Latest / Identity at the Center / #289 - DevOps Insights at Texas A&M University with Adam Mikeal

Transcript

#289 - DevOps Insights at Texas A&M University with Adam Mikeal · Identity at the Center

0:00
Well, I definitely think higher Ed tends to be more one of the
0:02
more complex use cases out there from a daddy's standpoint.
0:05
I, I think we've probably talked about this in the past and yeah,
0:07
not a lot of people I think are aware of of that and all the
0:10
hats you're wearing, right? Think like a baseball cap.
0:12
It's like, OK, I'm in this role. You've got like a baseball cap
0:15
that has like 5-6 different bills.
0:17
Yeah, you're like twisting it around.
0:19
I went. And they're all on at the same
0:20
time, right? You don't swap them out.
0:22
They're literally there all the time, right?
0:25
Yeah. This is identity at the center
0:34
if it has anything to do with IAM.
0:37
This is the go to podcast now your hosts Jim McDonald and Jeff
0:43
Stedman. Welcome to the Identity at the
0:51
Center podcast. I'm Jeff, and that's Jim.
0:53
Hey, Jim. Hey, Jeff, how are you?
0:55
Not so bad yourself. Great man, just getting back
0:58
from Identivers 2024 Las Vegas since our first episode since
1:03
we're back and and I figured I could make it seven days.
1:09
I was exhausted by the end. How about you?
1:12
I was good actually. I mean, I was tired when I got
1:13
back, but I don't know, I enjoy that kind of stuff.
1:16
So had a lot of good conversations with people, got
1:19
to catch up with folks, lots of good meals.
1:22
So I'm a I'm a fan of Vegas just for that sort of thing.
1:25
And then Friday night got to hang out with my brother for a
1:28
couple of that and went to Area 15, which was a very cool, I
1:33
don't know how to describe it, kind of like a weird experience
1:36
type place. Yeah, things to.
1:38
Do yeah, it was fun. So I decided what I'd like to do
1:42
today. Well, shout outs I wanted to
1:44
make because we didn't make them last.
1:46
I didn't get to make them last week.
1:47
So see all this stuff on LinkedIn, right?
1:51
There's the identity beer and there's the author of beer, and
1:56
this is from Sebastian and Roland from Umbrella Associates
2:01
in Germany. I'm not sure what I'm say, what
2:04
event I'm saving it for, but there's a good German beer here.
2:09
I'm assuming it's good, and I'm really happy about that.
2:14
Another shot out to the folks at Sabian and our friends there,
2:18
Jamie and Henrique in particular.
2:21
But why am I shouting them out? They had the best Concord swag
2:26
I've ever seen in my entire career.
2:29
Look at these three shoes. These are van sneakers, you
2:34
know. Hey, Enrique talked about him a
2:36
little bit. But man, these are they're
2:38
around like $3 shoes or something.
2:41
These are ones like you would buy in the store.
2:42
Other than the fact that they have the logo on it.
2:46
What a cool swag. Swag.
2:48
You're wearing their logo though, if you're if you're in
2:50
their shoes. So yeah, it was a very cool
2:53
thing. Henrika talked about it.
2:54
I thought it was very clever. I think, you know, getting a
2:58
customer of yours to also use their product as part of your
3:01
swag. That's that's pretty genius
3:02
play. I always talk about swag at
3:04
conferences generally sucks, but that was a good one.
3:08
I'll give a shout out to the tallest booth.
3:10
I thought they had the best demo environment or experience, I
3:13
should say, that I've seen from a vendor in a while kind of
3:16
telling that story of enrollment and purchasing like a ticket and
3:22
then, you know, getting access to a gated sort of event type
3:26
thing, right? You went through it.
3:28
I thought that was a pretty cool idea.
3:30
You're kind of stuck. Through a soccer stadium, yeah.
3:33
Very interactive you could feel like you're in like a real world
3:36
use case and then at the end you have a cool pair of socks, which
3:40
I know that's not your thing, but I like it.
3:43
I also wanted to shout out RSM. I mean, they sent us there.
3:47
They they'll, you know, a week in Vegas, you're exhausted and
3:51
broke. And I don't believe a gamble,
3:54
man. But that place is expensive.
3:56
So, you know, for them to be able to sponsor us to be there,
4:02
I thought was awesome. So I wouldn't be able to shout
4:04
that out. I also wanted to shout out
4:06
somebody named Jeff Sedmon, who took five episodes that we've
4:12
recorded there and they're all dropping, I guess by the time
4:16
this drops all dropped last week.
4:17
So kudos to. You.
4:20
Yeah, kudos to me. It was a challenge.
4:24
I was working through some audio challenges, so, you know,
4:28
probably not our best sounding material, but I think it came
4:31
across decently enough. I think lesson learned.
4:34
We added video for this time. So all these things are on
4:37
YouTube, so the content was great.
4:40
Lessons learned for the next time.
4:41
I've got some ideas on how to kind of improve the audio
4:43
quality and the video quality. But yeah, it was a very
4:47
interesting weekend and last couple days getting things kind
4:51
of set up and I think I have officially run out of storage on
4:56
multiple drives and recording 4K video takes up a lot of space.
5:01
It really does. Yeah.
5:03
A lot of extra, a lot of extra work, too, just to get the room
5:06
set up versus just doing audio. Yeah, I saved my last shout out
5:11
to the people who were really doing the work.
5:13
When folks like you and I are off, like having these
5:17
conversations with really smart people and all the folks who got
5:22
to go to the conferences because there's folks back home doing
5:26
the real work. The I am practitioners of the
5:29
world, you know, you often refer to them.
5:32
And I love it by I still concern that I am heroes who are running
5:36
around getting things done, getting the job done, often
5:39
times with too little budget, too few resources and tools that
5:45
really can't get the job done. So shout out to them.
5:49
You know, hopefully they're able to at least carve out a little
5:52
bit of time to listen to podcasts each week because we do
5:55
this for them. Yeah, you sound like you're
5:58
campaigning there for like the mayor of I Am Town or something
6:00
like that. So vote for Jim.
6:05
There you go. I'll give a shout out to Andy
6:08
Handel and the Saber Risk Alliance, definitely, you know,
6:10
appreciate them hooking us up with places to record and just
6:14
for, you know, being so welcoming for us to come out
6:16
there. So I think we've got a lot of
6:17
thank yous. I'm sure, you know, we'll have
6:19
missed somebody in the mix, but especially everyone who came up
6:23
and said hello and introduce themselves and, you know, our
6:26
listeners. I thought that was very cool.
6:28
We, we continued to grow. It was just like more and more
6:31
and more. There was one point where I was
6:32
in the hallway probably for two or three hours just talking to
6:35
people who were randomly stopping and saying hello.
6:38
And it was, it was good temps. It was very cool.
6:41
Yeah, and we were like a 5 minute walk from our recording
6:45
room back to our hotel room, but you could count on it taking
6:48
like 1/2 an hour to get there. Yeah, it was cool though.
6:51
I enjoyed it. I do too, yeah.
6:54
What else? So that was Identiverse.
6:57
Now we're back to normal, relatively speaking, at least
6:59
what's normal for us. We've got another conference
7:02
coming up in just a few months at this point, and it'll be
7:05
Identity Week, America. That's the one that we'll be at.
7:08
But there is a few different identity weeks taking place.
7:10
I think as we're recording this right now, which is what is
7:14
today, I don't even know the date, June 4th, the Identity
7:19
Week. Europe is starting right now
7:22
'cause that's actually no, it's next week, June 11th and 12th
7:24
now that I think about it. So by the time people listen to
7:27
this, it will be starting as you're kind of listening to
7:29
this. The one in America is the one
7:31
that you and I will be at. That's September 11th and 12th.
7:34
And then there's one in Singapore, October 22nd, 23rd.
7:37
IDAC 30 gets you 30% off of your registration for any of those.
7:42
If you're listening to this and you're planning on going to
7:44
Europe, probably want to use that code 'cause you're playing
7:47
probably the the short notice. All right.
7:49
But feel free to use that code anywhere on the world.
7:51
We'll have a link in our show notes so people can check that
7:54
out as well. What other business do you want
7:57
to take care of, Jim, before we get things started?
7:58
Well. We don't have our discount code
8:00
for authenticate yet, right? That should be coming along
8:03
anytime soon, and I think we jump right into it.
8:07
Yeah, Why don't we do it? We've got a repeat guest.
8:10
He's been with us before, Adam. Michael.
8:12
He's the chief information security officer and adjunct
8:14
professor at Texas A&M University.
8:17
Welcome back to the show, Adam. Thank you very much for having
8:20
me. Good to be here.
8:22
So Adam, I noticed that there is a new SISO title as part of your
8:26
introduction. How much credit do you give the
8:30
identity at the Center podcast for obtaining that since since
8:34
the last time you were on our show?
8:36
Well, I think clearly that was the deciding factor for my
8:39
institution. They they saw I was a guest and
8:42
they said gotta have this. Guy, right?
8:45
I mean, it's worth its weight in gold now.
8:47
Yeah. What's been new with you since
8:50
the last time we chatted? I think that, you know, there's
8:52
a lot of things probably going on in flight.
8:53
You're you're teaching. I think we're going to get into
8:55
a little of a conversation around like DevOps and probably
8:59
some AI and things like that. But give us an update.
9:01
What's what's Adam been up to? Well, so I think last time we
9:05
talked we focused mainly on what I had been doing.
9:08
My role at the time was managing identity security and we had
9:14
taken over the identity management office from at, at
9:18
our institution. Historically it had been part of
9:20
the infrastructure team. And we've kind of gone through
9:23
this transition where we're stopped.
9:26
We're not really referring to identity as identity management.
9:29
We're talking about identity security and we focused those
9:32
efforts on the security related platforms and tools that we
9:37
provide to others across the institution.
9:40
The, the management part of identity, right?
9:42
Like adding people to groups and does this person belong here or
9:47
not? Should they have access to this
9:48
thing or not? That's not really what my team
9:51
does. So in the office of the CSO,
9:53
we've tried to shift the focus to identity as a security
9:57
function. You know, like many universities
10:01
and anyone who has a federal partnership, we are dealing with
10:05
the federal zero trust mandate. I, I mean, it's a good idea,
10:09
right? So this idea of zero trust, I, I
10:12
describe it as try to avoid the, the buzzword.
10:16
But you know, zero trust to us just means we have less baked in
10:22
implicit access. And everywhere we can we try to
10:25
explicitly define access. So we apply these ideas across a
10:30
lot of different domains, networking, data, device
10:35
security. But when you move to a zero
10:38
trust world, there's a a very real aspect to which identity
10:41
becomes your new boundary, right?
10:43
Because if you're talking about no implicit access, you
10:46
explicitly grant access whenever appropriate.
10:50
You have to know the identity of the person or the thing that
10:54
you're dealing with. And so identity has become very
10:57
much a security focused effort for us here at Texas A&M.
11:03
Yeah, I kind of feel like from a university perspective, zero
11:07
trust has kind of always been a thing.
11:09
Right Before you were calling it zero trust, you just you're
11:13
putting your services on the network that are accessible by
11:17
so many people, in some cases maybe everybody in the world.
11:21
So when you do that, really identity becomes not only your
11:26
center, but it becomes your perimeter as well.
11:30
That's exactly right. You know, historically here at
11:34
Texas A&M, we've had a very flat network.
11:36
So like our campus network was very open.
11:39
Once you were on it, you had access to a lot of things.
11:42
Similarly for identity, for SSO, you know, we've had a, a
11:48
centralized identity function and but once you have
11:53
authenticated, oh, I'm me and I'm, this is my net ID.
11:57
There are many, many applications on campus that
12:00
basically say as far as they go to check access, it's just do
12:05
they have a net ID, is it valid, is it current?
12:09
And then OK, I'll just give you access now.
12:11
So we're trying to move away from that perspective to look
12:14
just because someone has validated their identity, that's
12:17
stage one. Now we know who they are, but we
12:20
need an explicit grant of access before you give them access to
12:24
this device or this data. Yeah, I mean the, the way you
12:28
framed it up digital security or I'm sorry, identity security
12:33
versus identity and access management is more than just
12:36
marketing, right. You, you're kind of living it.
12:40
I also see and hear that a lot like we're at the identity verse
12:45
conference last week and we're the identity security company
12:50
and I chose to prove the question like this.
12:53
So if you're AC SO or an IM program manager out in the world
13:03
and you're thinking about making this switch to saying I'm an
13:06
identity security group for my organization, what kind of like
13:12
makes you make that shift? What are the things that have to
13:15
be behind that to make it real and not just marketing buzz?
13:21
Right. So I, I think that it, it is
13:24
important to distinguish, you know, is it real or is it
13:26
marketing? I think it is there is a real
13:30
marketing aspect, right? So marketing in the truest sense
13:33
of why did why is it important to name things?
13:36
You know, there's an old joke about, you know, one of the only
13:40
hard things in computer sciences naming things, right?
13:44
And it's true, right? I mean, we can look at Microsoft
13:46
in there. They put copilot on everything,
13:49
right? And we we gripe about the fact
13:50
that it's hard to talk about their products and what they're
13:53
trying to do in this space because of the names they pick.
13:56
So the name is a signal to the rest of the organization about
14:01
what you think about the activity you're doing.
14:04
So when I renamed from identity management office to Identity
14:08
Security, part of what we were doing was signalling to my
14:13
security team and the other security practitioners within IT
14:16
security and risk. And then we were signalling to
14:19
the rest of our technology services organization.
14:22
This is the important thing we care about, right?
14:25
The, the focus needs to be on the security aspects of identity
14:28
and identity has a security role to play.
14:34
And then we're of course, signaling to the rest of the
14:36
institution, to the university itself, although that's probably
14:40
the less important signal because our users just simply,
14:43
you know, they, they don't really see those subtleties.
14:47
They're just, OK, I need to set my password, I need to deal with
14:50
my net ID, right? Their their branded
14:52
organizational ID, So we deal with them at at the level that
14:56
they understand. But I do think that that signal
14:59
that we send to our peers and to other IT pros that's important.
15:05
And So what I would argue is, you know, if you want to call
15:08
that marketing, OK, but I think that that's that's marketing
15:12
that has a purpose and has reality behind it.
15:17
Well, we shouldn't use marketing here as a, you know, a as a term
15:20
of in a negative context, right? You should be marketing like
15:24
here are the things that we do, here's the benefits we provide,
15:26
etcetera. And I guess that's sort of what
15:28
you mean. My next, my next question here
15:30
for you would be so you're, you're AC so now and you talked
15:34
about identity security. Do you have a list of services
15:38
that you provide for identity security to the organization?
15:42
Are there is that something in flight?
15:44
I mean, obviously it's always going to be something that's
15:45
kind of building out. But when you say identity
15:48
security, you know, what exactly do you provide as a service or
15:52
you provide guidance, those sorts of things?
15:54
Right. Yeah, No, absolutely.
15:55
We, we certainly have a portfolio of products and
15:58
services that we offer in our our service catalog, if you
16:01
will. It is in flight.
16:03
We're still building it out. We are trying to focus our
16:07
efforts on things where we're going to be able to have the
16:11
ability to make a difference, right.
16:13
Where can we move the needle versus where can we do things
16:15
that maybe we should lead to someone else in the org or
16:18
within the technology services group?
16:22
I I, we look at identity security as the group that
16:28
provides platforms to other IT pros, right?
16:32
So we talk about this a lot, the necessity of creating good
16:35
platform documentation. You know, there's this middle
16:39
ground. We write documentation and
16:41
explain to our users how they engage with the products and the
16:44
things that mean identity to them, passwords and usernames
16:48
and things. And then we have internal team
16:50
documentation we have to write to let us do our jobs for
16:54
business continuity when we have turnover and our staff.
16:57
But there's this middle layer, right, which is my team provides
17:00
a service that is consumed by another team, by another IT pro,
17:05
right? So I usually call that a
17:07
platform. That's the term we tend to use
17:09
for IT platforms and services, and we're writing tools that
17:14
they can use. Often AP is that they're
17:16
programming against or consuming maybe some sample code, maybe
17:20
good documentation so they understand what's happening.
17:23
There's training and education, All that layer in the middle
17:26
where my team's a service provider for another team and
17:30
not necessarily directly to a customer.
17:34
Really well thought out. So one of the services that you
17:38
provide is Miss Deb OPS area. That's what we really want to
17:41
dive into today. So can you describe what is the
17:45
service this DevOps service for or I am for DevOps, yeah.
17:51
However, you want to determine the service that you provide to
17:54
the university. Can you describe that?
17:56
Yeah, yeah. Well, let me take a step back a
17:58
little bit. And you know, this kind of ties
18:00
into my other role as an adjunct professor.
18:03
I've been teaching in a program here that does technology
18:07
management and IT service management for about 7 years at
18:12
the university. And I helped to develop with a,
18:14
a colleague of mine, a class that to our knowledge, it was
18:18
one of the earliest first classes in higher Ed and
18:23
undergrad that focused on DevOps.
18:26
We'll, we can talk more about that class later if you guys are
18:29
interested. But so that's a little bit of
18:31
background. I've been interested in this for
18:33
a little while and have some, you know, expertise in this to
18:36
teach it in my different roles throughout that same time
18:40
period, sometimes I was working at an academic college or I was
18:43
working in IT risk and compliance.
18:44
And then eventually I've moved into the the Cecil role.
18:47
I've tried to bring that background and experience into
18:54
that role, right. So when appropriate, I've tried
18:57
to advocate for and make changes that will allow us to deliver
19:00
our services from the perspective or using the
19:03
cultural practices of DevOps, right?
19:06
DevOps is really a sort of a cultural movement more than
19:08
anything else. It's not about a particular
19:11
technology or tool. It's not about a job title.
19:14
DevOps is about how you go about doing your your work.
19:18
And it's about emphasizing things like agility and velocity
19:24
and the ability to scale. And I think a big part of it is
19:29
about the humanity of how your team interacts with itself and
19:33
with other teams, with empathy and with trust and trying to
19:37
interact in a way that recognizes that we're all humans
19:40
and we have to get work done and stuff happens and, and let's
19:43
give each other a break, right? Let's try to work well together.
19:46
So this idea of team affinity, I think is a really core piece of
19:50
what DevOps is about. Now, a lot of people are going
19:52
to approach DevOps in a different way.
19:55
That's, that's great. Everybody's got an idea of what
19:57
that means. But I would argue very strongly
20:00
that right DevOps isn't a job title or a team title.
20:03
It's a way of approaching business.
20:07
It's a way of approaching service delivery.
20:09
So in that respect, anytime I've had the ability or the the need
20:15
to, to lead A-Team, I try to bring those ideas to it.
20:18
Some teams, it aligns better than others, right?
20:21
If you got a team of developers and you're building a product
20:24
that's really clearly aligned with these ideas around DevOps.
20:28
If you've got a team that's maybe managing a help desk,
20:31
that's harder, right? So DevOps isn't truly around.
20:35
It doesn't quite square up with sort of service delivery in that
20:39
sense. And I've developed a lot of
20:42
teams that we have, it spans this spectrum.
20:45
And so sometimes DevOps concepts and ideas are more applicable
20:48
and sometimes they're less. But I think a lot of these ideas
20:52
are, they're always available there, right?
20:55
To make a difference and make a change and get you closer to
20:59
this idea of being able to deliver services at scale and
21:02
with velocity, and treating your team with humanity and empathy.
21:09
And now we think that when it comes to a large universe, I
21:12
mean, look, granted Texas A&M is I think #1 in terms of the
21:17
status of the undergrad Class A talking about a huge
21:20
institution, yeah, you've got so much going on in terms of
21:24
DevOps. Now you're providing services.
21:26
This should kind of the core identity services that folks
21:30
think of, right? Like authentication,
21:34
authorization, identity provisioning.
21:39
Yes, the IGA, the identity governance, so we have several
21:44
very large scale projects in flight right now.
21:47
We are currently replacing our entire identity infrastructure
21:53
for that IGA function with a commercial product.
21:56
We've had a a homegrown legacy code base that grew up over 20
22:01
or 25 years. And so we finally, you know,
22:04
taken the time to step back and invest and try to replace that
22:07
with a commercial product. And that's going well.
22:10
But it's a big project, right? We're a year into it.
22:13
We're on schedule, but it takes time.
22:15
This is sort of rationalizing all those upstream data sources
22:20
from the like things like work day, where do we get that
22:24
information about our employees and our students, etcetera.
22:28
And then making sure that all the business logic's happening
22:30
to provision accounts correctly. And that's where it gets really
22:35
tricky in an academic environment because we all wear
22:37
so many hats and we wear multiple hats at the same time.
22:41
And a staff member can also enroll in classes and a student
22:44
is also going to get employed and a faculty member, right,
22:47
might also be a full time staff member like me.
22:49
And I'm an adjunct professor. And so we just have this, you
22:54
know, diffusion of roles and overlap of roles and juggling
22:59
the, the number of different roles.
23:05
And yeah, I'm not saying this well, juggling, I'll let you
23:11
correct that in post, right. Juggling all the different roles
23:13
and how they interact together and overlap all the the
23:16
different permutations, that is probably one of the things that
23:21
makes identity in a higher Ed environment unique as opposed to
23:26
other industries. I definitely think higher Ed
23:30
tends to be more. One of the more complex use
23:32
cases out there from identity standpoint, I, I think we've
23:34
probably talked about this in the past and not a lot of people
23:37
I think are aware of of that. And all the hats you're wearing,
23:39
right? You think like a baseball cap,
23:40
It's like, OK, I'm in this role. You've got like a baseball cap
23:43
that has like 5-6 different bills.
23:46
Yeah, you're like twisting it around.
23:48
And they're all on at the same time, right?
23:50
You don't swap them out. They're literally there all the
23:53
time, right? Yeah, I want to pull real
23:55
quickly on the thread about the custom code and then switching
24:00
to a commercial product because what I found is, yes, I think
24:05
there's sometimes, you know, issues with custom code and you
24:09
know, people generally are building products in their own
24:12
environment that they are, that there are commercial solutions
24:15
for. But sometimes it's difficult to
24:17
make a move from custom. We've built it, we know how it
24:21
works and whatever and now we want to go commercial.
24:24
And what I find sometimes is the custom product that the
24:29
organization has built. There is no comparison to a
24:32
commercial product, right? You've built it, it meets all
24:35
your needs and you will never find something that is apples to
24:38
apples and equal or even better maybe than what you've already
24:43
built. But still, maybe it's the right
24:46
idea to shift to a commercial product because, you know, do
24:48
you really want to be? You'd be in the business of now
24:51
maintaining an application in addition to, oh, the primary
24:54
mission of whatever your organization is, in your case,
24:57
education. But it could be manufacturing,
24:58
it could be retail. You know, unless it's a
25:01
competitive advantage, I'm not sure why you would build a
25:03
product in the space. That you, you exactly expressed
25:07
the thought process here, right? True, right.
25:10
You spend 20 years fine tuning a bunch of custom code, you're
25:14
never going to find something that does exactly that.
25:17
But that's your dilemma. You get yourself to this place
25:20
where you expect that level of customization.
25:23
OK, but now I have to balance that against the risk that
25:27
exists because of the level of expertise needed to maintain it.
25:35
And for higher Ed, it's hard for us to find staff.
25:39
It's hard for us to compete to, you know, with a start up or
25:44
another company to hire staff that have that expertise.
25:47
And so we found ourselves in a place where it was very risky.
25:50
We had a handful of people that understood this code and then
25:54
eventually it trickled down to one engineer, right?
25:57
That's not a great way to to plan for your business.
26:03
And you know, everyone always talks about the what if somebody
26:06
get hit by a bus? It's kind of morbid.
26:09
So I like to say, what if, what if that person won the lottery
26:12
and then they quit the next day? We would have been in a very bad
26:17
place. And so that's that amount of
26:18
risk needs to be mitigated out of the organization.
26:22
And one way to do that is to take a step back and say, yeah,
26:25
we're going to have to modify our customized process.
26:28
It won't be, as you know, catered to our exact needs.
26:34
We have to change the way we do business a little bit and
26:36
conform to a standard workflow. But you know what, The rest of
26:41
the world's doing it and it's working for them, so it'll
26:43
probably work for us too. And then we've changed to this
26:48
element where now we can go hire someone who understands this
26:51
commercial product. There's lots of people out there
26:53
that do. Yeah.
26:55
I think one thing you have to be careful of is it'll take the
26:58
commercial product and somehow like make it into a Frankenstein
27:02
beast, right? Oh yes, yeah, that's, I have
27:05
seen that happen multiple times at large organizations.
27:08
I've seen it happen here at the university, which is I have my
27:13
way of doing business right my, my workflow and I'll twist this
27:17
commercial product to fit rather than let's change the way I'm
27:21
doing business to a more conventional standard format.
27:26
Yeah. So when I going back to kind of
27:29
the DevOps piece, what we talked about the way I kind of framed
27:35
it up, I'm maybe made it sound too simple like you're providing
27:38
like these services, right? And so everybody should just
27:41
snap in. But traditional approach I think
27:45
is just handled that all within the tools that you have now
27:49
you're integrating to a central service.
27:51
So how do you take the central service and you've got all these
27:55
consumer teams that are running the rank technology stack and
28:01
have to integrate. I mean, what are you doing to
28:03
make that consumable and for and is the feedback positive?
28:09
Are people glad there's a central service, or do they feel
28:12
like you're twisting their arm into doing those?
28:16
Wow. Have you been sitting in on our
28:17
meetings? Right.
28:21
So historically universities are highly decentralized and and
28:27
there is a lot of autonomy and control given out at the edge in
28:31
the embedded units in the colleges and departments.
28:34
Our university has been going through a rather unique
28:36
experiment over the past two years and we have been
28:38
centralizing all IT. We had a president who came in,
28:42
they did an assessment, they wanted to centralized a lot of
28:44
these functions like HR and business and finance and ITIT
28:48
was snap of the fingers all centralized.
28:52
And we have been struggling with that decision ever since.
28:59
In this in this sense, right that that was a big massive
29:04
organizational change. But practically, pragmatically,
29:09
the management of the technology is still very decentralized
29:12
because we had 40 different groups that all had chosen
29:16
different tech stacks and all had chosen different tools and
29:18
platforms. That didn't change with the
29:21
stroke of a pen. What changed was now everyone's
29:24
reporting into the same leadership structure, OK, But we
29:28
still have these computers that have to be managed, right?
29:31
And we still have this data and these services and these, you
29:34
know, servers and data centers. So that stuff has been changing
29:38
slowly over time. And yeah, of course, you had a
29:41
group that had a lot of autonomy, and they got to pick
29:43
their tech stack. And now they're being told, now
29:45
you report to somebody else and someone else is picking your
29:47
tech stack, you're gonna have people that aren't really happy
29:52
about that, right? I mean, they don't appreciate
29:53
that exactly right. So trying to engage with that
30:02
idea with empathy and get everyone on the same page,
30:05
that's hard. And we want to try to bring
30:09
everybody along. Sometimes you don't have time,
30:10
though. Sometimes you're being told by
30:12
leadership, get this done right. And so trying to balance that is
30:17
a big challenge. I think one of the ways we took
30:20
this approach, right, we go back to this idea of DevOps and
30:23
delivering a platform. You know, we try to create tools
30:29
and platforms that we can offer and say, all right, here's what
30:32
it's going to look like, right? We're going to give you more
30:35
control. We're going to give you
30:36
self-service. Come to this tool and you're not
30:40
going to have to wait on us or ask us, mother, may I or put a
30:43
ticket in and then wait for something to happen.
30:45
We want to enable you to continue to move as fast as you
30:47
did before when you had that autonomy.
30:50
And we're going to do it in this way.
30:53
We're going to create a platform or an API that you could just
30:55
consume. And then we're going to put some
30:57
monitoring on the backside so that we see what's happening,
31:00
but we're not going to get in the way or or upfront stop you
31:04
from from making a move forward. We are still struggling to make
31:09
this happen all across our org, right?
31:10
This is. We haven't solved this problem,
31:13
but I think we've taken some steps and shown in certain areas
31:16
that it's possible to do it in this way and and be effective.
31:21
I think that, you know, your legacy will be you're going to
31:28
move the university forward in the centralization journey, if
31:34
you will, for a lot of other universities, and they're just
31:39
stringing further and further from that.
31:42
And it just makes doing certain things darn near impossible,
31:48
right? So your legacy will be that, you
31:51
know you move the ball in the right direction for as many
31:54
years as you're at it, and the next generation of leaders will
32:01
be able to pick up from a better place.
32:04
That's a good point. You know, our CIO has really
32:06
charted the strategy about how we handle this consolidation and
32:10
he's been very careful to try to get us to this place where we
32:13
can continue to deliver services to our customers and bring along
32:18
our staff so that they feel like that they've got a stake in
32:21
what's happening and they're involved and engaged.
32:25
Yeah. I mean, I think in the higher Ed
32:29
environment, you've learned leadership because there's
32:32
difference between leadership and management, right?
32:35
If you manage somebody, you can tell them go do this thing.
32:39
If you don't manage them, you have to coerce the OR coerce
32:45
them, or build a better mousetrap, whatever.
32:48
You have to get them to still do the thing.
32:53
Incentives and we sometimes call it the carrot and stick, but I,
32:55
I think that in higher Ed there's definitely a tradition
32:59
that you see more leadership through influence than
33:04
leadership through direct management or supervision in
33:08
that that concept. I wanted to pull this back into
33:12
this. I am from Del Ostrich.
33:14
I think it's a real interesting topic and I want to kind of get
33:19
into your journey from where you started to where you are today,
33:23
where you're heading. But I think kind of getting an
33:27
understanding of your IT environment would be a good
33:31
starting point. So are you guys in the cloud?
33:33
Are you using on Prem hosting? What's the situation?
33:38
So we have, yes, all of it, all the above.
33:42
We have a multi cloud strategy. We've been moving into the cloud
33:46
for a number of years. We are engaged with all three of
33:50
the major cloud providers, Amazon, Azure and GCP.
33:55
I'd say probably we have more enterprise technology in Amazon
33:59
and Azure, but we see a lot of researchers that are interested
34:03
in using GCP. I, I used GCP in my class when
34:08
we do DevOps and we, you know, have the kids write code and
34:12
they containerize code and they, you know, deploy it in a, in a
34:15
pipeline. We usually use GCP for that.
34:20
There's pros and cons to all three of those platforms.
34:22
We also have a lot of infrastructure still on premise.
34:25
Now we've been moving that into an environment that is
34:29
virtualized and containerized as much as we can, but we still
34:32
have a long way to go there, right.
34:34
So we've, we're making progress, but I, I wouldn't want to
34:40
pretend that we've sort of solved this problem, right?
34:43
This is a journey for us and it's a a maturity.
34:46
So you're the services that you're providing from a DevOps
34:49
perspective, are they independent of where the
34:53
applications are hosted or? Yeah.
34:56
So, well, there's, there's a couple things going on, right.
34:59
So there are services that security participates in with
35:03
other groups, things like GitHub and GitHub Actions and, you
35:10
know, containers, containerization, hosting and
35:13
container security and scanning. We're building some of those.
35:16
Some of them we've had where they're pretty mature and
35:17
they're working pretty well. And that's independent of any of
35:21
these different groups or different tech stacks, right?
35:23
So anyone, no matter what they're writing and they can use
35:26
GitHub. And we've got a, a GitHub
35:29
enterprise, you know, license agreement with Microsoft and we
35:33
make that available to developers or to researchers and
35:36
grad students who want to use that.
35:38
So that works well. We've got tools like that and
35:42
other DevOps like services. We also have elements where we
35:49
try to go in and work with the team.
35:51
They're like, they want consulting or they want advice.
35:54
How do I change the way we've been writing code and delivering
35:58
this? How can we be more agile?
36:00
How can we deliver this in a more cloud native application
36:04
type of way? And so we've got a a large group
36:08
of developers and we have a wide range of experiences there.
36:13
Some are doing more traditional waterfall style, waterfall style
36:18
development and some are really advanced along this, you know,
36:22
serverless and containerized applications and very much cloud
36:27
native software application deployment.
36:30
So that there is a spectrum like you would expect across any
36:34
large organization. Spectrum sounds like it's A to
36:38
Z. Well give you some idea of the
36:41
scale. I mean how many teams or
36:44
applications are you supporting this DevOps environment?
36:49
I am for DevOps. Right.
36:53
I mean, again, the spectrum, it really dominates here, right.
36:56
So we have probably 25, 100 to 3000 applications that are
37:06
consuming IAM services for SSO at a minimum.
37:12
We have probably, when I think about teams that are writing
37:19
code and deploying custom code for applications that aren't
37:23
just commercial applications that have been purchased, I
37:26
would say on the order of hundreds, multiple hundreds.
37:31
And some of that code, you know, is older and hasn't really been
37:34
touched in a while. It just was written and then
37:36
deployed and then left. Some of that code is active
37:39
right now under active development.
37:41
Some of it it's commercial products that have heavy
37:45
customization. So we write code to customize a
37:47
commercial product. It's a big spectrum again,
37:52
right? And the scale is pretty large,
37:54
right? So we think about the number of
37:58
Amazon accounts that we're dealing with, right?
38:00
And again, we're up into the hundreds because, you know, we
38:04
have researchers in labs that are doing their own research and
38:09
they kind of need to isolate the work that they do in the cloud
38:12
in that way. So we have a model where we have
38:15
these master agreements with the cloud providers and we provide
38:20
access to the cloud through this mechanism.
38:26
It allows us to have some type of telemetry and oversight into
38:29
what's happening. We can ensure that we've got
38:31
firewall set up and we've got network boundaries correctly
38:34
implemented. We can watch security and
38:37
compliance functions. But it allows the developer who
38:41
needs to like just spin something up and try something
38:44
in the cloud. It gives them, you know, as much
38:47
degree of freedom as we can give them to continue to move in the
38:51
cloud with agility. Yeah, so massive scale and it
38:57
kind of in a way was expecting that answer setting you up to
39:01
this next question, which is you really want to understand your
39:05
journey of providing IM services for Gov OPS because I'm thinking
39:10
you weren't there saying me, I see this coming in a few years
39:15
we're going to have all this needs.
39:16
Let's send up a team to support it and get every new
39:20
application. No, I would assume at some point
39:23
you came along and said we've had hundreds of apps that are
39:28
performing identity and access management services for
39:32
themselves and that creates all this risk for the institution.
39:39
Yeah. Talk to us a little bit about
39:40
that journey. When the when did you have the
39:42
light bulb moment that happened that way and talk to us about
39:47
what it was like before that and then after you stood up well.
39:55
I think the light bulb moment, I'm not even sure we had one,
39:58
right. So it was as we were looking at
40:00
the necessity to do a pretty significant upgrade to our
40:05
infrastructure, our identity infrastructure.
40:08
The second piece of that was the SSO components and the auth C
40:12
auth and then happens at the app layer.
40:14
And we knew these were tied. We needed the infrastructure to
40:17
be handled and a good solid foundation so that we could do.
40:22
The things we want to accomplish at the app layer and to do the
40:26
type of access authorization that we want to have happen.
40:29
So we're building that foundation now and we've been
40:32
making plans and sort of positioning ourselves to do more
40:36
of that work. We've been calling it phase two.
40:38
It's going to be focusing on the applications.
40:42
You know, we've talked, we keep using this phrase like DevOps
40:45
for IAM or IAM in DevOps. You know, I think it's really
40:49
more for us, we've been tackling the problems that exist and are
40:53
adjacent to IAM, right, and identity and identity security.
40:57
And we try to bring to the table when we tackle these problems,
41:01
an approach that incorporates DevOps concepts and ideas
41:08
because that allows us to deliver these things with
41:12
agility at scale, right? So when we deliver these
41:15
platforms and services, my identity security team is doing
41:18
these things in a way that is DevOps oriented, even if you
41:24
mightn't call them a DevOps team at likewise, we have teams that
41:28
are delivering cloud tech and they are doing things with a
41:31
DevOps orientation toward how they're delivering the work.
41:35
And that's spreading into our development teams and our other
41:38
operations teams. And it's sort of this thing that
41:41
is sort of gradually diffusing across our organization in
41:45
pockets. And again, it's a maturity
41:47
level, right? So we're not, oh, we're a great
41:51
DevOps shop everywhere you go. Look, oh, no, of course that's
41:54
not true. But we have pockets where you'd
41:56
say, oh, they're doing, they're, they're very much a DevOps shop.
41:58
All the things they do look like they conform to these DevOps
42:03
ideals. And then you've got groups over
42:05
here that might look a much more traditional approach to systems
42:08
development and operations and then everything in between.
42:12
Yeah. So, so in this scope that we're
42:15
talking about is not just like CSDD pipeline and
42:19
infrastructures code, it might be applications that need to
42:24
authenticate service accounts. I mean, is that also within?
42:28
Absolutely. And how do you consume the APIs
42:30
that let you do these things? So these things you mentioned,
42:33
right, infrastructures, code, but all those principles, those
42:37
approaches that I think we've definitely incorporated that in
42:41
security in a deeper way than we'd ever done before, right?
42:44
So over the last two years, we've had a very mindful
42:48
approach to take those DevOps concepts and apply them to how
42:52
are we delivering these platforms.
42:54
I think also, as we've changed our, our thinking of we just,
42:58
we're running security, right? So there's one way to look at
43:02
security function, which is, oh, I sit here and look at
43:05
dashboards and I respond and detect and then go take an
43:08
action versus building a platform and delivering that
43:11
platform to other people that they can write against and
43:14
consume. When you forced yourself to
43:17
think about being a platform provider to other teams, well,
43:21
now I'm responsible to build out and maintain this platform.
43:25
Obviously, bringing along some types of DevOps approaches to
43:30
that platform delivery is going to have big impact.
43:36
I would imagine you if you're delivering this to other
43:39
parties, you have to establish some sort of SLA or SLO to those
43:43
parties. Yeah, that's right.
43:45
I don't, I don't think we've gotten to the maturity level
43:49
where we formalize that. But we do talk about it between
43:52
ourselves. So I'm delivering it to another
43:54
group. That's my peer.
43:56
So my title is associate vice president and Chief Information
43:59
Security Officer. There's maybe an associate vice
44:02
president for enterprise operations and so we deliver
44:05
things their group consumes or another associate vice president
44:08
who's over all the development operations.
44:10
We a lot of our stuff is consumed by their group, right?
44:13
The developers that are building the apps and they need to
44:16
consume these APIs and these tools and platforms to set up
44:20
authentication and authorization.
44:22
So we talk between ourselves about what are our agreements
44:26
about what we provide, what can they expect from this platform
44:29
that we deliver and we're getting better about that.
44:33
But it's something we have to develop over time.
44:36
Yes. So I was wondering, adding like
44:39
how did you figure out how to do this right?
44:42
Nobody comes out of the womb and knowing how to do identity
44:47
security for dev OPS. But not only that, just
44:51
understanding the dev OPS process.
44:55
Did you learn it out of necessity or is this you know,
44:58
how did you find your way into it?
45:01
I think this probably goes back to my teaching, right?
45:04
So before I got into security, even when I was an IT director
45:09
at a college here on campus, the College of Architecture, we
45:14
moved strongly into a DevOps model of delivering services to
45:19
our customers. And some of the custom
45:21
application development that we were doing there, much smaller
45:24
scale, 'cause it's one of the smaller colleges, we were
45:28
frustrated with our inability to sort of constantly fighting
45:32
fires. We couldn't catch up.
45:34
We couldn't, you know, stay ahead of all the problems that
45:37
we had. And one of my engineers, one day
45:42
he walked into my office and he put this book down, slammed it
45:45
on the table. Have you seen this?
45:47
I'm like, no, what is it? And he brought me The Phoenix
45:50
Project by Gene Kim. So if you guys are familiar with
45:53
that, anyone who's done any reading in dev OPS, it's a great
45:56
book. And he's like, you got to read
45:58
this. And I was like, OK, I'll, I'll
45:59
read it. He's like, no, I mean, like
46:01
right now you have to read it like.
46:03
And he stood there. And watched you read.
46:04
I like I started reading it and and he, no, he didn't stand
46:08
there, but I started reading it and it hooked me immediately.
46:11
And I, this was like, I don't know, two in the afternoon.
46:14
And so I just got up and I left the office and I went to a
46:18
coffee shop and I sat there and I read the book.
46:20
I read the whole book start to cover right to the to the end.
46:24
And I came back in the next day and I said this was amazing.
46:27
And I bought like 12 copies for all the other full time
46:31
staffers. And I said everybody has to read
46:33
this. And you got two weeks.
46:35
And then we're going to go off site and we're going to have a
46:37
little like all day retreat and we're going to talk about it
46:40
'cause this is the answer that I think we've been looking for.
46:43
There's something about it just resonated with me, right?
46:46
And that was the beginning of my DevOps journey.
46:49
And from that point, couple years after that, I started
46:52
teaching. I wrote a curriculum, actually
46:54
talked to Gene Kim. He came and spoke to my class
46:56
the first semester I taught. He told me I have all my
47:00
students read his book. That's the first thing they do.
47:02
They read the Phoenix Project and it sort of sets the stage
47:05
for the entire semester. And, you know, I just continued
47:12
to sort of get into this idea of what does it take to build a
47:17
team that operates effectively according to these ideas and
47:21
principles. It, it just resonated with me
47:24
really well. And so as I've continued to
47:26
teach and develop and sort of gotten deeper into that, I think
47:29
that just prepped me. So when I took this role as Siso
47:33
and I looked at these things we were delivering and how we're
47:35
going to deliver platforms to campus and then to our fellow IT
47:40
pros and other teams, it seems natural that we would want to
47:44
use some of these ideas as much as we could.
47:48
Infrastructures, code, you know, telemetry and measurement baked
47:52
in that observability idea, the ability that we should be
47:57
automating everything we possibly can.
47:59
These are just natural extensions of these ideas.
48:04
And someone who's good with note cards to be able to organize it
48:06
on the wall. You know, you laugh about that.
48:09
But that day we did that little retreat.
48:11
I brought note cards, four different colors for the four
48:14
types of work he talks about in the venues project.
48:16
I had everyone write down all the work that we did.
48:19
I said bring this. Yeah, you, that's one of your
48:22
homework assignments. And they brought stacks and we
48:25
put them up all over the wall to get a visual idea of where is
48:29
all the work happening, where are our bottlenecks.
48:32
For the first time ever, we had a picture of the amount of work
48:35
we had in flight and what our work capacity was and where we
48:39
were over or under capacity. It was a very instructive.
48:43
Exercise. It's a great book, definitely
48:45
recommend it for folks. If I remember, I'll put it in
48:47
our show notes. So, Oh, yeah, you get a link to
48:49
it as well. How do you define the ROI for
48:55
all this work you've been doing? I guess, is there an ROI?
48:58
Have you been able to figure out what that is?
49:00
And I feel like that's one of the areas where, you know, you
49:03
have to kind of justify the investments being made into
49:05
this. You know you're getting your
49:07
money's worth. That's a great question.
49:09
That's a question my CIO encourages me to answer all the
49:13
time, right. He is definitely pushed us to
49:16
think about the work we do in terms of ROI.
49:20
I think that many times IT leaders don't naturally think
49:25
about that, right, If you don't have a business background.
49:28
But in a very real way, anytime the university decides to spend
49:33
money, if we're going to say we're going to take, you know,
49:37
$2,000,000 and purchase a big new commercial identity system
49:42
instead of something else, what is that something else?
49:45
Instead of putting it into a scholarship for a student,
49:48
instead of hiring a new faculty, instead of buying a new, you
49:52
know, instrument that goes in a lab that lets us research this,
49:58
these stem cells, anything that we spend our money on, we're not
50:04
spending it somewhere else. That really makes you think,
50:06
right, Is this important? Do we really need to do this?
50:08
So, yeah, being able to explain ROI to university leadership is
50:13
important. That's hard, particularly for
50:17
something like security tools where the ROI as well.
50:21
We didn't get hacked this week, right.
50:24
You know, be that's not a great story, a negative story, right.
50:28
You're trying to basically prove a negative right, right, right.
50:31
So no, no one wants to do that. It's not a great way to tackle
50:34
the problem. Building a narrative of what you
50:36
gain is important. I think there is a story where
50:40
you have to explain risk and we have to invest in tools that
50:45
will mitigate that risk. We talked about earlier that our
50:48
legacy code had gotten to a point where it was very risky
50:51
because we only had one person that understood it.
50:53
So that's a clear story. By replacing it with a
50:55
commercial product, we have managed that risk better.
50:59
You know, I'm able to hire people who understand the
51:02
commercial product because it's out there in the world and it's
51:04
a common tool. And worst case scenario, if I
51:08
can't hire anyone, I can hire a consulting firm who specializes
51:11
in this very common tool. And we know that we could pay
51:15
them to come in and do some work if we needed to.
51:17
So that's one part of the story. It's not a great story 'cause
51:21
it's kind of a, that's a compliance and sort of risk
51:24
story. But you know, our university
51:27
leadership understands that they've got to manage risk.
51:30
A better story is when you can't explain how this thing that
51:35
you're doing enables the business the university's in,
51:39
how does it enable teaching or enable research.
51:43
So when we can create a story that talks about that this IT
51:46
infrastructure makes it easier for our researchers to in
51:50
interact with their federal partners because now we're
51:53
meeting a standard for identity and we can share that identity
51:57
or leverage our identities with a grant Funding Agency.
52:01
And there are consortium that we are participating with in at
52:06
higher end where we sort of exchange identity protocols we
52:11
in. Common.
52:12
In common is a great example, right?
52:14
And so when we can do that, we have to maintain certain
52:17
standards in order to participate in in common.
52:20
So there are there are stories we can tell that talk about the
52:24
benefits we can get from this as well.
52:29
And Garrett can take a vacation or go to a conference or
52:32
something like that. That's right.
52:35
I want to wrap up the conversation with a quick dive
52:37
into your teaching side of things.
52:39
I'm curious, how has AI impacted the way that you approach your
52:45
class? Cause you've been doing this for
52:46
a number of years at this point and I have to imagine it's been
52:49
pretty disruptive it it. Has it's been fun.
52:54
This last semester, I decided to take a, a break from teaching my
52:59
typical class, which is on DevOps.
53:01
And I said, hey, let's do a class on machine learning and
53:05
AI. And, you know, I'd gotten to the
53:09
point where I knew my, my material pretty well.
53:11
I could just kind of cruise in, teach the class, do the lecture,
53:14
and halfway through or not even halfway through a month into the
53:18
semester, I said, what have I done to myself?
53:20
Because I felt like I was staying maybe two weeks ahead of
53:23
my students. Oh yeah.
53:25
It required a lot of reading and work on my part, but it was fun.
53:28
We, I had the students learn about machine learning models,
53:33
deep learning, all the different types of networks, you know,
53:36
recombinant neural networks and convolutional neural networks
53:39
and what they're used for and kind of how they work, the
53:41
mathematics of them underneath the hood.
53:43
I had them going through and building some of these things in
53:47
code in very minimalist, sort of simplistic ways.
53:50
Not, you know, these the students aren't in a advanced
53:54
computer science program, They're not doing, you know,
53:58
artificial intelligence engineering, but I wanted them
54:01
to understand at a basic level what was going on.
54:05
And they did and they got to do these things.
54:06
And then until the last half of the semester, we did things like
54:10
let's examine dark patterns in AI and what's going to be the
54:13
impact on our economy and what are the impact on society and
54:16
fake news and things like this. For the I've got a here's a
54:22
funny story, right? So my final for this class was
54:27
that I let them build something. So I didn't want them to write
54:30
a, a paper or just do it like a final exam.
54:34
We've done that all through the semester.
54:36
And so I said, I want you to take an LLM or some other type
54:41
of machine learning model and I want you to put something
54:44
together. Maybe it's you stitch some
54:47
things together and make an automation that does something
54:49
in response to something and automates that.
54:52
Maybe you train a chat bot and you have it, you know, just
54:57
whatever you want to come up with.
54:58
So I gave them some parameters, but I let them try to come up
55:01
with their own thing. I had one of the teams, they
55:04
trained like six or seven different chat bots with
55:08
different personalities. And then they had them like go
55:11
on Discord and talk to each other.
55:12
So the chat bots were interacting with each other.
55:14
So I had a number of things like this, right, Pretty creative
55:19
types of final projects. And then one group got up and
55:22
they, so they stood up to do their final presentation and
55:25
they, they pulled up the PowerPoint and my picture was on
55:28
the PowerPoint. And I thought, you know, boy,
55:30
like, what are, what are we in for here?
55:32
So this group found YouTube recordings of me like at a
55:37
presentation at a conference or something.
55:39
They extracted the audio. They cloned my voice using an AI
55:45
cloning technique to create a voice, right?
55:47
And then they stitched it up to Twilio and, and they pulled open
55:52
their phone in class and they dialed a number and my voice
55:55
answers and they start having a conversation with me.
55:59
That's awesome. I know it was great.
56:01
I was like, they got an A, you know, and then, and then they,
56:04
so at first they set it up so that my voice was sort of acting
56:07
like a, like a help desk. And they would say things like,
56:10
can you explain the OSI model? And it would start talking about
56:13
the seven layers of the OSI stack.
56:15
And at some point he just like hung up.
56:16
He's like, you got to cut it off.
56:18
It'll just go for hours talking about whatever.
56:21
I told him that if they ask my kids, they'd probably say that
56:24
was the most realistic thing about the, the model.
56:27
But but then he's decided to say, well, what could we do with
56:31
this for, for evil, right? So they, they had it where it
56:36
would call a student and it would say convince the student
56:41
that the final exam schedule had been changed.
56:43
Don't come to class on Monday. We've moved it till Wednesday
56:47
and he told, he hooked it up to an LLM in the background.
56:50
That was like the loop, right? And so he said you're a
56:53
professor and told the LLM you're a professor.
56:56
Just make up an excuse for why a final might be moved and it
56:59
would just make up new excuses every time.
57:01
And it called, right? It's pretty clever.
57:05
I love that idea. Yeah, that's that's very cool.
57:08
Jim, your son is in school. Has has, has he seen anything
57:12
from an AI perspective, from an education standpoint like that?
57:14
You know, he's he's very early he he just finished his freshman
57:17
year. So he's doing a lot of like the
57:20
the build up courses besides the fact that he's way too cool to
57:25
spend a whole lot of time telling me what he's doing in
57:27
his life. But we do talk about his past in
57:29
a little bit and he's enjoying it anyway.
57:32
But I actually had a question. I wanted to bounce off of Adam
57:36
and I don't know if you've given this thought right.
57:40
So my idea for how AI is going to fit into identity security
57:49
products in the future is very much like prompt driven
57:54
capabilities. So imagine you're an IGA system
57:58
and a prompt could come up and you could start it hitting it
58:02
with questions and iterating on those questions to find data
58:06
that you want. OK, so now a little bit easier
58:11
to picture if the software has the AI built into the software
58:16
stack and it's just one database, right, that's maybe
58:20
even physically contained. But now you think about the
58:23
scenario and can an identity company keep up with the likes
58:29
of Microsoft or Google or open AI, right?
58:35
Their their models just move way faster.
58:38
And if they were able to kind of lease their model and plug it
58:42
into their software through APIs, maybe, yeah, it could just
58:46
be way better than they could ever build themselves.
58:49
So I think it goes that model, but now you have the data
58:54
security, can you turn say you have a platform, you're an
59:01
identity security company, you have 1000 customers on it.
59:04
Some questions would be relevant to ask that made me spam all
59:11
1000 customers. Like how are other people doing
59:14
these things? What's a common practice?
59:17
What's setting are most most of your customers using now?
59:21
Maybe it's just you say no, sorry.
59:23
I think that's exactly, no, I think you're exactly right.
59:26
And I think I suspect that many companies right now are under so
59:31
much pressure to demonstrate to Wall Street and to their
59:36
customer base that they are integrating AI in a effective,
59:39
clever way that they are, I don't want to say skirting the
59:44
boundaries, but they are definitely pushing the
59:47
boundaries of maybe what's appropriate to use their
59:50
customers data for. And I think there's just saying,
59:52
well, this is going to be to their benefit and they're
59:54
convincing themselves that they can use the data in ways that if
59:58
their customers truly understood how their data was being used,
1:00:01
would they would not be happy. We've noticed over the past year
1:00:04
or two that. Many of our vendors are changing
1:00:08
the terms of their and the conditions, terms and conditions
1:00:12
to say what they can do with our data that they've never wanted
1:00:14
to do things with our data before, right?
1:00:17
But now suddenly that data is valuable in a way to them that
1:00:19
it's never been before because they can build these models and
1:00:22
train these models. It's a big concern for me.
1:00:25
And you agreed to it because you got the little thing that says,
1:00:28
you know, accept or declined. To just want to.
1:00:30
Use it. Yeah, declined me to just sum
1:00:32
your entire. Eye Well, sometimes you have a
1:00:34
choice, right? It's like you either have to
1:00:35
accept it or you can't use our service.
1:00:38
When I think about AI and I haven't, I haven't poked on this
1:00:42
very much, right. So you guys are kind of hearing
1:00:43
my first thoughts on this, but this project that my student did
1:00:50
right that illustrated how easy with just a couple of minutes of
1:00:54
recorded audio, he was able to create a completely legitimate
1:00:58
voice clone that my family when I played it to them said, yeah,
1:01:02
that sounds like you, right. So this takes me to this idea of
1:01:08
we are about to enter a a time period, a mode where
1:01:12
authentication of an identity is going to become very different
1:01:16
than what we have now, what we've had in the past.
1:01:18
The ability to say, yes, I really am who I say I am.
1:01:21
Video and audio is either if it hasn't happened already, it's
1:01:26
going to very rapidly going to lose its ability to prove that
1:01:31
something happened or that someone is actually who they say
1:01:34
they are. Right?
1:01:35
This idea, one of the things we do right now, if we doubt one of
1:01:39
our customers identity and they're trying to do something
1:01:41
like reset a password or reset multi factor auth, we make them
1:01:46
open up zoom and show a government ID live with a help
1:01:50
desk worker, right? That's that's what we do.
1:01:53
That is I'm not sure that's valid anymore, right?
1:01:58
I think that it is like I've seen technology.
1:02:01
We are very, very close, if not already in a place where that's
1:02:06
capable of being spoofed with, you know, consumer grade tech
1:02:10
with AI. So now what?
1:02:12
What are we going to do about authenticating the identity of
1:02:15
someone? I think we're about to see some
1:02:17
really interesting things happen in this space, and I'm not sure
1:02:20
what it's going to look like. It's going to be like secret
1:02:23
decoder rings and flash cards. And, you know, maybe even like
1:02:27
what I'm thinking is like this very unique value that we share
1:02:30
only with people we trust. I don't know.
1:02:32
We'll call it password. Password.
1:02:36
Well, you know, are we going to go back to do you guys remember
1:02:38
the old Ring of Trust model when people were trying to do like
1:02:41
they do public key signing parties where you get together
1:02:44
in the same room and then you chain off of that?
1:02:47
You know, I don't know where we're gonna we're gonna go with
1:02:50
this. Is this an Ave. for us to
1:02:52
finally see some decent real application of blockchain tech?
1:02:57
Maybe blockchain I? Feel like it's a solution in
1:02:59
search of an identity problem for a while.
1:03:01
Yeah, yeah. I don't know where we're going
1:03:05
with it. It's gonna be interesting.
1:03:06
Just when you think you know everything about identity,
1:03:08
something new comes along and totally blows it away.
1:03:11
So right. Yeah.
1:03:13
All right. Why don't we go ahead and wrap
1:03:14
it up there for this week? Adam, thank you so much for
1:03:17
spending time with us. Again.
1:03:19
Always appreciate our conversations.
1:03:21
Yeah, this has been fun. I you're going.
1:03:23
To come back, let's see what title you get after this one.
1:03:27
See how that goes. Let's see what else, Jim.
1:03:31
We've got our YouTube channel that we're still trying to build
1:03:33
up here, youtube.com slash at IDAC Podcast.
1:03:37
We got our website idacpodcast.com, XIDAC podcasts,
1:03:44
we've got Mastodon IDC podcast at infosec dot exchange.
1:03:48
I'll have LinkedIn connections for all three of us in our show
1:03:52
notes so people can reach out, you know, provide comments,
1:03:55
feedback, etcetera. All the good stuff we read
1:03:56
everyone that comes through and do us a favor, hit that like and
1:03:59
subscribe button. That's the best way you can help
1:04:01
us out, helps us have great conversations with great guests
1:04:04
like Adam and others. So do us a favor and and hit
1:04:08
that button, share it with a friend, share it with an enemy,
1:04:10
don't care as long as you share it with somebody.
1:04:12
So we'll leave it there for this week.
1:04:14
Thanks everyone for watching or listening and we'll talk with
1:04:17
you all in the next one. You've been listening to
1:04:21
Identity at the Center. We hope you've enjoyed the show.
1:04:25
Make sure to like, rate and review, and we'll be back soon.
1:04:30
But in the meantime, hit the website at
1:04:32
identity@thecenter.com. See you next time on Identity at
1:04:38
the Center.