Latest / Identity at the Center / #232 - Just in Time Access with John Morton of Britive

Transcript

#232 - Just in Time Access with John Morton of Britive · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:11
AM, this is the go to podcast now your host Jim McDonald and
0:17
Jeff Steadman. Welcome to the Identity at the
0:21
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff.
0:25
How are you? Oh, not so bad.
0:27
Yourself. Good.
0:28
I'm getting used to seeing you in your Home Office.
0:31
Obviously we're on an audio only podcast, but we have cameras on
0:34
so I can see you're at home. You've been home for like 2
0:37
weeks in a row. This is really weird.
0:39
Only one week. So yeah, I'm home this week.
0:41
I was out last week, but I think I was able to record from home.
0:44
So and then I hit the road for the next.
0:47
I believe it's at least eight weeks in a row that I'll be
0:50
gone. So I'm making trips kind of
0:53
lower place, more in Chicago, Cincinnati.
0:57
Back to Milwaukee and then Chicago, then Milwaukee, then
1:01
where am I going after that? Then DC and then Austin, TX and
1:07
then San Diego and then who knows past that.
1:11
That's everything that I have going for next weeks.
1:14
Yeah. So what do you do?
1:15
Do you have any like tips and trips tips and tricks for the
1:19
non road warrior people like me? Well, like, what do you mean
1:24
tips or tricks? Like, I, you know, our guest.
1:28
I'm not going to announce who our guest is, but he has this
1:30
camera on as well. And I see he's got some
1:31
backpacks in the background, right?
1:33
And I'm thinking, like, I know when I'm hitting the road like
1:36
2-3 weeks in a row, I like to basically keep my backpack
1:40
packed for three weeks, right? I don't know.
1:44
Do you have anything like that? I mean, I'm coming home in
1:47
between all those trips and I like to travel light.
1:49
I'm a big fan of one bag travel if I can do it, so I try to.
1:54
I have a quest to find the perfect one bag solution.
1:57
I am somewhere around the 30 or 40th attempt of different bags
2:02
in my collection. At this point, I think it's a
2:04
big benefit if you can travel and fit everything you need
2:08
underneath the seat in front of you.
2:10
You don't have to fight for overhead space for luggage.
2:12
You don't have to worry about checking bags.
2:14
I haven't checked a bag in a decade.
2:16
I don't know, and that was for an international trip, so I'm
2:18
not. I'm not a fan of that pack
2:21
light, you know, pack what you need.
2:24
Yeah, especially if you're doing domestic US travel, you know, if
2:27
you forget something, you can always find something local to
2:29
replace it if you need it. Trying to think what else, find
2:32
multipurpose items, so try to standardize like power plugs,
2:36
cables, things like that. So you don't need to bring like
2:39
8 different power adapters. With you get a nice USBC
2:42
charger, multiport with enough wattage to juice up all your
2:45
stuff. You know, get cables that can
2:47
serve multiple purposes, stuff like that.
2:50
And definitely if you're traveling a lot.
2:52
Invest in yourself. Meaning get like an airline car,
2:56
airline club card or something like that to separate you know
2:59
yourself from the from the masses when you're in at an
3:03
airport. Yeah, I haven't been traveling
3:06
all that much really since the pandemic, but prior to that I
3:09
was traveling a lot. I think my tip would be practice
3:13
the cone of silence, which is like, you can create this
3:17
invisible bubble around yourself in your own mind anyway.
3:20
And it's like, you can kind of like, pretend you're not there,
3:26
well, you know, pretend you're not in that airplane seat,
3:29
because sometimes it's like hot or cold.
3:33
Maybe there's a baby right behind you crying, or there's
3:36
other people just being rude or whatever.
3:39
Don't don't fall into the trap of, you know, be rude yourself.
3:43
Just pretend you're not there. That you know that's a good
3:46
point get and this reminds me get the best noise cancelling
3:51
earbuds or headphones whatever that you can muster they may
3:55
they are a huge game changer. So I travel with a couple pairs.
3:59
I got my Ear Pods Pro and then I have the Bose quiet comfort to
4:03
earbud things. I don't like the overheads
4:04
because they take so much room so I'm not a fan of the in ear
4:07
type of stuff. So if that works for people
4:09
that's another one. So I carry both of those with me
4:11
and. Yeah, It was very helpful for my
4:14
last flight from New York City that had a child screaming in
4:17
the seat behind me. And I was, for the most part,
4:21
blissfully unaware. Yeah, I know when you, when you
4:24
have enough years of travel under your belt, you start
4:28
hearing people travel horror stories and you're like, yeah,
4:31
you travel it off. That's going to happen.
4:35
And we're on the runway for five hours.
4:37
Yeah, that stuff happens. It delays all that stuff, stuff
4:42
you can control, stuff that you can't.
4:44
You know, I've kind of gotten just used to.
4:45
It's like, whatever. I mean, it happens.
4:48
If and now that I'm connecting, I used to, you know, fly out of
4:51
Chicago because that's where you used to live.
4:52
So everything was a direct flight.
4:53
Now, living in North Carolina, out of the Asheville area,
4:57
everything is a connection for the most part.
4:59
Asheville, I go to Atlanta and then I go somewhere else.
5:01
So there's been a couple of nights where I've been, you
5:02
know, had to spend a night in Atlanta because flights are
5:05
delayed or whatever. It's a first world problem.
5:08
You know, I made it. We're okay.
5:10
We're fine, yeah. I get Nagri.
5:12
Doesn't change the outcome any. No, doesn't do anything for me.
5:17
Yeah, so it's. I guess So you're asking about
5:20
travel? I got a lot of things going on.
5:21
We're actually recording this a couple weeks in advance, so kind
5:24
of the 4th wall down. It's September 7th.
5:26
As we're sitting here recording this, I have all these trips
5:29
lined up starting next week. And we're going to kind of talk
5:33
through some of that because I think some of these trips are
5:35
related to speaking engagements or conferences or things that
5:39
you and I are both doing. Guess the first thing coming up
5:42
is really it's a tie. It's for you and me.
5:45
I'm going to be at Identity Week, America, October 3rd and
5:48
4th in Washington, DC I'm hosting a panel discussion on
5:51
pass keys. We're recording this in the
5:54
middle of the day. As soon as this is over, I'm
5:56
hopping onto a call with my panel participants.
5:59
To figure out what the heck we're going to talk about.
6:01
So that is real time information of what we're doing.
6:04
I'm going to be out there and we've got a discount code for
6:07
folks who want to take advantage of that.
6:09
For Identity Week America, it's ID AC30I DA C30 that gets you
6:14
30% off your conference pass. It works for both Identity Week
6:17
America and Identity Week Asia. So if you're looking at any of
6:20
those conferences here in the next few weeks, definitely come
6:23
out. Say hello, I will be there, but
6:25
feel free to use the code that shows support for for us.
6:28
And then while I'm in DC, you're going to be in San Francisco.
6:32
I'll be in San Fran at Octane 2023 is October 3rd through the
6:36
5th. We have a discount code for that
6:40
one as well, 30% off using OK TNID C30.
6:46
I'll get you 30% off. You can register@octa.com/octane
6:50
and we're also doing some fun stuff over there.
6:53
One is I'm going to have my fancy Dancy iPhone and I'm going
6:58
to take some videos and hopefully do some interviews
7:00
with folks that I see around the conference.
7:02
I'll have some of the new updated IDAC stickers.
7:07
They're more easily peeled off and you're.
7:11
Very proud of those, by the way. I mean, it's a.
7:16
It's a game changer. How often can you upgrade a
7:19
sticker, right? You know, like what do you have
7:22
to do to upgrade something that's been around for 100?
7:24
Years now with 100% more sticker.
7:27
Yeah, it's much more sticky. And then we're doing a cohosted
7:32
event with our friends from Accents We're it's Wednesday
7:36
night. We'll put the link in the show
7:39
notes for how to register for that bad boy.
7:42
Or you can look at my LinkedIn profile.
7:44
I've posted a video on it which kind of shows the last time we
7:48
did an event or actually attended their event, didn't
7:51
cohost that one at as identifiers, but we will for
7:55
this one at Octane and our guest today may be in attendance there
7:59
in Octane as well. Yeah, we'll see.
8:03
And then after that we've got Authenticate conference that is
8:06
October 16th to 18th. That's in Carlsbad, CA.
8:09
That's the San Diego trip that I mentioned.
8:11
So I'm heading out there for that.
8:13
Jim, you and I are going to be on the main stage.
8:15
We're going to do a live show in front of the live studio
8:18
audience of people in the in the venue, as well as streamed live
8:22
to the Internet. That'll be interesting.
8:24
We've got to figure out what the heck we're doing with that one
8:26
too. So we got to get out on our
8:28
horse about that. But we've got a code for that
8:30
one as well. I D AC15 podcasts that get you
8:33
15% off. So we've got discount codes, the
8:37
galore for Identity Week, America Octane, Authenticate,
8:42
very appreciative of all those guys sponsoring with us and
8:45
helping us get the word out for stuff that we're going to be
8:47
doing at their stuff and hopefully they get the benefit
8:49
of your great attendance being there.
8:51
So I'll have links in our show notes too, where people can get
8:54
all this information and make it easy for people to sign up and
8:57
register. Also, if you're a fan of the
8:59
podcast at the Authenticate Conference, we're going to
9:02
record like 5 different episodes or four In addition to that main
9:07
stage one and we're going to have a multitude of guests.
9:11
We're also going to have live studio audience opportunities
9:14
where people can come attend, ask questions of the guests.
9:18
We have to keep them in about an hour long because we're going to
9:22
be on the schedule just like any other session, but should be a
9:26
lot of fun. So if you're into the show and
9:29
you want to take part, being there at Authenticate is a great
9:33
way to do it. And by the way, they're also
9:36
having one night, which one of their entertainment nights is
9:39
they're going to have out on the patio.
9:41
It looks like a really nice hotel or nice resort.
9:45
They're going to have food trucks.
9:46
So that's how we'll be fed that night is via food trucks.
9:49
I'm really looking forward to that.
9:51
I think Mexican food in San Diego is the best Mexican food
9:56
you can get in the US Those are fighting wars.
10:00
I know that we're going to get some hate mail over that, but
10:03
I'm, I'm putting, I'm laying down.
10:05
Do you agree? No, but that's only because I
10:09
haven't had it in the San Diego area from a food truck.
10:11
I'll be honest, I didn't really discover food trucks until about
10:14
a year ago. Was never like a thing in the
10:18
Chicago suburbs. So it's like, okay, whatever
10:20
you're talking about too cold there.
10:22
Well. Yeah.
10:23
And I guess it's just it's, you know, it's urban, I mean you
10:25
know it's it's suburb and so it's just spread out everywhere.
10:27
It's not like you're in the city and stuff like that.
10:29
Or at least I wasn't very much now, hadn't lived in Nashville
10:32
for a little over a year. There is a huge food truck scene
10:35
because there are constantly going between all the different
10:37
breweries and different things. So I'm I'm all in on the food
10:41
trucks. A good food truck.
10:44
Chef's kiss for sure. Am I willing to go and say that
10:47
San Diego area has the best Mexican food out of a food
10:50
truck? I don't know.
10:51
I'll take the challenge. I'll throw away the food truck
10:55
qualifier. I'm just saying it has the best
10:56
Mexican food. But what about, like, Chili's?
11:03
We'll leave it at that, folks. Episode over.
11:07
Yeah. Why don't we get to our main
11:08
topic We're going to talk about just in time access and just in
11:12
time. We've got John Morton.
11:13
He's the field CTO, Cloud Solutions, engineering leader at
11:17
Brightive. Welcome to the show.
11:19
Or I should say, welcome back to the show, John.
11:21
Always happy to be here, gentlemen, and the Chili's
11:24
comment that that those are fighting words.
11:28
Hey, shout out to my chili heads.
11:29
I work for Chili's for like 4 or five years.
11:32
Made great friends, lifelong friends.
11:33
It was a great time and I'm. I'm a fan of the queso.
11:37
What can I say? I travel, I go to a Chili's, I
11:39
eat the queso. It's simple.
11:41
I'm a simple man with simple. Yeah, with simple needs.
11:43
The last time you were with us, John, was episode 115.
11:48
And we talked about the cloud being different.
11:50
That was way back in October 2021, now we're in September of
11:55
2023. What have you been doing for the
11:57
last two years? That is a great question and
12:01
surprisingly I've been diving into exactly that, Not just
12:05
cloud usage but actually like digital transformation and I've
12:11
been working a lot with customers.
12:13
Getting to know them and understanding what are they
12:16
doing there that's so radically different that traditional tools
12:20
just don't fit. So a lot of conferences, lot of,
12:23
you know, customer engagements, you all mentioned some
12:26
conferences. We all may be used to an
12:27
identity, but we're talking things like Google Next, a WS
12:31
Reinvent, Cube, Con, a Kubernetes specific conference,
12:36
DevOps days, these sort of conferences I've been attending
12:40
and really just learning from customers or what are they
12:42
doing. And how are they doing it?
12:46
That's it. That doesn't sound very much.
12:51
Well, the objective there, the pitch I always give is what I've
12:53
been working on for our company at Bright of is I bridge the gap
12:57
between sales, engineering and product being an evangelist for
13:00
customers. So when I gather all that data
13:02
and information of what they're trying to do, how do we build
13:05
our product and make it better and actually tangibly build it
13:08
so and then go sell it. So that's the the summary there.
13:12
So for people who aren't familiar with Bright of what is
13:15
it that you guys are looking to solve for?
13:17
Yeah. So the best way I summarize it
13:19
is that we do cloud access management.
13:21
I know that sounds very simple and it's very easy way to put
13:26
it, but that is functionally what we do.
13:29
We help folks manage access to the cloud.
13:31
And our claim to fame is, as you all pointed out, is just in
13:34
time, meaning you get the access you need when you need it.
13:37
It's the appropriate access and it's what you want.
13:40
Not to be confused exactly with authentication, more focused on
13:44
that authorized authorization piece, but that's the summary.
13:49
Yeah, that that's a good summary.
13:51
I think what I always get hung up with on just in time access
13:55
is because I think you just said what it is.
13:57
But how does it really work? Like walk me through a scenario
14:01
where somebody is like receiving just in time access to go do
14:05
something they need. Yeah.
14:07
And so, yeah, back to that point of what are these engineers, I
14:11
like to call them builders, platform engineering folks,
14:14
system engineering folks, site reliability engineers in, you
14:19
know, operations trying to do what they're trying to do for
14:22
the most part is maybe deploy a certain piece of software
14:26
literally right now, whether that's a human method or an
14:29
automated method. What they've learned over time
14:32
is you don't have to have static credentials that have static
14:35
permissions like a domain admin to add someone to a security
14:38
group. You can actually do it pulling
14:41
the levers of API. I can put Jim McDonald in
14:44
security Group A for 5 minutes, he does his job and I take him
14:48
out. That's the simplest way to break
14:51
down some of that complexity that makes a lot of sense.
14:54
I think that you know, one of the biggest shortcomings we have
15:00
is over provisioned accounts, accounts laying around that you
15:04
know even if you feel like you've got all the safeguards
15:06
and controls around those accounts, it's an unnecessary
15:09
risk to have an account out there that has all these
15:12
permissions that's not being used.
15:15
But it brings me back to I think that the terminology that I was
15:19
hearing a lot a few years ago is 0 standing privileges.
15:23
And my question is, is just in time access is 0 standing
15:26
privileges? Are they exactly the same thing?
15:29
They, they go hand in hand, they go hand in hand.
15:31
So what's always tough for customers, I've been doing this
15:34
now for three years specifically is everybody says they do JIT
15:39
and and JIT can literally mean, hey, Jeff logs on right now,
15:44
creates an account for me right now and he puts me in the group
15:48
right now. That qualifies as just in time,
15:50
right? That is radically different than
15:53
0 standing privileges where you know you may have an existing
15:56
user account and you get the access you need.
15:59
Being put into a group for example, and taken out the 0
16:02
standing privileges there is your account has zero standing
16:06
privileges. So architecture is my favorite
16:09
term for that. Makes it a little confusing
16:11
about the two and it's the operations team who really can
16:15
break it down for even better, if that makes sense.
16:19
It seems like the council we're talking about are the of the
16:22
privilege of variety makes you think of privilege access
16:26
management or Pam. I'm wondering, is what we're
16:29
talking about like Pam 2.0? Because we've done episodes
16:32
where he said Pam is dead. I wouldn't say Pam is dead,
16:35
because that hurts a lot of people's feelings.
16:38
What it is, is access is being looked at in a new way, right?
16:42
Why does it have to be privileged access when you can
16:44
manage access this way? A better way to look at it is, I
16:48
always say from the resource up, it should be the resource that
16:52
dictates the level of privilege. And you know that's a new way to
16:57
kind of look at things. If you were biased like I was
17:00
for a long time and I am where what I mean is like a developer
17:04
may say, I need access to an EC2 instance.
17:08
That's a resource. It's a bucket where you store
17:10
data, ECT. They don't care how you get
17:13
there. All they care about is getting
17:15
the access they need when they need it.
17:17
So they're looking more at the resource itself versus some sort
17:20
of account that gets down into it, right.
17:24
So John, I'm gonna ask you, I'm gonna ask the question very
17:27
open-ended about what business problem that solves, but then I
17:31
do want to get into specifics depending on your answer.
17:34
So what business problems does just in time access solve?
17:38
Oh, now that is my absolute favorite, Jeff and Jim, this is
17:43
where I over the past few years working with operations and
17:47
builders. I've been so relieved working
17:49
with them because there are a lot of shops of yes versus
17:53
working with traditional identity and security that are
17:55
shops of no. What does that mean?
17:59
Operations teams, platform engineering, system engineering.
18:02
They get paid to do things like, you know, we're recording now.
18:07
They get paid to keep the platform up, right.
18:10
They get paid to make sure when we access it, it's there.
18:13
The KP I's for the business are driven by functional operations
18:16
of organizations. The last thing they want is to
18:19
be slowed down and doing their jobs.
18:22
A lot of the KP I's revolve around and they report up to the
18:24
CTO. So what we do?
18:27
Is we help remove a lot of the complexity of access so they can
18:32
do their job. Simply put, they are begging
18:35
please remove the complexity so I can do my job.
18:38
Because when you think about things like least privilege,
18:42
privileged access management, request workflows, that is
18:47
complexity. The business value of what we're
18:50
doing is we're streamlining that process by giving these builders
18:53
a self-service opportunity that has security guardrails.
18:57
So it's win, win. The builders get what they want.
19:00
They do things fast and there's security involved because we
19:02
have guardrails with Jet and we we really enable them to build
19:07
fast. That's a great answer.
19:10
You know, I I don't, I can't think of the organization I've
19:13
worked with in the past decade or said that doesn't have cloud
19:18
infrastructure, cloud applications.
19:21
And I think we're talking a lot about how to do these things,
19:27
how to manage these privileges for the cloud.
19:30
But what about on Prem? A lot of these organizations
19:33
still have servers and data centers, and it might call it
19:38
like a hybrid cloud, but the reality of it is is it's still
19:41
on Prem infrastructure. You are absolutely correct.
19:45
So one thing I like to remind people of too, just to take one
19:48
step back, is when I talk about the cloud, I really hate.
19:51
It was a joke that came out maybe four or five years ago
19:54
where somebody said the cloud is just someone else virtualizing
19:57
your data center. That is not the cloud at all.
20:00
The cloud to me when I talk about AWS or GCP is actually a
20:05
new operating system. It's not somewhere where you
20:07
virtualize servers. It's a brand new operating
20:10
system that has its own functions.
20:12
So what they did there is they built capabilities like
20:16
ephemeral access that made it easy.
20:19
So the hardest thing we deal with that bright is your exact
20:22
point. You can do all these fancy fun
20:25
things in the cloud. Why can't you do it on premise?
20:29
Well, there's certain limitations.
20:30
There's traditional networking, traditional directory
20:34
structures, file structures. You have these beautiful
20:37
firewalls that keep us out, so we're slowly bridging that gap
20:41
back to on premise where my use case still applies on premise.
20:46
Imagine if you can put someone in a security group for 5
20:49
minutes and take them out. That's the simplest way to think
20:53
about it. Now you when you add on the
20:55
layers to it, you have to have some sort of agent that runs in
20:58
the environment that can do this job that you would have done
21:00
manually. That's where it gets a little
21:01
fun, but we are seeing these capabilities expanded with
21:05
certain tools like Kubernetes, with certain capabilities like
21:09
robotic automated processes, things like Jenkins, things like
21:12
Terraform. So the cloud world is slowly
21:15
being begged to go back to the on premise world.
21:19
We're just nobody's 100% there yet.
21:22
Yeah, yeah. There's just so many such a
21:24
variety of use cases and legacy systems and things like that,
21:30
so, so. It sounds like on Prem is a more
21:34
difficult 1 to tackle in terms of the types of systems.
21:38
Are we talking about apps? Are we talking about middleware
21:42
infrastructure or is it all the above platforms as well?
21:47
Yeah. Now that's that's still I always
21:49
talk to you is another thing I like to talk about is a cloud
21:52
journey, right, a cloud journey. You just nailed it very
21:54
eloquently, Jim. So a lot of folks, they will
21:57
start with, let me just virtualize some of these
21:59
hardware servers into the cloud, Very basic stuff, right?
22:03
So at its core lift and shift, we're managing the platform.
22:08
But anybody who goes on a digital transformation knows
22:10
that's the tip of the iceberg. You want to use these new
22:13
operating systems like I mentioned and you know, get that
22:16
going. So what we'll see is it's a
22:20
really diverse set of what they're going for.
22:22
Now a little bit bias here, but there are certain organizations
22:26
that are on the bleeding edge of pushing operations faster.
22:30
Retail for example, they get paid when you go download stuff
22:33
off their app and purchase stuff through their apps.
22:36
They're a lot farther in your case, Jim, of where we at, you
22:39
go somewhere else like insurance.
22:42
Yeah, we're lucky if we see anything in the close fed space,
22:46
very similar. So many controls and rules,
22:48
they're not there. So they're different verticals
22:50
that push a lot farther. But we really run the gamut of
22:52
all all of those in between and I described as human problems
22:56
versus legitimate automated infrastructures, code CICD
23:00
problems. There's a full spectrum there.
23:04
You mentioned a couple of different verticals like
23:06
government and insurance compared to maybe retail and
23:09
sort of the, I don't know the the where they're at on their
23:12
journey either to or from the cloud, I guess would be the
23:14
right way to put it. A lot of folks out there
23:18
probably have a Pam strategy. I hope they do at least of some
23:22
sort and maybe it's been designed.
23:25
You know that was more focused on an on Prem versus something
23:28
that's more cloud focused. Does it make sense to have a Pam
23:33
strategy for both? Here is our Pam strategy for on
23:37
premise environment and then here is our Pam strategy for our
23:40
cloud environment. Are there parallels that could
23:44
be drawn between the two to say okay as a general rule of you
23:47
know, of of operating? We want to be least privileged,
23:52
right? Or if we can zero same
23:54
privileges, which I love, I love, I love.
23:56
You know the idea of that. I think I've been using it since
23:58
I heard you talk about it a couple years ago.
24:00
That's a great idea, right? That's this just in time axis
24:02
type thing. If I have a strategy that was
24:06
built for on Prem, how much of that translates to my Pam
24:11
strategy for the cloud? Yeah, Jeff, get me excited over
24:16
here asking the tough questions. So I would say almost 5% would
24:22
be applicable. Here's why.
24:23
Now traditionally, everyone should have an identity
24:26
strategy. You guys nailed it.
24:28
Jeff and Jim, you're here to hear first leaders in in the
24:31
right way to think about it, right.
24:33
It should be an identity strategy.
24:35
Why am I saying that? Pam to me has always been a
24:38
subset of that. And about 20 years ago, some
24:40
smart vendors, we won't name names, they created their own
24:43
market space for Pam and they created all the rules.
24:46
Well, those rules don't apply 20 years later.
24:49
Trust me, I very rarely encounter anybody who wants to
24:52
be held up having some virtual machine log into them as an
24:56
admin user because you have to pay for more admin accounts.
25:00
So those sort of strategies, you're correct, they should be
25:03
there. But what hurts the most is the
25:06
mandates, the compliance, the risk, the the regulations that
25:10
accompany Pam. So there's no way to escape that
25:13
strategy, but it does not in any way correlate 1 to one for
25:18
capabilities in the cloud. For example, you know 0 standing
25:21
privileges. We once showed an auditor when
25:23
we were working on our own stock two type 2.
25:26
They said, hey, let's do an audit of your environment.
25:28
Bright if we showed them and they said why do none of these
25:31
accounts have any permissions? This isn't even possible.
25:35
Where's the privileged accounts? We're like when we use this new
25:38
tool that we built and that doesn't work that way anymore.
25:41
So as times evolve, the traditional Pam idea, which to
25:45
me is a subset of identity, is not going to be able to keep up.
25:48
It's just not feasible. Well, I think a lot of
25:51
organizations run into this struggle of the definition of
25:54
what is privileged access, and sometimes it's like okay.
25:58
Well, because I'm an admin, I need that admin access all the
26:01
time. When do you really, I mean, you
26:04
know, sometimes it's you know, one transaction, right, you're
26:07
doing per day that requires it. Or maybe it is in an area where
26:10
you're constantly doing things and the end up as sort of like
26:14
this spectrum of different permissions.
26:17
And I think the reality if you really were able to get it down
26:21
to a fine grained point in time, minute, not even minute by
26:25
minute, but millisecond by millisecond in some cases, what
26:28
is your actual privilege profile look like?
26:32
There's probably a spectrum there.
26:35
Am I thinking about that right, or is there a different way to
26:37
that, that people should be thinking about that out there?
26:39
You're thinking about it right? And that's traditionally how I
26:42
came into it too, right? I kind of thought about it.
26:43
So this is where I ran into the conflicts, though, where I
26:46
pivoted to, well, what are the builders doing?
26:49
They don't care about an admin. They don't know the difference.
26:53
What they care about is access to resources.
26:56
So within any environment, any ecosystem, the data, the
26:59
resource is what can be classified as privileged, if you
27:03
will. How we get that, you know can
27:05
latch on to that easier than us. So let me put it a different
27:09
way. A lot of Pam and I am teams
27:12
think they ask me if I just had the context, if I knew what was
27:15
privileged, if your tool could tell me I could fix things.
27:19
That's never going to work. That's a never ending tale.
27:22
With every new cloud added, every new resource added, we say
27:26
hey, why don't you look at the resource itself and what they're
27:28
trying to do. When we build guard rails around
27:30
that, does that make kind of a sense around a different way to
27:33
approach the same problem? Yeah, I think so.
27:36
I think it's difficult in the real world sometimes, right.
27:39
It's how, I guess how responsive are your identity systems in
27:45
being able to manage that. It's typically the challenge I
27:48
see because the traditional method of doing this is I go
27:51
into a vault. And then, you know, first of
27:54
all, I log into a vault, and then I need to find my
27:57
credential and then I need to check it out like a library
28:00
book. Sometimes there's a form I need
28:01
to fill out that says, hey Jim, am I allowed to have this
28:04
library book out? And then we're waiting for Jim
28:07
to say yes or no, right? And then I get that account, and
28:11
then I do my thing, whatever it is.
28:13
And then maybe I keep that library book checked out for the
28:16
entire day, week, month, hour, whatever it is.
28:21
And then somewhere Jim, the mean privileged librarian comes along
28:25
and says give me that back, takes that, takes that book
28:27
back, that account back and changes the password on me.
28:30
So I can't use it. It seems like that that's not
28:32
super responsive in today's world.
28:36
And and I'm thinking about this this just in time, Access is
28:39
very in my mind. It's going to have to be very
28:42
data-driven, but it's going to really be a a different way to
28:44
think about how can we actually deliver on that promise of JIT.
28:49
And say, okay, well, here's here's what we've got.
28:51
And you know, your access is minute by minute, second by
28:55
second, really kept up to date because I think there is
28:57
something very powerful to say about, yeah, if if an account
29:01
gets breached, the account itself doesn't have any
29:04
permissions, which is great. It's very similar to kind of
29:07
this, this idea of passwordless or and I'll say true passwords,
29:10
meaning there is no password in the environment you're relying
29:13
on other mechanisms to do authentication.
29:15
So if you steal the database that has the credentials in it.
29:18
The pastor feel is blank, empty or just doesn't.
29:20
You know, it doesn't make any sense and is of no use to
29:23
people. I see kind of the same concept
29:24
here. Yeah.
29:25
So it's exactly that. It's just to add, like I like to
29:28
say, Better Together to add to what you're saying, right.
29:30
The Better Together story is if you looked at it this way and
29:34
when I talked to my customers, we don't have the content as
29:38
identity practitioners of all these vulnerabilities.
29:41
All the simplest way we can do it is say we have a production
29:44
environment, the developers or builders have the context of
29:48
what they need. What if we allow them to have
29:51
self-service to what they want with security guardrails to your
29:53
point, the security guardrails being you can build your own
29:57
access in this environment and you use JIT and you use our
30:00
policies and you plug into the SIM and you plug into SSO or
30:03
MFA. That is exactly where we're
30:06
fitting. We don't know what you're trying
30:08
to do. We want to give you the
30:09
guardrails to build it to be the most effective you can.
30:12
That is amazing. When we, when we our customers
30:16
specifically, that's what they're buying into rather than
30:19
identity saying you need to explain to me all these things,
30:21
Jim, why do you want this access?
30:23
I'm going to give it to you for 24 hours.
30:25
Instead it's saying, hey, why don't you build this, then you
30:27
use it. We'll keep an eye on it.
30:29
If it works, it works, everybody wins.
30:31
Does that make sense? Yeah, for sure.
30:33
I think there's another area that I kind of want to get into
30:35
a little bit and this is around. Data, because I think this is an
30:39
area where a lot of organizations struggle.
30:42
Back in the old days in quotation marks there were
30:44
things like data lakes with Hadoop, things like that and it
30:47
was still very much role based access to some degree, maybe
30:51
some attribute based access control.
30:53
And now we've got things like Snowflake and this potentially
30:57
is an area they think they could have a pretty big impact,
30:59
meaning just in time access into Snowflake environments and data
31:03
accesses. First of all, I guess for people
31:06
who aren't familiar with Snowflake and pretend I'm a
31:08
dummy, I know it won't be a big stretch for you.
31:10
What is Snowflake? And then talk about the impact
31:15
that something like either JIT or 0 standing privileges might
31:19
have on a solution like Snowflake.
31:22
Yeah, excellent. And I love these folks.
31:25
Never think anybody's a dummy. I get excited about it cuz I had
31:28
to start, you know, somewhere. So when I think about what
31:30
Snowflake is, so when I started out, I used to be in finance
31:33
before, actually before I came to the vendor side like 1012
31:35
years ago. And everybody knows what a DBA
31:38
is, right? Everybody knows what a database
31:40
is. Hopefully you store data in it,
31:42
you reference it, you need it for everything.
31:44
And that's how most systems, information systems work.
31:49
It's not really that much different.
31:50
Where Snowflake changed the game was in just charging pricing
31:54
model. I know I'm not making this like
31:56
a business conversation, but it's actually pretty important
31:59
rather than worry about tons of storage.
32:01
And this actually speaks to the difference between on premise
32:04
and cloud. Most of the time when you
32:06
worried about, and I I'd like to speak like a CTO, because it's
32:09
business value. When you have an application
32:12
that references data and databases you used to get
32:14
charged by storage. The more data you stored, the
32:17
more expensive it was. What Snowflake did is they said
32:21
that is a bad idea. Let's switch it where we're only
32:24
going to charge you when you access data, we don't care how
32:27
much of it you store. So that radically allowed
32:31
applications to be built in new ways.
32:33
We won't go too deep into it, but it's your idea of data
32:36
warehousing. It's still the exact same,
32:38
right? You store the data somewhere and
32:40
you get charged by compute. What this does though is it
32:43
allows organizations to get really business analytical and
32:47
think about what they're doing with the data and use it in new
32:49
and creative ways. So with Snowflake, you can store
32:53
all the data you want, you can distribute it how you want, you
32:55
want to protect it, but you're allowing folks to access it when
32:57
when they want, and they're only charged in in that time for
33:01
compute. Now why that matters?
33:03
Does that kind of make sense? Yeah, I'm thinking of my simple
33:06
brain, almost like a vending machine.
33:08
You've got a stock of soda inside the vending machine.
33:11
And you're only paying for the things that you're pulling out
33:14
of that vending machine 100% rather than paying for keeping
33:17
that vending machine alive and stocked and full where you may
33:19
not use it all the time. I only want a couple sodas.
33:22
So what that does though from a security perspective is it's a
33:25
little scary to traditional security practitioners because
33:28
now you have new ways of accessing snowflake tools like
33:32
Jupiter notebook that data scientists use.
33:34
So to your point earlier, Jeff, guess how they access this data?
33:38
They have one set of logging credentials, they use it in
33:41
these robotic processes and they fetch this data all the time.
33:45
Now that's good on the business side, but on the security side,
33:48
that's a little petrifying. Especially if you can run up the
33:52
bill or access data sets, you shouldn't be able to access it.
33:55
You do need some disparity there.
33:58
And again, it's the traditional concept of do you need global
34:01
admin to access every table and every entry to run this task
34:05
with one set of credentials or can we do it in a different way?
34:11
Okay. So I'm sold.
34:13
I need to have just in time in my environment, I need to have
34:16
privileged Access management environment if I don't already.
34:19
One of the challenges that typically see this is around
34:22
this concept of accountability versus ownership and
34:25
responsibility of delivering these services out to, you know,
34:28
the to the environment who runs Privileged Access Management.
34:35
Within an organization and part of that would be things like
34:39
services like just in time or 0 standing privileges or
34:42
traditional Pam right? That might be like a vault or
34:44
things like that. Cuz I feel like typically
34:47
infosec teams like to get their hands in there and say okay,
34:51
here's my tool right? And you developers need to use
34:53
this. There's another school of
34:55
thought that's like, well, it's the engineers are gonna be using
34:57
it, maybe they should own it and.
35:00
Information security, maybe provide some guidance or you
35:02
know some oversight over how it's used, right?
35:04
Things like that. Maybe it's someone else.
35:07
I don't know, like where do you see this, this, this.
35:10
I won't say battle, but this discussion taking place it is it
35:14
is a battle. So what my best recommendation
35:17
is as such. All right so and this is what I
35:19
tell the boards or sea level folks the job of a sea.
35:23
So in my opinion Chief Security Officer is to technically own
35:28
the tools that account for risk. They own the risk.
35:32
They do not need to have the context to understand what
35:35
exactly the CTO is doing in Snowflake right.
35:39
But he does own the risk of that access of that getting out.
35:42
So traditionally when we've seen it and you all probably have
35:45
seen the same thing, I am teams even their purchases go to the
35:49
see see so see so owns the product.
35:53
What is a happy medium is when you do say CTO or CIO, I'm going
35:58
to own the risk. Here's the tools I'm providing.
36:01
They will help you enable your task, your functions, MB, O's,
36:06
whatever, right The the CTO also has an objective, so does the
36:09
organization. That's what we normally see. 95%
36:12
of the time the see so owns the risk, they own the products.
36:16
But you have to work hand in hand with the business units.
36:19
The CTO normally that's executing these functions or has
36:22
to use them. I think this is an important
36:24
topic for people to really kind of understand because I ran a
36:27
workshop on this actually a couple weeks ago with a client
36:30
and we spent probably a good two hours talking about the racy
36:35
model of the IM program in the room was information security,
36:39
you know, general IT application developers, things like that.
36:43
And we kind of we had discussion around Okay.
36:47
Let's talk about these services for identity that we're going to
36:50
be providing and this isn't specific to you know Pam or JIT,
36:52
but I think it's it certainly applies is is really
36:57
understanding where do you fit within that racy matrix because
37:01
I think a lot of people and I and I'll, I'll blame not blame I
37:05
will I'll I'll drop this on my information security brothers
37:08
and sisters out there is there is this tendency that oh it's a
37:12
security tool so security should own it and operate it and blah,
37:15
blah, blah. That might not be true.
37:18
You might be accountable for the tool or the risk that the tool
37:24
is mitigating, but that does not necessarily mean you need to be
37:27
responsible for the delivery of that service.
37:29
So I think this is something that organizations really need
37:31
to start thinking about. If you're if you're running an
37:34
IM program or you're looking at getting one stood up, or anytime
37:37
you're building out a new service, really take some time
37:39
to think about that racy model. Because I think there's a big
37:42
difference between being accountable for risk.
37:45
And this is where I see the SISO and the CTO having the
37:49
accountability hat. And to me, accountability is
37:52
like Highlander. There can only be one, yeah,
37:54
you've got to have one person or one group that's that's actually
37:57
accountable for, you know, the risk of the service, whatever it
38:00
may be. Versus who's responsible for
38:04
making sure that service is up and running.
38:05
So I think this is an area where really think about you know, do
38:08
you really want to be accountable for it.
38:10
Because if you are, something goes wrong, that's, you know,
38:13
the group or the person that's going to be on the hook to talk
38:15
to others, to figure out what happens, go to the board.
38:20
Things may be now conversely, you know, typically that's the
38:22
person probably going to get the recognition for, hey, the
38:25
ServiceNow, hopefully that person.
38:27
That it's accountable to sharing that love downstream to others
38:30
as well. But I think that's something
38:31
important for people to think about is this concept of
38:34
accountability versus responsibility and then of
38:37
course the consultant in the informed part of that racy
38:40
diagram. But really think about where do
38:42
you really want to be, you know, with regards to that service you
38:46
did. You said it nicely, Jeff.
38:47
I was just taking it in watching the master teach.
38:51
Yeah, You didn't think you'd get out of here easy, did you, John?
38:55
I never do. It's fun though.
38:57
No, you know, you know I want to add something on this topic
39:01
which is I think privilege access management or just in
39:04
time access. This is one of those areas where
39:07
you know information security, if they're delivering single
39:10
sign on or identity governance and administration or what other
39:14
whatever other I M services they're offering, they just
39:17
assume okay, well we'll run the Pam system as well.
39:21
But what I found in my career is that Pam.
39:25
As seen by engineers or whoever's being affected by it
39:28
and going to have to use the tool as this is being done to me
39:32
and now I have to figure out how to do my job efficiently.
39:36
In light of the fact that you've thrown this obstacle in my way
39:39
and I'm going to figure out ways to work around it versus the
39:43
mindset, the mindset shift that can happen if you say no,
39:47
actually this is your tool, you run it, and now.
39:52
You can't skip a step, which the step is if you go into an
39:56
organization and the engineering team thinks, Oh well, John and
40:00
Jeff have worked here for 20 years, They're my best friends.
40:03
They would never. They would.
40:05
They would. They would never try to rob the
40:07
company or do something bad or become an inside threat.
40:12
We trust each other. We share passwords.
40:15
We don't. If that's the mindset, no you
40:17
don't. You don't get to run the system
40:20
right and but you at least have to have like a management view
40:23
within that team that says, you know, I have people come and go
40:28
and you know like I can trust you with my lunch money, but
40:33
that's I'm not going to trust you with the keys to the Kingdom
40:36
of of the company. It's just the way it is, right?
40:39
So. Jim you and I had this
40:41
discussion a long time ago. I I remember this was an episode
40:44
I I don't know when it was. It was a long time ago.
40:45
We talked about this is related to remember when Tesla almost
40:51
got breached and basically there was this guy who was like an
40:54
insider threat and he was being paid or the the I guess the the
40:59
attempt was right is somebody would give him money to give him
41:01
information on Tesla stuff right.
41:04
And you and I had a conversation like, OK, so.
41:06
And my, my, my thought process was everybody has a number to,
41:11
you know, break their oath of security or whatever, you know,
41:16
privacy, whatever it may be. The number might be small, the
41:19
number might be a strong astronomical, but everybody has
41:23
a number. If someone came to you Jim, and
41:25
said, hey, I will give you $2 billion tomo bravo, If you're
41:29
listening to, you know, be part of an acquisition where they
41:33
acquire the identity of the Center podcast.
41:35
I think we would listen to that, right?
41:37
As much as like doing that, right.
41:38
We have a number that we like, all right?
41:40
That would be something like that.
41:41
And I think the same goes for anything.
41:43
Now, again, I'm not saying that people are bad inherently.
41:45
I try to believe in the good side, but I think everybody has
41:48
a number. And if you're relying on trust
41:53
to be your security platform, you know, in a physical, human
41:57
sense, I think you got problems. I think that's the case.
42:00
I think it's best run by the engineers because at 12:00
42:03
midnight, you know they're trying to solve a problem.
42:06
You threw the system at them. Either they're going to try and
42:09
work around or they're going to pick up the phone and call you.
42:12
And I think information security's role is to make sure
42:16
that the controls that have been put in place actually work, get
42:20
tested on a regular basis. The system is doing what it's
42:22
supposed to do, be accountable for the system.
42:25
In other words, the buck stops here.
42:27
But that doesn't mean turning the wrenches necessarily.
42:30
Right. Yeah.
42:31
And just to add to that, just to add highlight exactly what you
42:34
both are saying. The reason I took this role and
42:37
I wanted to get closer to the customers is because I
42:40
consistently see cloud teams pull away from they hear words
42:46
like Pam and Lee's privilege, they pull away, they're building
42:50
these tools themselves. Every one of my large customers
42:54
have built some version of the tool themselves because they
42:57
don't trust. Their cohorts and information
43:00
security because it's just slowing them down and we don't
43:03
understand what they want. So that's if we can bridge that
43:06
gap going forward. Those are the most effective
43:09
customers I see out in the world.
43:13
Yeah, you talked earlier a lot about and I wanted to kind of
43:17
close this out in terms of the area we've been talking about
43:21
just in time Access. But shifting back to what you're
43:24
talking about with DevOps, you know, you're talking about the
43:27
conferences you're going to. To me this seems like that's the
43:31
sweet spot for Just in Time access is you know, especially
43:37
around non human accounts and not having them sitting around
43:41
with privileges to singing, you know, high power groups and
43:47
elevated permissions and doing it in a just in time way.
43:53
I'm wondering am I thinking about that right?
43:55
What is the role for just in time access in DevOps?
44:00
So yeah, So in the over 2 years I've been meeting with these
44:03
folks and you know, and they love the idea and but I think
44:06
again, I will say this bluntly and boldly, Identity needs to be
44:11
more in DevOps or I call them platform engineering builders.
44:15
I call them builders. They're builders and their
44:18
organization, the engineers, They're looking for identity
44:21
solutions. And they're not finding what
44:23
they're looking for. Matter of fact, case in point,
44:25
literally I heard it so much we actually built a request module.
44:29
Now we call it Access Builder in our own tool.
44:32
Because another thing they would tell us is the complexity of
44:34
requesting a simple access. Jeff needs access to XYZ.
44:38
I got her to submit a service now Ticket.
44:40
I filled it out wrong. I get it back.
44:42
I get the right details. He goes to someone who doesn't
44:45
know what I want. I get it back.
44:46
He goes to some cloud engineer to fulfill that.
44:48
He doesn't know what I want. I get it back.
44:51
So it's even in the complexity of requesting access that we
44:54
decided to build this product and it's hitting off like
44:56
gangbusters. And we're asking where is your
44:59
IGA tool? Oh, way too complicated.
45:01
Where is your ITSM tool? Oh, we don't even want to use
45:05
that if we don't have to. Can you just give me one line of
45:08
audit that says Jeff Steadman approved this thing?
45:12
That's all I need. I don't need the complexity.
45:14
So they're begging. Builders are begging for these
45:18
sort of solutions where they're just not happy with the current
45:21
state of things. And it is them.
45:22
They're the ones who are pushing innovation and making people's
45:25
lives hard in identity and infosec, right?
45:29
Yeah, I and I think from a CIO perspective, you don't want to
45:33
slow down like the engineers can move like at the speed of light.
45:37
Now with these cloud services and just roll out new business
45:41
functionality, even the CSO is minded from a business
45:44
perspective. I don't want to slow that down.
45:47
But at the same time just saying, all right, well I'm
45:51
hands off that that doesn't take away the the necessity to ensure
45:57
security controls are being followed.
45:59
So you have to find the middle ground and I think just time
46:02
access can potentially bring you a long way toward achieving
46:07
that. You need to have the paper
46:08
trail, but you know, counting on like a service desk ticket or
46:15
counting on your IGA system to provide a detective or even a
46:19
preventive control, it's just too slow.
46:22
It's. It's the worst break glass is
46:24
always my favorite. You you all pointed it out.
46:27
There's normally two guys in every shop or or ladies, you
46:29
know, two people who have the keys of the Kingdom for cloud
46:33
and they have it written down in the hopefully a little safe next
46:38
to their desk and they both know how to log in.
46:41
And that's how they still do it, because they don't trust even a
46:43
vault to get them to where they need to be.
46:45
They're like, man, you and me, Jim, we're going to turn the
46:48
keys at the same time and get in here.
46:50
But yeah, it's it's a tough and interesting place to be.
46:54
And just finding that happy medium is what I'm trying to do.
46:57
That's that's where I want identity to go.
46:59
It is, to me, the biggest rough spot of all enterprises I talked
47:03
to is the identity processes. Right now they're just complex,
47:07
mundane and misunderstood. And they may have its place in
47:10
finance, healthcare, there are compliance regulations and
47:13
mandates. Hopefully those change.
47:15
But where you don't have as much retail, manufacturing, things
47:18
like that, they just want to move fast, Give me what I need.
47:22
We're all getting paid. Give me what I need.
47:25
I love it. I think that's that's that's a
47:28
good way to probably close out that part of the discussion is
47:30
give it, give it to me when I want it and get out of my way.
47:36
So we mentioned at the top of the show we were recorded a
47:38
couple weeks early. It's September 7th, which is a
47:42
holiday in my household and maybe others, but it is opening
47:46
night for the NFL season here in the US.
47:49
So I'm a big football fan, been for years.
47:51
I have retired from the fantasy football game.
47:53
I used to run one for like 20 years.
47:56
I haven't done that in a long time.
47:57
Now I can actually sit and actually watch a game and enjoy
48:01
it rather than watching the little ticker at the bottom that
48:03
says, you know, so and so scored touchdown or receiving yards or
48:07
passing yards, whatever it may be.
48:08
So here is what we're going to end On a lighter note today,
48:11
we're going to pick a winner for this week's slate of games, week
48:16
one of the NFL. And because people aren't going
48:18
to hear this until, I think September 25th, Ish.
48:24
We're going to be able to find out right who is right, wrong
48:27
way off phase. And so you know, welcome to the
48:29
first ever Locktown episode of the NFL Weekly Picks with
48:34
identity at the center. John, who do you have your eye
48:38
on this week? Who is going to win?
48:41
So I actually do compete in the survivor pool, where you can
48:45
only pick one winner every week and you cannot pick the same
48:47
team. I did my research based on
48:51
degenerate gambling and sports betting and I'm going to go with
48:54
the Baltimore Ravens to at least get the win money line.
48:57
All right, who are the Ravens playing?
48:59
The Ravens are playing. Actually, that's a really good
49:02
question. I'm not.
49:03
Even that's probably a good. Oh yeah, the Texans.
49:05
That was. That was why I think
49:06
statistically the safest. Bet you are correct.
49:08
Yeah. OK, Jim, who is your lock for
49:11
the week? They are going to win their
49:13
opening game. Well, I I want to interrupt
49:17
first with I'm not a huge NFL fan until the college football
49:21
season ends. I'm a Georgia Bulldogs fan.
49:25
They are going to win every week, so we can put that in the
49:30
bank. I also am like super excited
49:32
about Coach Prime and what he's doing at Colorado.
49:36
They beat TCU last week. They're going to beat Nebraska
49:38
this week. NFL wise, Eagles first.
49:43
I grew up in Philadelphia and my number two team has been The
49:47
Jets because it lives in the New York metro area for a while and
49:51
they sucked big time when I lived there.
49:54
But now I think they're my pick for the Super Bowl, so.
49:58
You think The Jets are going to the Super Bowl?
50:01
I I think they're winning the Super Bowl.
50:03
Wow. And they're playing the Bills,
50:04
so that's a money night game. That's huge.
50:07
Obviously Aaron Rodgers going to.
50:09
The Jets is is a big deal and they're wide receivers really
50:13
good too, right? They're OK.
50:16
I thought like the one guy was like superstar.
50:18
I don't know. Like, it's not really my my cup
50:22
of teas, so. You're going to The Jets?
50:24
Well, you're saying you're picking The Jets of the.
50:25
Super Bowl, though, Who is winning this week?
50:28
They're going to play the Buffalo Bills.
50:30
You're picking the Eagles over the Patriots?
50:33
Yeah, that's safe bet. OK.
50:35
Yeah. All right.
50:37
So my two teams are the 49ers and the Bears. 49ers play.
50:44
Who do the The Steelers, who are bad?
50:47
They should win that game. But this is about passion, about
50:52
feeling. I'm going with my Chicago Bears.
50:55
Aaron Rodgers is out of town, and the Packers are coming in to
51:00
Soldier Field. I'm going Bears, baby.
51:02
I've drank the blue kool-aid the blue and orange.
51:05
Bears Lock it in. We're done.
51:08
Wait, how many wins did the Bears have last year?
51:11
I had a few I was just checking. OK, a few means three or more.
51:16
They have more than that, I think.
51:17
So here's here's the excitement in Bear Town.
51:20
It's we're not facing Aaron Rodgers or Brett Favre for the
51:24
last 20 years. So there's actually a legitimate
51:28
chance now that the I think the Bears can finally start to show
51:31
some progress against. The Packers, from a win
51:34
percentage, I think it's neck and neck.
51:36
I want to say the Packers took over like a one or two game lead
51:39
in the last couple years, but historically it's been like, you
51:43
know, 700 and 700. They've played so many games
51:45
against each others and it's been pretty even.
51:47
But I feel like this is the year the Bears turn the corner,
51:51
mostly because they're not facing Aaron Rodgers.
51:54
Again, feels like you're trying to talk yourself into this one,
51:57
but that's OK. Hey, so.
51:59
You're saying there's a chance? I'm saying there's a chance.
52:03
All right, we'll go and wrap it up for this week.
52:06
John, thanks again for coming back on the show.
52:08
We really appreciate the time you spent with us.
52:10
I'll have links to your LinkedIn and to to the bright of website
52:14
BRITIV e.com so you can learn more about what John's been
52:18
working on and some of the cool things that the bright of
52:21
solution does. We'll have links to all the
52:23
different conference things that we talked about early on.
52:27
So things like Identity Week America or discount codes for
52:29
that, Octane or discount code for that authenticate our
52:34
discount code for that. And of course, you know, you can
52:37
always connect with Jim and I if you've got questions, comments,
52:39
concerns, football picks. We're still looking for people
52:42
to send pictures of Whopper's candy to Jim, because that's his
52:45
favorite candy. And we'll go ahead and leave it
52:48
for this week. You can find us on the web, IDAC
52:51
podcast.com, Twitter at IDAC Podcast, Mastodon at IDAC
52:56
Podcast at Infosec dot exchange. Hit that subscribe button, like
53:02
share, you know, whatever you want to do to help us out, get
53:05
the word out for identity center in the gospel of identity and
53:08
access management to others is always appreciated.
53:10
So we'll help. Leave it for this week.
53:13
Thanks everyone for listening and we'll talk with everyone in
53:15
the next one. You've been listening to
53:18
Identity at the Center. We hope you've enjoyed the show.
53:22
Make sure to like, rate and review and we'll be back soon.
53:27
But in the meantime, hit the website at
53:29
identity@thecenter.com and find us on Twitter at IDAC Podcast.
53:36
See you next time on identity at the center.