Latest / Identity at the Center / #379 - The Strategic Importance of Identity Security in Enterprises with Eve Maler

Transcript

#379 - The Strategic Importance of Identity Security in Enterprises with Eve Maler · Identity at the Center

0:04
This is Identity at the Center. Welcome to the Identity at the
0:11
Center podcast. I'm Jim McDonald.
0:14
Unfortunately, Jeff Steadman is still traveling and is unable to
0:17
make it for this episode. But fortunately for you all,
0:21
I've got an awesome guest and Eve Mailer.
0:24
She's the founder and CEO of Fen Factory.
0:27
Eve, welcome to the show. It's a pleasure to be back
0:31
again. Thank you.
0:32
Again, and I don't think we've asked you this question, but
0:36
every time I see Ven Factory, I want to hear the background for
0:39
that. What?
0:40
Why do? Why did you call your company
0:42
Ven Factory? I mean it's a little bit of an
0:45
in joke, but who doesn't love a Venn diagram anyway if somebody
0:49
doesn't know the in joke. But you know, starting in 2005 I
0:53
think I started putting together 3 set Venn diagrams to compare
0:56
originally SAML open ID and info card if you remember all those
1:02
things. And people appreciated the
1:05
comparison. I wasn't the first person to,
1:08
you know, put identity and Venn diagrams together.
1:10
But it ended up being kind of popular and I did a whole series
1:14
on my blog.backinthedaywheniwasblogging@xmlgirl.com.
1:17
And so some people started calling me Queen of Venn and
1:21
started being disappointed if I didn't include a new Venn
1:25
diagram in any presentation I was giving.
1:27
So I just decided to lean into it for fun.
1:30
I love it and you've told, I know now that you've told some
1:33
of that story prior episodes, guys, if you're interested in
1:38
going back into the EVE archive, go to
1:41
identityidacpodcast.com/listen or just go to idacpodcast.com.
1:50
Click on the listen button. We have a cool handy dandy
1:53
search screen. You can search for EVE Mailer
1:57
that's MALER and you'll see all those episodes in the first one
2:02
that she was on is when we got her identity origin story.
2:05
So we I asked Eve to come back this week.
2:10
Eve and I were going back and forth and she's working on a
2:12
book targeting CE OS to kind of put together the whole story for
2:17
why identity in the enterprise needs to be empowered and
2:21
resourced as a product and not just as plumbing.
2:25
And I thought that was real interesting.
2:27
And she also mentioned that when she talks to the identity geek
2:34
community, she called talks about mastering IMS higher
2:37
purpose, which I think is very heady.
2:41
And I think that identity geek thing is like, well, I'm an
2:45
identity geek. I Co host a podcast with another
2:48
identity geek and we target identity geeks as our listener
2:52
community. So I can't wait to kind of dive
2:55
into this. And Eve, why are you writing
2:58
this book? Why are you writing a book for
3:00
CE OS? You know, it's because I have
3:04
seen an area of innovation among the customers that I've worked
3:09
with over my time working with identity vendors that has led me
3:14
to believe that greater visibility across the enterprise
3:19
of what identity can do for you and the downsides if you don't
3:22
do it right, they're being felt and the only person who can
3:26
really make it right is the CEO with the, you know, input and
3:30
approval of their board. So I'm kind of just going for
3:33
the gusto in, you know, I've, I've talked in previously about
3:37
mastering Iams higher purpose. You know, it's got a lot of
3:40
different purposes and we kind of put it into a box when we
3:46
just say, well, it's about security or it's about user
3:48
experience and there's a whole long list of things.
3:51
We can't solve all those things alone.
3:53
We need an intensely cross functional focus.
3:57
So I'm just going to write this for CE OS who need to hear the
4:01
message so that they can be more competitive and be more safe and
4:06
do better for their customers and all of the above.
4:10
Yeah, and my experience tells me a lot of what, you know, I got a
4:13
draft version of your tape table of contents, and a lot of it
4:18
really spoke to me. And so we're going to get into
4:21
some of that. But I wanted to kind of point
4:23
out one thing that jumped off the page for me, which was
4:26
subheading Chapter 1. So not even getting into the
4:29
text yet, you said why digital identity has become every
4:34
executive's nightmare and you're next.
4:37
So give us a little bit of flavor on that.
4:40
Yeah. Why nightmare?
4:42
Well, I'm trying to obviously dramatize a risk that
4:47
executives, particularly Csos, but also CEO's, are facing, and
4:54
they may not really be fully aware that they're facing.
4:56
It used to be that if you had a breach, you would be fined.
5:02
And there might be some terms that you have to live up to.
5:05
But now the FTC and the SEC are all putting more burdens
5:11
personally on these executives. And it isn't just, you know,
5:15
there's actually an organization called the Professional
5:17
Association of Cisos that started two years ago, I think
5:22
because of the threat that Cisos are under for personal liability
5:26
if something goes wrong in their security practices.
5:30
But CE OS are also at risk and there's a couple of examples of
5:35
this. So Drizly was one famous one
5:37
with the FTC kind of putting CEO's on notice that they have
5:40
to get their their security practices right.
5:42
And we know you and I know people listening to this know
5:46
the importance of identity in that proposition.
5:48
But so CEO's are personally liable for some of these things
5:53
happening. So they need to be aware of that
5:55
and they need to know what to do about it and why.
5:57
It doesn't have to be all doom and gloom.
5:58
And it can actually look like a growth engine.
6:01
Yeah, that reminds me of a lot of Sarbanes-Oxley, which was the
6:05
driver for everything I am in the past, right, CE OS had to
6:09
sign off on financial statements like you know, these folks work
6:13
for you. You need to know what's going on
6:16
within your organization. I also think you mentioned CE OS
6:21
and Cesos as much different. Like for me, I've gone and
6:26
worked with organizations that the CSO doesn't own all of
6:30
identity. They might own identity for the
6:33
internal. But certainly when you get to
6:36
customer I am, it starts becoming more of a mixed bag,
6:40
right? And I think that's that, that's
6:43
probably the perspective or I don't want to put words in your
6:45
mouth, but I would assume that's a lot of the perspective you're
6:48
coming from is like it's owned in different parts by different
6:52
people. Yes.
6:53
And, and that's where I was sort of coming from about 2-3 years
6:57
ago. I remember sitting on a customer
6:58
Advisory Board meeting listening to one of the excellent
7:02
practitioners of the art and who was one of our customers
7:08
representing a perspective that I hadn't had prior about how to
7:13
do identity. He was an identity product
7:16
owner. And there's this whole argument
7:20
you, you have yourself hosted arguments about the Cheeto, the
7:24
chief identity officer. And from my perspective, I, we
7:28
haven't had enough clarity to know what a Cheeto would be or
7:32
where it should live. And I think we have to go pretty
7:34
deep down the rabbit hole of different organization
7:37
structures and different industries to actually find out
7:40
what makes sense and how broad that remit has to go.
7:44
And you're right, quite often it's sort of workforce identity
7:47
or, you know, a broader workforce identity and customer
7:51
identity. And so that's a reasonable split
7:54
per population. But I've started cataloguing all
7:58
the places that identity can live.
8:00
And in fact, all the cases where it's kind of broken up, I call
8:03
it sold for parks and it's just all over the place.
8:08
So, you know, where would you put a Cheeto if you had a
8:10
Cheeto? Do you know the answer for where
8:11
you'd put it? I don't actually think so.
8:13
I think more has to be done, and that's what I'm trying to bring
8:17
to bear the book. Yeah.
8:18
And I think I feel like organizational structures are
8:21
changing. We've seen kind of the matrix
8:23
organization structure and with the picture, but I think over
8:26
time it becomes more matrices or matricized than less, right?
8:32
We're not going back to the old, the old kind of hierarchical
8:36
structure. But I think that that begs the
8:39
point, which is you've got all these pockets of identity,
8:42
you've got all these perspectives.
8:45
I don't think a book about, well, CEO, you have to be
8:50
personally engaged in cybersecurity is it would be as
8:55
compelling, right? Because it's like, that's why I
8:58
hired the CSO, yeah. Well, and that's the problem.
9:01
If it's just about security, they think it's taken care of.
9:04
But if it's also about, you know, when I called them the
9:07
four PS, I think I've talked about that with you guys before.
9:10
You know, if it's about protection and it's about
9:12
personalization and it's about payment and it's about, you
9:16
know, what you're what people want, you're sort of stuck for
9:20
an answer in figuring out, well, who owns it.
9:22
And the last thing the CEO needs is I have to be responsible for
9:25
this, you know, this entire thing.
9:27
No, I have people for that. But the question is people, not
9:30
person. So how do we do it?
9:33
Right, right. And, And we as identity
9:35
practitioners are often times the ones who are trying to pull
9:40
the plug from both ends and plug it together.
9:43
And that's if there's only one plug on on each side.
9:46
So yeah. It's a great image actually.
9:51
I'm picturing left all of the power cords and you don't know
9:54
which one leads to what and trying to connect them up.
9:57
Well, and it's raining and you're standing in a puddle.
10:00
Good luck if you if you if you don't do it right, you might get
10:05
electrocuted. The consequences are severe, but
10:07
don't worry, just keep going and keep going without maybe the
10:10
full empowerment that you can imagine having without the full
10:13
budget that you can imagine having.
10:15
So like, you know, this is, This is why for the, it's for the,
10:18
for the CEO, because they have the ability to see through to
10:24
the strategic advantage in doing this more thoroughly.
10:29
So I want to convince that person to kind of make the job
10:31
easier, not only of, you know, identity owners, identity
10:34
practitioners today, but really everybody who struggles with
10:38
that. Boy, it's I don't know if you
10:40
remember the old Saturday Night Live routine about, you know,
10:42
it's a, it's a floor wax, it's a dessert topping.
10:45
Hey, you guys, it's both. Now what do we do?
10:49
So I want to make everybody's lives easier by making that case
10:52
much more clearly. Now, the word on every the tip
10:57
of everybody's hung these days is AI.
11:00
And Jeff and I often say we could call this AI at the
11:02
center. We had leave at least an AI
11:05
conversation every episode. And you so this was chapter 2's
11:11
subheading another one that was an attention grabber.
11:14
How artificial turned every CEO into a sitting duck.
11:19
Why, why did you say that? That's that's a very graphic
11:24
image I think. Yeah, I mean, we know the
11:28
stories, and I want to bring these stories to life about how
11:31
spear phishing has become an extra added threat when AI is
11:36
scaling and automating those attacks.
11:40
You know, we saw the, you know, the Hong Kong financial
11:43
executive actually succumb and approve a transfer of, you know,
11:47
US equivalent $25 million. There's another favorite story
11:51
of mine, which was when an executive of Ferrari was so he's
11:57
an executive of the company and his purported CEO got in touch
12:02
with him over WhatsApp and sounded urgent.
12:06
So, you know, he got on, hopped onto a call with turned out not
12:10
actually the guy right. And this is what deepfakes are
12:12
doing to us. And he cleverly used what we
12:17
would call dynamic knowledge based authentication to
12:19
challenge this purported CEO because he sent something was
12:22
off. It was like, Hey, remind me,
12:24
what was that book that you recommended to me the other day?
12:29
Click. So he succeeded in beating back
12:32
that attack. But this is constant among the
12:35
C-Suite, you know, because those are the folks who hold the pen
12:39
for so much control of financial resources and trade secrets.
12:44
And you know, all of the material, non public information
12:46
that they're exposed to. So that that's, you know, it's a
12:49
honeypot of, of things that are worth attacking.
12:52
And that's where we see AI, well, one of the places we see
12:55
AI being being good to use. Yeah.
12:59
I mean, I think you're setting up the picture of like why is
13:04
this so important for an organizational standpoint?
13:06
What is the level of impact of the of the fraud that can take
13:11
place and identity is kind of like the you know, I was, I was
13:16
thinking as you asked that question that CEO used knowledge
13:19
based authentication. He didn't even realize it.
13:22
Yeah, he wouldn't have given it a name, right?
13:24
He. Would not have given it a name
13:26
we. Have names for this, but we
13:27
don't you know, ACEO is not going to want to know the name.
13:29
They just want the problem to be solved and they want the risk to
13:32
be mitigated and they want the the acceleration of business to
13:36
be accomplished. And so that's kind of where I've
13:39
been. You know, the research that I've
13:40
been doing is reaching out to all the folks that I've been
13:42
talking to about, well, where does identity live for you and
13:45
what scope do you have? And no sort of comparing notes
13:50
across those different domains. I think that the timing is also
13:56
so important here because we weren't talking about deepfakes
13:59
five years ago or if it five years ago, if we were talking
14:03
about it was like science fiction.
14:05
But masks. Physical masks, right?
14:08
Physical masks. Right.
14:09
Put on something I've seen, you know, it's near Halloween, so
14:12
I've been seeing some great examples of physical masks, but
14:15
it's the virtual ones that we got to watch out for.
14:17
Yeah. Where's it going to be 5 years
14:18
from now? Like, and if you don't start
14:20
thinking about the problem now and preparing now, you're going
14:23
to be behind the curve. And this is not a curve you can
14:27
afford to be behind. Absolutely.
14:30
So I follow kind of the stock market a little bit and it's
14:35
we're in this big evolution that's happening again.
14:38
It happened in the nineties, 2000s where companies that got
14:44
ahead and digitized and said we are a technology company,
14:48
whether they're, you know, an old film company or whatever
14:53
they're doing. Yet if they hung on to what they
14:55
were doing and kind of pen and paper and our customers like the
14:59
physical touch are coming into our brick and mortar stores,
15:02
most of those companies are gone.
15:04
If they didn't kind of latch on. And I think the same thing is
15:07
going to happen with AI companies that fail to kind of
15:10
latch on and and invest now, they're going to have a hard
15:14
time surviving in the future. They're going to because
15:17
catching up is not just a decision to make 10 years after
15:22
like, hey, we better catch up. It's like it's too late.
15:25
And humans tend to catch up, at least mentally linearly, whereas
15:30
AI is producing non linear changes, hopefully gains, but
15:34
also risks. So, you know, there's, there's
15:37
been there's a famous like Harvard Business Review case
15:40
study around Kodak not wanting to compromise if you know, film
15:44
selling business and losing the entire game.
15:49
And, and it's been making the rounds on LinkedIn again today.
15:52
I noticed it's a really good case study.
15:54
And you know, if you're trying to protect your core business,
15:57
which has, you know, maybe incremental innovations around
16:00
it, and yet some digital things are happening that are going non
16:03
linear, you, you ignore those at your peril for sure.
16:07
And and, and they really are on both the risk side of the Ledger
16:10
and the growth side of the Ledger.
16:13
Yeah, The interesting thing about that business case, I
16:17
didn't go back and read it recently, but I remember this.
16:19
It's always stuck with me that Kodak invented the digital
16:23
camera. There you go.
16:26
But. Irony of irony is.
16:28
The irony of irony, right, is like, that's going to
16:31
cannibalize the rest of our business.
16:33
So it's like but you can't. Better not do it yet.
16:37
Better not do it yet well. This is where identity is like
16:40
it's because we've all become digital humans and our
16:44
businesses have become digital. Even like the very brick and
16:47
mortar businesses that need to be in the real world have become
16:50
digital. We're all susceptible to these
16:53
trends. So, you know, we shouldn't just
16:54
think, you know, digital isn't for us.
16:57
It's it's too late for that conversation, I believe.
17:00
Yeah, so the CE OS need to pay attention to this and I you
17:04
know, going through your table of contents and thank you for
17:06
sharing it with me. I will not re share it.
17:09
And I understand also, look, this is like a draft, right?
17:12
So you're kind of in the in the formulation stage still for a
17:17
lot of this. Yeah, but I'm.
17:19
Writing every day? Yeah.
17:21
I pulled pieces out, little Nuggets that kind of grabbed my
17:24
attention. So one was that identity has a
17:27
homeless problem. Yeah, that has to do with the
17:31
fact that I was even looking for like industry trends of where
17:35
you'd put some, you know, majority identity owner in your
17:39
organization. And even among let's say large
17:42
banks, I don't see a huge amount of consistency.
17:46
I do see a few little patterns here and there, but it looks
17:48
like the sold off for parts kind of picture where I think I might
17:53
have mentioned this at some point when we were speaking
17:55
previously. But you know, I spent some time
17:57
at PayPal and back in the day it's risk and fraud organization
18:01
owned authentication, not access management, but authentication
18:06
because the primary source of fraud was coming from that kind
18:10
of locus. And so that's one way to do it.
18:16
I believe PayPal has now changed, but like there are lots
18:19
of organizations where they're kind of indecisive about where
18:24
to put identity role. And you can waste a lot of time
18:29
if you're just not trying to figure out work the problem
18:32
basically and figure out, yes, it's going to be cross
18:34
functional. Yes, it's going to be quite
18:35
matrix, matrix Y Let's decide. Let's not worry about what
18:40
everybody else is doing. Don't have to look at somebody
18:42
else's paper to see what the answer is, but figure it out
18:45
fast and figure it out decisively.
18:47
And that's, you know, part three of my book is planned to be
18:51
like, well, that's how you do that.
18:53
I think one of the challenges the CEO's face is that at the
18:58
end of the day, their organization is full of people.
19:01
There's just a whole bunch of AI agents and maybe we'll be
19:04
someday will be a lot easier, just like tell them what to do
19:07
and they do it. The.
19:08
Digital workers, I don't know. I worry about those digital
19:10
workers because they don't understand limits.
19:14
Or they might not do it right. You got to point.
19:16
Thinking about, you know, efficiency and whatever it is
19:19
that they're doing. Yeah.
19:20
So I don't know how things happen to PayPal, but I think
19:24
that a lot of times CE OS don't see this as important enough to
19:29
rock the boat over, you know, and they think that deciding who
19:33
should be in charge of identity, what are the bounds of identity,
19:37
is less of a strategic decision that's more based on, well, how
19:42
do I deal with this problem and piss off the least number of
19:45
people within my organization so that we can just forget about it
19:50
and move on. But.
19:52
It's plumbing. As long as you take care of the
19:54
tickets on a regular basis, we'll be OK.
19:56
That's that's the kind of thinking that I think it's
19:58
gotten us into problems. And one of the things I've been
20:00
surfacing and some of the the interviews that I've been doing
20:03
has been awesome stories of synergies when you actually
20:07
treated as strategic and look across the whole organization
20:10
and realize. Well, you put in place this
20:12
infrastructure for let's say identity verification and you
20:16
discover that your call center is having a challenge because
20:21
something happened post COVID and you know, there's lots of
20:25
new calls and we've got, you know, sort of incidences of
20:28
fraud. And you start to be able to
20:30
actually take those plugs and sort of put them together
20:33
without having to reinvent any new technology, without having
20:37
to redeploy anything new, but kind of just doing a few new
20:40
flows of what you already have and making multiple departments
20:45
happy and actually seeing a reduction in fraud.
20:48
So like an example like that convinces me that we just have
20:51
to bring these examples to the world, right?
20:53
You need them sort of like in your pocket so that you can
20:55
convince the next executive who needs to be convinced that this
20:59
is not just theoretical. Yeah.
21:02
So where do you think identity should live and who should be in
21:08
charge of it? You talked about products and
21:10
product owners and things like that.
21:13
So later on, what is the strategic decision?
21:17
You know, put me on the spot for like a place it should live.
21:19
I will say one of the things I've been finding is that
21:23
workforce and consumer to put things into very large and
21:27
precise buckets can deserve to be separate.
21:31
And it's not out of the question that workforce should live in
21:36
security because you need a home.
21:38
You don't want like to have dotted lines everywhere in your
21:41
reporting structure or under the CIO or I've seen under like
21:47
technology as a as a common sort of pillar.
21:52
When I look at the consumer side, I do see more and more
21:57
either almost a line of business of its own, although it's not,
22:01
it is it is kind of like services that serve all the
22:04
product. But I do see this kind of shared
22:08
product infrastructure role and you know, I don't hate it.
22:15
I think it's been a good choice for for those excellent
22:17
practitioners that I've been talking to who have, you know,
22:20
great best practices to share. I think there's a kind of a nice
22:25
dividing line that could obtain and I'm not here to tell anybody
22:28
like where they should definitely place it, but where
22:32
the back end services of identity are owned in this kind
22:36
of shared product land and all the front end work might be for
22:41
each individual product because they're having to tune very
22:44
precisely to their personas. So that's that's a potential
22:49
answer, but I've also seen it owned by marketing.
22:55
Sometimes it is owned by fraud, which is a really interesting
22:59
ones. You know, if you're a financial
23:01
institution, that might not be such an unusual thing to do.
23:03
So I don't know that I'd recommend anyone place.
23:07
The most important thing is understand how wide, how wide
23:12
the rabbit hole goes and you know who all you have to
23:16
communicate with and collaborate with and sometimes get critical
23:21
input from. You know, I think last time we
23:24
spoke I was talking about racy charts and like, I feel like
23:27
everybody starts to not often go to sleep when I say racy chart,
23:30
but you know, there's a little bit of that exercise to it,
23:32
right, to get it right. I think this idea of the chief
23:37
identity officer makes a lot of sense.
23:40
It's like that's an organization saying that we understand how
23:46
important identity is to the Big Picture Act.
23:49
I mean the the difficulty is this, not every organization is
23:52
going to appoint a chief of identity, but having some kind
23:59
of senior position. I mean, Jeff and I have always
24:02
talked about the that every program I am program had to have
24:08
a program manager. And what we thought is like,
24:11
because he and I kind of came through a similar path in that
24:15
we both ran programs and we kind of like came up through the
24:19
grassroots because we were kind of good at taking those two
24:22
wires and plugging them together while standing in a puddle of
24:26
water. And, and so that's an important
24:29
skill. But I think in a big company
24:32
where identity is so important, touches so many things, it's
24:36
just not realistic to think that it can be done at a grassroots
24:40
level and be successful. So here's another one that I
24:45
grabbed from your from your TOC. It was escaping the trap of
24:52
organizational paralysis. And you know, I think this is
24:56
what that point is all about. Is that trying to say that, OK,
25:01
this is just fix this at the grassroots level is kind of I'll
25:06
call it, I think it's a cop out. You know, First off, I think
25:10
it's a cop out because I mean, you know, when we're, you and I
25:13
were going back and forth about this episode, I, I sent you
25:17
something like a reminder of like what, you know, putting a
25:21
dollar value on identities. You know, I kind of always think
25:25
back to when Meta bought WhatsApp.
25:28
I think they paid something like $19 billion for WhatsApp.
25:32
You mean an incredible amount of money.
25:33
And I think at the time we're talking about like users, users.
25:37
To me, the users were identities because they weren't, you know,
25:43
logging in using it out of their IDP is like WhatsApp had all
25:47
these identities globally of like millions and millions of
25:50
people. And you put a dollar value on
25:54
those things and you just can't. This is this is like.
25:59
The when you're looking at consumer identity, and that's
26:01
something I tracked, boy, back in my, my Forrester days.
26:05
Remember when we had these social sign in broker identity
26:09
providers? These are the like the Jan Rains
26:13
and the Gigas that specialized in bringing user populations to
26:19
markets indirectly through assisting those being ID PS
26:24
being social identity providers. And not to put too fine a point
26:28
on it, those were markets for yeah, identified user records.
26:34
So there's, you know, there's a downside to that too.
26:36
There's there's kind of the dark side of it.
26:38
There's there's privacy concerns and there is, you know, kind of
26:41
the way we're treating human beings.
26:44
Nonetheless, it is absolutely a corporate asset.
26:47
It's managed today as a corporate asset.
26:49
And one of the things I wrote about in my Consent is dead
26:52
paper was looking at it was like a Nestle investor deck talking
26:58
in, you know, two or three years ago about their goal to have
27:02
this many more hundreds of millions of consumer records.
27:08
Now they were striving to have more of those be first party,
27:11
which is absolutely identities that are managed by that company
27:14
as a first party. They do have, you know, third
27:17
party data that they access as well through the various martech
27:20
kind of stacks. But like that's an asset of the
27:23
company employee records. They're kind of it's now it's
27:29
data you have to protect. It's an asset, but not in the
27:31
same way. It's not the kind of explosive
27:34
thing that you look to grow in and of itself.
27:37
Whereas, you know, anybody would be happy to have say open AI
27:40
numbers in terms of they're up to like 700 + 1,000,000 users
27:45
now. So that's that's just a value in
27:48
and of itself for sure. I think more companies want to
27:52
shrink that workforce identity, not just from like layoffs and
27:56
stuff, but like if you've got multiple identities for a
28:01
smaller number of people, like if you said, oh, we have 300,000
28:05
workforce identities but only 50,000 people work here, that's
28:09
not a good thing. You know, this brings up a
28:12
thought. I've been trying to sort of
28:14
categorize the different populations, putting non human
28:17
identities aside for one moment. I've been, I've been watching
28:22
the conversation, the industry conversation for like the last
28:25
five years. Focus a lot more on that middle,
28:28
middle part of the Venn diagram of consumer and workforce where
28:31
it's like B to B. And I think it's actually
28:34
worthwhile getting a little bit more specific about B to B
28:37
because it's all about who has the kind of power dynamic in the
28:41
relationship. So if it's channel partners, you
28:46
want to enable them and they're a bit like customers because
28:49
they lead to customers. If they're part of your supply
28:52
chain and it's B to B, it's a little bit more like, well, you
28:56
have to kind of do what we say. We have these standards and
28:58
you're upstream from us and we have to protect ourselves.
29:00
And so supply chain is a lot more like, you know, that those
29:04
kinds of partners are a lot more like employee, the larger and
29:07
more wider employee population and channel partners and things
29:12
like sort of loosely held brokers, like think about
29:14
insurance brokers or you know, car dealerships, that sort of
29:17
thing. They're a lot more on the
29:18
customer side of the equation, right?
29:21
And how much you can control them and how much you have to
29:23
sort of live with the constraints that they have
29:26
because they're them. So.
29:28
So I kind of think B to B really breaks down around that sort of
29:30
are they upstream from you? Are they downstream from you?
29:33
Yeah. Something to consider if we're
29:35
going to be handing out identity responsibilities.
29:38
It all kind of fits into this bucket now.
29:40
Third party risk management, that's the the hot buzz term
29:45
and. For good reason.
29:47
Yeah. Well, you know, it's a couple
29:49
steps in, but it always comes back to the identities because
29:53
it's human beings or even, you know, non human accounts that
29:57
are going and accessing systems. But a lot of times when you're
30:00
talking about these third parties, it's they have to get
30:03
human accounts set up and how do you manage those?
30:06
How do you set the And that's not a question I'm asking you to
30:10
answer right now, because I think it's there's a lot that
30:13
goes into it. But you're right, when you start
30:15
talking about those brokerages or kind of the third parties
30:20
that are kind of more on your customer or.
30:23
Distribution, yeah, they're, you want to enable them just as much
30:27
as you want to enable customers. You direct customers to have no
30:31
friction, right, Because they're the ones selling your insurance
30:34
policies. They're the ones actually, you
30:36
know, bringing the customers to you.
30:38
So it looks an awful lot like the reducing friction from a
30:41
sale kind of user journey. This is, I think, exactly like
30:46
in my career, what resonates the most to me in terms of why this
30:51
is it, why you need to have one person kind of like these as a
30:57
practitioner. We say, all right, well, now
31:00
we're going to, you know, bring brokerages or dealerships into
31:05
our identity management system and we're going to, and you have
31:09
somebody lobbying. Literally, we should have 6
31:12
character passwords. They should have to login once a
31:15
year, things like that. And then you'll have a CISO
31:19
saying no, they should have 12 character passwords and they
31:22
should expire after 30 days. And they their sessions should
31:25
only last 15 minutes. And then you're, there's the
31:28
identity practitioner holding the 2 ends of the trying to plug
31:32
things together and you're doing it at the grassroots and you're
31:35
trying to get these two people as diametrically opposed views
31:40
of how I know I'm just picking on like one thing, the
31:43
passwords, but it's the overall picture.
31:48
Yeah, Yeah. And like, to me, like, I don't
31:51
even know if the CEO realizes those kind of conversations
31:55
happen because I think a lot of times the CEOs come from, they
31:59
started off as sales people right there.
32:01
They're the ones who are dealing with the customers and they
32:05
learn how to meet like a, a sales objective.
32:08
And then they become in charge of a business unit and other
32:11
people who are out selling. And then eventually, like the,
32:15
they rise to the top, the top, you know, and they're running
32:18
the whole organization. They never spent time on IT and
32:22
operations. And so they really don't
32:24
understand it. And as becomes more and more
32:26
complicated identities, you know, we take it for granted,
32:29
right? But these are folks that I mean
32:32
it's complex stuff and they don't have, they don't have RAM
32:36
storage for it because it's just not something they want to think
32:40
about. I mean, there's some, there's
32:41
different kinds of CE OS, right? And some of them, a lot of them
32:44
are kind of sort of biased towards sales, especially if
32:47
they sort of grew up with the business as it, as it, you know,
32:50
really rocketed up. There are some who you know,
32:53
might have come out of techie stuff.
32:54
There might have some who came out of operations.
32:57
You know, I was very fortunate to work with Fran Rosh, who,
33:00
boy, he'd done so many things. He'd had some technical
33:02
background. He had a great business head and
33:05
he still does. And but like you can't assume
33:08
anything about first of all, that person's level of
33:13
knowledge. Second of all, their immediate
33:15
concerns are really up leveled from the concerns of somebody
33:19
who's having to make difficult choices among all those
33:23
different sort of squabbling parties about, you know,
33:26
password rotation and you know, what the user journey looks
33:30
like. Like we want to keep those
33:33
operational concerns of identity decided on with the right group
33:38
of people to optimize, you know, to not just have a local maximum
33:42
to optimize for the overall best outcome, but you want the
33:45
metrics to really speak to the top line and bottom line of the
33:49
business. That's one of the things I've
33:50
been doing has been collecting everybody's like best metrics
33:53
and some of them are really quite interesting.
33:56
You know, I want to I want to sort of break out of the mold
33:59
and go for something that the CEO will set up and take notice.
34:01
And we have some evidence that boards that they're bored
34:04
relevant directly. Yeah.
34:08
And that's, that would be kind of a great way that people could
34:11
help you too, right? As if they can kind of like help
34:14
those conversations happen. Yes, I would love for people to
34:18
reach out, by the way, like I'm, I'm still interviewing, I'm
34:21
still collecting data. I would love to hear from people
34:24
if they consider this a call for stories about any of the stuff
34:28
that we're talking about today. They can, they can send mail to
34:31
info@venfactory.com if they want to reach out with a good nugget
34:35
or two. Always happy to chat.
34:38
That would be awesome. That's a, that's a way to start
34:40
building a relationship with your CEO.
34:43
And I make the case or, and, or COO because I find that a lot of
34:48
times the COO is an organization like if so, if you have that CEO
34:54
typecast that I kind of mentioned where they're, they
34:57
don't really understand the operations.
34:59
They, they typically will have somebody who's in the COO
35:02
position who really understands and really knows how the whole
35:07
business works, knows who the players are, things like that.
35:10
So I think that's also probably pretty relevant in this
35:15
situation. So many gems in your table of
35:20
contents, far too many to cover in one episode.
35:23
But one that jumped out at me was identity security and AI
35:29
infused trend whose time has finally come.
35:33
And I just, I mostly want to pick on the term identity
35:37
security, right? It's it's hot right now.
35:40
It is very and it's very hot right now.
35:43
And I want to know is that different than identity access
35:47
management or digital identity? And should we now say we're in
35:53
identity security when we, as identity practitioners, explain
35:58
to other folks what we do? Right.
36:01
So, so the word trend in that particular section title has to
36:05
do with if you remember the game that I played from stage at
36:08
Identiverse a couple years ago, trends and transients.
36:11
I like to just sort of, I'm trying to introduce a bunch of
36:14
different trends and things that aren't trends or shouldn't be
36:17
trends to my, my readership where they may not have heard of
36:22
any of these things. And so I introduce identity
36:24
security as I think a bonafide trend.
36:27
And the more I think about it, you know, the started with, I
36:31
think Gartner invented ITDR as a kind of extension of the XDR
36:36
star Dr. that, you know, we're familiar with from security writ
36:39
large. And there was a lot of
36:41
resistance to it for a few years.
36:42
People are like, what does this mean exactly?
36:44
And then somebody came up with ISPN, maybe it was also Gartner,
36:47
I don't know. And both of those things have a
36:51
role in securing your identity estate.
36:55
So they're kind of like a meta thing on top of identity being
36:58
done seen that way. But I like the identity security
37:03
phrase to kind of go over the top of roughly those two because
37:08
we have examples of different areas of security like
37:12
application security, data security.
37:15
Now we've got AI security, which is a specialty that also grew
37:19
very fast, just like AI itself. And I think identity security is
37:23
a legitimate security discipline that requires us to not just
37:31
assume that doing IAM means it's there for protection.
37:36
I say your protection is the first of the four PS.
37:39
It is there for protection, but done wrong, it can end up giving
37:43
you extra vulnerability because it's so critical to your to your
37:48
security estate. So to me, identity security is
37:51
the hygiene that perhaps we should have applied all along
37:54
until we realized, oh geez, were the first pillar in zero trust.
37:58
Then we should make sure that these things are done correctly.
38:02
So I see identity security as a legitimate area of security
38:06
applying to identity the same way that I am and IGA apply to
38:12
security and to other things. I think so too.
38:17
I I kind of feel like digital identity and identity
38:20
governance, those are areas that have become the domain of the
38:25
identity practitioner. I feel like identity security is
38:31
almost encroaching on other areas or maybe that's not the
38:34
right way to think about it. But I feel like most of the time
38:40
now, I think everybody's just getting on their identity
38:42
security bandwagon, just like everybody got on the zero trust
38:45
bandwagon. But I, I kind of feel like at
38:48
least where it started was identity security was we're
38:51
taking areas of security and we're making them identity Ware,
38:57
which was always kind of like what identity at the center was
39:00
about was that I think. We want the.
39:02
Identity is the most important asset.
39:04
And if you can start plugging it into all of your other security
39:11
systems beyond business systems. But just from a cyber
39:14
perspective, plugging into your, your logging and monitoring and
39:19
alerting, etcetera. And doing that in a 2
39:22
directional kind of mode where it's identity aware and it can
39:26
take action by saying, hey, we found that Eve's account looks
39:30
like it's been compromised. Why don't you just shut that
39:33
thing off for a little bit until we have time to do an
39:37
investigation or something? Well, there's been, I've had
39:40
some interesting conversations around that too, because like,
39:42
you know, what was the domain of the security Operations center
39:46
team, But they've struggled to actually achieve some of the
39:50
things they've been trying to like some of the visibility that
39:52
they wanted to get into identity related vulnerabilities.
39:56
Identity security tools are coming along to help them.
39:59
Or like the identity security tools don't care if they're sort
40:03
of run by an identity team or a SoC team.
40:07
That's a choice that an individual company can make.
40:09
And I've kind of seen both and there's new coordination.
40:12
So to me. That's all to the good.
40:14
Like that's what we, what we kind of wanted out of this was
40:16
to do security better in the very first instance of, you
40:20
know, modern digital identity. So maybe we'll be able to do it
40:23
better now. It is, it is changing the vendor
40:25
landscape somewhat. And you know, cyber security
40:28
vendors have been like, oh, those things look good over
40:30
there in identity land. So it's making things up a
40:33
little bit. Yeah.
40:35
And I think from the practitioner's perspective, we
40:37
should be supportive of, of this model.
40:40
And I think that we, as we as individuals, as we kind of like
40:45
growing our career, we may end up overseeing the whole thing.
40:49
I, I think that's one trend that I've seen happening more and
40:53
more of the last 5-10 years is that you're talking to a lot
40:57
more CSO's who made their way through identity.
41:01
Like, Oh yeah, I ran the identity program and now I'm the
41:04
CSO And I, I always kind of expected that to happen because
41:09
I feel like an identity, while you might not have your firm
41:13
roots in like network security, you might not be a TCPAP person,
41:18
etcetera, but you've got kind of a set of skills of working
41:24
across the enterprise, working cross organizational boundary.
41:28
And to me that's, you know, that's the mark of a leader,
41:32
somebody who can can do that successfully and, and realize
41:36
that you're you're working with people who might have a
41:38
different perspective. That's a really, really good
41:41
take. And I like that.
41:42
It's like the more we see I am folks kind of rise through the
41:47
ranks to become security leaders, the more we'll know
41:50
that they're, they're broad focused throughout a lot of
41:52
different functions. Their ability to kind of
41:55
evangelize, their ability to coordinate.
41:58
It'll it'll be good for security, it'll be good for
42:01
Cecil Land, it'll be good for organizations.
42:03
Yeah. So, so Eve, I really appreciate
42:06
your time today. Really excited for when your
42:08
book comes out. And just kind of looking,
42:13
peeling back the, the, what do they call it, the third wall or
42:17
fourth? Yeah, something like that.
42:21
We had a network, I had a network issue.
42:24
So I'm not even sure where we are in terms of our timeline,
42:28
but I think we're right on track to move into this lighter note.
42:32
And the later note is something that Jeff and I started a few
42:34
years back and kind of the idea was to kind of just end on
42:39
something a little bit lighter and a little more entertaining.
42:43
Hope. You know, we want the whole
42:44
thing to be educational and entertaining, but this later
42:47
note is meant to be more on the entertaining side.
42:51
But I think with you, I want a little more education too,
42:54
because you are somebody who does a lot, a lot, a lot of
42:59
public speaking. And I'm thinking that you
43:03
probably have a routine or, you know, I always watch baseball,
43:07
right? And that people do the same
43:09
routines like they used to always like readjust their
43:11
batting gloves and, you know, spit on home plate and whatever
43:15
they did, they get ready for their at bat.
43:18
I'm sure you don't if you spit on something before you get up
43:22
there for public speaking, we don't want to really know about
43:24
it. But what?
43:26
What are some of the things that you do to get yourself in the
43:29
zone for public speaking? Gosh, you know, I do plan, I do
43:35
practice, but I don't know what the first thing that's going to
43:40
come out of my mouth is until about 5 minutes before I would
43:43
ever get up on stage. And usually the adrenaline at
43:46
that point is so high that I end up getting sort of weirdly
43:50
creative. And I kind of just never know
43:55
what that's going to be. So I leave a little bit of it
43:56
unplanned. And I will tell you.
43:58
So I had this great opportunity in in June to go down to Sao
44:04
Paulo, Brazil for the first time and give a talk for the
44:08
organization at VR. And I was one of two very
44:11
privileged people who were speaking English at this
44:14
conference that was otherwise in Portuguese.
44:17
And I decided a few minutes before to have the first
44:22
sentence come out of my mouth, be in Portuguese.
44:24
So I paced around trying to practice it for myself.
44:28
That was merely, you know, thank you for for having me here.
44:32
I was just hoping to be respectful to my hosts and to
44:36
just tell them that I really appreciated being there and was
44:38
just thrilled about the opportunity.
44:39
So it went. It went OK.
44:41
It was a little halting. I spent a lot of time in
44:43
Duolingo sense. Well, that was brave.
44:46
I mean, I don't know if I would have the courage to do that, but
44:50
I like it. Me personally in conversations.
44:55
You know, me personally, I'm like I'm an over preparer
44:58
because I kind of feel like if I'm giving a presentation, I've
45:01
gone over and I said it five times, if I get nervous or I
45:05
lose my chain of thought, I can more easily pick up.
45:08
So I'll get up in my hotel room and I'll stand up and I'll do
45:13
the presentation. And I don't know, something
45:16
about like, standing up while I'm practicing makes me feel a
45:20
little more prepared to get up there and do it.
45:23
I don't. Sure, makes total sense.
45:26
Yeah, yeah. And I also don't find, I think,
45:29
I think frequency of presenting is a huge thing.
45:32
If you're presenting like every week, it's not even a thing,
45:37
right? Yeah, I mean, I still, you know,
45:40
there's a little bit of a, there's a free, some of, you
45:42
know, nervousness or whatever. And I think it helps to get you
45:45
on your toes mentally. But I do prepare.
45:48
You know, I'm doing a webinar at the end of the week.
45:51
I'm doing in person talk in a few weeks.
45:55
Like all those things you need to know what goal you have.
46:01
Well, you want to know what you want to get across.
46:03
What are the key takeaways? If you just remember those, you
46:06
know, bulleting it out is just very handy.
46:09
I have a friend who's throwing herself a birthday party and she
46:12
decided based on my story of having done a lightning talk at
46:16
something that was called a nerd night back when I was in
46:18
Seattle, she is having her friends give 5 minute
46:22
presentations at her birthday party.
46:26
And I think it's wonderful because anybody who's nervous
46:28
about public speaking, you know, a little wine, a little, you
46:32
know, friendship, blowing out the candles on the cake and a
46:35
presentation, it's the perfect opportunity to practice if
46:38
you're nervous, so. That's a great idea.
46:41
Great idea. Well, Eve, thank you so much for
46:44
doing this. I'm going to wrap it up now by
46:48
saying reminding everyone if you've got a connection to your
46:51
CEO or somebody who's CEO and your family or CEO and your
46:57
family. Any executive leader, honestly,
47:00
who might have stories or might feel this pain or might have a
47:04
great metric to share, you know, get in touch.
47:07
They should reach out to Eve. We'll put Eve's LinkedIn and
47:11
that e-mail that she mentioned in her in the show notes.
47:17
Check us out. We're on the Web at
47:19
idacpodcast.com. Our YouTube channel is
47:23
idacpodcast.tv. We're always available in your
47:27
favorite podcast listening application.
47:30
We'd appreciate it if you would subscribe, give us a review.
47:34
We always like that and tell other folks about the podcast
47:37
and that's how it spreads by word of mouth.
47:39
So really appreciate your time again, Eve, and thank you
47:43
everyone for listening. We'll catch you on the next one.
47:48
You've been listening to, Identity at the Center.
47:51
We hope you've enjoyed the show. Make sure to like rate and
47:55
review, and we'll be back soon. But in the meantime, hit the
47:59
website at identity@thecenter.com.
48:03
See you next time on Identity at the Center.