Latest / Identity at the Center / #340 - RSM & IDAC Present: Compliance & Digital Identity with Kia Smith

Transcript

#340 - RSM & IDAC Present: Compliance & Digital Identity with Kia Smith · Identity at the Center

0:00
I think people hear the word compliance and they
0:03
automatically think of a check the box activity or let me just
0:06
throw a bunch of stuff at someone to see, you know, if it
0:09
kind of sticks. But really when you start to
0:12
step back and think about the whole reason for a compliance
0:16
activity, in particular like a Sarbanes-Oxley, it's to be able
0:20
to provide someone, and that's usually an external party, a
0:23
level of comfort around how you're protecting something.
0:27
So it all comes back to protection, right?
0:29
It all comes back to making sure that you have the appropriate
0:32
kind of security and you have the appropriate rules and and
0:36
kind of processes in place to really say that we are
0:40
protecting this information or providing information with a
0:44
good faith effort. You can apply just about any
0:46
framework you want to validate that protection.
0:50
So you can do a NIST framework or you can have a GDPR really
0:55
HIPAA, you know, most of that is kind of industry specific
0:59
determine on which framework. But the whole compliance
1:02
function or the audit IT audit functions that sometimes is
1:05
referred to is really just about providing assurance around your
1:10
tools and your processes. So if you are and I am
1:13
professional and let's say you are managing or you are
1:17
responsible for that, that are back or or whatever is that
1:20
piece of audit evidence. It may seem that it is one
1:24
discrete piece of evidence, but really and especially an
1:27
identity and access, it's really a key to how your organization
1:32
is operating. This is identity at the center
1:42
if it has anything to do with IAM.
1:45
This is the go to podcast now your hosts Jim McDonald and Jeff
1:52
Steadman. Welcome to the Identity
1:59
Epicenter podcast. I'm Jeff, and that's Jim.
2:01
Hey, Jim. Hey, Jeff, how are you?
2:03
Oh, not so bad yourself. I'm doing great.
2:06
I'm really excited for this episode.
2:07
It's a continuation of that series that we started in the
2:10
beginning of the year. And I talked to our friend and
2:14
guest for the first episode, Ghazi.
2:17
He told me today, and this is unprompted, right?
2:21
He said he's still getting people who are watching the
2:23
episode for the first time reaching out to him.
2:27
I think it's one of the great things about, you know, our show
2:31
and like have and the guest that we have on is these episodes
2:34
have a long tail. So we put on an episode, it
2:38
could be a year ago or two years ago, it can still be completely
2:42
relevant. I think the topic we're going to
2:44
talk about today will be relevant.
2:46
I mean, it's been relevant for the whole time I've been an IT
2:49
and probably for the rest of our of my career as well.
2:53
So, you know, I'm excited about this topic.
2:56
I'm excited about this series, and I'm excited by the fact
2:59
that, you know, there's proof in the pudding that people are
3:02
still reaching out to our guests a long time after they come on.
3:06
Yeah. I mean, we have a long tail.
3:08
We have great audience out there that listens.
3:10
So we definitely appreciative of all that.
3:11
And hey, new people are discovering all the time, which
3:13
is pretty cool. It's on the Internet, so it'll
3:15
live forever, theoretically. So, yeah, I think people
3:19
discover this. And I think you and I have
3:21
talked about this and mostly you is like, this is like a time
3:23
capsule, right? Of as of today or 2025 in March,
3:27
as we're recording this, this is what this topic was like.
3:32
So who knows, we might be in a history book in the future
3:35
somewhere. It's like, all right, well, this
3:37
is where, you know, some artifacts that people might look
3:39
at. And with this being our 340th
3:42
episode, there are certainly a lot of content that people kind
3:44
of pull through. But yeah, it's pretty cool.
3:46
I'm. I actually, I like this series
3:49
that we were kind of working with RSM on and because I think
3:53
this is important topic where we want to show well-rounded
3:56
identity people, you need to know more than just 100%
4:00
identity to get by in the digital identity space.
4:04
So that means things like what we're going to talk about today,
4:06
compliance, governance, that means cyber security at large.
4:10
You know, there's we're probably going to talk about AI and the
4:12
cloud, right? You don't need to be, I get it.
4:15
You and I are, you know, identity people, but we also
4:18
need to be able to talk about other topics and be able to
4:21
relate and have a more well-rounded knowledge around
4:23
that stuff. So I guess that's a long way to
4:25
say is I, I'm happy that we're doing this type of series
4:28
because I always believe in sort of that well-rounded education
4:32
to make sure that we can spread the gospel of digital identity
4:35
in as many ways as we need to to people who maybe aren't what
4:39
they consider identity folks. Yeah, it's one of the reasons
4:42
also that you can come from so many different backgrounds to be
4:46
successful in this industry is that there's so many different
4:50
types of angles you can take not only to get in, but even when
4:54
you're in the industry, you know different areas you can focus on
4:59
or be expert in and it makes up for maybe the areas that you
5:02
don't have. So if you're not technical, you
5:04
might be a project manager. If you're neither 1, you might
5:07
be a subject matter expert in something like compliance
5:11
privacy, kind of like the the paper or the regulation side of
5:17
the industry. All the, all those things are
5:19
all important and they make up the big picture.
5:22
Yeah. Or maybe you just have golden
5:24
golden, you know, radio pipes and you do a podcast every week.
5:28
That could also be it. Yeah, I don't think that's why
5:30
we do the podcast every week, but I'll, we'll just go with
5:33
that. But I, you know, one other
5:35
thing, and this will be my professional segue, like I've
5:38
been trying to do, is the conferences, like just look at
5:41
the conferences and nobody wants to say they have tracks anymore,
5:45
right? They want to have themes or I
5:48
don't know, because they, they want the idea that you can go to
5:51
the conference and bounce between the tracks.
5:54
But they're, they're still tracks, right?
5:56
And they, they vary from executive leadership to
5:59
technical to, you know, other business regulations, standards,
6:06
the whole 9 yards. And so I think conferences are a
6:10
perfect way to, you know, continue that education and, and
6:15
build yourself out. And if you're not an expert in
6:19
compliance and regulation, you have two choices. 1, you can go
6:23
to the conferences that will go over our discount codes.
6:25
And 2nd, the other is come to the Identity Center Podcast and
6:28
listen to this episode. Yeah, We'll get you started and
6:31
then you can continue on your discovery, your journey of
6:34
discovery past that. But that was a very professional
6:37
segue. Let's build on it.
6:38
We do have some conferences that we're going to be at as well as
6:41
have discount code for. So the first one coming up here
6:44
pretty soon, Jim, is the European Identity and Cloud
6:46
Conference in Berlin. So that's put in my cup in your
6:49
coal, that's May 6th to the 9th. And if you use the code ID AC25
6:54
MKO, you get 25% off. So I know you and I excited
6:57
about getting out there for the first time and checking that
7:00
out. So that's one that's coming up
7:01
pretty shortly. So hopefully, you know, we'll
7:03
see some new friends and maybe some friends that we've seen
7:06
come across the pond to us and Ideniverse, which we also have a
7:09
code for. So if we want to talk about
7:11
Identiverse that's in Las Vegas, that is June 3rd through the
7:14
6th, you and I will be there. We have some, I mean we have
7:18
some things that we're going to be planning on there.
7:19
I don't know if now is the right time to mention it yet, but we
7:22
will be part of the opening kind of ceremony type thing at the, I
7:27
guess the opening night of the Expo hall and stuff like that.
7:29
So I've kind of alluded to that over the last maybe several
7:32
months, but it's official and now we're just working out the
7:35
details of actually how to pull it off.
7:36
But if you use that code IDV 2, five dash, IDAC 25I know it
7:42
rolls right off the tongue. You get 25% off.
7:45
I'll have both of those codes in our show notes and they're
7:48
always on our homepage at idacpodcast.com.
7:50
So if you just Scroll down, you'll see the codes we've got
7:53
there active. I'm sure we'll get some others
7:55
as you go throughout the year. So check back and you know, if
7:58
you've reached out with questions and things like that
8:00
about the kind of stuff, check back.
8:01
We would generally will try to get something for all the major
8:03
conferences or as much as we can so.
8:06
You know, one of the main things I'm happy about is that the
8:08
conference code, that conference codes that we give out are not
8:13
case sensitive because if they were, this would get really
8:16
confusing. Not case sensitive.
8:18
And typically we strive to get like the best code that we
8:21
possibly can so we're not in like an awkward position of
8:23
like, oh, I heard this code and there's a better one over here.
8:26
So typically we try to make it make sure that at least it might
8:29
be a tie, but at least you shouldn't find anything better.
8:31
So hopefully we become the one stop shop for those types of
8:33
codes and you've done a lot of work on that.
8:36
Yeah, no, I, I, I insist on that.
8:38
Like, if we're going to go ahead and give out these codes, we
8:42
want to make sure that they're not usurped by a better code
8:46
somewhere else. So feel confident to use the
8:48
codes that you find here on the podcast.
8:51
Yep. OK, enough preamble.
8:52
Let's get to our guest. She's been patiently waiting on.
8:54
She's put up with a whole lot of our stuff getting set up and
8:58
prepared for this. I want to introduce Kia Smith.
9:00
She's a director in R Sims security and privacy risk
9:03
consulting practice along with us.
9:05
Jim, welcome to the show, Kia. Thank you so much for having me.
9:10
I'm very, very excited to have this conversation.
9:13
I'm humbled to be invited. I have listened to a lot of your
9:17
distinguished guests. So I I hope I can continue maybe
9:21
to contribute to the discussion in the discourse that you guys
9:24
have here on, on this great platform.
9:27
Well, I have no doubt that you will.
9:28
That's why you're here. You're an expert in this space.
9:31
And so why not pull in some of the smart people that we work
9:34
with the talks on these topics? I guess the first thing that I
9:37
always like to get into is backgrounds of people.
9:39
Jim alluded earlier that people come from like kind of all kinds
9:42
of backgrounds. It was a bartender before I got
9:44
into IT, so. And I don't drink.
9:47
So figure that one out, folks. But there's always interesting
9:51
stories and I'd love to hear how you got into the cybersecurity
9:54
space. And then I guess, do you
9:55
consider yourself a cybersecurity person, a
9:57
compliance person, both, something else?
9:59
Tell me a little bit about your journey.
10:01
Yeah, that's a great question. And and Jim was spot on.
10:03
I think myself, like most people have that very non traditional
10:08
kind of journey to get here. I always say, you know,
10:10
cybersecurity and compliance IT audit was my side hustle all
10:15
through school. So I went to school and did a
10:18
lot of school because I was, I went to grad school and I went
10:21
to law school and I was a public policy major.
10:25
And then I went to law school and I thought I was going to do
10:27
education law and I was working on a lobbying firm, writing a
10:31
his briefs and doing all the things law.
10:33
And the whole time I was doing that, I was an IT auditor in the
10:36
federal government and that was my side hustle.
10:39
And so in the government then they just wanted someone to kind
10:43
of learn this cyber and compliance things.
10:46
I didn't really know what any of them meant, but I always said
10:50
yes to all the trainings, to all the opportunities.
10:52
And it's just something that a career that kind of developed in
10:56
and of itself. And throughout all of my
10:58
education and all of my experience on the legal side, I
11:01
always kept coming back to my experiences that I had in
11:05
working in the field. And so I really felt that this
11:08
is where it spoke to me. It, you know, much to everyone's
11:11
chagrin, that was like what, you know, like what was all of that
11:14
about for law school and LSAT and everything.
11:17
But I certainly think it helped give me some good perspective.
11:22
And there's certainly lots of transferable skills that I took
11:25
from my education, but I truly have decided and determined that
11:29
I'm really more of like a cyber professional that just happens
11:32
to focus on a lot of compliance and governance things.
11:35
So let's. Talk a little bit about that law
11:37
background, because I think we've had actually a couple
11:39
people, Jim, if I remember that have sort of law backgrounds
11:42
that have moved into the space of cyber.
11:44
What was that transition like? And I guess was it like flipping
11:47
a switch and make, oh, now I'm this or it was like a gradual
11:50
transition? I guess talk to me a little bit
11:53
more about that. Yeah.
11:53
So I think there is particularly between law and where I
11:58
specialize most Times Now, which is a lot of compliance work.
12:02
Most of the compliance that I deal with is regulatory legal,
12:06
so big, you know, documents and lots of critical analysis and
12:10
interpreting of statutes and terms and contractual kind of
12:14
clauses, all which are things I did in law school and I learned
12:18
to kind of interpret and investigate.
12:20
So I think that piece of it for me was a little bit more of a
12:24
natural fit, but really it was just kind of interesting.
12:28
I distinctly remember I was AGS, nothing in the government
12:32
working on this kind of, you know, very generic IT governance
12:37
audit that they were just trying to literally build.
12:40
They didn't really even know what it was.
12:42
And I was talking to an administrative law judge who for
12:46
those that don't know administrative law judges, they,
12:48
they practice law on behalf of the government.
12:50
It's great way to, you know, simplify it.
12:53
And she suggested that maybe I position myself to do the work
12:58
that I'm doing, but within the Office of Inspector General,
13:01
because that had more executive oversight, had a little bit more
13:04
congressional leaning, lot more statutes, thought it would lend
13:07
itself more to what I would be interested in being with my law
13:10
background and public policy and all of that.
13:14
So that's really where I found my home.
13:16
And it kind of just merged all of these skills that I've been
13:19
honing, you know, my critical analysis, my ability to kind of
13:23
read and understand and apply laws to facts that we were being
13:28
presented. The facts were cyber and
13:31
technological, but they still were facts nonetheless.
13:35
So I think there's lots of synergies there.
13:37
That's why you tend to see, you know, some retired lawyers and
13:40
others of us hiding kind of in the mix in the cyber, cyber
13:44
sphere. Well, their loss is our gain.
13:48
Being one of our colleagues, it's always great to hear from
13:49
you. For people who aren't familiar
13:51
with what a director in a consulting practice does right,
13:55
it's kind of somewhat of a generic of a title.
13:57
What is your day-to-day like? Like what would you say you do
14:00
around here? Oh, what do I do around here?
14:04
Sometimes I ask myself that as well.
14:06
There's, there's lots of things that you do, you know, and in
14:09
any firm that you you have, there's a lot of an industry and
14:12
education component. I think where I'm at as a
14:15
director, I see that as probably one of my most important roles
14:19
that I play. And the education is both
14:21
internal to our teams, to our our junior colleagues and folks
14:27
that we're trying to train up. And really, I know Ghazi was on
14:30
your show before, spoke about our apprentice model that we
14:33
have. It really is an apprenticeship.
14:35
That's how I learned really growing up how to apply and what
14:39
are some techniques and how to interact with clients.
14:41
So that's a big part of my job is the training and the
14:44
education and kind of in that apprenticeship.
14:47
But another big part is doing things like this.
14:50
Actually, it's thought leadership, it's participating,
14:53
being a force in the industry, making sure that we're sitting
14:56
at the table that we're staying up on, particularly in my field,
14:59
regulatory and compliance type changes that have happened, that
15:03
we understand trends and that we're really, you know, working
15:06
with our clients to meet them with what they need.
15:09
And that takes a listening ear. It takes a lot of educating me,
15:13
educating them on what I'm seeing as a practitioner and
15:16
then educating me on what what they're feeling needing and what
15:19
the market is kind of demanding. So that's what a lot of my job
15:23
is. I mean, I could go through all
15:24
the minutia which you know about with, you know, billable hours
15:28
and, and all of the other things.
15:29
And obviously we're doing reports and all the things that
15:32
you would immediately contribute to professional services firm.
15:37
But I really think that's my my main charge kind of as a
15:40
director at this point. And in my role and in the firm,
15:44
it's really kind of being that that interval education piece,
15:48
internal and external to really promote us for to make sure that
15:51
we're, we're really bringing the best power and the best minds
15:55
and talent out in the market to, to meet our clients needs.
15:59
So Kia I, I think back to, well, First off, I think that the
16:04
listener base of this podcast are the I am practitioners of
16:08
the world, Those people throughout the career journey,
16:12
people who are just starting out, just getting their arms
16:14
around cyber and identity all the way up to the most senior
16:18
people. But I think back to the early
16:21
days of my career and it was right around the time that
16:24
Sarbanes-Oxley became law, right?
16:27
And it was like everything you could do to justify a project
16:32
was like we're solving these Sarbanes oxy problems.
16:35
They really didn't have context for what was happening or why
16:39
that was relevant from a cyber perspective.
16:42
So I was wondering if you kind of, you know, think thinking
16:45
about that person who's maybe implementing the controls or
16:50
trying to align their projects to these frameworks that are set
16:54
up with the the regulations. How does somebody think about
16:59
what the parts and pieces are and how that affects
17:03
organizations and how they do IT and cyber?
17:08
That's a great question and it's something that I wish I too,
17:11
when I was maybe first starting out, had a better appreciation.
17:15
I think people hear the word compliance and they
17:18
automatically think of a check the box activity or let me just
17:21
throw a bunch of stuff at someone to see, you know, if it
17:25
kind of sticks. But really when you start to
17:27
step back and think about the whole reason for a compliance
17:31
activity, in particular like a Sarbanes-Oxley, it's to be able
17:35
to provide someone, and that's usually an external party, a
17:39
level of comfort around how you're protecting something.
17:42
So it all comes back to protection, right?
17:44
It all comes back to making sure that you have the appropriate
17:47
kind of security and you have the appropriate rules and and
17:51
kind of processes in place to really say that we are
17:55
protecting this information or providing information with a
17:59
good faith effort. You can apply just about any
18:02
framework you want to validate that protection.
18:05
So you can do a NIST framework or you can have a GDPR really
18:10
HIPAA, you know, most of that is kind of industry specific
18:14
determine on which framework. But the whole compliance
18:17
function or the audit IT audit functions that sometimes is
18:21
referred to is really just about providing assurance around your
18:25
tools and your processes. So if you are and I am
18:29
professional and let's say you are managing or you are
18:32
responsible for that, that RBAC or or whatever is that piece of
18:36
audit evidence. It may seem that it is one
18:39
discrete piece of evidence, but really and especially an
18:42
identity and access, it's really a key to how your organization
18:47
is operating. It's really a key.
18:49
It really, it really displays to anyone that's looking at what is
18:55
your general kind of stance in terms of security and
19:00
protection. So it's oftentimes we get lost
19:03
and especially when you start to hit audit season, it just seems
19:06
that maybe you're getting hit by multiple external parties.
19:09
And sometimes it can be kind of hard to decode which audit means
19:15
for what, right? Because there's all these
19:17
different external kind of parties asking questions.
19:20
But just know that the evidence that you provide rolls up into a
19:24
bigger picture that makes a statement about your
19:26
environment. So it's always important to
19:28
really know that all all of it matters and telling the complete
19:33
story of kind of how your organization is is running
19:36
itself. Yeah.
19:38
And I feel like the word compliance and security
19:43
sometimes get mixed up and some people think that, oh, we're,
19:48
we're just chasing after being compliant with these
19:51
regulations, we should focus on security.
19:54
But the same time, you know, usually the end goal of of a
19:59
regulation is to get you to be more secure in certain areas,
20:03
right? So.
20:05
I'm sure you've run into this question or this conundrum
20:08
before. How do you think about it?
20:11
Yeah. So, and, and that is something
20:14
that I think a lot of times we will start an engagement, right,
20:18
a compliance engagement or, or let me start with this.
20:21
I think compliance, when you think about it, compliance is, I
20:25
think more of a reactive, right, process.
20:28
Compliance is usually an external somebody or something
20:32
that's asking you to, to validate or show what you've
20:35
done, right? So it's a, it's a view of what
20:37
you've been doing, right? A reactive or a post.
20:40
It's in the past. Show me what you've been doing.
20:43
Governance, though, is really a proactive kind of activity,
20:46
right? Like that's the behaviors,
20:48
that's how you want to be, how you want the how you want your
20:52
organization to run. And within both governance and
20:55
compliance, you can't decouple either from security, right?
20:59
So I think they're not mutually exclusive.
21:02
I don't think that you're either a really secure or a very
21:05
compliant. I think that you're secure first
21:08
or most organizations should be secure 1st and then you may need
21:12
to change how you're demonstrating that security to
21:15
align with that compliance framework, but they shouldn't be
21:18
decoupled or thinking of AS2 separate.
21:21
So if I'm going to be very secure, I can't be compliant
21:24
because you're absolutely right. At the end of the day, that
21:26
compliance is really about sharing and showing and
21:30
demonstrating that you have a level of a level of security
21:34
around your your organization or around your processes.
21:39
So I, I, OK, just from my perspective, Sarbanes-Oxley and
21:45
PCI, those are kind of like the OG regulations for me, you know,
21:50
and throughout, throughout, I'd say quite a bit of my career, it
21:54
was like, oh, these are your socks and PCI application.
21:58
So those are the things you chase after.
22:00
But it seems like today there's a much more complex regulatory
22:06
environment. And I'm wondering, like, have
22:09
you seen that shift as well? And you know, when you think
22:14
about that, what are kind of some of the most significant
22:17
drivers of that shift? Yeah, there definitely has been
22:21
a shift. And I think a lot of the shift
22:24
is due to organizations, businesses and governance
22:28
heavily relying on third parties, right.
22:31
And what the advent of third parties, cloud service providers
22:35
and and quite a few other kind of organizations bringing into
22:38
the mix of how companies and businesses go about their their
22:42
work. They have extended them into
22:45
kind of the regulatory framework of regulatory pool, for example,
22:49
right. I'll I'll use the government,
22:51
for example, the government is one of the bigger consumers of
22:55
third parties. That's either, you know, a
22:58
managed service providers, they leverage a lot of cloud service
23:01
providers, a lot of tools that are third party custom off the
23:06
shelf tools for vital reasons, for efficiencies, for cost and
23:10
you know, cutting and just for, you know, best practices really,
23:13
right, best in class. Well, those might not be
23:16
traditionally tools or organizations or third parties
23:21
that would normally be subjected to compliance because they're
23:24
not a government thing. But now because they have
23:27
entered into the government ecosystem either by being a
23:31
third party vendor or by being a third party provider, they now
23:36
find themselves subjected to some sort or at least, you know,
23:40
casually related to some sort of compliance or regulatory
23:44
activity. So you see all kinds of
23:46
different actors now that are being subjected to maybe DoD
23:51
type compliance regulations because they are a fourth or an
23:55
NTH party provider to a subcontractor.
23:59
And now all of a sudden they're starting to see, you know,
24:01
contractual language or things that are requiring them to meet
24:04
regulatory, you know, regulatory requirements in a way that they
24:08
never would have or they generally don't have to because
24:11
they don't really play in that space traditionally.
24:14
So I think as the world and business has continued to kind
24:16
of expand and kind of merge across various different
24:20
industries and use, use and leverage products differently,
24:24
you've really seen kind of the expansion of the regulatory
24:27
landscape. And I think a lot of external
24:31
compliance and regulatory authorities have really
24:35
recognized that. And so you started to see the
24:37
shift in the last really three to five years of a heavy focus
24:41
on supply chain or sometimes it's called supplier risk
24:45
management. But really it's the idea of
24:47
understanding that now the way businesses perform is a lot of
24:51
services are outsourced. And so if services are being
24:54
outsourced, our companies also outsourcing risks that they
24:58
should or shouldn't be, right. And so there's been a lot of
25:01
focus in continuing movement towards really having strong
25:08
third party processes and supplier risk management
25:10
processes just because that regulatory and compliance
25:13
landscape has now gone outside and maybe the primary business
25:18
and stretched into vendors and and other parties.
25:21
So I think it's something that that I deal with it quite often.
25:26
I, I can't tell you how many companies or organizations will
25:29
reach out to us to talk about a certain thing and they'll start
25:33
the conversation with saying, I don't even understand, Like
25:35
we're, we don't work with the government.
25:37
I don't even understand how this came into my contract or why do
25:39
I need to do this or why, you know, why do I have to, you
25:42
know, do the specific way of split tunneling, like, you know,
25:44
very specific kind of technical things that are kind of specific
25:48
to the government, but it's really through those contractual
25:50
relationships and that and they're we're just, you know, we
25:54
are, we are grouping and working differently than what we were
25:57
even 1015 years ago. Yeah.
26:00
It's just what you said there really something that I've
26:03
always wondered. So you talked about do you, are
26:07
you outsource, you're outsourcing a function, are you
26:10
outsourcing the risk? So let's take a sample of ACRM
26:15
system. You outsource it to a client or
26:17
to a company and they have sock 2, they have all the, you know,
26:22
check boxes checked and then they have a breach like, I mean,
26:29
is that company now I you may have shifted the work, but
26:35
really you're the one who suffers from that breach, right?
26:38
Correct. So.
26:39
Spot on. OK, yeah, that's I guess the way
26:43
I've always thought about it. But yeah, what else can you do
26:48
other than check for those things, right?
26:50
Yeah. And so a lot of what a
26:53
compliance, a lot of the compliance frameworks that we
26:55
deal with in this kind of move is they kind of recognize that,
26:58
right? They recognize that the way
27:01
businesses were interconnected in ways that we weren't
27:04
previously, right. There's lots of different actors
27:06
and providers across industries that are bringing best in class
27:10
services, you know, in a way that we maybe hadn't thought of.
27:14
So a lot of compliance frameworks have been really
27:18
developing and putting additional kind of focus on.
27:22
So what are you doing around that SoC two?
27:25
OK, great. You get a SoC 2 that says they
27:28
use least privilege or that says, you know, everything is in
27:32
AWS or that says whatever, right.
27:34
But what are you, the organization that's, you know,
27:37
contracting them? Did you validate that?
27:39
Did you do a spot check? Are you, you know, looking at
27:43
that on a regular cadence to confirm that nothing has
27:47
changed? Do you have contractual language
27:50
that requires them to notify you if they're changing something?
27:54
Are you making sure that their cyber risk posture is in
27:59
alignment with your cyber risk posture?
28:02
Maybe you align to a certain framework or certain sticks?
28:06
Are you ensuring that those clients and those companies that
28:09
you're partnering with because they are providing services on
28:12
behalf or for you that they're really operating in a way that
28:16
you find appropriate? So it's really putting a lot of
28:19
focus and onus on. We understand that third party
28:23
and service providers is really kind of how we operate in the
28:27
world and in business, but we don't outsource risk.
28:30
We outsource processes and services.
28:32
So since you can't outsource risk, what are you going to do?
28:35
What is your governance again? What is your internal kind of
28:39
business behaviors and processes going to be to really make sure
28:43
that you're managing and in monitoring that relationship,
28:45
you didn't just like kick over the function and be like, good
28:48
luck to you. Hope you know, hope nothing
28:50
fails. You're actively involved in it.
28:55
So I think this is a super timely question to ask because I
28:58
feel like this is the new, well, maybe not new, but supply chain
29:01
attack. It's not just like physical
29:04
goods of things, it's also the services that every company
29:07
relies on from others. And I guess, you know, you talk
29:10
about some of the controls or layers of control that you might
29:13
put in like legal language within a contract.
29:16
Who's responsible for that sort of language?
29:18
Is that something that lawyers for the company should be
29:22
thinking about? Is it something that maybe a
29:23
risk officer or AC so should be thinking about?
29:26
I mean, should an identity person be thinking about those
29:29
sorts of things and say, hey, have what is our repercussion of
29:32
this? Because there's a lot of SAS
29:34
services that are used by identity people, right?
29:36
A lot of companies are moving their products, that sort of
29:39
thing. I guess we know this is going to
29:41
happen, right? It's just a numbers game and
29:43
say, OK, someone's going to get breached.
29:44
There's going to be some sort of issues.
29:45
Humans are going to human, right?
29:47
Mistakes will be made. What do I do about it though?
29:50
If I, let's say I don't have the, the legal language, is it,
29:55
do I have a control within my organization?
29:57
It says this is what we do to check up on our suppliers.
30:00
It's sort of like a third party risk management type thing, you
30:03
know, what can I do as a customer of these sorts of
30:05
things? Because like you said, you can't
30:07
outsource the risk. At the end of the day, I'm
30:09
responsible to you as my customer to make sure whatever
30:12
I'm doing meets your needs. If something behind the scenes
30:15
is having a problem, that's my problem, not yours.
30:18
I can't just pass the bug and say, well, it's not my problem.
30:20
You know Microsoft did something that's not going to work in the
30:23
real. World, right?
30:24
And really, you know, in, in a true consultant answer, it's all
30:28
of the above, right? But it's, it's amazing
30:32
sometimes. And again, I always deal in like
30:35
the contract area because a lot of what I do from a compliance
30:39
standpoint is contractually enforceable or regulatory, you
30:44
know, bestowed upon groups or organizations.
30:46
So we always end up in like a document of some sort.
30:49
And so it's, it's funny because we'll often in those
30:52
conversations, I'll say, well, can I have your security folks
30:56
on the line? Can I have your legal?
30:57
Can I have your procurement? And everybody's like, what do
31:00
you like? Why, Why would my security like,
31:02
why would my security people be be here?
31:04
And I'm like, well, what is your security clauses say, right
31:08
about how you expect them to behave and identity and access,
31:13
no matter what compliance framework that you're looking
31:16
at, it's really kind of at the cornerstone of kind of security
31:20
101. Do I know who has access right?
31:24
Is there access appropriate? And am I doing something to
31:28
monitor, remove or, you know, completely authenticate and make
31:32
sure that it is who it's supposed to be when it's
31:35
supposed to be, right? That is a tenant that is in
31:39
every single compliance framework, no matter which
31:41
industry, whether you're talking socks or, you know, CCMMC or
31:46
FISMA Fed ramp, it, it really, it literally doesn't matter.
31:49
HIPAA, all of them have a huge set.
31:51
It's always the largest group of access and identification
31:55
controls. IA controls AC and IA, right?
31:57
And they go hand in hand, you know, like best friends that
32:00
they are. So when you really start to
32:03
think about how do we set our program up to make sure that we
32:07
organization understand what our suppliers, our vendors, our
32:12
partners are doing, usually it is the most enforceable way is
32:16
through that contract vehicle, right?
32:17
That's how you get legal. You can apply legal
32:20
repercussions, right? I am agreeing the service you
32:23
agreed to do X and the X really should be a combination of your
32:28
security folks and your IE folks say, hey, we don't allow, you
32:32
know, group accounts, right? So whatever you do, you can't
32:35
have a group account. We have, we run quarterly access
32:38
reviews. We expect you to run monthly
32:41
reviews and report to us quarterly.
32:43
We exercise least privilege. Like those are things that
32:46
should be set out. If that is the cyber security
32:49
and your security posture and your organization, it should be
32:52
passed along and it should be detailed.
32:54
And so you started to see, even with a lot of like cloud service
32:59
offerings, there are a lot of kind of frameworks are body of
33:03
evidence, as they'll sometimes call it.
33:04
So sometimes you'll see, you know, cloud service offerings
33:07
will say, well, we're not fed ramp, you know, authorized, but
33:10
here is our Fed ramp equivalent. And essentially it's just how
33:14
they're performing against all the controls so that that
33:17
organization can look and see, you know, is there identity and
33:20
access management like the way they're managing, you know,
33:23
they're, they're very they're very high administrators.
33:27
Does that match what what we think administrators should be
33:30
or is everybody an administrator?
33:31
Does everybody have access to every single thing all the time,
33:35
right? Or if you are providing a
33:37
service for us, how are they, how are you restricting and
33:41
making sure that a person for my company only has access to my
33:46
company and right, they're not able to dip in, you know, across
33:49
three different companies and put my information somewhere
33:52
that it shouldn't. Like where are those rights?
33:54
Where are those group policies? Those are things that should be
33:57
included and should be thought of.
33:59
And to do that, you need practitioners.
34:02
So that's not something that generally a procurement officer
34:05
can just detail out themselves. The procurement should
34:08
absolutely be working with their security specialists.
34:12
They should be working what folks that are administering
34:15
their I am to understand, hey, what is our access policies and
34:18
what do we expect, you know our vendors to be doing?
34:22
And since we're reviewing what what would you need to see right
34:26
so that that language is codified and put in to
34:30
contractual or rules or mammogram them, whatever is
34:33
going to dictate, you know Sops how you were going to interact
34:36
and behave with one another. So I think you answered the
34:40
follow up question. I was going to ask to say where
34:42
does this start? Is it, is it legal?
34:44
Is that really where it starts is to have that teeth behind a
34:46
contract to say, look, these are security requirements that our
34:49
organization has and make sure that language is in the
34:53
contract. What concerns me sometimes is,
34:57
are the right people looking at the contract to make sure that
34:59
that's in there, which you just talked about?
35:02
Yeah. And maybe it's I, I, I don't
35:04
know where that information comes from because it's just
35:06
experience. Is there are there sources
35:08
online that people get it? Is it, hey, drop a note to key
35:10
on LinkedIn and ask her for if I sent it right?
35:13
That kind of thing. But I feel like sometimes there
35:15
is a pressure also to say, well, they don't do that.
35:19
So we're just going to have to accept the risk in case
35:22
something happens. Talk to me about how the
35:25
business gets involved with making that decision.
35:27
And how do you how do you make sure that that, you know, people
35:30
who are listening to this, people who are in identity and
35:32
cybersecurity are saying, OK, we've got we're doing our best
35:35
to protect our environment. But every once in a while you
35:38
get the business. It's just like, just do it.
35:40
Right. Right.
35:41
How do you how do you help manage that discussion?
35:44
Yeah, I, I do think it's a, it's a measure of a collective group
35:50
in the procurement and contracting process, right.
35:53
So I think it starts with, obviously sometimes it's your
35:57
lawyers and it's your procurement specialist, but I
35:59
think it is going to your, your cyber, your security folks and
36:04
literally asking what is it that we do here is.
36:08
And, and oftentimes when you partner with a third party, they
36:10
provide you kind of like there's their customer shared
36:14
responsibility matrix or customer responsibility matrix,
36:18
whatever it may be, right? They, they have different terms.
36:20
Basically they'll say, here's all the things we agree we're
36:22
going to do and these are the things we're not going to do.
36:24
It's on you, right? And so I think the first thing
36:28
that I see a lot of times is organizations will get that kind
36:31
of a standard paper, but it's not really reviewed.
36:35
And, and the folks that are reviewing it are usually not the
36:37
folks in security. And you should be having your
36:39
security folks review it because the security folks are the ones
36:43
that can say, hey, they don't really practice any type of, you
36:47
know, maybe they use all group accounts for everything they do
36:52
or system accounts. They have no real, you know,
36:55
identification or authentication methods at all.
36:58
It's kind of like the wild, Wild West.
36:59
Somebody like you work there, you get everything right, and
37:03
you need somebody, but only a security person is going to be
37:06
like, hey, we don't want that, and here's why we don't want
37:10
that, right? That's that risk we're talking
37:12
about. So then when that executive says
37:14
we're going to accept the risk, they actually understand what
37:18
the risk is, they're accepting it, and it should be documented.
37:21
That should still be documented, right?
37:22
Like the idea to not act should be documented the same way as
37:27
how you do ACT when you're thinking of governance.
37:29
Again, this is that proactive kind of behavior.
37:33
We've decided that we are going to continue this relationship
37:35
with this third party. We're going to, you know, accept
37:38
their procedures or their security.
37:40
Security basically as it is. We've accepted that these, you
37:45
know, 10/15/20 things that they say that they're not responsible
37:49
for. We've accepted the risk of of
37:51
managing it or not managing that.
37:53
That should be a proactive, documented decision.
37:57
It just shouldn't be a decision by, you know, almost by neglect,
38:02
right? Like we, we don't really know
38:04
what it means. So we're just going to sign it
38:05
anyway, right, Because that's still not making the decision.
38:08
That's just kind of, you know, moving along and and the whole
38:11
point is, again, governance is the behaviors you want, it's
38:16
internal, it's who we want to be, right.
38:18
And so all organizations should and usually have a goal and
38:22
security to have very strong governance practices.
38:25
So the idea that you are proactively acknowledging and
38:29
accepting risks, security or otherwise, should be something
38:33
that should be involved with multiple parties, legal
38:36
executives and and security. I'm always a fan of bringing our
38:40
security practitioners to those conversations because the
38:45
insight that they provide make the words make sense, right?
38:48
A lawyer that's reading it has no idea half the time why any of
38:52
that matters. What you know, what tools
38:55
they're using, even why that matters?
38:57
You can. You're going to need a
38:58
practitioner to die. Digest that for you.
39:02
You know, as I'm sitting here listening to you, I'm thinking
39:04
I'm learning so much. This is awesome.
39:08
And like Jeff, I had a question queued up.
39:11
I think you answered it, but it made me think of one thing I did
39:16
recently. And I'm sure this was regulation
39:19
driven. I went to my doctor like, oh, we
39:21
have all these things for you to accept.
39:23
And it was like 10 pages of small 10 point font text.
39:28
And I was like sign, sign, sign, I, that's a whole other episode,
39:33
right? But kind of the question I was
39:36
getting toward is, you know, we do a lot with the middle market
39:39
at RSM. We don't maybe have the middle
39:44
market maybe doesn't have the weight all the time to go to a
39:49
SAS vendor and kind of put them through the paces, right.
39:52
If you're $1,000,000 client, they'll run through the paces to
39:56
win your business, but they might more or less send you to a
40:01
website is what I'm thinking. But here's the the thing I was
40:06
getting ultimately getting at was there are certain services
40:10
now. That are almost like you can't
40:13
run them on site or only you know, nobody would run them on
40:17
site. So I'm just thinking of like
40:19
authentication. You know, very few organizations
40:22
want to run their own external authentication system on Prem
40:28
right? They just get a cloud.
40:29
And you know, the thing that you mentioned that really stuck to
40:34
me was, you know, they might not have the form that you're
40:39
looking for to say we're Fedramp compliant, but they might be
40:42
able to show you that their processes exist.
40:45
You might be able to look at those processes and say they're
40:48
better than our own processes. So from a risk evaluation
40:53
standpoint, it's not just to check the box exercise, it's an
40:57
evaluation. Hey, they do all these things as
41:00
well as we do them. They've actually got them
41:02
documented. Maybe your organization doesn't.
41:05
So that that was my thought. I wanted to get into that
41:08
conversation, but I also wanted to just shift.
41:12
So let me shift to another discussion around kind of which
41:18
you talked about a lot of different regulations so far
41:21
during the episode. And I wanted to get like the
41:24
most impactful, but I think there's two types of impact. 1
41:28
is what regulations are having the biggest impact across all
41:34
industries. And you know, I'll put my vote
41:37
out there for GDPR because I keep running into it where
41:41
organizations, especially over the last 10 years have had to,
41:46
you know, make that a major requirements impact in terms of
41:51
deployment of identity systems. Now I think the other most
41:56
impactful could be where does a, a single regulation hit an
42:00
industry especially squarely in the eyes and say this completely
42:06
impacts our identity access management.
42:09
And so I have experience working with utility clients.
42:13
They have a nerk SIP body of regulation, right?
42:17
And it requires that there's an air gap.
42:20
And so for people who don't know an air gap is it's a complete
42:24
separation of the network between corporate and power
42:30
generation, especially nuclear. And so you know, you can't, when
42:34
you have a completely separated network, you can't have IM
42:37
systems with one foot on both sides.
42:40
You're basically duplicating your identity systems as well.
42:44
So I've seen that is like a huge impact on that.
42:48
You know those companies are hit squarely with that one.
42:52
So I'll turn it over to you and kind of the where do you see
42:55
that like the broad and the narrow?
42:58
Yeah. I mean there, there's some, I, I
43:00
would definitely say one that is disrupting lots of industries.
43:06
So I will say this goes across industries.
43:09
Is the cybersecurity maturity model certification, CMMC and in
43:15
its ruling or in its stated purpose, you would think it has
43:19
a pretty narrow scope because it is written to impact the defense
43:24
industrial base, but the defense industrial base is huge.
43:30
It is organization. So just think about you, you
43:35
have a prime, so the big primes of the world, think about any of
43:38
the major aerospace or you know, aerospace engineering, our
43:43
defense contractors, right? But it's everybody in that
43:46
defense supply chain, all the companies in their supply chain
43:51
are also impacted by CMMC and it has no, it takes no
43:56
consideration of size or profit share, right, And who it
44:01
impacts. Literally the mandate is that
44:04
anybody in the defense industrial base supply chain
44:07
will maintain a certain standard of cybersecurity.
44:11
And much like the air gap you're talking about in CMMC, there is
44:15
no commingling of information. So this information that it's
44:20
targeting or CUI that it's important, it has to be solely
44:24
and completely separate from anything else in the
44:27
environment. So this is where I say I start
44:29
to have these interesting conversations with, I had, I was
44:33
on a call with the maintenance company, right?
44:36
They, they do lawn care and maintenance and they are
44:39
subjected to CMC and they're like, why am I talking to you?
44:43
Right? Like we, we do maintenance, but
44:45
because they support, you know, DoD locations and other places
44:51
that are considered to be sensitive and they're in the DoD
44:54
supply chain. Now, granted, they're probably
44:56
like 15 down the supply chain, but they're in the supply chain.
45:00
They find themselves subjected to these, you know, regulations
45:05
that have specific kind of so they're like, so you're telling
45:08
me I now need to find a way to segment my whole environment.
45:13
So I have my whole commercial environment, but because I do
45:16
these, I have these, you know, four or five, whatever
45:18
contracts, it puts me into the defense industrial based supply
45:22
chain. And now I find myself having to
45:25
create a separate enclave or a whole separate environment just
45:29
to manage those contracts, right?
45:31
So it starts to have huge implications and, and really
45:36
we've been seeing it across every industry.
45:38
It's impacting, you know, healthcare providers, like I
45:42
said, maintenance, huge manufacturing implications.
45:47
Think about people that make small bolts that might autumn,
45:50
you know, ultimately end up on some kind of jet or some sort
45:56
of, you know, or some sort of DoD equipment, right?
46:01
They, they may not even, they, a lot of them didn't even know
46:03
they were in the supply chain until they started seeing all of
46:06
these things flow down. And so it's completely
46:09
disrupting how, you know, they are delivering and how they're
46:14
providing their business. And, and in a lot of those
46:16
cases, when we go and talk to them, like, OK, we need to make
46:20
sure that only appropriate people have access to this
46:22
information. Show me, you know, your role,
46:25
role based access or show me your RBAC or show me what you're
46:27
doing. They're like, well, there's
46:29
three of us, So what would you like us to show you, right?
46:32
Like we all have access, we all do everything, We all can see
46:36
everything. Is that a problem, right.
46:38
And we're like, oh, let's dive into that a little bit, right?
46:41
And see for this environment, you may have to do something
46:44
slightly different because it does require you to do least
46:47
privilege and it may require you to set up slightly different
46:50
kind of access permissions and things like that.
46:53
So I definitely think CMMC is one it, the rule has been
46:59
meandering for the past, you know, 10 years or so since the
47:04
idea came, came about, but it went final in December.
47:09
And I think a lot of people thought it was going to roll
47:11
back and it's full steam ahead and its requirements and
47:13
certifications. And so it's requiring lots of
47:17
organizations across lots of different industries to really
47:23
figure out how and what they're going to do to implement it.
47:26
And and I will say one of the tricky things is that identity
47:31
and access management piece of it because the whole cornerstone
47:35
is that only the appropriate people have access to the
47:39
information. And when now you have to set up
47:41
to your .2 separate environments and you can't swivel chair or
47:46
you can't figure out what do you do?
47:48
Do you have two totally different kind of directories
47:51
and policy and you're totally managing two different like how
47:55
do you do that in a way that makes sense?
47:57
And so that's what we're constantly kind of working on
48:01
with some of these regulations. So I think that's a big one.
48:04
And then I think your second question is what is maybe a more
48:06
smaller or one that we're also seeing.
48:10
I think there has been in the in the last few years with GDPRI
48:16
think some of the healthcare in expansion of some of those have
48:20
also started to find the way across.
48:24
Not just a specific kind of usually used to be just like
48:27
hospitals or medical facilities, but you're starting to see the
48:32
advent of more like medical devices.
48:35
Companies are being pulled into certain compliance things
48:38
they've, they've technically or have always been with the kind
48:42
of maybe HIPAA or HPA, but now they're starting to see high
48:46
trust and GDPR and some other things because they often have
48:50
international manufacturing places.
48:53
And so that opens them up kind of in a way that they didn't
48:57
expect. So I think it can, for me, it
49:00
gets kind of exciting when you kind of see how everything
49:03
starts to really intertwine. But it certainly can provide
49:08
challenges because most businesses are not set up to
49:12
only respond or be organized in a way that compliance
49:16
frameworks, you know, speculate right there.
49:20
They are designed to run their business.
49:23
So it's always very interesting in working with clients to kind
49:25
of figure out how to right size their footprint or right size
49:30
their processes to fit their business needs, but more
49:35
importantly, their governance aligns with their compliance.
49:39
So again, it really goes back to what are the proactive behaviors
49:43
that they can put in place so that compliance is just a thing
49:47
that kind of checks on their governance.
49:48
It's not a different thing that they actually have to do.
49:53
So you've got me thinking now, Kia, the supply chain of, you
49:58
know, all the different parts of the especially for like
49:59
government type stuff. You mentioned CNC, Is this
50:02
podcast supposed to be seen MC client?
50:04
Because I know that we're on podcast players in some of those
50:08
environments. So I don't know if we have to.
50:11
I don't know, it depends. I've seen some really strange
50:14
things come into scope in some of these assessments, right?
50:17
I mean, as long it depends on what you start talking about and
50:20
what you start recording and what you start, you know, and
50:22
that's where a lot of the theoretical conversations come
50:25
in at, right? Like what really should be
50:28
considered sensitive or what really in the DoD space, what
50:32
should be considered CUI, controlled, unclassified.
50:35
So the idea that there's this whole body of information that
50:39
is sensitive enough, it needs to be protected more than just
50:41
regular information. But it's not like top secret
50:45
things, right? But it does require some
50:47
additional layers and effort there.
50:50
So, you know, you may be somebody might be reaching out
50:53
to you and want to know, you know, kind of like where's fed
50:56
ramp or where you know, some of these compliance things on your
50:59
road map because they want to be able to use your podcast in
51:02
their environment and their environment is fully compliant.
51:04
You're knocking them out of compliance.
51:07
Well, air gap will, you know, you'll have to buy an A tape
51:10
cassette player. There you go.
51:12
Record us a tape and put us in a room and just put us on a
51:14
speaker and that's the way we'll cover that.
51:17
I know where I, I want to like be cognizant at a time.
51:19
And I have one more question I want to ask you because I feel
51:22
like we've set a record, Jim, in the last year where we've gone
51:27
over 45 minutes without mentioning really AI.
51:30
And so I want to get Kia's, Kia's thoughts on where do you
51:35
see AI really impacting sort of the space between compliance and
51:39
some of the things that people in the digital identity and
51:41
cybersecurity space you really need to start to think about?
51:44
Yeah, I think when you think about AI, right and and its
51:48
usefulness, it's really used to kind of advance or make
51:53
processes more efficient. There's certainly a lot of
51:56
routine and kind of either governance and security type
52:01
things that you could use AI to really help you check on a
52:04
regular basis. And again, I think from a
52:07
governance standpoint, that's very powerful and really
52:11
maturing your cybersecurity posture for it, right?
52:15
Being able to use these where there's a little bit of a
52:18
temperance is, is that at the core, right of most compliance
52:23
is understanding and always being able to know exactly where
52:29
things are coming from, who specifically is doing it.
52:33
And if somebody's reviewing it, right?
52:34
So it's still putting back that human element that kind of the
52:38
whole purpose of AI is to kind of remove some of that, right?
52:40
So I think there's a little bit of a pull right now and a little
52:44
bit of a hesitation from a compliance standpoint and really
52:49
how to evaluate the use of AI in environment.
52:55
Now there are like for example, ISO, I know I think A to LA is
53:00
coming out with statements. I know there's different kind of
53:03
governing bodies that are starting to put out more
53:06
literature, more guidance around acceptable off like acceptable
53:10
use cases of digital identity or other type of like control
53:14
activities or even data, a lot of data gathering activity.
53:18
So for if you think about AI in a financial industry and how can
53:24
be used to kind of aggregate large quantities of data
53:26
reporting, there's a lot of questions and maybe some
53:30
controls and frameworks coming around on how to validate the
53:33
inputs so that you can rely on the outputs that are generated
53:37
from whatever AI tool. I think that's going to continue
53:41
to expand because it's not going away and and people want to use
53:44
it. I just think as everything
53:46
technology is light years ahead of, you know, laws and
53:51
regulations. So that's nothing new to anyone
53:55
that's there, but I think organizations, again, from a
53:59
risk perspective, and again, we're cyber, I'm a cyber risk
54:03
practitioner at heart, right? Everything to me always comes
54:06
back to risk. Again, you never can outsource
54:09
your risk. So no matter what you're using,
54:11
tool or otherwise, as a cyber risk practitioner, I'm always
54:15
going to question, OK, but how do you get comfort of validate
54:19
that what you're doing is appropriate?
54:21
And that may mean spot checks, that may mean that you you use
54:25
AI in a limited fashion over certain areas where the risk or
54:29
the impact is less in your environment versus others.
54:33
But I certainly think it will be continued to be pulled in more
54:37
from a compliance perspective. But I think we're just they're
54:41
just behind and really evaluating how it's going to be
54:44
acceptable within the frameworks as they exist today.
54:47
I feel like we could talk for hours and hours and hours on
54:49
this, but I don't want to do that to you.
54:51
So I think this is probably a good spot where we kind of start
54:54
to wrap things up. I've learned a lot just in the
54:58
last, you know, hour or so that we've been talking and I think
55:01
there's so much more we can cover.
55:02
So hopefully we'll come back and continue to educate us on on
55:05
some of the things that might be changing in the world and things
55:07
that we started thinking about, right?
55:09
It's OK to get smarter. I think it's that's one of the
55:11
things that we should always be cognizant of is like, OK,
55:14
hindsight's 2020, what can we do next time to be better?
55:17
And so I think back to like where we started, maybe the
55:19
conversation run contracts and legal if that language isn't
55:22
there now when it's up for renegotiation, maybe that's a
55:26
good time to start thinking about it, right?
55:27
So there's continuous improvement and you know, from
55:30
that standpoint. So let's go ahead and leave it
55:33
there for right now. I do want to end a lighter note
55:35
because we were talking and sort of preparing for the show and
55:39
you totally blew my mind with the concept of a pickle pop.
55:45
I am not a pickle fan. I will go on a on a platform and
55:49
a hard stance, a hard opinion of I do not like Pickles.
55:53
And so the idea of a pickle pop really, I find personally, I
55:58
hate to say it, but a little bit revolting.
56:00
So tell me about a pickle pop. What is it, why is it, and who
56:05
is it? The pickle popsicles are a
56:10
delicious in from Jim's input, a nutritious, apparently snack
56:15
that one can enjoy any time of the year.
56:18
No, it is really frozen pickle juice goodness in a popsicle.
56:25
And so either on a stick or in like the little old school, you
56:28
know, plastic little push pop push ups, you can get them
56:32
anywhere. As I explained to you, they are
56:34
I'm not a, you know, a population of one and enjoying
56:38
pickle pops, but they're just delicious treats and you can do
56:41
all kind of variations with them out.
56:42
If we didn't go this far, but you know, in certain areas of
56:45
the South, people may put certain types of seasoning on
56:48
top of their pickle pops. Teejan is one that's pretty
56:52
popular kool-aid or sugar sometimes.
56:55
So you have a little bit of that, that sweet with that salty
56:58
like dill pickle bite that you get with that sour pickle juice.
57:02
It's just a refreshing kind of treat.
57:05
I I suggest everyone should try one.
57:08
I will try anything at least once.
57:10
So what is if I'm going to go out and look for a pickle pop,
57:14
what is the one? You're like, Jeff, I know you
57:16
don't like Pickles, but you've got to try this.
57:18
Like what's the flavor or whatever that I should?
57:21
I am very old school. I like the best plain dill
57:26
pickle pickle pop. There are some zesty ones.
57:29
I do kind of like a little spice sometimes so I'll get the spicy
57:32
ones. But since you're just getting
57:33
started and you don't really know, you're very unsure about
57:36
it, I would go. Be careful, I'm a newbie in the
57:38
pickle. World yeah.
57:38
I don't want to scare you. I don't want to do too much too
57:40
soon. So I think you just start with
57:42
the plain dill pickle pickle pop, OK.
57:46
And usually they're green, they're long, you know, and they
57:50
have like a little pickle picture on top of it.
57:53
It's like a pickle, like a pickle man with a hat or
57:55
something. It's, it's just a, it's a, it's
57:59
a delightful treat. I think it's a surprising treat
58:01
and it gives you that salty. So especially if you're a
58:03
savoury person, I feel like it gives you a little bit of that
58:06
salty, but it's it's frozen. So it's kind of refreshing.
58:11
Jim, have you ever had a pickle pop?
58:14
I have. So Kia pointed out something
58:17
that I said. They were nutritious.
58:19
So I'm a baseball nut. And by the way, when we're
58:24
recording this opening day is tomorrow.
58:26
Shout out to my friend Arturo. We're going to be following.
58:29
We're going to be texting, but it's a game that starts in
58:33
spring, goes all the way through the summer.
58:37
The World Series is in October. End of October is very cold, but
58:41
there's that point in the middle from Memorial Day to Labor Day,
58:47
especially in July where you're out there in the sun playing
58:51
baseball. You get dehydrated.
58:55
That's what the pickle pop. What I thought it was invented
58:58
for was getting those electrolytes and getting your
59:02
water at the same time. Now I want to point something
59:05
out because I'm a big pickle fan.
59:06
I also like olives is the only type of Pickles aren't the color
59:14
of Kia's background? You can also pickle things like
59:19
garlic cloves, carrots, and my favorite which is pickled.
59:26
What are those things called? Cauliflower.
59:28
Pickled cauliflower is like heaven on earth.
59:32
I don't even know what to say at this point because I, I don't, I
59:36
don't, I don't, I don't know how we can top pickle pop talk.
59:40
My wife used to run marathons. I, I, I'm going to have to ask
59:42
her about this. I'm like, Hey, have you heard
59:43
about this? Because she's always been
59:44
talking about like, you know, like she has these gels and
59:47
electrolytes, right? And all that stuff that for
59:49
endurance running and etcetera. But I've never heard of pickle
59:52
pop. And now you're starting to say
59:53
that there's other pickle or other pops like cauliflower, I
59:57
mean. Are these just my vegetables?
1:00:01
Yeah, I know. That's the most delicious other
1:00:04
than frying broccoli, which is like fried broccoli is awesome.
1:00:09
But if you pickle things, things that you didn't like before, you
1:00:14
might like now you don't like Pickles, so probably not.
1:00:17
But pickle cauliflower is pretty awesome because cauliflower is
1:00:22
like doesn't really have much of A flavor, so you just get the
1:00:26
pickling flavor. So what I need is like a pickled
1:00:29
chocolate chip cookie. That's kind of what I'm looking
1:00:31
for. If they make that, then I will
1:00:34
definitely try that. So I'm going off the rails here
1:00:36
at the. End that that is that I don't
1:00:39
know about that one, but I I am a fan of olives.
1:00:42
I'm a fan of most things that are pickled and I, I agree
1:00:47
wholeheartedly with Jim's sentiment that you pickle
1:00:50
something and it it almost automatically tastes better.
1:00:53
I don't know, it's something about the process or infusing
1:00:56
it. It just gives it a different
1:00:57
kind of flavor. But the pickle pops, I'm sure
1:01:01
you're going to come back and be like, you know what?
1:01:03
That was surprisingly tasty. All right, I'll give it a shot.
1:01:08
I pulled up this. Will be known from here here for
1:01:10
it as the Pickle Pop episode. The Pickle Pop episode never
1:01:13
covered it. Before I even I picked.
1:01:14
I chose a background for you because of that, right?
1:01:18
A little subliminal advertising. I got you.
1:01:20
Obviously. All right, we're going to go
1:01:22
ahead and leave it there for this week.
1:01:24
Kia, thank you so much for sharing the time with us.
1:01:27
I'm sure there's so much more we can get into, and like I said,
1:01:29
hopefully we'll come back and have another conversation.
1:01:32
I'm going to have your LinkedIn profile and our show notes for
1:01:34
people to check out in case they have questions about compliance
1:01:37
or if they have a favorite pickle pop flavor that you want
1:01:40
to try. Either way, yeah, let's talk
1:01:43
about it. So yeah, with that, we'll go
1:01:45
ahead and leave it for this week.
1:01:47
You can find us on the web, idacpodcast.com.
1:01:51
Check out our YouTube channel, idacpodcast.tv.
1:01:53
We'll take it right there. Do all those cool fun things
1:01:55
that helps Jim and I out. Get great guests like Kia on,
1:01:58
like subscribe, share with friends, share with enemies,
1:02:01
doesn't matter. As long as people are listening,
1:02:03
that's all we really care about. So with that, we'll go ahead and
1:02:05
leave for this week. Thanks everybody for watching
1:02:08
and or listening and we'll talk with you all in the next one.
1:02:13
You've been listening to Identity at the Center.
1:02:16
We hope you've enjoyed the show. Make sure to like, rate and
1:02:20
review, and we'll be back soon. But in the meantime, hit the
1:02:24
website at identity@thecenter.com.
1:02:28
See you next time on Identity at the Center.