Latest / Identity at the Center / #331 - RSM & IDAC Present - Risk Management & Digital Identity with Matt Franko

Transcript

#331 - RSM & IDAC Present - Risk Management & Digital Identity with Matt Franko · Identity at the Center

0:00
As a as a former journalist, I am not a techie by nature.
0:04
So I always had to, when I was was coming up, figure out how to
0:08
take the tech speak and put it in the simplest terms possible.
0:12
So whenever I'm talking to an executive, I let them know that
0:16
security is just a practice in risk management, right?
0:20
You have some bad things that could happen.
0:24
You have some ways to reduce the risk or the likelihood or the
0:29
impact that those bad things will happen.
0:32
And what's leftover is, is your residual risk identity is one of
0:38
those things that you can do to either reduce the impact or
0:42
reduce the likelihood that something bad could happen.
0:46
So when I was listening, you know, to your, your podcast
0:48
before and we were talking about attack vectors, I think Kazu was
0:51
talking about attack vectors, right?
0:54
And some of the top attack vectors that we see these days,
0:58
if you look at at RSMS attack vector report is around
1:03
phishing. So business e-mail compromise,
1:06
you know, those are often times stem from phishing.
1:10
You get password guessing or weak, weak passwords is another
1:17
way you know, those are all related to identity and identity
1:21
management. So that becomes, you know,
1:27
having good strong identity practices, having good strong
1:30
authentication practices. All of those different pieces
1:35
are what reduces that that likelihood or that impact of
1:39
that bad act or getting into your environment.
1:47
This is identity at the center if it has anything to do with
1:52
IAM. This is the go to podcast now
1:57
your hosts Jim McDonald and Jeff Stedman.
2:07
Welcome to the Identity of the Center podcast.
2:09
I'm Jeff, and that's Jim. Hey, Jim.
2:11
Hey, Jeff, how are you? Oh, not so bad yourself.
2:14
Doing great. Hey, I actually almost said
2:16
something different. That would have been the first
2:17
time in in. Ever that you're, we're usually
2:22
an autopilot for that opener, but what do you got?
2:25
No. So I mean the big news of the
2:27
day today, we're recording on Thursday.
2:30
What's today's date The. February. 13th and Zilla
2:35
Security announced that they've been acquired by Cyber Ark.
2:39
I mean, the words that they use was we're now part of Cyber Ark,
2:43
but I think it couldn't have happened to a nicer bunch of
2:46
people. So congratulations to everybody
2:48
from Zilla. We've had Mitten, there's CPO on
2:54
that was episode 3, O3, we've had Deepak on their CF or I'm
3:00
sorry, CEO and that was episode 269.
3:03
So go back, check out those episodes if you want to know
3:06
more about their platform. But yeah, that was the the big
3:10
news in our space today. Yeah, I don't want to draw any
3:13
correlations, but, you know, being on the Identity Center
3:16
podcasts tends to lead to good things for companies.
3:19
Like we've had that we've seen a lot of seed rounds get announced
3:23
recently with some of the sponsors we've had on here.
3:25
So I'm not going to draw any correlations, but you know, if
3:29
you're looking to get exposure, it's probably a good place to
3:31
go. It's hard to say that being on
3:32
the podcast hurts. Yeah, that's true.
3:35
It only hurts people's ears or maybe faces as they're trying to
3:38
watch this on YouTube. But we do try to make it as
3:41
entertaining and informing as possible.
3:45
And it's conversational, right? We don't, we try not to make it
3:47
too much of A commercial. But yeah, Congrats to them.
3:50
Look, they found success. They've got a nice product.
3:52
And you know, hopefully we see more of them in the future as
3:54
part of whatever that holds for them, right, as part of the
3:56
Cyber Ark. Well, I think it's just so much
3:59
congratulations for Cyber Ark because you know, the whole
4:02
Zillow security product with the Zeus functionality, I thought
4:06
that was really revolutionary. Like we do those sponsor
4:10
Spotlight episodes. I get really excited about
4:13
things, but I don't, I mean, I, it's not fake.
4:17
I don't have to fake that excitement and enthusiasm like
4:20
they've got a good product. Well, I'm not going to fake any
4:23
excitement or enthusiasm today. I am actually.
4:26
And I'm looking forward to today's conversation because
4:29
I've worked with this person now for a couple years and he's he's
4:33
legit. We started this podcast series
4:36
back in January and we're kind of partnering up a little bit
4:40
with our employers RSM to do this series of how cybersecurity
4:45
intersects with parts of digital identity.
4:47
And the whole point is to become more well-rounded from a digital
4:50
identity perspective because they get a lot of people fall
4:52
into this hole and this trap of, well, I'm an identity person and
4:57
I don't know anything else or I don't care about anything else.
5:00
There are so many other components that interact and and
5:04
impact the way that digital identity works with especially
5:07
within a business. But I thought it would be a good
5:09
idea. And you thought it would be a
5:10
good idea. We thought it would be a good
5:11
idea to kind of figure out, OK, how can we become more
5:14
well-rounded and kind of put together this program.
5:16
So we've got I think what 10 or 11 episodes that we're going to
5:19
put out for the rest of the year around us.
5:21
And we started with Ghazi a couple weeks ago, kind of kick
5:24
things off while we were recording at Gartner.
5:27
If you missed that episode, definitely go back.
5:29
You know, not just for the good conversation with Ghazi, but
5:31
also Jim. You had a hat on and you know
5:34
it. It drew some comments.
5:37
Hey man, when did when did Texans do as the Texans do?
5:41
Yeah, unfortunately I didn't see many Texans doing what you were
5:44
doing, but I liked it. I thought it was cool.
5:46
No, I mean outside of outside of the identity conference for
5:51
identity people. There were plenty of people
5:54
wearing DOS style of hat for anybody who hasn't figured it
5:57
out as a cowboy hat. A cowboy hat.
6:00
And then you're, what do you call that jacket?
6:02
I call it the Hugh Hefner jacket because it's like that crush
6:05
kind of Burgundy or like wine velvet.
6:08
It's a it's a smoking jacket. OK, yeah, well, you were
6:11
smoking, that's for sure. Listen, I I realize I'm not
6:15
supposed to be talking yet, but I think Ghazi wore that same
6:18
outfit in the Northwest this week when we were at a client
6:22
and I made comments about it. So we need pictures of that.
6:25
I wish, I wish I had them, but it was like, yes, the same
6:29
jacket, the same hat. Did you give it to him?
6:32
No, no. But me, I'm starting a trend.
6:35
That's a trend that I will get, but I won't do it.
6:37
But I will gladly watch other people do it, that's for sure.
6:40
So why don't we jump into because that voice you just
6:41
heard was Mr. Matt Franco. He's a principal at RSM and he's
6:44
responsible for cyber strategy here along with us.
6:47
So, Matt, welcome to the show officially.
6:50
I am very excited to be here. When I was asked to, to come on
6:55
the show, I, I couldn't believe it First off because I thought
6:58
it was just identity folks. So here I am very excited to to
7:04
go ahead and get started. Yeah.
7:06
So why don't we start with a little bit about your
7:08
background. I think one of the things that
7:09
we try to do is when we first start off and we kind of
7:12
introduce people and to our audiences a little bit about how
7:15
they got started in the space because they feel like there's a
7:18
lot of different ways, a lot of good stories.
7:19
Yours is a good one too. So let's start.
7:22
You know, normally I would ask how did you get into identity?
7:24
But I feel like we need to go broader here.
7:26
How did you get into the cybersecurity space?
7:28
And then we'll just kind of go from there.
7:30
Yeah. So mine's an interesting one, at
7:33
least I think. But I think everybody says that
7:37
that they they fell into it by accident.
7:39
Actually, when I was listening to to your podcast with Ghazi, I
7:42
wanted to make sure I did not say all of the exact same things
7:45
he says because we work together a lot.
7:48
But mine, mine is unique in that it's probably not unique for
7:53
everybody at the time and in our generation, I feel like a lot of
7:56
folks got into cyber that didn't go to school for cyber.
7:59
So surprise, I did not go to school for cyber.
8:02
But when I did go to school for is journalism, when I had this
8:06
dream that I wanted to be a sports broad, a sports
8:09
broadcaster, I went through all of college thinking I was going
8:15
to do that. I worked at a new station in
8:17
Cleveland for a while and then when I was graduating college, I
8:22
knew I did not want to do that anymore.
8:26
I took a job in the industry. I spent three days at that job,
8:31
quit, moved home, started to apply for colleges.
8:36
I was going to go back to school to become a teacher and a
8:41
company called Secure State was advertising for a three month
8:45
contract through the Early Childhood PTA magazine that my
8:50
sister-in-law was a member of. OK, that's unique.
8:53
I got a joke in there because like, OK, that one I haven't.
8:55
That one, yeah. Your, your boss, Daniel always
8:58
likes to joke that I was found in the PTA.
9:01
Sort of, yeah. So I I I took that job during
9:06
the interview process. They, they liked what they saw
9:09
on the journalism side and they wanted me to come join for PR.
9:12
So I did the contract move over to PR, got into marketing from
9:18
marketing, got into sales from sales, got into, they launched
9:22
the CEO at the time or for all of the time, Ken Stasiak
9:26
launched a another company that focused on federal government
9:29
contracting. And that's where I cut my teeth
9:32
on the consulting side and just kind of continued from there.
9:37
And then we got acquired by RSM back in 2018 and here I am.
9:43
So what kind of company was secure state?
9:45
Like what was the the product or the service or or what did it
9:48
do? So Secure State was a management
9:51
consulting firm that focused on information security.
9:54
So we did a lot of program development.
9:57
Virtual CISO penetration testing was probably our biggest thing
10:02
back in the day, right on through to, to helping
10:06
organizations out with remediation support.
10:10
So boutique in size, I think when we got acquired, we were
10:14
about 50 or so people and we joined RSM, it was about 100
10:20
people. So it was, it was, you know,
10:23
unique to, to join an organization with the platform
10:27
like RSM has, where we were able to expand quite a bit quite
10:32
quickly. And yeah, it's just, it's been
10:36
great, been a great ride. What was been, I guess the best
10:41
thing coming out of that because I want to focus on a positive.
10:44
Typically when we, when there's an acquisition, you know
10:46
something's changed, but what did it allow you to do that you
10:49
couldn't do before? Yeah.
10:52
So I was part of the team that got to vet the organizations
10:56
that were going to buy a secure state.
10:59
So they had to interview you and you interviewing that.
11:01
Yeah, it was. It was interesting.
11:04
The thing that was the most exciting and the reason why I
11:08
was in the majority that voted for RSM was the platform.
11:13
So at at Secure State we didn't do implementations.
11:17
So identity was out of the question.
11:20
We didn't do remediation support too much.
11:24
Like there were certain things that we could, you know, spot
11:26
fix and stuff like that. And it was, it was that ability
11:31
to expand your relationship to be able to help your clients
11:35
more holistically versus coming in and being like, yeah, you
11:39
need to fix this stuff. And when they turn to you and
11:41
say, can you fix it? And you're like, we could, but
11:45
it's not really what we're here to do.
11:48
And then the scale and size of the opportunities that we got
11:52
into were much bigger. You know, when you're a
11:56
boutique, it's a lot harder for buyers in the organization to
12:02
say, I'm going to put my whole, you know, security plan and
12:07
program in, in your hands as a boutique versus when you come to
12:13
an organization the size of RSM. Those doors just open up a lot
12:19
more from that. I can definitely appreciate that
12:22
because Jim and I both came from Boutique consulting and
12:25
absolutely what you're saying is like, Yep, totally got it
12:27
totally makes sense. One of the things that I so when
12:31
I introduced you, I said, you know, responsible for, for cyber
12:34
strategy. What the heck is cyber strategy?
12:36
What does that mean? Yeah.
12:38
So in RSM it's a collection of services and offerings that we
12:42
have and individuals that focus on those delivery of those
12:48
services and offerings. I like to think of it more like
12:52
a, a mindset and where it is that management consulting type
12:56
approach to cybersecurity. So what we're doing in this
13:01
group and and we all connect together, really we go more.
13:06
This is just how we structure. But you know, a, a cyber
13:10
strategy team or what we're doing from that perspective is
13:13
helping our clients understand where their program is today and
13:20
where it needs to go in the future.
13:23
And then helping to really build that transformation road map, if
13:28
you will, to get there. And pulling in and, and helping
13:31
to understand all of the different components that you
13:33
would need to make that program go.
13:36
Whether it is a program documentation, whether it's
13:40
figuring out what resources or people you not might need and
13:44
what that bland and what that skill set looks like, how much
13:47
budget you're going to need to spend.
13:50
And then what are the tools that you need to enable those
13:53
programs to be able to effectively manage your risk as
13:57
an organization and utilize your your company's funds or or
14:03
dollars or resources appropriately?
14:06
So, Matt, we're going to talk about risk management and the
14:09
intersection of digital identity today.
14:12
Where, where should we start this conversation?
14:15
You know, what is risk in the context of digital identity?
14:20
Well. Risk is the foundational aspect
14:25
of security, right? We say this to people all the
14:28
time. As a as a former journalist, I
14:32
am not a techie by nature. So I always had to, when I was
14:36
was coming up, figure out how to take the tech speak and put it
14:40
in the simplest terms possible. So whenever I'm talking to an
14:44
executive, I let them know that security is just a practice in
14:49
risk management, right? You have some bad things that
14:52
could happen. You have some ways to reduce the
14:57
risk or the likelihood or the impact that those bad things
15:01
will happen. And what's leftover is, is your
15:04
residual risk identity is one of those things that you can do to
15:10
either reduce the impact or reduce the likelihood that
15:14
something bad could happen. So when I was listening, you
15:17
know, to your, your podcast before and we were talking about
15:20
attack vectors, I think Kazu was talking about attack vectors,
15:23
right? And some of the top attack
15:25
vectors that we see these days, if you look at at RSM's attack
15:30
vector report is around phishing.
15:34
So business e-mail compromise we you know, those are often times
15:38
stem from phishing, you get password guessing or weak, weak
15:45
passwords is another way, you know, those are all related to
15:50
identity and identity management.
15:53
So that becomes, you know, having good strong identity
15:58
practices, having good strong authentication practices, all of
16:03
those different pieces are what reduces that that likelihood or
16:08
that impact of that bad act or getting into your environment.
16:13
Yeah. I remember when we first talked
16:15
you, you made the statement that risk should drive strategy and I
16:22
wanted to unpack that a little bit.
16:24
What did you mean by that would seem like kind of like the
16:28
foundation of your thinking when it comes to risk and strategy?
16:32
Correct. So again, cybersecurity is a, a
16:37
practice in risk management, right?
16:39
So the first step that you would typically, you know, take in
16:46
developing a, a cybersecurity program is to understand your
16:50
risk landscape. What are the threats that are
16:54
out there that are targeting you as an organization?
16:58
What are the vectors through which those threats might get
17:04
through? And then from there, figure out
17:08
what are the controls that I need to apply to my environment
17:12
to reduce that risk? Or as I like to look at it, how
17:17
do I change my business processes too, so that way I
17:21
inherently take on less risk in the way that we operate.
17:25
So that foundational aspect, that first step is getting an
17:30
understanding of the risks and then building your plan, you
17:33
know, from from there. I like to, you know, liken it to
17:37
anything else that you do do in life, right?
17:39
If you're going to, if you're going to go travel around the
17:43
world, you're going to take a look at, you know what, what
17:46
good things can happen, what bad things can happen, and then
17:49
you're going to build your, your plans accordingly.
17:52
Yeah, yeah. So that foundational element are
17:54
what are the risks? So let me ask the how question,
17:58
like how do I come up with the list of the risks and what is
18:02
there? Is there like a prioritization
18:04
effort that I need to go through?
18:06
How does how does that work? If practitioners sitting here
18:10
listening to you today, what's your advice?
18:13
Yeah, there's a lot of different exercises that you can do to to
18:18
develop the your, your risk landscape, The NIST 800-30
18:25
publication, and I know you like Ness, we, we were talking about
18:28
it before, but that publication has a list of risks that you can
18:33
use. I personally like to not
18:37
necessarily look at risk scenarios, but more attack
18:42
vectors because I can't necessarily control who's going
18:47
to target me or how they're going to target me from a
18:51
scenario standpoint. But what I can't control are
18:54
those attack vectors and those variables.
18:57
So I like to look at, you know, what attack vectors are open in
19:01
my organization be its Internet, you know, Internet access
19:06
through the Internet. If I'm an organization that is
19:08
e-commerce and I'm transacting a lot through the Internet, social
19:13
engineering aspects or business e-mail compromises, I use
19:18
wireless, you know, access and I have wireless access points
19:21
everywhere. I have a lot of physical, you
19:25
know, access. If I'm a health system and
19:27
everything's open or I'm in a higher Ed and everything's open,
19:30
right, I like to look at all of the different vectors that a bad
19:35
actor would look at and then start to build my wrists out
19:38
from there. NIST 830, like I said, does it?
19:42
Does it? And then there are, you know,
19:45
other, other solutions out there.
19:48
The MITRE attack framework does does a good job at helping you
19:51
get an understanding as well for, for how an attacker might
19:55
might come after you. The industry, there's a lot of
19:59
industry sharing. The Isacs that are out there, FS
20:03
ISAC or or you know healthcare ISAC, etcetera, etcetera, where
20:07
you can get a lot of that information to get an
20:10
understanding of what is my inherent risk profile like.
20:14
And then from there you start to build out your plan.
20:17
Yeah, I think it sounds like risks are very individual to the
20:20
organization, which I it's kind of a common sense thing, right.
20:24
I mean, some companies are they're at risk that somebody
20:28
would try to pull off a financial crime.
20:30
Others might be the target of state actors.
20:34
But I would think in this day and age, like even if you're not
20:37
a primary target for a state actor, you never know, right?
20:44
Can you completely rule that out?
20:48
I don't think so. You don't maybe state state
20:55
actors, state actors are, are typically going to go after
20:58
critical infrastructure, which, you know, everybody's basically
21:03
critical infrastructure these days, right.
21:06
So I, I guess you're talking me right into it.
21:11
I, I always, I'm one that, that doesn't think that that matters.
21:17
There's philosophical arguments you can get into, actually get
21:21
into one all the time with, with one of my colleagues here.
21:25
I could see where their techniques and their tools and
21:29
the resources they have to target you are different and
21:33
they might be a little bit more advanced, but if you have your,
21:37
your front door open and somebody's walking by, they're
21:41
going to be able to get in. So you do at some point have to
21:45
have to do the, the, you know, the minimum standards, if you
21:49
will, regardless of who you are. And, and that's where we, we try
21:53
and help organizations understand and executives
21:56
understand that they need to really, you know, focus on
21:59
building out a program and managing risk effectively.
22:03
Wasn't this what I think where likelihood comes part of the
22:05
equation, right? It's it's not just the risk
22:07
itself because we can say, well, everything's a risk, but what is
22:10
the likelihood that, you know, a state actor is doing something
22:14
versus, you know, just random target of opportunity.
22:17
You left the front door open. I looked in.
22:19
Oh yeah, look at that. And that's, and that's three
22:20
bucket. Sure, I'll help myself to the
22:22
contents right of this buffet of information.
22:25
I, I would imagine likelihood is a big part of how you define the
22:29
risk as part of that calculation, because I can
22:32
easily see people getting paralyzed by the sheer number of
22:36
things that could go wrong. How do we stop that paralyzation
22:41
mapping and saying, OK, that's great and I'm glad you're
22:43
thinking with the security hat on, but the likelihood of that
22:46
is probably not as high as these other things.
22:48
Let's focus elsewhere. Yeah, that's where those
22:50
variables come. I NIST 830 can be very
22:54
overwhelming. I I can't tell you the number of
22:57
scenarios. Somebody told me the exact
22:59
number the other day, but that's, that's a big list of
23:02
scenarios. And then in my brain, I'm like,
23:04
OK, let's say we do all of those scenarios.
23:07
There's a scenario that's not in there that's going to happen.
23:09
So that's why I like to look at at the variables.
23:12
When you think of, you know, a risk equation in and out of
23:15
itself, you look at threats, times, vulnerabilities, and then
23:20
subtract your countermeasures. And that typically gets you the
23:24
measurement of risk. So when we look at impact, I, I
23:28
like to look at data sets. I like to look at, you know,
23:31
your systems and what those systems do for you as an
23:35
organization. And if those systems or that
23:38
data was compromised, what would the impact be?
23:42
Your likelihood? You know, a lot of times you
23:45
could tie to to the attack vectors that you have open the
23:48
industry that you're in. You know, when you think of
23:52
physical security, you know, whether or not you're you're in
23:55
an area of high crime or you're in an area of low crime, you
23:59
know that that ties into your likelihood.
24:02
So your threats are impact likelihood.
24:05
Then from a countermeasure standpoint, that is where you're
24:09
getting into or your vulnerabilities are the things
24:13
that you have open. A lot of times folks will say
24:16
that's the absence of controls, but the things that you have
24:19
open or are the things that then bad guys can take take advantage
24:23
of. From a vulnerability standpoint,
24:24
then you look at your counter measures and that's your
24:26
frameworks that are out there. That's your NIST 800-53 or 170
24:30
wallet or your PCIDSSN, IST, CSF, so on and so forth, right?
24:35
And that's why when you think of developing a program, you do
24:40
hear a lot of individuals talking about the frameworks
24:43
that are out there that they can use.
24:45
And that's a framework of controls to help guide what
24:48
you're trying to do. So in a basic sense, a lot of
24:53
the the things that you're taught, the frameworks that you
24:55
could use. ISO has an approach, the
24:57
international standards organization, NIST hasn't
25:01
approached the National Institute of Standards and that
25:04
for them falls under 800-37, which is the risk management
25:09
framework, which takes you through the whole process of
25:13
figuring out again, what what are your risks, how do you
25:16
categorize your assets and then applying your controls based on
25:20
that risk level, based on that categorization.
25:24
It's funny, you said, Jim, you love NIST, and I think that NIST
25:29
is a little humbling because there's so much there that
25:33
ultimately the more I talked to Someone Like You, the more I
25:35
realized like, yeah, I don't know how all that works, but
25:40
let's talk about risk in terms that the digital that the
25:45
identity practitioner is going to understand.
25:48
So we're talking about things like data breaches and
25:52
ransomware. Is that the risk or is that a
25:55
description of the result? Where?
25:57
Where does that fall? Yeah, it's definitely a risk,
26:01
right? So a data breach is when a risk
26:06
is realized and people have access to your data and they're
26:11
exfiltrating that data out of your environment.
26:15
You know, ransomware, same idea, right?
26:17
A lot of times those two things go hand in hand, but that's,
26:21
that's what we're looking to reduce the likelihood of or the
26:25
impact if it were to happen in an organization.
26:29
And we use identity in a lot of ways to to, you know, protect
26:36
against that from happening. So we do that through, you know,
26:40
multi factor authentication, strong passwords, limiting
26:46
identity and and limiting access or rights for folks to the least
26:51
amount that they need to do their job.
26:55
And and then, you know, you can limit the impact by limiting
26:59
what an individual might have the rights to access once
27:03
they're inside the environment. So think of phishing as as one
27:08
of those attack vectors. If I as an individual within an
27:13
organization have rights to everything and the domain admin
27:19
and I get fished and I provide my credentials or a bad guy gets
27:24
access to my machine, they're able then to do whatever they
27:29
want in the environment because they have domain admin.
27:33
You know, in in one of our strategies or one of our
27:36
recommendations or one of the controls that you have inside of
27:39
an organization is that I shouldn't be using my domain
27:42
admin credentials for my everyday.
27:44
And the reason why you prescribe that control is because it
27:47
reduces the risk if I were to be compromised because if I get
27:52
compromised using my normal credentials, they might get
27:55
access to my laptop, they might get access to a shared drive
27:59
that I have files on, but they won't get access to everything.
28:03
Now, you know, they could scrape things off of my system if I'm
28:07
an admin on there, they can, you know, pull down hash
28:09
credentials, escalate and elevate privileges and all that
28:13
fun stuff. But in its simplest sense, if I
28:16
only have access, minimal access to do my job, you're going to
28:21
reduce the impact of me getting fished through those controls
28:26
and those controls that a lot of times we prescribe are are
28:30
around identity. You mentioned identity being
28:34
such a important part of the the strategy to reduce and mitigate
28:38
some of these risks. Obviously, we believe that we've
28:41
called this podcast. I change the Center for a
28:42
reason. How I guess how accurate is that
28:46
to say is identity? I'm going to make a statement
28:48
here. Is identity the number one
28:51
vector for attacks that people should be thinking about?
28:55
And when I say that I mean passwords, I mean the lack of
28:57
the buffet, I mean the lack of controls around access in
28:59
general. Or is there other?
29:01
Of course there are other components, but do you which one
29:03
do you see is bigger than identity if that's not true?
29:08
It's probably top five. Another another vector would be.
29:13
Just saying that the most important I am is most
29:16
important. You're on the Identity Center
29:18
podcast. Man, I mean listen if again you
29:21
go back to those attack factors that I mentioned earlier, it is
29:25
probably 1 and 2 are have to do with.
29:29
I always call it user awareness, right?
29:32
Users clicking bad links, users creating bad passwords.
29:38
So, you know, it's, it's, it's one or two, some of the other
29:41
ones that we've seen out there are individuals not knowing what
29:47
they have exposed to the Internet.
29:49
So unpatched devices that are exposed to the Internet that
29:54
that should not have been. So that to me comes back back
29:58
to, you know, asset management and understanding what assets
30:03
you have. So, you know, inventory is
30:06
probably the first step that we take understand what you have in
30:09
your environment before then you step to making sure you lock
30:13
down access. But it it certainly is at the
30:17
center. I was going to I was going to
30:18
finish your words for you. You did it, you did it for me.
30:22
I was like, I, I guess what you could say is identity is at the
30:24
center, whether that is for on Prem devices, whether that is
30:29
for, you know, software as a service, moving things to Azure,
30:34
You have to make sure that you are locking down access to the
30:38
least amount possible and people are not abusing the rights that
30:42
they have. And again, that all comes back
30:46
to the tools and processes that you put in place to manage that
30:49
aspect of your program. And that's, you know, where,
30:52
where you know, you guys come in is, you know, helping to, to
30:56
understand and, and figure out with us what are the right
30:59
tools, what are the right processes based on the
31:04
organizational profile, the threat profile, and, you know,
31:08
the overarching risks that they have within their, their
31:11
company. So.
31:14
And that's the trick, right? I think there's so many tools
31:16
and budgets are always limited. How do you find the right tool?
31:21
And do you even need a tool? Sometimes the answer is not a
31:23
tool. Could be, you know, a people or
31:24
process type thing, right? Change the way you do the
31:27
business, you know, resolve the risk, things like that.
31:30
There's so much that goes into this.
31:31
And I, I think we've heard over the last several years a lot of
31:34
buzzwords, zero trust, you know, cloud first, zero standing
31:39
privileges, you know, no AI is out there.
31:42
What stock do you put into some of those?
31:45
I don't they're not really frameworks, but ideas on how to
31:47
approach security from, you know, different aspects.
31:52
Yeah, I mean, to me, zero trust is the most obvious.
31:56
Seems to, I know we like to use buzzwords and we like to to make
32:00
the old new again by using said buzzwords, but zero trust is the
32:05
way that anybody's built security, you know, from from
32:10
the beginning. And the key is to not trust
32:13
anything until you know that it is safe.
32:17
So this goes all the way back. I was telling Jim I was going to
32:20
go all the way back to to ancient times, right?
32:23
You built walls around your, your castles, you built moats,
32:29
you built all that stuff and you didn't let anybody in from the
32:33
outside unless you could verify who they were and whether or not
32:38
they were on your side. So, so to me, it's, it's, it's
32:42
making the old new again. I think that that is definitely
32:48
a, a strong approach to things is to make sure, you know,
32:51
you're denying access to everything and only allowing by
32:54
exception. I I think that's, that's, you
32:57
know, number one, number one rule, but identity solutions
33:02
play an extremely important role there.
33:04
The authentication mechanisms that you use play an extremely
33:09
important role there. I can't remember what.
33:11
What were some of those other buzzwords that you use?
33:14
So we talk about things like cloud and you know, obviously
33:16
there's AI is kind of branded everything now every, every tool
33:19
seems everything. 'S AI in it?
33:21
Yeah. Yeah.
33:22
Like what stock do you put in some of this?
33:24
I guess where do we separate marketing and just trying to tag
33:27
on to whatever the fad is to, is this actually useful?
33:31
Does this thing make sense? Yeah, I think AI has a lot of
33:34
potential and a lot of opportunity to streamline some
33:37
of the more monotonous jobs that we have or to be able to
33:41
identify more of the anomalies that we're we, you know, are
33:46
able to see because it's all built on data, right.
33:48
And if you're able to process data faster and come up and make
33:51
decisions on that data faster, well, obviously things are going
33:54
to be better. So I think AI has has some
33:58
definite potential. When you talk about cloud, we
34:02
don't go to an organization these days that is not in the
34:06
cloud in some way, shape or form as far as how their business is
34:10
operating. And when, you know, you talk
34:13
about the connectivity between on Prem cloud, SAS, all those
34:18
different things. The only way that an
34:21
organization can properly manage those environments is through
34:25
proper access control. You know, we're we're big
34:30
advocates here of, of making things as simple as possible.
34:34
So single sign on is one of those simple ways to do things.
34:38
If you have a company that has to manage identity in 12
34:43
different SAS based applications in Azure on Prem, etcetera,
34:48
etcetera, and somebody leaves, you're going to leave yourself
34:53
vulnerable to a potential attack because the likelihood that
34:57
you're going to forget to remove access from one of those
35:00
applications or one of those areas where you have have an
35:04
identity stored that that is really high.
35:09
We see it all the time with with companies that we work with.
35:12
So single sign on is one of those big things that, you know,
35:15
you push when you talk about cloud and you talk about, you
35:19
know, those different aspects. Yeah.
35:22
You know, when Jeff wrote a cloud, it kind of kicked off to
35:25
in my mind, cloud is one of the few things, especially when
35:30
you're talking cloud is SAS identity is one of the few
35:33
things that you can actually control from a security
35:36
perspective or SAS application. That may be the only thing and
35:40
that goes to your point about a single sign on, you know,
35:43
managing a central IDP. That's certainly important.
35:48
But even like public cloud platforms as a service identity
35:54
is certainly something you can control.
35:56
You can still control. I think we were talking about
35:58
with the other vectors is like, you know, potentially leaving
36:01
the configurations for, in terms of what's publicly available,
36:06
things like that are not only publicly available, but what is,
36:11
are you denying access by default?
36:14
But it ultimately does come back to logging in usually like you
36:19
put poor controls on it, but if somebody has a credential,
36:22
they're probably going to get in.
36:24
And if they don't, they're probably not going to get in
36:27
unless you have a really bad configuration.
36:29
So for my money, and of course I'm like the identity
36:33
practitioner, so I'm always like identity #1 but for my money,
36:37
it's like that is where we're still going to be empowered.
36:41
We're empowered today and we'll be empowered more and more in
36:44
the future to manage identity and have less and less control
36:48
over everything else. Yep, yeah.
36:51
And if if you don't limit the number of people that have the
36:55
the access or those credentials, the the worst it's going to be
36:58
actually had a customer. Whoa.
37:01
This was, I don't know, 7-8 years ago we did APCI assessment
37:07
for them and we found that during, you know, one of our
37:12
reviews, they had 300 people with administrative access to
37:19
their, their PCI environment, their card holder data
37:22
environment, and it was 300 people at an organization that
37:28
managed that environment. That was their job.
37:30
And we're like, why do you have 3300?
37:33
Like that's a risk. And they were like, well, the
37:37
reason why we have to have 300 is because they have 300 people
37:42
that any given time are going to need to access our environment.
37:46
And we don't want to have to issue you credentials or
37:48
anything like that or have them check out passwords or you know,
37:51
any of those, those neat techniques.
37:54
It was just easier to give everybody a credential or we
37:56
were like, you shouldn't have 300 people have access.
38:01
Well, they were able to, you know, push back and the PCIDSS
38:05
is a wonderful thing, but it doesn't say how many people can
38:09
have access. It just says that you have to
38:11
control access to the least amount possible.
38:15
Fast forward three months later and somebody at that managed
38:19
service provider got popped and they found their way into the
38:22
PCI environment and we're able to, to get away with some credit
38:26
card numbers. So, you know, lesson learned.
38:30
There are like, you have to, to keep that reduced because that's
38:34
your attack surface right there. If you have way too many people
38:38
with access, your attack surface is now much wider than it should
38:44
be, should have been. And all it takes is one person.
38:46
I had another client. Hold on real quick.
38:50
I have all kinds of, I have all kinds of stories there.
38:53
No, you're very serious, but I just wanted to point out like
38:56
what you hear a lot. So for practitioner learning,
39:00
point is when you hear about, oh, we've got to minimize the
39:03
attack surface, that's what we're talking about.
39:05
You want to try to reduce. It's just like, you know, if you
39:09
have to mow your own lawn, maybe you want to get a small of a
39:12
yard as possible so you're not spending all weekend mowing 15
39:17
acres or something. Or you just need to get a really
39:20
big mower. It could because having a lot of
39:23
acres would be nice, right? It's got other other benefits.
39:27
Or maybe you just hire somebody to take care.
39:28
Of it for you. You know, I actually, while we
39:33
have you here, I wanted to ask you a question, Jonathan.
39:37
I call these kind of the the holy war.
39:40
So one of the holy wars in identity is like, what do you
39:43
where do you manage contractors? What should be the source of
39:45
record for contractors? I'm not going to ask you that
39:48
one. The other one is where
39:50
organizationally does I am fit? Should it be in IT?
39:55
Should it be in IS? Does it depend what?
40:00
What's your perspective on that? Well, I mean, I'll go with the
40:06
consulting answer. It depends.
40:10
And here's what it depends on. If you don't have a strong
40:12
leader in information security and I, I, we still see this to
40:17
this day, right? We call people ACISO or you
40:21
know, we, we relegate security to, you know, somewhere within
40:26
the IT department. I would say if you lack that,
40:30
that level of leadership that is reporting to the executive team,
40:35
right, They report to a CFO or a COO or even the board.
40:40
If they're not at that level, I could see where it might make
40:44
sense to have identity reside with the CIO or within IT.
40:51
It is a business enabler. It is user experience has a lot
40:57
to do with identity. So that's that's why I've seen
41:01
it or we've seen it a lot of times reside within IT.
41:05
But it is the foundation of cybersecurity.
41:10
And if I have the responsibility of an organization to help
41:14
manage the risk of that organization through controls, I
41:18
would like to own and have influence to drive the identity
41:25
program myself. Yes, collaboration is key.
41:29
And everybody's going to be like, well, you should be
41:31
collaborating with the CIO and you should be collaborating with
41:34
IT. Completely agree.
41:36
And that's why I could reside under the CISF because we will
41:40
collaborate on it. We will make sure that user
41:43
experience is great. But if we have to control access
41:47
in the right way to reduce our attack surface.
41:50
And again, as we talked about with, with the expanse of, of
41:54
cloud and, and all, you know, micro segmentation and all these
41:58
other techniques that now we're employing or imploring to make
42:02
the organization safer. I am a huge advocate that
42:05
identity should reside under the office of the CISO as one of the
42:11
programs that you would have responsibility as the CISO to
42:16
set the North Star for, to figure out the mission vision
42:19
values to set the budget for and to drive forward in terms of
42:24
making sure it gets the right amount of resources instead of
42:28
having resources diverted for other programs that may be part
42:32
of, you know, a big digital transformation initiative.
42:35
So that that's my defense for residing underneath the CISI
42:40
know I'll probably get you said you you put my LinkedIn profile
42:44
here later on in the show, probably get a lot of nasty
42:47
grams, maybe even from some clients.
42:50
So I apologize, but you know that that would that would be
42:54
where where I would say it would reside.
42:56
What? What do you think?
42:58
Well, here you let off with depends and I agree with that
43:02
because first of all, only a Sith deals in absolutes.
43:05
There is a ton of Gray Jedi's out there that are, you know it.
43:09
It does depend because you mentioned the leadership, you
43:12
mentioned the, the, you know, the ability and the know how to
43:16
do something like that. And I, I do think it does
43:19
depend. But my answer to this is
43:23
typically it doesn't matter so much who owns it as long as
43:29
somebody knows that they own it and that they have the
43:32
capability and the resources to actually, you know, affect that
43:36
program and having it move forward.
43:38
One of the models that I've seen recently is not recently, but
43:42
that I've seen success with recently is this shared
43:44
ownership model where if you were to take the old adage of
43:47
plan, build, run, plan might sit within information security,
43:52
build might sit somewhere else. They're taking, you know,
43:55
direction and guidance and policy maybe from the plan side
43:59
of things. And then the run may sit in a
44:00
completely different part of IT. For example, maybe it's
44:03
engineering, then maybe it goes to a help desk or something like
44:05
that. So I think there is an
44:07
opportunity to take that depends answer, apply it to the
44:10
organisms. OK, well, what makes sense for
44:11
us, right? Maybe the information security
44:13
team is 3 people and they just, they don't have the resources to
44:16
do that. They are forced almost into
44:19
having to be collaborative, which to your point, they should
44:22
have been doing all along. But that's an opportunity to
44:25
look at, you know, look at different ways to do this.
44:27
I don't think it has to be a binary.
44:29
You take it all or nothing. I think you can carve out parts
44:32
of that because one of the things that typically comes up
44:34
is the idea of a racy right roles and the program.
44:38
Does everybody know what they're doing?
44:40
Who is the A and does that person understand it that
44:44
they're the A? Because I find a lot of people
44:46
think that they are accountable for something when they're not
44:49
really. They might be responsible or
44:51
maybe, you know, consulted or informed and going through that
44:54
exercise of creating your IM program.
44:56
There should be a step that says, OK, are we on the same
44:58
page here? Do I agree that Matt's in charge
45:00
of the program? But Matt, there's a limit to
45:02
your power, right? You're, you're the A for policy,
45:05
but I might be the A for building our IGA platform and
45:09
maybe Jim's the A for the privileged access platform,
45:11
right? I think there's a lot of
45:13
different ways that you can kind of skin that to make sure that
45:16
it, the, the structure of the program is appropriate for the
45:21
organization. I spent a lot there and I and I
45:23
and I, I was able to get my Star Wars SIF in there.
45:26
So what do you think of that? Yeah, I, I put my I put my hood
45:29
up, you know, for for you. I, I, I like that breaking it
45:35
down plain build run, because, you know, hiring a bunch of
45:39
engineers to develop the identity solution when you
45:43
might, you know, have engineers within IT already who are
45:47
experienced in that area. Completely agree.
45:49
I think then it comes down to leadership, right?
45:54
And who's going to lead through everything that you, that you
45:58
have to do from that perspective.
46:00
I did like the, the racy comment that you made on the
46:03
accountability side, though. You want to make sure you have
46:06
one person accountable, because if multiple people are
46:08
accountable, chances are nobody's accountable.
46:10
It's like Highlander, there could only be one.
46:13
There you go, 100%. So I, I, I like, I like that
46:18
idea. I think I definitely could see
46:20
that that working with an organization.
46:23
I have a client that identity has bounced around a few
46:27
different places a few different times.
46:29
It was in IT, then all moved over to security, then all of
46:34
security moved back over to IT. Now security's back out in a
46:39
broad identity with it. The former CIO wanted to pull
46:43
identity back into IT so it you know, it goes a lot of different
46:47
places. One of the problems that that
46:50
client was looking to solve was the run standpoint and, and help
46:58
desk was having some issues with getting vish or voice fishing
47:05
because you know, as human beings a lot of times we trust
47:07
way too easily. So they, they had problems with
47:11
folks getting Vish. So they wanted cybersecurity to
47:14
own that part as well. Because cybersecurity
47:20
professionals are skeptical by nature, right?
47:22
It's it's what we do. We're always the ones that are
47:25
walking into buildings and you're like, OK, I could do
47:28
this, this, this, this, this, this, this is bad.
47:30
This is bad. So that skepticism, you know,
47:34
comes through when somebody's trying to reset their password.
47:37
So Matt, I thought what you might say to me was, I think
47:40
you're asking a trick question. Why wouldn't the CSO report to
47:45
the CIO and therefore it basically you get 2 for one or
47:50
the CIO does. And I feel like that's what I've
47:54
seen the most, is that the CSO reports that the CIO.
47:59
So from a reporting structure, it, it is both.
48:04
But here's the the root of the problem for me is that I kind of
48:09
feel like it's a little bit of the fox guarding the hen house
48:14
in terms of I, I think there's a, a, what do you call it?
48:22
Like a segregation of yeah, segregation of duties or, or
48:27
potential conflict of interest where, you know, you as the C so
48:31
are setting up all these security policies.
48:33
You must go through XYZ penetration testing with.
48:37
And and you said all the metrics of where an application has to
48:41
be before you can roll a major upgrade, before you can roll out
48:44
new software. And now you're under the gun
48:47
with commitments to go live by a certain time.
48:51
And well, do you, you know, loosen up your policy so that
48:57
you don't miss your deadline? I mean, yes, CISO is going to do
49:03
that. Not necessarily.
49:04
But this is what conflict of interest is all about.
49:07
It's like, you know, avoiding kind of that undue pressure.
49:11
So that is my concern about putting operational things under
49:15
the CSO. Yeah, I, I, So I think the CISL
49:21
often times falls under the CIO because no other executive feels
49:27
comfortable that they understand what the CISO does.
49:32
But I believe, and you can read it for, you know, it's a tale is
49:38
all this time that the CISO should not report up through the
49:43
CIO because of that conflict of interest.
49:47
They, you know, control the same budget.
49:50
A lot of times you could end up sacrificing security for
49:55
functionality and if you don't have somebody at an equal level
50:00
or somebody you know, able to report outside of that
50:04
structure, be the ones that say that this is a bad idea, then
50:09
you'll you'll have some issues. I have a friend, They were not a
50:13
client at the time. They were going to be a client.
50:17
He is a friend. He pulled us in and he reported.
50:21
He was the CISO. He reported to the CIO.
50:25
They had to, he got in, he did an assessment.
50:30
They had this, you know, major issue that they were trying to
50:33
solve. They pulled me in.
50:34
We helped put together and figure out the path forward to
50:38
solve for all of the vulnerabilities they had, their
50:41
absence of alignment from a regulatory standpoint to the the
50:45
controls requirements that they had.
50:48
He put together the plan, went to go report it to his CIO, get
50:53
budget and start executing on the project.
50:56
And his CIO said, yeah, all that budget that you had is gone.
51:00
I spent it on a cloud project and it was like, but we're not
51:07
going to be compliant. Yeah, I think we'll be OK
51:10
because, you know, as we move to the cloud, we'll be able to, you
51:13
know, get out of the compliance game.
51:15
It's like that's fundamentally wrong.
51:18
But you know, you you just took the budget that was there for
51:24
the CISO to help control the risk of the organization to do
51:29
something that's going to be, you know, functionally different
51:32
and maybe serve, you know, the one part of the needs of the
51:36
business better. But you're leaving the
51:39
organization exposed to, you know, a huge risk here by making
51:43
that move. Whereas if that person reported
51:46
outside of that structure, they got their own budget, they have
51:49
their own reporting lines. The CIO and CISO wanted to
51:53
battle for that budget, for those things.
51:55
They couldn't go back and forth and then present it to the
51:58
business and say you could do this cloud project today, but
52:03
you are leaving yourself exposed to these fines, these risks,
52:07
etcetera, etcetera. Are you OK with that versus the
52:11
CIO making that decision? Come to find out, you know, that
52:15
CIO had a, you know, bonus package tied to that move to the
52:20
cloud. So that's why, why those funds
52:22
were siphoned over there. But that's, that's why we're an
52:27
advocate of keeping it outside of it.
52:29
To your point, the fox guarding the hen house, right?
52:35
If, if security is within IT, that's exactly what you have.
52:40
So you keep that outside, you force that collaboration, but
52:44
then you also force those two sides to, you know, be able to
52:49
work together to understand what do we need to do to make the
52:51
business better, faster? And what do we need to do to
52:55
make sure that, you know, maybe it's, it's got a little bit of a
52:59
guardian on it to make sure that we don't get out of control.
53:03
Is this a negotiation point for CSO's and people aspiring to be
53:08
CSO's to really maybe try to dictate what that reporting
53:12
structure looks like? If I go and say, OK, I'll, you
53:15
know, I like the role, I want to be a CEO, but I want to report
53:20
to you CEO, right, or something like that.
53:24
Is that a viable way to approach a conversation like that?
53:27
Do you think or do you think that that's a turn off for
53:30
people who are looking for CEO's where they'd want to kind of
53:33
define their own organizational reporting?
53:35
I mean, it depends on on where you are in your career.
53:39
If you just want that title of a CSO that's, you know, it's A and
53:43
you've never been a CSO before, I think that's a that's.
53:46
A. Tough.
53:47
I think that's a tough point to negotiate from, right.
53:51
If you've been a CSO before and you can talk business and you
53:54
understand business, because I think a lot of folks from a
53:57
ACISO standpoint, they, they still talk in tech speak.
54:03
And if you're still talking in tech speak, I think a lot of
54:06
times that's what makes, you know, CEOs or CFOs nervous from
54:10
that perspective and they don't understand.
54:13
And they have a hard time relinquishing control.
54:15
They are. They are the worst Esos because
54:17
they are so technically involved with everything that they
54:21
haven't been able to abstract themselves out and actually be
54:23
strategic. Sometimes they're thinking, so I
54:26
just see that. I think that's, that's key.
54:28
So, you know, for those folks that are aspiring to be AC, so,
54:32
you know, look at, look at taking business classes, finance
54:35
classes, getting your MBA, your executive MBA.
54:38
And that's going to really give you, you know, with, with that
54:42
technical background, which I and a strong advocate that you
54:46
need to have with that technical background.
54:48
If you can learn the business side at you're, you're
54:51
unstoppable from that perspective.
54:53
And then if you're able to talk and bring that technical aspects
54:58
to the business in a way that they understand it, well then
55:02
you have, you know, you're, you're fighting from a strong
55:05
negotiation point there to be able to say, yeah, I'll take
55:08
this job, but only if I report to you as ACEO or you as a CFO
55:14
separate from the CIO. So on this holy war, Jeff, we
55:20
finally reached clarity. It depends.
55:24
It depends. We think we were going to get
55:25
anywhere else. I mean come on.
55:27
No, we got 3 consultants sitting in a room and we all came up
55:30
with great ways to say depends. I'll argue the other side too,
55:35
if you want me to, I'm sure. And we could, Jeff, I think we
55:40
can have a 2 hour podcast with Matt.
55:41
So I think we should just plan to have him back at someday in
55:44
the future. But being that we're bumping up
55:48
about an hour now, we probably ought to go to let him know.
55:50
What do you think? Yeah, I mean, Matt, you've been
55:53
very generous for time. It's also, you know, in the
55:55
evening now, 6:30 Eastern, so I know it's a long day.
55:59
Why don't I? I I definitely would love to
56:00
have you back, Matt, if you, if you will, you know, join us
56:03
again because there's so much for us to talk through.
56:05
I want to close out the show on a little bit of a sports thing.
56:09
You were talking earlier about reducing attack surfaces.
56:11
And what I thought about that, I thought of, I'm a big football
56:15
fan, NFL. And one of the things that
56:18
people would used to say is you got to get skinny.
56:21
And what that meant was you've got to get small and get cut
56:25
through the holes that your offensive line is making for you
56:28
because you're not going to have, you know, all the room in
56:30
the world unless you're the Philadelphia Eagles, apparently.
56:32
But that's a different discussion.
56:34
But you have to get skinny and that sort of, you know, making
56:36
yourself small to fit to the full the, the, the whole.
56:39
So I know you do a lot of coaching with sports.
56:41
I think you're doing wrestling, football, baseball.
56:45
You've got at least three sons that we know of.
56:48
So tell me about sort of your sports world, because I know
56:53
people who coach, you know, 1 sport, maybe 2, but you're
56:57
coaching a variety of different things.
56:59
What's drawing you to that? So I only have 3, three sons and
57:04
I know that I only have 3. So, so we're good there.
57:09
We're good there. What's drawn me to sports is
57:13
that I grew up in a, in a sports family, You know, all my, I had
57:17
three brothers. We all played sports.
57:20
My oldest brother actually, you know, coached at, at extremely
57:23
high levels, college football actually with the, the
57:26
Lieutenant governor here of Ohio and my other brother played
57:31
college football. I, I was more drawn toward
57:34
wrestling and my younger brother was more drawn toward baseball.
57:38
So I played, played them all. And that's, that's why, why I,
57:46
you know, initially wanted to get involved in coaching.
57:49
I, I did a little bit of it post high school with some wrestling
57:53
camps and then helped out with, with the high school program
57:57
where I, where I went to school when I was in college.
58:00
And then as I had kids, to me, it was a great way for me to be
58:05
able to spend time with them. I, we live in a very small town.
58:10
I think by my son's whole class at each level, they each have
58:14
like 80 kids in their whole grade.
58:17
So we are hurting for people to help.
58:19
So I volunteer to help where, wherever I possibly can.
58:23
It forces me to quit working at 5:00.
58:27
Normally I'm staying for you guys, but it forces me to quit
58:30
at 5:00 because I have to go to practice.
58:33
And then when I'm coaching football, I'm thinking about
58:35
nothing else or coaching wrestling or baseball or soccer.
58:39
I'm thinking about nothing else but what's in that moment.
58:42
So it, it helps me live in the moment and it helps me bond with
58:46
my children at the same time. So that's, that's one of the,
58:51
the primary reasons why I do it. You know, there's a the role
58:56
that I serve in the organization is coaching as well.
58:59
So it just all kind of ties together for me.
59:04
And and you know, you're helping to to get people to do things
59:09
that they didn't expect that they could do when they start
59:12
and see that growth throughout the course of the year is really
59:15
cool as well. So what ages are you coaching?
59:18
So right now I do for wrestling it is anybody from we have a a
59:25
three-year old girl on our on our team all the way up to 6th
59:31
grade. And that's really cool because
59:35
it's all different levels. That 3 year old girl's dad is a
59:40
professional MMA fighter. So she's already, you know, 11
59:45
bad person and then so that that's cool for football.
59:53
My oldest son does not play football, but my middle son does
59:58
and my youngest one does. So that is what first first
1:00:01
grade kindergarten and then pre-K for baseball, I coached
1:00:06
them all. So it's 10 year old, it's 6 year
1:00:09
old and it's, you know, just T-ball kind of thing.
1:00:14
And then soccer is just the middle one and the younger one
1:00:16
right now, so. It's, it's younger kids, you
1:00:21
force it. You have to, you have to, you
1:00:25
have to do it. Because if I didn't do it, I
1:00:26
don't know. I don't know who else would.
1:00:29
And I'm really, you know, when I want, I want my kids to learn a
1:00:33
certain way. So I didn't coach soccer before.
1:00:37
And I don't know if the guy who's who was coaching my son at
1:00:40
the time was listening. I doubt it.
1:00:41
But you never know. My son, my old, my older son,
1:00:47
you know, he's, he's not naturally athletic.
1:00:52
He is intellectually driven. He is not instinctively driven.
1:00:57
So he, he a lot of times would end up playing out of four
1:01:01
quarters, he would play 2 per game on soccer and he would pay
1:01:05
the back row. And it's recreation soccer.
1:01:08
And I went up to the coach and I was like, Hey, you know, what
1:01:11
can, can you help me understand your, your philosophy here on
1:01:15
why you're only rotating the same kids up front and you don't
1:01:19
have them sit and you have these kids all play in the back and
1:01:23
they sit and he's like, well, you know, it's a mix between
1:01:25
playing time and winning. And I'm like, they're 8.
1:01:30
And that was the end of it for me.
1:01:32
So I'm always a strong advocate of if you're going to run your
1:01:35
mouth at coaches, you better back it up.
1:01:38
So I started coaching soccer because I believe, you know, at
1:01:44
this age that my kids all are, what you're trying to do is to
1:01:49
spark something. You want them to enjoy the
1:01:52
sport. It doesn't matter about winning.
1:01:55
Now, winning helps you to enjoy the sport.
1:01:57
But if you lose, but your kid scores a goal because they
1:02:01
played in the front, they don't normally play in the front or
1:02:03
they learn different things because they're playing upfront.
1:02:05
They don't normally play upfront and they want to come back next
1:02:09
year. That is a bigger win than what
1:02:12
shows up on the scoreboard. So that's the way that I coach
1:02:17
everything at this current stage because it's all, you know,
1:02:20
recreational wrestling gets a little bit more intense.
1:02:25
But for baseball, soccer, football, it's all about
1:02:28
rotating the kids to every position because the biggest kid
1:02:31
in the world today doesn't need to play offensive line.
1:02:35
They might not grow anymore and have to play, you know, running
1:02:39
back. So I'm all about getting kids
1:02:42
exposure to every position and getting them to love the game
1:02:46
and and want to come back. So I forget what your question
1:02:50
was, but I could talk for days about coaching well.
1:02:52
I love the passion about it. I mean, it, it, it does take a
1:02:55
certain love of what you do to be able to do that, right.
1:02:58
I mean, it's, it takes time. It's not, you know, it's, it's
1:03:03
not like you're sitting there playing video games.
1:03:04
No. Which I would love to do, but
1:03:06
you know, there's me too. I would love it it.
1:03:09
It helps me professionally too, because, you know, while I'm,
1:03:12
I'm coaching adults, you'd be surprised.
1:03:18
I am not surprised whatsoever, that's for sure.
1:03:21
Having spent, you know, a decade plus in food service, You know,
1:03:24
you learn people's ranch dressing is not the most
1:03:27
important thing in the world at that moment.
1:03:29
I I totally get it, for sure. Yeah.
1:03:31
Yeah. Jim, you've got a couple boys.
1:03:33
Have you ever coached them? I know you're probably a big
1:03:35
baseball, but. A few years of travel baseball.
1:03:39
Yeah. And I think what Matt was
1:03:42
saying, it's like they're young, but there is a mix of
1:03:46
expectations from the parents of like kids that are like more
1:03:52
advanced, better players, especially in travel ball,
1:03:55
right? They're like anybody can sign up
1:03:57
for rec, but there's like a tryout system and all that.
1:04:01
They're expecting you to push and play in more advanced
1:04:04
tournaments. And there were kids who are
1:04:07
further behind and not ready to go and play in those
1:04:10
tournaments. And then you get into the stage
1:04:13
where it's like you almost have to like talk to the parents,
1:04:17
like, yeah, you're your kids aren't good, aren't ready to
1:04:21
keep up with the rest of team. And like next year, they need to
1:04:24
go find a new team to play for. And dealing with like 910 year
1:04:29
old kids, that's just like, I just didn't want to do that.
1:04:32
So like when it got to that stage, that was time for me to
1:04:35
get out of it. But I, I resonated what Matt
1:04:41
said because then my kids continue to play on after I
1:04:44
stopped coaching. And I realized like, I wasn't
1:04:47
going to go and tell that coach use my kid in this way or do
1:04:52
this or do that, because I learned that those are the
1:04:58
people you can't stand that come, they don't put the time
1:05:02
into it that you do and yet want to tell you how to run your
1:05:07
show. And so, you know, that
1:05:11
basically, I think what, what it became for me was, you know,
1:05:15
with my kids, like, right, I think my kids are being treated
1:05:18
fairly or they're not, They're being treated fairly.
1:05:21
I would talk to my son about, you know, this is what you
1:05:25
should be doing. This is how you should interact
1:05:27
with the coach, how you should, if you want to bat higher in the
1:05:31
lineup, hit better. You know you want to play first
1:05:35
base, let them know. I'd like to show you I can play
1:05:38
first base. I've been working on it outside
1:05:40
of practice. I'm pretty good at it, etcetera.
1:05:45
And if I thought the kids are being treated unfairly and my
1:05:48
kids are doing the right thing. So it's like, hey, it's time to
1:05:50
move on. Because the reality is like when
1:05:53
they're your kids, you're kind of tied to their personal
1:05:57
success. And I think you are you do.
1:06:00
I think I was pretty realistic about where my kids stood
1:06:03
athletically, but I also realized they're my kids and I
1:06:07
love them. And so like, I might think
1:06:10
they're better than this other coach thinks or for whatever
1:06:13
reason, he's not playing my kids.
1:06:15
So maybe it's time to move on and find different team that
1:06:19
wasn't in like a super small town like Matt.
1:06:21
So there was some opportunity to move up or down in terms of
1:06:25
levels and stuff like that. So but yeah, it's I, I guess the
1:06:30
take away is super fun. There's a lot of rewarding part,
1:06:34
but when you're coaching, there's a lot of hard part that
1:06:37
comes with it too. And what I just kind of
1:06:39
described there is like, these aren't adults at work where it's
1:06:43
like, you know, someone's not performing and you give them a
1:06:46
couple of warnings, then you fire them and they deserve to be
1:06:50
fired or whatever. These are little kids and so
1:06:55
like. Yeah, you never know what you're
1:06:56
going to get one day. You got.
1:06:58
To work on fly balls because you keep dropping fly balls and then
1:07:02
they keep dropping fly balls, you're just going to go in there
1:07:04
and be like, you're kicked off the team.
1:07:06
Like all their friend group is now on the team.
1:07:09
Like that's, that's a pretty tough thing.
1:07:11
So I it just wasn't for me, and that part of it wasn't for me.
1:07:16
So I've got my push, my next. Coach at that level yet so.
1:07:21
So here's my next $1,000,000 idea once I'm done, you know,
1:07:24
identity podcasting is I'm going to create Hard Knocks for like
1:07:27
Little League teams and take it behind the scenes of like all
1:07:31
these, you know, youth sports and really kind of dramatize it,
1:07:35
right? And and show that all that and
1:07:38
you know, all the parents and and the language.
1:07:41
And you don't need to dramatize it.
1:07:42
There's. Plenty I know it's going to be
1:07:44
like it's going to be a legit in real life.
1:07:46
So you know, HBO, if you're listening or or Max, whatever
1:07:49
we're called now, you know, there's my submission for a a
1:07:52
new show is like Hard Knocks. I don't know, small town USA
1:07:56
baseball or football or maybe everything, right, Something
1:07:59
like that. OK, we've been talking for an
1:08:01
hour. Matt, as usual, you're just a
1:08:03
always a pleasure and a gentleman to speak with us.
1:08:06
You can find us on the web. We're at idcpodcast.com.
1:08:09
I will have Matt's LinkedIn profile in our show notes.
1:08:12
So if you have questions, comments, concerns, you know,
1:08:16
you can always, you know, reach out to him that way.
1:08:18
And yeah, don't forget to connect with Jim and I on
1:08:20
LinkedIn as well. We're always happy to, you know,
1:08:23
talk, engage, answer questions, take ideas for for future shows
1:08:27
and things like that. So please reach out if you
1:08:30
enjoyed this like subscribe, share it with a friend, share it
1:08:33
with an enemy, doesn't matter as long as they hit like and
1:08:35
subscribe to and with that, we'll leave it.
1:08:37
So thanks everyone for watching and or listening and we'll talk
1:08:40
with you all in the next one. You've been listening to
1:08:45
Identity at the Center. We hope you've enjoyed the show.
1:08:49
Make sure to like, rate and review, and we'll be back soon.
1:08:53
But in the meantime, hit the website at
1:08:56
identity@thecenter.com. See you next time on Identity at
1:09:02
the Center.