Latest / Identity at the Center / #116 - The 2021 ForgeRock Consumer Identity Breach Report with Eve Maler

Transcript

#116 - The 2021 ForgeRock Consumer Identity Breach Report with Eve Maler · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity at the
0:26
center podcast. I'm Jeff and that's Jim.
0:28
Hey, Jim! Hey, Jeff, how are you?
0:30
Not so bad yourself, good. Hey, I was wondering if we could
0:34
break from not having the identity at the center podcast.
0:38
Be a commercial because what I want to do is just do a
0:42
commercial for our friend Vittorio and his podcast called
0:46
identity unlocked, a listening to it last night, the most
0:49
recent episode and he was talking about the skim standard
0:53
and, you know, I just listen I can't say I listen to every
0:55
episode of this podcast but I think if you're listening to
0:59
Identity at the center you ought to give the torrio's podcasts a
1:02
try as well. I mean it's just fantastic.
1:05
It is good. Yeah definitely and he actually
1:07
broke the news with us when he was starting that I guess it was
1:11
a year ago maybe two years ago whenever this kind of started
1:15
around. So yeah definitely I think
1:16
there's plenty of space plenty of room in the in the identity
1:20
podcast space considering it is such a small area but Definitely
1:25
check it out, identity unlocked. It's something that Vittorio
1:27
does with all zero. I'll put a link in our show
1:29
notes and we're actually gonna see Vittorio, I think next week,
1:33
either Sunday, or maybe Monday or Tuesday, or Wednesday at the
1:36
authenticate conference in Seattle, where we're going to be
1:39
presenting, but it'll be cool to hang out with some of the
1:43
identity as I guess we like to be called I do.
1:46
I say, weird saying we I don't feel like I'm part of that crew
1:49
but it'll be cool to see, you know, some familiar faces or at
1:53
least familiar voices and And it'll be my first, I guess first
1:57
business travel in almost 18 months.
2:00
So I'm looking forward to that. I feel the same way with the
2:04
identifier ID tag but we have a real OG member of the generosity
2:10
with us today. She'll let us know if we
2:12
qualify. And the only recommendation I
2:15
have for Vittorio on the podcast because I just came up with this
2:20
about two seconds ago, which is to number the episodes because
2:24
there's going Say here's how many episodes he had but he
2:27
doesn't numbers episode so I really don't know the answer,
2:30
but he's pretty consistent. And like I said, the contents
2:34
fantastic little more technical a little more focus on.
2:38
You know, the standards and the and the folks who are involved
2:40
with the creation of the standards that we so desperately
2:45
need in the identity management space.
2:48
But it's a it's it's just really great again.
2:52
Yeah, it's definitely pretty cool.
2:54
And yeah. They do get definitely more
2:55
technical than we do. I think they record it almost
2:58
like a TV show. I think their record like five
3:00
six seven or eight and it kind of in a row and then they
3:03
release it like Netflix style, you know, once a week for a
3:07
period of weeks which is different how we do it.
3:09
We're usually scrambling at the last minute, like you're
3:12
something weird recording and I got to get it edited and put,
3:15
you know, put online, you know, for the following Monday order
3:17
R&B, or maybe might be a week or two in advance.
3:19
But yeah, it's definitely something worth checking out.
3:22
Its identity locked unlocked. On the austero website.
3:27
For sure. What do you say?
3:28
We get into talking about our guests, not talking about our
3:33
guests, but talking with our guest about the report, they
3:36
just issued, let's go ahead and welcome Eve mailer back to the
3:40
program. She's Ford rocks, Chief
3:42
technology officer and chief humanitarian.
3:44
Welcome back to the show. We've, it's really nice to be
3:47
with you guys. Hi, I always I always enjoy
3:50
seeing your smiling face in the window here the last time you
3:54
were on Was episode 48, would have been June of 2020 and we
3:59
talked about the Ford Rec 2020 breach report and now you're
4:04
back again. And we what we want to do is
4:06
talk about the 2021 breach report, and some of the findings
4:10
that kind of came up with that. But before we get to that, you
4:13
know, what's new, anything new happened in the last year, or
4:16
so, for you, it's been really boring here and nothing really
4:19
know. Of course, there's been a bunch
4:20
of stuff. I mean, for one thing and I know
4:23
you guys are going to want to quiz me about Slater but, you
4:25
know, where I am, we've been getting a lot more artificial
4:29
intelligence infused. And so, that's been a really
4:33
great journey and I'm looking forward to maybe debating that
4:36
with you. I am a little bit of a skeptic
4:39
so I will try to temper my expectations but be honest, any
4:45
time I hear, you know, Ai and a security project the okay, let's
4:49
let's figure out what the real thing is here.
4:52
Well, you know, there's there's kind of like an argument to be
4:54
He made that, you know, AI as it was conceived of in science,
4:57
fiction is like well we'll never achieve that.
5:01
And so we'll just redefine what a I means.
5:04
But I think you know we've got some practical tools now that
5:07
our they're worth looking at they're worth talking about and
5:10
I don't know. We've been applying them to
5:12
Identity governance and administration which has been a
5:14
tough area to, you know, get satisfaction in.
5:18
So it's a pretty fun ride so far.
5:21
Yeah, I think that's typically The Source by That I see when it
5:25
comes to Ai and IGA specifically, I know that that
5:28
was kind of the buzzword around, you know, like roles and what
5:34
are people doing with accesses. So I'm definitely going to want
5:37
to pick your brain about. Okay.
5:39
So how do we solve this? Because every company struggles
5:42
with this concept of least privilege versus zero, trust
5:47
versus no standing privilege. What is the Right?
5:50
Mix? Is there a right mix?
5:51
What makes sense? I don't know if there's a
5:53
necessary one. Right answer.
5:55
I think it's different for every organization but like you said,
5:58
well, we'll cover that in a little bit.
5:59
Why don't we shift over to talking about this breach report
6:01
because there's some really interesting findings.
6:04
Jim why don't you go ahead and start us off?
6:07
Yeah, so I mean the first thing I want to do is just put the
6:10
name of the report out there so it's the Ford Rock consumer
6:14
identity breach, 2021 report. 2021, is the third year.
6:19
I think that you guys have actually even.
6:21
We had you on the show before it was to talk about the Breach
6:25
report. You know, my favorite part I'm
6:28
just throw it out. There was the stop drop and roll
6:31
three things. All Enterprises should do to
6:34
should be doing to reduce breach threats.
6:36
It was like stop using passwords that we are here.
6:39
Yeah, I mean, it's like, it's not as easy as it sounds, but it
6:41
can be done. It's like, yeah, it's like you
6:45
should breathe breathing in and out, but it's yeah.
6:48
Anyway, stop using static passwords drop into your users
6:52
experience and roll clean up. So I thought that was really
6:55
cool so I want to come back from that but I want to hit you with
6:59
a question. What was the most unexpected
7:01
finding from the report? You know, one unexpected finding
7:06
I'll give you my pair of most unexpected findings.
7:10
The first one was that the increase in user name.
7:13
Password based breaches was four hundred and fifty percent over
7:19
the last year. So maybe that it was happening
7:22
that I was creeping up on us is Not unexpected, but I think that
7:26
kind of increase is pretty, you know, eye-opening.
7:29
So that's one. The other one for me was we
7:32
actually found that the number of Records breached actually
7:36
went down the number of breaches went down, but guess who's
7:41
really suffering breaches of under 100 million records?
7:45
We're still talking Enterprises with maybe tens of millions of
7:48
records at risk. Those breaches went up 50%.
7:53
So it's basically saying the mega breaches that you hear
7:56
about most often in the news. That's, that's a worry.
8:00
It's not not a worry, but ordinary Enterprises who might
8:04
think they're a little bit under the radar?
8:06
Kind of security through obscurity.
8:08
They have to take action to. And you know, think about the
8:12
JBS Foods ransomware, if you sort of go Upstream to see what
8:17
the problem was, it was an orphaned account.
8:20
So there was unauthorized access by somebody who I was using an
8:25
account really--that, they shouldn't have been using.
8:28
So actually that's that's kind of thing.
8:29
Where IGA becomes important to battle these things as well, but
8:32
I'm not authorized access is like the or reason behind
8:35
breaches, even if you can, categorize them as other things.
8:38
So, so see that 50% was really kind of a shock to me.
8:42
I think that you're right. I mean, we're you know, I
8:45
wouldn't think of 2020 as the year of one of these Mega
8:49
breaches that was like, hundreds of millions of Records, but it's
8:53
the frequency. See and I think that the the
8:57
Cyber gangs are really looking for quick and easy wins that
9:01
they can get and they're out, they're scanning the internet
9:04
and looking for ways to get in or they're purchasing
9:07
credentials from the dark web or getting them through phishing
9:10
scams. And really what, you know, the
9:13
the conversation that we've been having a lot ourselves and with
9:17
with our guests is, you know, there's, it's almost like
9:21
they've broken down the process in terms of There's one group
9:26
that goes after, you know, the phishing scams or whatever and
9:29
then they don't even use the credentials to perform the
9:31
attacks. They sell the credentials to the
9:34
next group that's going to go and do the attack.
9:36
So it's kind of like supply chain.
9:38
A dark web supply chain that is everybody's broken down and they
9:41
do their part. And it's very professionalized
9:43
and automated and little scary and that steady drumming because
9:47
the problem, right? It's like we haven't got a newer
9:49
to it. But, you know, it's just a
9:51
constant steady pace of these things succeed.
9:54
Ting. Yeah, absolutely.
9:56
So, I mean, you kind of let it into it there but the most
10:00
common type of preach this year. What was it in?
10:04
Do you have any statistics on? Kind of how much it occurred?
10:07
Number one, the previous year in our 2020 report was unauthorized
10:12
access indeed that kind of or breach method.
10:17
And this year, it was also number one, it had increased.
10:21
So it's now 43 percent of the causes of the breaches that we
10:24
are. We were looking at so you know
10:27
that's not the kind of number with a bullet that you want to
10:30
see, right. Absolutely what I thought was
10:32
really interesting was when you start to break down the breaches
10:35
that were in the report, it's like unauthorised access being
10:38
43%. Fishing, 25% malware ransomware,
10:43
17% in a most of them are identity access management
10:49
issues. I mean, the malware ransomware.
10:51
How did that get in? We don't know, but we can be
10:55
Pretty sure based on other industry data that it's probably
10:59
higher than 50%. This still comes back to
11:02
somehow. People are using credentials to
11:04
break into companies to conduct their their malicious intents.
11:10
Yeah, I mean, it was astonishing to me, I guess.
11:12
Was that unauthorized access actually went up and it's one.
11:15
Number one position fishing went up, and it's number one.
11:18
And number two, position ransomware went up.
11:21
And it's a number three position and you're right, that identity
11:24
is a big part. Of helping to prevent all of
11:27
these attacks. And it's no wonder I think maybe
11:30
I'm reading too much into it but the but the sisya zero.
11:33
Trust maturity model has these five pillars and it puts
11:38
identity in the number one spot because you have to list them in
11:40
some order. But I think that that is really
11:42
where, you know, you have to start first if you want to do
11:46
the best job and have the most impact.
11:48
Most immediately, I think anybody's paying attention to
11:52
the news as probably going to get this next one or be able to
11:55
guess to do if they haven't read the report.
11:57
But the question that I wanted to ask to what sector of
12:00
business had the most breaches, and here's more important and
12:04
why what? And whether you got the
12:07
information from the report or I'm going to ask you to maybe
12:11
expand or try to use interpret? Yeah.
12:15
Read the tea leaves. Why do you think that that
12:18
sectors getting breached the most health care was the sector?
12:21
Maybe we should do quizzes. I don't know if you guys do
12:23
quizzes with your audience but yeah.
12:25
Maybe they can be fabulous prizes, but unfortunately
12:27
Healthcare was the most breach sector.
12:30
And I mean, here's the interpretation, it's got super
12:35
valuable data it, you can perpetrate a lot of really
12:39
interesting theft and fraud with Health Data Health Insurance
12:42
data, insurance, fraud is rampant.
12:44
And a lot of times possible institutions practices these,
12:50
you know, these folks who are having to protect all of this
12:53
data, they're kind of Of stress and strain with their
12:58
capabilities of doing so. And when you see these like, for
13:01
example, ransomware attacks happen, you know, they're trying
13:05
to keep people alive and I just saw on the news just very
13:09
recently that a hospital is being sued because of, you know,
13:14
an unfortunate death of a child that, you know, the parent is
13:17
attributing to the fact that they had this attack and they
13:21
weren't responding quickly enough.
13:23
I know, I don't know how that will come out but Um, you know,
13:26
lives are at stake, so they do what they have to do.
13:28
You have anything? I would think that if well, I
13:32
mean, do the people who are doing these attacks have morals.
13:36
I don't think we know that right questionably having to say no.
13:44
Yeah, I mean, okay, so we don't know that for know for a fact,
13:48
one way or the other. But I would think that that I
13:51
would really think that the criminals in Most of the cases
13:55
are after money, right? So killing people is not really
13:59
their motivation. It's interesting because I had
14:02
kind of a different list in mind and I wanted to bounce it.
14:05
I I think the things that you mentioned there, you know the
14:08
motivation again around money is that they can really monetize
14:13
stolen data. My thought also is you know with
14:19
Healthcare organizations that I've worked with over X.
14:22
It's not like you know in the World where you have Bank of
14:26
America, Wells, Fargo, and you have these Mega corporations
14:29
that are running the financial services industry.
14:33
Now there are smaller Banks, so don't get me wrong, but on the
14:37
healthcare side, there's not Mega Healthcare organizations as
14:40
much as unlike financial services.
14:43
So you have smaller businesses and I think they tend to be
14:46
under invested in terms of securing their it
14:51
infrastructure. So you have two things working
14:53
as like, it's a small company, which Which by the way.
14:55
So, that's where we're seeing all the growth in these data
14:58
breaches and smaller companies. And then they're under invested
15:02
and they're under invested because they've, you know, their
15:04
priority is not money and it's funny.
15:06
I've been part of you know maybe some panels at conferences
15:09
around comparing health care and financial services approaches to
15:13
things like open apis. You know how do you have kind of
15:17
this common infrastructure? That is both secure and has a
15:21
good experience and everything and you you don't get into a
15:23
shouting match, exactly. But No, there's different
15:26
motivations for securing. What's there?
15:29
It's money. It's people's livelihoods and
15:31
savings and everything. Yes it is.
15:33
But people's bodies is you know kind of different and and
15:38
hospitals really do struggle. And I think also Healthcare
15:42
payers can also struggle because they have, you know,
15:45
increasingly complex Enterprise environments.
15:49
There's a lot of MMA going on in particular in that sector and
15:54
that can also Present opportunities for Bad actors.
15:57
So they got a lot of priorities on their plate and, you know, I
16:01
get it. I think there's tools that we
16:03
can bring to bear in the modern era to help but it you know, it
16:06
takes some time and there is kind of a kind of a maturity
16:08
model. Well, I think it's a little bit
16:10
leaky to almost by Design, right, you've got all these
16:13
different Spokes and no real main Central Hub.
16:17
So now you've got spokes, connecting two spokes plus
16:20
you've got the payers the doctors offices, you know, all
16:23
the different places where You this, some of this information
16:26
is is meant to be shared and be portable and be able to move
16:29
between provider to provider. And it may not even necessarily
16:33
be necessary for the main provider to be breached.
16:37
They could come in through any number of doors, right?
16:38
And I think that that certainly as The Challenge from the
16:40
healthcare environment, I see that, you know, potentially as
16:42
well in the finance side, you know, Finance tends to be a
16:45
little more funded when it comes to security measures but I think
16:50
just the nature of the industry does not lend itself.
16:52
Well to having In this quarter of decentralized security
16:58
across, you know, any number of thousands, or maybe even
17:01
millions of entities, they have these, you know, sites of data,
17:05
you know. So it's a really good point.
17:07
The ecosystems involved in health care are there much
17:10
wider. And they're much deeper in a
17:12
sense than they tend to be in finance.
17:13
Just as an example, you may have, you know, somebody who
17:16
helps with rehab. And there are third-party
17:18
provider with respect to, you know, whoever kind of
17:20
prescribed, the rehab and information needs to flow.
17:25
Really personal sensitive information needs to flow in
17:29
order to achieve the care. And I, you know we can talk
17:32
about different funding models in the US and you know how that
17:35
all happens. But all of that contributes to
17:38
complexity and and to the danger and it actually argues for that
17:43
kind of interoperable, you know, we solved it originally was
17:46
something like Samuel whereas I always joke, you know, you're
17:49
having to fling identity information across the internet
17:52
and you have to do it securely and ultimately of the you know
17:55
Provide a good experience. And and that flinging is what
17:58
happens almost constantly in healthcare is why there's
18:02
Healthcare information exchanges.
18:05
So yeah Point very well taken. I think one of the other
18:08
interesting tidbits that I saw relative to rent somewhere in
18:12
the report was about the willingness to pay Ransom.
18:19
And this kind of goes back to wise Healthcare Target.
18:22
I think it's that they're willing to pay ransoms.
18:25
If you if you hack a university or if you hack certain other
18:31
Industries, they will not pay Ransom, government agencies will
18:34
not pay a ransom, right? So, if your motivation is
18:36
getting paid, why would you even go after those Industries?
18:39
It's a soft target from that perspective.
18:41
And so they go straight there. And this is one of the reasons
18:44
why people have really got to be.
18:48
This is where Healthcare needs to gain more practice, testing
18:52
their backups. Seeing how Long, it takes to
18:55
restore because that's your window, in which to avoid paying
18:58
Ransom Ware and, and having those things under control as
19:02
opposed to. Well, theoretically we have a
19:04
backup, you know, never used it great.
19:07
I mean, you know with ransomware you have the threat of a data
19:11
breach, right? Which is a big part of the foot,
19:14
which is what this report focuses on.
19:17
But I think the bigger thing that's going to drive most
19:19
organizations to pay a ransom, not to keep the data private.
19:24
Even though that that That becomes a cost equation.
19:26
Okay, if we keep the data private, what does that data
19:29
worth the bigger question is if you shut down our operations and
19:33
we have people in life support systems and we can't get alerts
19:37
and things like that and all you want is 10 million dollars or
19:42
maybe it's a lot less maybe it's 100,000 dollars maybe we just
19:45
made a hundred thousand dollars and hope to you go away and
19:48
leave us alone and let her people live, you know, there's a
19:51
saying that you know, whatever you subsidize, you get more of
19:54
and I think We're currently in that cycle and it'd be great to
19:58
be able to climb out of it. And of course, some of the tools
20:00
that we have to go upstream and protect against, even the
20:03
placement of the ransomware can come from Identity.
20:07
And these days with people talking about pastoralist more
20:10
often you know just strengthening authentication
20:13
methods and having them not be so awful in experience, I think
20:17
would do a lot. So I think there's another
20:20
impact you know, beyond just the rent somewhere angle of Which is
20:26
financial impact in terms of fines and lawsuits.
20:31
We definitely saw that we GDP are, you know, when some of the
20:35
preachers occurred and companies fat held financially liable for
20:40
the results of those reaches, he talked a little bit about that
20:43
because I think some of that came out in the report as well.
20:47
Yeah. So there's those things get sort
20:51
of added up into the cost to these Enterprises of breaches
20:54
and By the way, the healthcare sector had the highest average
20:58
cost per compromise record because you know, they were
21:01
talking about, you know, maybe some, some kind of ransom, they
21:04
might have to pay. Well, there's a lot of costs
21:06
associated. There's re protecting systems as
21:09
reputational damage and so on. So four hundred and seventy
21:12
dollars per record, even though they didn't have, they had only
21:15
one percent of the number of Records compromised.
21:18
So obviously each one is more more valuable and more costly.
21:23
Well, your thing too is, you know, We're talking about health
21:25
records. How do you replace or switch out
21:28
a health record? You are who you are, you can
21:31
find a problem you know you can't revoke your fingerprint
21:34
and hey you know your health record is going to be your
21:36
health record and it and if you were to obfuscate it or to
21:39
change things, you know, to fool anybody you're not going to get
21:43
the desired service. Are you?
21:45
The only the only successful opportunity I've seen in that
21:47
would have been the movie face off.
21:49
And that is a scary thought, back to science fiction.
21:55
So if one other question was with respect to the 2021 breach
22:02
report, where can people go ahead and download it?
22:05
And by the way, it's been out for better part of a year at
22:09
this point. When can we expect the 2022
22:12
breach report you guys already in the process of building that
22:15
out? Yeah, so I think it came out
22:17
from this year, it might have come out around May or June, if
22:21
I'm not mistaken. And, and we do often look at
22:24
like the first, Years worth of data in the year that it's
22:27
published in. So I think what we'll do is
22:30
we'll begin fresh work on the 2022 report.
22:36
Basically, once 2021 concludes, and hopefully numbers, hopefully
22:40
numbers improve what with this as zero trust Mania, which I'm
22:43
very excited about well hope that we'll see some some added
22:47
maturity in the various sectors so people can get the report at
22:52
for truck.com resources. And there's actually a report
22:56
and there's also a handy dandy infographic.
22:59
If people want to sort of share that out as the, the easy one
23:02
pager. Yeah, I love the infographic but
23:04
I do want to pick on something you just said there so he
23:07
mentions your trust. I think there's an overall Mania
23:11
surrounding 0 troughs, right? And I look bulbs of the
23:14
cybersecurity world. No, no, I actually love it.
23:17
No, I love it too. I think it is a very useful
23:21
concept to something that pretty much nobody.
23:25
Argue is not good, but I also think that there's some
23:29
confusion, right? There's there's kind of that new
23:32
nist 800-238-4847 has for. What is your a zero trust
23:39
architecture for me? Anyway, it's not going out and
23:43
buying as your product to just plugging in some Appliance on
23:47
your network. It's a lot more than that.
23:48
It's really an overall architecture but I my follow-up
23:54
there. Was were you implying that you
23:57
expect that having, you know, having the whole world trying to
24:02
get zero trust is going to have a positive impact on these
24:06
numbers. Next time, the report is run, I
24:09
hope so. I mean, it's hard to know if
24:12
maybe we'll see it in some sectors and not another sectors,
24:15
obviously regulations and Frameworks that are meant for,
24:20
for example, the public sector, which is what we've seen out of
24:23
the White House. For example.
24:25
Are going to disproportionately affect the public sector, but
24:28
I'm seeing uptake greater uptake as well in the private sector
24:32
because if you ever framework, if I something, if you ever boil
24:36
something down the way, zero trust, is being boiled down now
24:39
for easier consumption. Well, you know, it's going to
24:43
reduce the friction in adopting some of the best practices,
24:45
right? So I mean, one can dream some
24:49
people call me a Pollyanna but I mean that the on-ramp does seem
24:53
to be stronger on Indication. And that is something that is
24:58
getting. I would say easier and easier,
25:01
and it's maybe not easy yet. There's a lot of things to think
25:04
about one of the things that, you know, my team.
25:06
And I think about a lot is, how do you improve the unhappy
25:11
paths, because that's pretty much the sticking point most of
25:15
the time. So so let's, let's see, shall
25:19
we? I'd love to talk to you in a
25:20
year's time or the appropriate time and we can see what
25:23
happened. This is Those things where
25:26
everyone wants to do it. But it, I think it's gonna take
25:29
a while for people to actually start to put the tools and
25:32
processes and collection of capabilities in place to
25:35
actually make a dent honest, you know, I think with it becoming
25:39
important now. So that means me to believe.
25:42
Okay? We've got budget Cycles.
25:44
So maybe people start to put stuff in the beginning of next
25:48
year, or maybe mid next year because they can't move on a
25:51
dime, right? Those sorts of things.
25:53
So it wouldn't Surprise me that we don't really see the benefits
25:57
of, you know, quote-unquote zero trust for everybody until 2023
26:03
2024 and by then maybe zero. Trust isn't the fat anymore.
26:07
Maybe, there's something else I think we're chasing a little bit
26:09
here. - trust, ya know, I think you're right, that.
26:12
It'll be little bits and I'm sure you're right.
26:14
That it won't be a year. Considering it's not a product
26:17
that you put in, it's a mindset. And, you know, a lot of people
26:21
ask me, well, what's the difference then between, you
26:24
know, least privilege? And zero trust and getting to,
26:27
that sort of resource orientation is sort of the
26:30
hardest part because it makes you want to do certain things
26:33
inside out. And actually, for me, it's
26:36
really natural. Just because, you know, if you
26:38
look at nist, 800-221-9460, sure. 40 trust.
26:46
And there it is. Plain, as day, a policy,
26:48
decision point, and a policy enforcement point and those
26:52
mechanisms are still not. As common as they could be.
26:57
And I think that's where, you know, helping make it easier
27:00
things like, you know, identity to Solutions in the cloud, can
27:04
all accelerate adoption of some of the best practices.
27:08
Well, that is always the same, it just, you know, the cheap and
27:11
easy stuff relatively speaking, right?
27:14
Having better stronger, passwords and the PHA and place,
27:17
you know, improving user experiences, you know, cleaning
27:20
up rolls. I know we're gonna talk about AI
27:22
here in a second, so maybe pivot to that in a minute.
27:25
It. But there are things that
27:27
organizations can do today that don't cost money, and the terms
27:31
of I got to go get a new technology, its administrative
27:34
or analysis, work to figure out, hey, you know, do we have a good
27:38
inventory? In are privileged access
27:39
management? What is privileged access
27:41
management? Are we cleaning out?
27:42
Dead accounts, orphaned accounts, dormant accounts,
27:45
whatever. They might be you're removing
27:46
privileges when they're not needed.
27:47
There's a lot of just basic identity hygiene, you know, you
27:50
know Jim and I call it, you know, stupid, I am stupid.
27:53
I am but but It's hard. I mean, it's not, you know,
27:56
here's people, you know, it's not, I don't know if if if by
28:00
that you mean, you know, you could be stupid and do it or
28:03
it's just the stupid stuff that just has to be done and it may
28:06
be boring but it but it is the blocking and tackling but here's
28:11
the rub with some of it, not all of it.
28:13
But particularly with things like cleaning up roles and
28:16
finding the orphaned accounts, killing him, the number of
28:20
stakeholders who have to be involved in all that if you
28:22
think about like access certification and access
28:24
request, That whole kind of all those life cycle pieces.
28:29
The I'm gonna go back to incentives here you know
28:32
whatever you penalize you get less of it.
28:34
That's a corollary to whatever you subsidize.
28:36
You get more of and we're sort of penalizing doing a good
28:40
thorough job of access certification and even proper
28:44
consideration of access request because we're asking humans to
28:48
do things against data sets, that can be quite quite huge.
28:52
You know, if your organization has Tens of thousands of
28:56
entitlements or more. And I've, you know, I've talked
28:58
to organizations who have more rolls than people, like, where
29:02
do you even begin? How do you, you know, it's like
29:04
you're looking through the wrong end of a telescope or something.
29:06
You just you can't get perspective and that's kind of
29:09
why I like AI. It turns out to be a tool with
29:11
you a job. It's good at.
29:13
I want to follow up on something.
29:14
Jeff is talking about of. Yeah.
29:16
The basic blocking and tackling of, you know, if we look at the
29:20
three things that you can do to reduce data breaches from the
29:24
report, Stop drop and roll. Stop using static passwords in
29:28
other words, use MFA and password list and I had a
29:35
depressing moment this week. We talked to one of the
29:39
vulnerability scanning experts in our company, right?
29:43
We're just picking his brain a little bit on rent somewhere and
29:47
he's like, you know, during but I'm hired as kind of the white
29:50
hat. Hacker, one of the things he
29:53
does, if he can get a credential And it's it's guarded by
29:57
multi-factor. He'll try to find the credential
30:00
where the person just if it has a push authentication, they just
30:03
accept it. So it's like, oh my goodness.
30:06
Like that is the, that's like the best thing we have, right?
30:10
That's the best protection. We have.
30:11
It is still potentially flawed. I think it does come back to
30:18
user education. I know Jeff is real short on
30:20
this. Like we got investing user
30:22
education, but gosh, like, You know, there's a there's a big
30:26
ones like you just put a gun in somebody's hand, he's in teach
30:29
them how to use it. Yeah, that's pretty responsible,
30:32
right? Yeah.
30:33
Well and that's where you know, education there's education and
30:36
then there's education. I can't remember.
30:37
We talked about this last year but like if there's just a
30:40
training program where people are tested on their compliance
30:44
to having gone through the, you know, video training.
30:49
I don't find that as compelling as once again actual incentives
30:53
and disincentives for doing the right and Wrong things like, you
30:55
know, having sort of mock fishing campaigns and reward the
31:00
people who report it. Even if you know you get 10
31:03
people reporting you should get everybody reporting it if that's
31:05
your policy right. Fishing is just, you know, it
31:08
was number two with a bullet, right?
31:10
In the in the report. And these are the kinds of
31:13
things where people get the point if their behavior is
31:17
actually sort of molded in an Enterprise.
31:23
And so, you know, I am Personally, not a big fan.
31:26
I understand the reason for serve compliance oriented
31:28
training, but I'd rather have there be consequences and they
31:32
can be positive consequences or negative consequences.
31:35
Yeah, I think the key part their rate is the is routine training,
31:38
right. A lot of organizations will do
31:40
this. Check box as you mention it
31:42
every year it's time for the annual privacy training.
31:44
I know, security training, whatever.
31:45
Maybe, you know, I'll tell you right now, I got an email today.
31:49
That was a phishing email and it was training if I had clicked on
31:54
it. It.
31:55
I would have gone into the into the bad pile.
31:57
I got a nice email probably for our information security folks,
32:00
but I spotted it, I knew it right away and I'm pretty good
32:02
about checking that kind of stuff, you've had the aversion
32:05
training already. So you saw it you're like
32:07
exactly. So you know we do it here or
32:09
even you know on her own side, the pretty side but that's I
32:12
think the missing link is too many companies just do it once
32:17
per year. Yep.
32:18
And then it becomes you've got a whole nother year and who knows
32:20
what's going on? It doesn't instill that security
32:23
in mind says, okay, is this? Thing from information Theory,
32:25
they testing me, is this real whatever may be so that
32:28
education part of it I think is important to kind of keep things
32:31
going and to make sure that people stay vigilant because
32:34
people will let down their guards.
32:35
Right? It Jim mentioned it with the MFA
32:37
prompt all of a sudden you know my phone is getting Microsoft
32:40
security prompts is that me and my try and do it, is it?
32:44
Because my phone is trying to connect through the exchange
32:46
server and the mail app. You know, I have so many
32:49
different devices, I'm not sure what's real and what's not?
32:52
I just don't do it at any time and I'll wait for something to
32:55
fail. You know, that's maybe that's
32:57
not a great user experience, but at least that way, I know I'm
32:58
not getting breached. It's funny.
33:00
You know, it's funny talking about, I mean I hate to harp on
33:02
this but you know, you're there you go.
33:05
The, The Experience often times of doing access certifications
33:08
is compliance driven so it happens exactly what it has two,
33:10
which is every several months, you know, because sarbanes-oxley
33:14
says, and, and it's painful and you don't do it again.
33:18
And we think about the value of D provisioning access or counts.
33:23
I mean, it's a tremendous Tell you it's critical for that kind
33:26
of resource oriented thinking the zero trust thinking, well,
33:30
can you get to a point where you could do access certification
33:33
every morning, you know, agile says, if it hurts do it more
33:37
often and the point is not, you know, mask isn't the point is to
33:41
get better at it and make it hurt less.
33:42
So it should be possible actually, to be able to do that,
33:46
you know, on a dime if you want to.
33:47
And then you could prove to yourself any time that you've
33:51
reduced excess Trust. So is it may not be 60 to 0 in
33:57
one year, but 60, 20 and maybe a couple three years, you know,
34:03
it's okay to get smarter. It's okay to get better, you
34:05
know, I think that idea of doing it a certification every morning
34:09
terrifies, probably a lot of people think about how painful
34:12
it is. But you know, if you're in a
34:14
mature organization, you've invested in your IGA
34:17
capabilities and you're doing this, where it makes sense,
34:20
right? Maybe it's hey here's all the
34:22
people who got added to domain After that, didn't go through
34:25
the normal kind of request process flow, may be through IJ
34:29
platform, flag those, right? Or even better yet just remove
34:32
the remove the permissions, you know, automatically.
34:35
That's the kind of stuff I think is kind of like, smart.
34:37
I am it's taking advantage of the tools.
34:39
You have knowing what your risk tolerance is our knowing, you
34:42
need to protect and not just dumping the sort of information
34:45
into a Sim somewhere that someone will discover six months
34:48
later because they're investigating something by that
34:51
point. It's too late, actually, it's to
34:52
Downstream, it's actually cheaper.
34:54
We're to catch it Upstream, if you can align the incentives.
34:59
Like, I don't know, back in my old days of doing sgml when it
35:03
was a matter of well, who tags the data, you know, who adds the
35:06
metadata to the data and when is it least expensive and most
35:10
accurate to do that and that's what the subject matter expert
35:13
and oftentimes the things you have people do in the process of
35:16
IgA there. They're kind of not subject
35:18
matter experts like you know if you've got somebody who's the
35:20
approver for some access has been requested do they know the
35:24
context of why the access is being requested?
35:27
You know, are they left scratching their heads and going
35:29
well otherwise it's going to prevent somebody from doing a
35:31
job. They need to do so sure.
35:34
So if you can provide that context that's you know that's
35:37
where we see a I coming in. Yeah.
35:38
The old rubber stamping. Right.
35:40
And yeah. Exactly.
35:42
Or certification. And you've got a thousand of
35:44
them to approve your. Yes.
35:46
Yes. Yes.
35:49
Select all. Yes, up.
35:51
Some it done, right? Okay.
35:53
This is a it's a, it's a world record.
35:54
Hard for the most you know, expedient access review ever,
35:58
check something off, your to-do list to exactly and then you get
36:02
that endorphin rush. That's what they taught me in
36:04
Franklin, planner training. Anyway it's a win for everybody.
36:08
All right, so let's talk AI because we've been we kind of
36:10
tease the top of the show. We're talking around it.
36:13
If we're getting close to it, I found it.
36:14
All right, so tell me, tell me about your AI plans for world
36:19
domination here. So it's a big brain, it's in a
36:21
vat know. So, We're particularly using
36:26
artificial intelligence and and we're particularly ensuring that
36:30
it's explainable. So that it's kind of a
36:32
recommendation engine for all these use cases that were
36:35
talking about, so that the people who are responsible for,
36:38
whatever their day job is, can get a level of comfort that
36:41
allows for eventual automation, we call it autonomous identity
36:45
and so, you know, thinking about IGA, you know, and why I can I
36:49
can go as far as saying it's blocking and tackling, but I
36:51
don't know about simple and easy.
36:54
Gartner says that you know 50% of IgA projects are in distress.
37:00
We've got the problem of you know, Roll Explosion.
37:02
And then if somebody wants to take a look at all of them and
37:04
they'll just throw up their hands.
37:06
We had one customer who was spending 12 million dollars a
37:10
year on supporting the people who were doing all those manual
37:15
processes. All that, all those clicks that
37:17
we were just talking about and to 12 million dollars a year.
37:20
So it's kind of it, it might be easy.
37:24
My It'd be simple. I don't think it's both and most
37:26
often it's neither and so you know with the poor visibility
37:29
into access risk, the poor quality that you get out of
37:32
access certification through kind of nobody's fault the
37:36
inefficient provisioning of access when you want to
37:39
accelerate your business and then the inefficient you know,
37:41
operations although the wasted effort that was something we
37:44
were looking at it going. Yeah, toss identity.
37:47
Purge starts to make sense because what you can do is
37:50
there's sources of data that you have all around your company and
37:54
Probably already hooked them up for other reasons.
37:57
Can you use them to gain context to give the person who needs it?
38:04
Whether it's access request, exit certification.
38:07
All those different kinds of use cases.
38:10
It's different stakeholders who have different reasons for
38:12
wanting something. Can you use all that data to
38:15
give them the tools? They need to make the right
38:18
decision or to observe the the transparency of the access that
38:24
you've actually really granted and know that it's correct.
38:26
So give me a give me a real world example here.
38:28
Take me through, you know, let's say me is the business?
38:33
Is this something that's a business is using, you know, as
38:35
part of a recommendation engine or something like that or is
38:37
this something like a security analyst or an IM analyst might
38:40
be looking at. So you could have a lot of
38:43
different personas taking advantage of really the same
38:48
engine. So there's different
38:49
visualizations that you can put on top of it.
38:51
So I mean Executives have reason not to Ever.
38:55
Maybe look at the system but they have incentives.
38:56
Not to like go to jail a big fines because they use in some
39:00
cases. I can personally go to jail
39:02
right? Risk and compliance leads
39:04
obviously are icky persona for ensuring that an access
39:08
certification is done expeditiously but also
39:14
accurately and see. So and all of their security
39:20
staff have their own reasons for wanting to ensure at least
39:24
privilege. Maybe they've got like a zero
39:25
trust roadmap that they're executing to.
39:27
And so, can they show these marks of things improving and
39:30
getting better? And then, you know, the poor
39:31
line of business managers and also, the employees are asking
39:34
for Access. They have their own role in
39:36
this. But then you look at like it
39:39
staff, you know, CIO and all their staff.
39:42
Sometimes you just kind of want to ensure you're paying less
39:46
money and doing more stuff. And then when I was thinking
39:51
about all the different personas, you actually have to
39:53
think about the Bad actors. And You know, they're sort of
39:55
golden opportunity and the way they would like things to be in
39:57
the way they would like things to be, is actually how we have
39:59
it now. So it's kind of the reciprocal
40:02
of the Enterprise as a whole, it's use case.
40:04
So, so all of these folks can benefit from different
40:07
visualizations over the same data.
40:10
One of the things that we put a real emphasis on is look, we
40:15
know the average Enterprise probably has, I don't know to 35
40:19
different IDs, IGA Solutions, entitlements might be being
40:24
managed and roles might be managed and different tools
40:27
across a large, maybe multi National or Global Corporation.
40:31
It's hard to get your arms around all that stuff.
40:33
So we are taking the approach of saying, all that data is good
40:37
with us. We actually have an IGA
40:38
solution, but you don't even have to use that to get the
40:42
benefit of, you know, how you like train models, you need to
40:46
have all and only the right data to get the right visuals on,
40:52
what's going on so that you can then make it.
40:54
Isn't so that's really what we're doing.
40:56
It's like you don't have to just take in data from some tool we
40:59
made you probably have five tools and that's okay.
41:04
So yeah, I can give you a use case like you know what an
41:07
access request looks like. It's kind of looks like it did
41:09
before only it's prettier in faster.
41:12
So one interesting use case, I always thought of for identity
41:18
Administration, when it comes to AI is too.
41:24
You know take on what I call role exhaustion or identity
41:29
management overload, its when managers get so overwhelmed with
41:35
all these access requests coming in to Chef need access to the
41:40
cafeteria calendar. It's like, who cares?
41:43
Just give it to him, right? So my thinking is, well,
41:47
couldn't artificial intelligence weed those out, right.
41:52
Everybody else in the department.
41:54
Has the cafeteria, or I think I use the cafeteria menu example
41:59
because it's easy to understand as a person.
42:02
I mean, everybody gets that everybody should have access to
42:05
the cafeteria menu at least on a retreat from a read perspective
42:08
because it's zero risk, right? But there's other areas where
42:12
it's a little bit more risk but if you take the Confluence of
42:16
factors of, you know, all the other people who have access to
42:20
it, Jeff looks just like them, you know.
42:24
Jeff works from the home office and blah blah blah blah blah.
42:28
All these reasons then you can say it's a reasonable amount of
42:31
risk. Based on the risk tolerance that
42:34
we have to. Just go ahead and send this
42:37
through for approval because Jeff asked for it.
42:39
Let's just give it to him. The potential is okay.
42:42
Now you're setting up some robot to use some mathematical
42:47
calculation that people couldn't do in their own heads to
42:50
determine whether or not Jeff gets that access.
42:53
But what if Jeff actually? Should have got that acts as
42:55
we're now abuses that access. At some point, we need to do the
42:59
reverse course to see how in the world did Jeff get that access.
43:03
Well, the computer, the computer decided he should get it.
43:06
Okay. Well now we need to reverse the
43:09
calculation, to figure out how did the computer come up with
43:12
that because ultimately, it might come down to a court case
43:16
that we actually have to prove. Why did Jeff get that access?
43:21
So that's why I say, explain ability the Concept, you know,
43:25
kind of the formal term of art, explain ability as part of AI is
43:28
so important and why I described it as a recommendation engine
43:33
approach. Like, you know, if you go into
43:34
Netflix or similar and it says, well, we're recommending this
43:38
movie to you because you watched tank girl, I don't know, like a
43:43
movie, interesting choice, I love Tank Girl, great music and
43:51
but there's al7 shove, I'm with you.
43:56
But so there's a lot of different reasons why somebody
43:57
might deserve access that aren't part of the usual, first of all,
44:03
the usual calculation, we tend to make.
44:05
And second of all, could be more sophisticated or complex than
44:09
what we're capable of doing in our heads.
44:11
At that moment that were asked because, you know, sort of
44:13
synchronous asking for something as like, okay, go do you know,
44:17
all the reasons why, you know, do you have a lock on text peer
44:20
group? Analysis is what's quite often
44:22
used, right? So is Is he part of, you know,
44:25
the guy who wants access to this thing?
44:27
Is he part of this peer group that does roughly the same
44:29
thing? Well, that might be the most
44:31
important reason. Why somebody else next to him
44:34
gets access, it might not. I mean, you can look at Job
44:39
profile. You look at the department
44:40
Association. You can look at salary band, you
44:43
can cost center. You can look at whether it's a
44:47
certain training enrollment, who's their manager, who's their
44:50
managers manager, there could be a lot of different reasons.
44:54
Why an entitlement sort of got there in the first place.
45:00
And if you're just looking at their, their peer group, a lot
45:05
of in a lot of cases, what drives the Affinity kind of
45:07
between the user and the entitlement assignment to them.
45:13
It's mainly not because of the peer group they're in so that's
45:17
a pretty tall order for somebody to figure out when it's like
45:20
asking for access to the cafeteria or something more
45:22
sensitive. The more sensitive, it gets the
45:25
higher confidence, you're going to want to have about the
45:28
calculation that you're making. And that's where the approach we
45:31
take is simply to say. Here's the percent confidence,
45:35
that here's why you'd want to do this and then you can decide
45:38
your own kind of what's green? What's yellow?
45:41
What's red in terms of percentages?
45:43
Like let's say it's you know bottom 20%, you should cut off
45:45
all that excess and up to 90%. We need to pump it through
45:49
workflow, 90% and above. I feel very comfortable going.
45:54
Sure. And that's exactly where it sort
45:56
of encourages automation, because it's telling you why,
45:59
you know, which which Association rule was the
46:03
strongest to let it, you know, give you the confidence.
46:08
So, so it's really not trying to be this black box or, you know,
46:11
we're worried that we have about, you know, data that was
46:14
generated on its own by a brain-in-a-vat.
46:17
It's more like, here's a support underneath you to let you feel
46:21
confident in making a decision, one way or another, or need Need
46:24
to go check it out for that matter.
46:25
You know why you want to check that out?
46:27
You'll know what's an outlier. You'll know what looks risky.
46:29
I wanted to ask you a few other questions before we run out of
46:31
time. So, Jeff introduce, you is the
46:35
chief humanitarian. For those who don't know what
46:38
that is, is because of your role with the ummah standard user
46:43
managed access. Any updates in the on that front
46:46
is that still moving along? It is actually, there's been an
46:50
interesting thing happen and the last little While which is and
46:55
it's been brewing for a while. There is a program in the UK
46:58
called the UK pensions dashboard program and it has been sort of
47:04
chugging along defining, some standards for how.
47:08
So, a pension and the UK is like, like a 401k here, a
47:11
private pension. So your job might put aside
47:13
money for you and, and they have a state pension as well.
47:16
And so the challenge is just as it is in the u.s. that people
47:19
will leave a job, and they'll kind of forget or lose track
47:23
leave behind A significant chunk of money and you know after I
47:27
don't know 10 or 11 job changes like where did all that go?
47:31
So the pinch this dashboard program is intended to number
47:33
one. Help you discover where those I
47:37
think they call them pension pots.
47:39
Are but also bring those together and kind of a
47:42
centralized dashboard and then let you share out that
47:44
information selectively to, let's say financial planners.
47:49
And so, this program has now kind of reached this new stage
47:53
where they're starting, To build it now and it's based on the
47:57
ummah standard and they profiled it.
47:59
It's almost kind of like a, in a way, it's a financial services
48:02
profile security profile of Uma. And so it's kind of a quite
48:07
exciting stage. It's really fascinating.
48:10
Again, trying to stay within the amount of time that you've
48:13
graciously allotted us today. I think, you know, Jeff talked
48:18
about the identi Rowdy. Anybody who's been in this
48:21
industry long enough and seeing thousands As of Venn diagrams, I
48:25
presentations. I know you're working on a new
48:28
vendor diagram and for those who don't know, that's kind of the
48:33
circles overlaid partially over one another and then you get the
48:36
kind of The Sweet Spot. So like maybe a Venn diagram of
48:40
usability and security right in The Sweet Spot would be password
48:44
list technology but your new one has the 4pu so maybe you can
48:49
talk us through that. Well, I appreciate your asking
48:52
about this, you know, for some time I've been Talking about the
48:54
drivers of identity, the business drivers of identity.
48:58
And in fact two of the peas have to do with security and
49:00
experience protection and personalization.
49:03
And I think it's fair to say that for ten years, at least the
49:06
identity world and I consider you both identity.
49:10
By the way, have known that you really have to do better than
49:15
saying, oh, you have to balance these two, right?
49:17
You know, are we call it access without compromise?
49:21
You need to be able to achieve access for legit fo folks, that
49:25
is a pleasant experience. You know, a Ford Rock exist on
49:30
Earth to help people safely and simply access the connected
49:32
World, okay? So it has to be the right people
49:34
and they have to be able to do that in a great, you know, a
49:37
great experience, having a great time doing it.
49:41
But but there's more to the picture and the third set in
49:45
that van that I talked about for a long time was payment and I
49:48
think we're seeing, you know, all kinds of ways in which
49:51
transactions need to be deeply identified.
49:54
Be supported, but the fourth p and this shouldn't be new, but
49:59
it is kind of new. I think in the picture given
50:01
recent sort of developments is people, you know, can't just be
50:05
compliance oriented that we do privacy Uma was actually an
50:10
early sort of harbinger of than me.
50:13
That's not the right word, an example of enabling
50:18
person-to-person interactions. Multiple identities in the same
50:22
interaction. There's a lot.
50:24
Of use cases where we have, we don't see this as identity
50:27
relationship management, but it really is so protection,
50:30
personalization payment, and people.
50:32
And the center of that, all of them need trust.
50:36
All of the need privacy. All of them needs security, and
50:40
all of them actually kind of need trade in today's world.
50:43
So, so that's the new van. I got pictures people can get in
50:47
touch with me if they want to see pictures.
50:48
I was going to ask if this is document somewhere.
50:51
So I captured protection Ation payment and people as the four
50:56
Ps that I get that. Yes, that's correct.
50:58
And it sort of looks like, well, some people think it's a flower
51:01
other people think it's a B-2 bomber.
51:03
I don't know what that means. Yeah, okay, well I guess the
51:08
Mind sees what it wants to see in that case.
51:10
It's the identity were Shack test, right, right.
51:13
Yeah, exactly. Well, you've been super generous
51:15
with your time. I do want to, you know, be
51:17
cognizant of that. But it would not be a
51:19
conversation with Eve without having something.
51:23
Musically oriented. Because of your role that in ZZ
51:26
off. Yeah, official band of the
51:28
identity I guess I could safely say that at this point before I
51:33
meant to ask this before but you know when is these EOS going to
51:36
make a comeback? We have to I think have a full
51:39
identity conference somewhere. No hybrid, everybody is forced
51:43
to be there and I think we at that might just be the magic
51:47
circumstance for us to show up. We're talking about some sort of
51:50
Revival gigging next year, although not in a conference.
51:53
So Tuned. Gotcha.
51:55
Maybe do like a twitch stream or something like that.
51:57
God, sir, why not? Well, maybe not because they
52:00
just got hacks. You probably don't want to well,
52:02
we'll see. Never mind.
52:03
Let's go to the graphics of for them and then play.
52:05
Yeah, exactly. So, what I want to do is kind of
52:09
pull a start to pull us up to the surface here and end on a
52:12
little bit of a lighter note, and given your, your musical
52:15
pedigree. Here's my question for this
52:18
week, it's, I want you to assemble a music.
52:21
Supergroup. Tell me who's in that.
52:24
Group. And what song are they going to
52:26
cover? So vocals, whatever your band
52:29
looks like vocals, guitar, drummer etcetera, maybe it's
52:32
just one person. I don't know.
52:33
But what's your super group look like and what's the song?
52:36
They're going to sing. This will expose you know what
52:39
are I'm really from but a lot of people know about me that I love
52:42
Queen. So Queen figures fairly large in
52:46
my nice sketch here. I think it's got to have Freddie
52:50
Mercury and Brian May. So that's Vocals guitar and I
52:56
was thinking maybe after reach out to rush, we need Geddy Lee
53:00
and Neil Pier. So we've got them and I thought
53:04
I would add sting because what I really want to hear is a
53:08
Bluegrass remake of Tie Your Mother Down.
53:13
Okay. Because the Good Fortune of
53:21
getting to sing at identifiers, I guess it was two years ago.
53:24
Go. When we were at the Newseum,
53:27
it's a, it's off a queen to. So highly recommended I bet, you
53:31
know this song, it's been on the radar, probably do and
53:33
somewhere, I definitely like Queen.
53:36
I have a queen song, maybe I'll save that for a later.
53:38
Note it that sometime in the future.
53:40
But yeah, Jim. How about yourself?
53:44
What is your your superb and look like vocals.
53:46
Robert Plant guitar, Jimmy Page, drum, John Bonham.
53:51
That is definitely a super gorilla.
53:52
What's the song They're saying? Any Led Zeppelin song you can
53:56
think of, all right, okay. If I have to pick a song, I'm
54:02
gonna go with whole lot of love. I'm gonna go with.
54:06
All right. So lead singers going to be
54:08
Chris Cornell and then we're going to have Tom Morello and
54:12
Dave, Mustaine my guitar and they can duke it out over who
54:15
are wants to be lead and Rhythm nice and and they'll have Dave
54:18
Grohl drums and they're going to kind this will show you my era.
54:24
Definitely a 90s, alt rocker, the Smells Like Teen Spirit from
54:28
Nirvana. That's what I'm going to have
54:29
them awesome too. Very nice grunge.
54:34
Yep. Total total Grand tracker.
54:36
What if it's either that or I'm listening to some sort of
54:39
electronic EDM or something? So I played it safe this time
54:43
otherwise they're just be like oh it'll be I don't know
54:44
Deadmau5 and Skrillex or somebody right now.
54:47
Yeah. And my pic with all the Led
54:49
Zeppelin was, you know, that's what I've been listening to a
54:52
lot on my My eye my iPod lately showing your age.
54:58
Thanks Jim. All right, let's start to wrap
55:02
up things here before we go any final thoughts.
55:06
Eve, what should people be taking away from this
55:08
conversation? You know, the key finding, I
55:10
guess from the report and what's the one tip you can give them
55:15
that will that they should take away and do something about it?
55:18
I would say, you know what, one of the other things that we
55:21
learned from the report is that the amount of time people spend
55:24
Spent online more than doubled, so more than seven hours per day
55:28
and the course of this, whole kind of pandemic and lockdown
55:30
experiences. So when you move into the
55:33
digital world that rapidly in that totally identity is more
55:37
important than ever. And you know, talking about the
55:40
four Ps. Every single one of them really
55:42
is important and so I think it's not too soon for any
55:46
organization to think about getting on that kind of zero
55:51
trust, I was going to say ladder.
55:53
But if you want to From 60 to zero, maybe it's getting into
55:56
that race car and stop on the brakes.
55:58
I don't know, just taking one action and then taking the next
56:03
action, put one foot in front of the other.
56:04
And I think small changes won't make a big difference so that
56:08
you're not a soft target and so you don't present a terrible
56:12
experience to anybody, whether it's and users, or whether it's
56:15
your, you know, line of business managers.
56:18
I think we can improve the experience for everybody eat the
56:21
elephant one bite at a time. There you go.
56:24
Go Jim. How about yourself final words
56:26
of wisdom final words? So I think reports like this
56:29
really helped position our listeners.
56:33
The I am practitioners in selling identity and access
56:37
management for the appropriate level of importance of serves in
56:41
protecting your organization. Things like password list,
56:47
things like even the the stuff that doesn't cost any or a lot
56:50
of money like cleaning up all those Dead accounts.
56:55
Getting your arms around service accounts and changing the
56:59
passwords that haven't been changed in six years.
57:02
Like, those are the things that have to get done so that you're
57:06
not kind of the, the data going into this breach report.
57:10
We use the breach report usually as part of your business case,
57:15
that's my final word. So at that we're going to go
57:17
ahead and leave it for this week.
57:19
We're going to have a whole bunch of links in the show notes
57:21
will have a link to Yvonne LinkedIn as well as her
57:26
currently dormant, Twitter account, XML girl, who knows?
57:30
Maybe we'll see a return. There, we have a link,
57:31
definitely to the Ford Rock 2021 consumer identity breach report
57:36
to the nist, 800 20, 70 trust publication will have a link to
57:42
Vittorio and off zeros identity unlocked podcast.
57:46
Obviously, we have links to Jim and I on LinkedIn, always happy
57:49
to connect with folks who are listening and looking for ideas
57:51
on topics that might be interesting for people.
57:54
And then you can always connect with us online.
57:56
We're on the web identity at the center.com and we're also on
57:59
Twitter at idea. See podcast, so with that want
58:02
to thank youi for joining us. Jim, thank you so much for your
58:05
time and we'll talk with everyone in the next one.
58:12
Thanks for listening to the identity at the center podcast.
58:15
If you like what you heard, don't forget to subscribe and
58:17
visit us on the web and identity at the center.com.