you figure out with them whether or not it is something
28:56
that the organization needs and then you road map it.
29:01
So I'm not sitting here telling everybody to to give a hug.
29:08
No, because that's not going to fly.
29:10
I would be out of the job same day.
29:13
You give them a soft no, saying it's not going to happen right
29:16
now. But in phase 234 it might be of
29:21
interest re exploring this, this idea, right.
29:25
So phase rollouts King. I think a big emphasis here DIC
29:30
has been on the identity fabric, right?
29:33
And I, I feel like it's more of an emphasis maybe in Europe than
29:37
the US where maybe the emphasis is more product focused.
29:43
Do you feel like that's true? And then what's your take on the
29:47
identity fabric? Is that an important concept for
29:50
you? Oh yes, it's definitely an
29:52
important concept for me. I'm a firm believer of that if
29:58
we are smart about it and we go the identity identity first
30:01
route and we we focus on how we manage identities and what kind
30:09
of shared signals we can get, we will be in a much better place
30:13
than than where we are today. Honestly, I, I don't necessarily
30:22
care about which product does what.
30:25
A vendor as a vendor, there's going to be new ones tomorrow.
30:29
They are getting smarter. And at the rate that we are
30:32
applying agnostic AI to, to everything these days, who knows
30:38
what's just around the corner, right?
30:40
Yeah. Every product is like now with
30:44
100% more AI and before it was 100% more zero trust and before
30:47
that was more, you know, whatever the the security did
30:51
you return was. So, yeah, so whatever opened us
30:54
opened up the company wallet, right?
30:56
And today it's AI. So yeah.
30:59
It's kind of. Yeah, to your .0 trust then.
31:01
Before that I was thinking REST API, REST API and.
31:05
It was blockchain was like The thing is a revolutionized
31:08
There's so many buzzwords. I want to ramp up the
31:11
conversation. On a later note here, I did more
31:13
LinkedIn spying and I noticed that you're from the Caribbean.
31:18
The Caribbean. How does a native say it?
31:21
Well, I say it as being from the Caribbean.
31:24
The Caribbean, OK, what's the best thing about being from the
31:28
Caribbean? What's the worst thing about
31:29
being from that area? And for people who aren't
31:31
familiar, kind of maybe explain geographically where the
31:34
Caribbean is? So geographically, I will say
31:38
all the islands and north of the Venezuela and up towards
31:43
Florida, that's kind of what I, I grew together as being the
31:46
Caribbean, right? And I would say one of the, the
31:52
best things about it, about it is this sense of belonging, the,
31:59
the close relationships. It's more about the the person
32:04
than than the job, stuff like that.
32:07
The worst part is I run on Caribbean time.
32:09
So what we don't fix today, we fix tomorrow if we get around
32:13
it. So yeah.
32:15
I would think it was. I was, I was expecting you to
32:18
say flying home for Christmas, Cost of fortune.
32:21
Everybody wants to be there then.
32:24
Oh yeah, yeah, but but no, it's, it's not too bad.
32:27
So going back to the Caribbean, yes, it does cost a little,
32:32
especially here from, from your right.
32:34
But if you're smart about it, then it's not too bad.
32:38
How? How often do you go back?
32:40
I try to go back every other year, yeah.
32:43
But, you know, COVID and all that kind of screw over those
32:48
plans. Yeah, so I I was actually
32:51
wondering, do you have any hidden gems?
32:53
I'm planning a vacation to Dominican Republic.
32:57
Bunta Canta. Bunta Cana.
33:01
I shouldn't know how. To say that.
33:05
So is that a good choice to start with?
33:08
And any hidden gems. You see now here's the trap,
33:13
right? It's, you say hidden gems, it
33:15
gets out and that's no longer a hidden.
33:17
Gems. Right.
33:18
Oh yeah, with our with our millions and millions.
33:21
Of billions. Of billions.
33:23
Yeah, no, I'm, I'm kind of relaxed whenever I go back to to
33:27
the Caribbean. So it is for, for me, Trinidad
33:30
and Tobago is like the home base and I'm born there.
33:37
So, so my, my heart will will always go to, towards that part
33:41
of the Caribbean, right? But other than that, go,
33:44
definitely go island hopping. There's so, so much to explore
33:48
and, and I mean, a lot of people have been to to Jamaica and the
33:54
Bahamas and stuff like that, but there's also other, other
33:58
islands that has stuff that's worth seeing and, and
34:03
experiencing. Yeah, sounds wonderful.
34:06
All right, well, that's pretty good.
34:07
Probably spot to leave it for this this one.
34:10
Jerome, great to meet you in person.
34:12
Thanks for taking time here, being with us.
34:15
I'll have your LinkedIn profile in our show notes so people can
34:18
reach out and connect. Maybe trade war stories, maybe
34:22
maybe you guys, you know, it can get maybe in a more of a hidden
34:24
gem conversation. A1 to 1.
34:25
So, you know, blasted on the Internet.
34:27
But thank you so much for being part of this.
34:29
And yeah, we're going to leave for this week.
34:31
Find us on the web at idacpodcast.com, like and
34:34
subscribe and do all those fun things right.
34:36
That's what gets us up to places like this.
34:38
And yeah, appreciate it. So thanks everyone for watching
34:41
and or listening and we'll talk with you all in the next one.
34:46
You've been listening to Identity at the Center.
34:50
We hope you've enjoyed the show. Make sure to like, rate and
34:54
review, and we'll be back soon. But in the meantime, hit the
34:57
website at identity@thecenter.com.
35:01
See you next time on Identity at the Center.