Latest / Identity at the Center / #300 - Identity at the Center Defined

Transcript

#300 - Identity at the Center Defined · Identity at the Center

0:00
So let's actually turn episode 300 into a real episode where we
0:04
talk about identity. Nah, I'm good.
0:06
I'm just going to hit stop here and yeah, let's talk about
0:10
something. So do you want me to read the
0:14
question? So we've got like a mailbag.
0:16
We got two really high quality questions that have come in over
0:21
the past week or so. Instead of the usual crap we get
0:25
from your listeners. And I'm just kind.
0:27
Of you had to put it that way. No, I didn't mean it that way,
0:30
but I thought like, OK, this someone served us up a really
0:34
good question for episode 300. I'll read it, but basically I'm
0:40
going to summarize it first. The question was, you know, what
0:43
is Identity at the center all about?
0:46
And not the podcast necessarily, but the theme, the idea that
0:50
went behind the name Identity at the center.
0:59
This is identity at the center. If it has anything to do with
1:04
IAM, This is the go to podcast now your hosts Jim McDonald and
1:11
Jeff Stedman. Welcome to the Identity at the
1:19
Center podcast. I'm Jeff, and that's Jim.
1:21
Hey, Jim. Hey, Jeff, how are you?
1:24
Good, I made you laugh right before we hit record here.
1:27
I know I almost couldn't speak normally.
1:31
Or as normally as you can speak, anyway.
1:33
I was going to say, that's not that normal.
1:35
I mean, you left that that was a fastball right down the middle,
1:37
Jim and I turned on that one. Episode 300 Jeff, what do you
1:41
think? 300 crazy, man, what a year for
1:45
milestones. I mean, five years.
1:47
This is episode 300. We kind of saved this one for
1:49
ourselves, which is the two of us.
1:51
But yeah, I mean, crazy the amount of milestones we're
1:54
celebrating this year. Totally crazy.
1:56
Now. Do you remember what our
1:58
original plan was for episode 300?
2:01
It was going to be when we started doing YouTube.
2:05
Oh yeah, it was so exciting and too much of A opportunity.
2:09
So we've been hitting the YouTube thing pretty hard this
2:13
year. I think it's official, though.
2:14
Now we do YouTube. So if you go to our IDAIDAC,
2:20
podcast.tv brings you right to our YouTube page.
2:25
Yeah, exactly. So yes, I, I thought about
2:28
waiting for episode 300 and then I started, we started recording
2:31
in video recently. Like in the last couple months I
2:33
was like, let me start practicing stuff because I don't
2:35
know how to video at it. It was, it's been a long time
2:37
since I did anything in it. And I think it shows in the
2:40
production of the videos. It's like, all right, it's kind
2:43
of basic, but that's fine. You know, I'm learning it.
2:45
I'll get better at overtime. But I started just doing it and
2:48
it was just like, well, let me start uploading them just to
2:50
kind of get a feel for it and sort of work out my process
2:52
because I do have to make this manageable because the podcast
2:55
is not our jobs, Jim. We have real jobs in the real
2:58
world. Kind of is our job, but it's not
3:01
our day job. Our day job is we're consultants
3:05
at RSM. We've been doing identity
3:07
strategy for over 20 years and that's what puts food on the
3:11
table. But this is a a passion of ours
3:16
that we've been doing for five years, 300 episodes, and we're
3:19
going to continue to do, who knows, maybe we'll make it to
3:22
500. Maybe we'll see.
3:24
But yeah, it's fun. We're going to keep on doing it.
3:27
And yeah, episode 300. So congratulations to us and I
3:30
think that's it. That's it, That's it.
3:33
That's it, right? As as the great big Bill
3:36
Belichick said, we're on to Cincinnati.
3:38
We could pop the champagne, but this might be the time we get to
3:41
twist off champagne. Yeah, and I was at a bachelor
3:45
party weekend for my youngest brother and I'm, I'm good for
3:50
right now. You drank your share.
3:53
It did. I mean, I didn't have too much
3:56
drink, but I drank more than I normally would, that's for sure.
3:59
And so did my brother, so he had a good time.
4:02
Yeah. Back to dry, Jeff.
4:04
Yeah. In more ways than one.
4:07
My dry sense of humor, right? That kind of stuff.
4:10
Yeah. Let's see.
4:12
What else? Another milestone.
4:13
Another milestone, right with the five O 1.
4:16
Go ahead. I'm Yeah, I'm gonna let you take
4:18
that one. Yeah, this is something that I
4:21
have been eagerly anticipating since November of last year, but
4:24
I am proud to announce that we are now officially A5O1C3
4:28
recognized charitable organization or nonprofit.
4:32
For those who people who are not aware, I actually with Jim's
4:36
help set up a nonprofit organization called IDAC Corp
4:41
and the whole intent is to basically help kind of fund the
4:43
podcast. So if you've been paying
4:46
attention, basically since the start of the year, we've been
4:49
starting to do sponsored episodes every so often.
4:51
We don't do too many. We don't want to saturate it.
4:53
And again, this isn't our job. We kind of have to make it easy
4:55
for us to do. We'll do maybe like one or two a
4:58
month and hope to kind of offset some of the expenses that we
5:01
generate just, you know, through this between, you know, software
5:04
services. I mean, hard drive storage is
5:06
getting nuts with the video now. So you know, stuff like that.
5:09
But yeah, we're officially as of as of now recognized 5O1C3.
5:14
So if you sponsored with us in the past, hey, tax deductible
5:19
now. So sponsor early and sponsor
5:21
often. Absolutely, Yeah, it's a big
5:24
mouse. And then Jeff, you put a lot of
5:26
work into that. Really appreciate all the, the
5:30
hard effort. I I think that's the thing with
5:32
the podcast, not just this thing, but all the work that
5:35
happens in the background with scheduling, the awesome guests
5:40
that we have, the sponsors that we have, all the post production
5:45
editing that goes into the LinkedIn posts and now running
5:50
it basically like a official charity slash business almost.
5:57
I mean, it's the same level of effort is just there's no profit
6:01
at the end of the day. Right.
6:02
And yeah, we have like to track expenses and reimbursements and
6:07
like all that stuff. It's like we're, we're
6:09
officially like a real company now.
6:10
Yes. Well, the good thing is, though,
6:12
I mean, a lot of money went into this over the past five years,
6:17
the past 300 episodes. You know, we started out with
6:20
like A-team's call and record it to an MP4 file or MP3 file and
6:26
throw it up there on on the Potosphere.
6:30
But now, you know, we've upped our level, upped our game in
6:34
terms of audio quality, you know, these kind of microphones,
6:37
things like that. The Riverside platform that we
6:41
record on. Yeah.
6:42
That would be a good sponsor Riverside.
6:44
Products until they sponsor us, you know, whatever platform we
6:47
use. You didn't hear what Jim just
6:49
said? Yeah, yeah.
6:51
But it it wasn't, it wasn't cheap.
6:53
And we've been doing it for a few years.
6:54
So yeah, it's definitely. It cost more than I thought,
6:59
Yeah. And you know, going forward, I
7:01
think we hope to make at least enough to cover the podcast
7:03
expenses and, you know, hopefully maybe fun travel to
7:07
fun conferences like Europe next year, maybe for EIC, stuff like
7:10
that. So we'll see.
7:12
But we do it primarily for for the for the walls.
7:15
And yeah, yeah, that's it. Yeah, so let's actually turn
7:19
episode 300 into a real episode where we talk about identity.
7:24
Nah, I'm good. I'm just going to hit stop here.
7:26
Now let's talk about something. So do you want me to read the
7:32
question? So we've got like a, a mailbag.
7:34
We got two really high quality questions that have come in over
7:39
the past week or so instead. Of the usual crap we get from
7:43
your listeners. And I'm just kind.
7:46
Of you had to put it that way. No, I didn't mean it that way,
7:48
but right, I thought like, OK, this someone served us up a
7:52
really good question for episode 300.
7:56
I'll read it, but basically I'm going to summarize it first.
7:59
The question was, you know, what is identity at the center all
8:03
about? And not the podcast necessarily,
8:06
but the theme, the idea that went behind the name identity at
8:11
the center. And so I'm going to read this
8:14
off. And we did protect the identity
8:17
of the of the person who submitted the question they
8:20
asked us to. We put them in a witness
8:22
protection program. Exactly.
8:24
So I'm the director of. I am at XYZ organization in
8:30
phase Zero in the Phase zero assessment to modernize our
8:34
legacy identity system. Myself and engineers have been
8:39
listening to your show for quite some time and so many topics
8:43
resonate. Thank you very much, Cha Ching.
8:46
Thank you, Cha. Ching yeah, my problem is we
8:49
don't have IDAC and we want IDAC.
8:53
We have identities coming in from the business side,
8:56
students, affiliate side and Federated partner sides.
9:01
This creates significant issues across enterprise systems.
9:05
The question, what does the center actually look like?
9:10
All identities created and are all identities created and
9:15
managed in one place. I would love to see a simple
9:19
design for what right looks like and understand and understood
9:25
that looks different everywhere from the consultant perspective,
9:30
but still need the ability to explain the concept to
9:33
executives. So what is identity at the
9:37
center? So first of all, well, and
9:38
thanks for listening and engineers and clearly this is an
9:41
education side of things. We're talking about students.
9:43
So I think we've said this before, education tends to be
9:47
one of the most complex identity and access management scenarios
9:49
you can have, especially when you consider the number of roles
9:53
and the dynamic context switching that people go
9:56
through. You can be a student who is all
9:58
of a sudden a part of the, you know, an employee who could
10:02
potentially also be a parent. They could be a teacher and
10:06
everything in between and sometimes all in the same day.
10:08
So very complex, which I don't know if a lot of people
10:11
recognize just how how difficult sometimes managing all that can
10:16
be on the education. So kudos to you for for thinking
10:18
about that. What does the center look like?
10:24
I mean, this is now we're starting to get a little bit
10:27
into philosophy, I think of how you want to manage this.
10:29
But I'm going to throw this idea out there because here's what I
10:33
think. The center of the universe from
10:37
an identity perspective in my mind is whatever your identity
10:43
and access management system or identity governance, whatever
10:47
those collection of technologies look like is, you're going to
10:50
have the center of the universe somewhere that's tracking and
10:53
storing all that information. Maybe it's one system like an
10:56
IGA or maybe it's a couple systems like you've got some
11:00
people in IGA and maybe some other people in, in a, you know,
11:03
IDP directory or something like that.
11:06
But my, it, it's, it's really the philosophical construct of
11:10
where am I centralizing as much of that data as possible to then
11:14
do stuff with it. So if I have, you know, in the
11:17
orbit around it, maybe there is a student system and maybe there
11:21
is an employee, you know, like a HRIS type system, like a work
11:27
day maybe, right. All of a sudden you start to
11:29
pull in some of that data and you're going into the middle.
11:32
And then what do you do with that?
11:33
Well, let's create accounts and you spin off into other planets
11:37
that are maybe systems, you know, or maybe other use cases
11:40
and things like that. So I think the it's the idea of
11:43
you are trying to centralized as much of the identity controls as
11:47
possible, not just provisioning, could be authentication, could
11:50
be privileged access, it could be analytics, you know, audit
11:55
like kind of all that stuff. That's what I think of when I
11:58
think of like identity, the center, it's the identities are
12:01
at the center of your organization.
12:03
You are providing as many governments or governments or
12:06
risk controls as needed to make sure you're protecting the
12:10
organization and the data you're collecting around that.
12:15
That's true. No, that's really cool all.
12:18
Right. Next question.
12:19
No, no, I want to add a few things, but I think that's a a
12:24
big picture look at it. And I made some notes that I
12:27
wanted to go through and I think I kind of took it almost from
12:32
the standpoint of like when we first started, what did Identity
12:36
Center mean to me? And it was always that identity
12:39
was at the center of information security.
12:43
And I kind of took the idea that it's really when they talk about
12:48
identity being the new perimeter, what does that mean?
12:50
It's that, you know, we're having less of a focus on the
12:55
perimeter and kind of keeping the bad guys out.
12:59
And now we're saying that the individual resources, IT
13:04
resources inside the network, we have to take kind of a zero
13:08
trust approach that whether you're inside or outside that
13:13
firewall you have, you know, you can't basically infer trust.
13:20
And so identity essentially becomes the key to the door to
13:24
get to use that asset or not to use that asset.
13:29
And I also think it's kind of like it's identity versus IP or
13:36
information protocol like TCPIP. So I think IT security prior to
13:42
identity becoming so popular, TCPIP became the way that you
13:48
controlled security for much of your network.
13:51
And it's still that that perimeter concept, but now it's
13:55
we can't rely on just using TCPIP as a method for whether or
14:01
not we trust somebody to come through the door.
14:04
So that was kind of point number one.
14:09
I think that, you know, identity is also at the Center for the
14:17
architecture of those applications now, right?
14:20
So it needs to be kind of like built into whether it's
14:23
infrastructure or applications that there's an expectation that
14:28
identity becomes a, a key way to secure them.
14:33
And that identity is usually external to the application or
14:39
the device. So identity is, you know,
14:42
potentially like coming like from the IDP like you mentioned.
14:46
So that was point number one. I'm actually going to be
14:49
flipping pages. So identity at the center of
14:53
information security, I think is point #1 identity at the center
14:58
of business. So there's a couple concepts
15:01
here. First is I'm going to say
15:04
identity is the person, right? Identity isn't the account.
15:08
So if you're. Doing I don't always agree with
15:11
that, but go ahead. I know you don't always agree
15:13
with that, but but to me this is an important thing.
15:15
So if you are doing business with one person, but they have
15:21
accounts over multiple applications.
15:24
So a lot of this has to do with especially on the business side,
15:28
has to do with what is the use case that you're trying to
15:31
solve. But now let's say you have
15:34
you're an association or university, you've got all these
15:38
applications, you have all these accounts and they each have
15:42
metadata about the account, which from their perspective
15:47
that is the identity. But now you want to take as an
15:51
organization, you have a bigger picture of that person across
15:55
all these applications. You need to have a way to
15:59
recognize that uncorrelate that they are one identity, one
16:04
person owns all of these accounts and that if there are
16:09
deltas in the metadata, those need to be worked out.
16:13
So I kind of see the ability to connect those accounts as kind
16:19
of very powerful and very important to the business to be
16:23
able to recognize that identity across all these systems.
16:27
And that could be from a marketing perspective, you know,
16:32
for example, being able to tell buying patterns and predict what
16:37
that user might want to do next. Ultimately, you need to tie that
16:42
back to an identity. A lot of that marketing data
16:44
also is not an identity data like you're buying patterns, I
16:49
don't think are part of your identity.
16:52
I think the identity like ties back to who you are.
16:55
But we can't just have an open an open book to say everything
17:00
is identity. You know, you're buying
17:01
patterns. All of your privacy and context
17:04
information like those need to be stored in separate systems
17:08
and the identity needs to tie all those things together.
17:12
What are your thoughts I. Mean yeah, yes to everything.
17:18
I feel like we're talking kind of the same language.
17:20
We definitely started with this idea of, you know, identity is
17:23
the new perimeter. OK well that was like five years
17:25
ago at least, so it can't really be called the new perimeter
17:28
anymore. I would say identity is the
17:30
current perimeter. So people need to update their,
17:33
you know, their vernacular around that.
17:35
But yeah, I mean, I hate to say it, but, you know, it also
17:40
depends on the new organization too.
17:41
Like, what is what does center mean for them?
17:43
Because center could be, yeah, we have a centralized team
17:47
that's doing that versus we're a very decentralized organization
17:50
that doesn't have a central team do that.
17:52
So I like everything you said. I feel like it echoes a lot of
17:56
stuff that I said, so good answer.
17:59
I've got a couple more. OK, I'm going to keep going if
18:01
I. Can.
18:02
All right. Yeah, you're very clearly
18:03
prepared. And very clearly prepared.
18:06
So first thing was really like the internal security concept of
18:10
like identities at the center of your security tooling and the
18:15
way you should approach securing your infrastructure.
18:20
The second thing is around building business models based
18:23
on identity. So you know, I was talking about
18:26
identity as kind of the the center point of connecting
18:30
accounts and connecting data that ties back to a person.
18:35
I also think on that same business channel that identity
18:39
is now creating new business models.
18:42
And so the first one that comes to mind is decentralized ID and
18:48
organizations wanting to become the the focal point for an
18:54
identity and basically have that identity information and look at
18:58
that as an asset and a way to differentiate themselves in the
19:04
market and get ahead of their competition.
19:07
But. When you say decentralized
19:09
identity, that leads me to believe like things like
19:13
blockchain based rate or things like that where there is no
19:17
center by design. It's a bunch of nodes that sync
19:21
up somehow to each other, but you're still working off of the
19:24
same platform or chain or whatever you want to call it.
19:29
So how does that work from a centralization standpoint?
19:32
So I'm not really thinking about the that technology per SE, but
19:36
I am thinking of even let's imagine a scenario where, you
19:42
know, say a credit card company becomes a decentralized identity
19:46
provider. And if you're to present that
19:51
identity, you need to come back to that center to validate that
19:59
that data is, you know, issued by them.
20:03
Right. Yeah, I mean.
20:05
So what, what's the difference between that scenario that you
20:09
described, right, where you have, let's say you've got a
20:11
bunch of decentralized platforms, right?
20:14
One's finance, one's medical, another might be education,
20:18
another might be government. It really looks, feels and
20:22
smells like to me, it's just another version of a social IDP,
20:27
right? We, we had this process like,
20:28
OK, well, I'll stop creating accounts and let's, you know,
20:30
use your Google account to log in or your Facebook account or
20:33
your LinkedIn account or XYZ. I feel like we're headed down
20:36
that same path again, where it's like, OK, use my, you know,
20:40
finance account chain to log into financing, use my
20:43
government account login to log into that chain, right?
20:46
Things like that. Does it?
20:48
Does it feel familiar at all? It totally does to me.
20:52
There's kind of like the stickiness of the identity.
20:55
I remember a bunch of years back when Facebook bought WhatsApp
21:01
and it was like the amount of money they paid for it was like
21:03
stunning, shocking everybody. And it wasn't, I don't think
21:07
because they were buying the technology, the ability to make
21:12
phone calls and video calls, right, that that technology
21:16
could have been had for a lot less money.
21:18
It was all the identities that they had.
21:21
And the more identities they could pull into the platform,
21:25
the more it became central to their business that they could
21:28
grow their business because basically their business is
21:32
putting advertisers in front of eyeballs.
21:36
I think the stickiness of the identity becomes central to a
21:40
lot of business models. You know, Federated identity is
21:45
a big driver that as well. So you know, if you're using
21:49
your Google account or your Microsoft account to log in
21:52
across multiple platforms, you know, that's that's feeding into
21:57
that business model. It's more people on that
21:59
platform. And that's why you can get so
22:01
many free services from different providers like
22:05
Microsoft, like Google paying for.
22:09
Yeah, it's not. If it's free, what do you
22:12
always? You're the product if it's free.
22:15
Exactly. So that was my my next angle.
22:19
You know that I think identities at the center of business for
22:23
certain businesses. The last thing I think you
22:26
touched on, which is it's becoming at the Center for
22:29
governments. So especially like government to
22:32
citizen communication, more and more delivery of those services
22:36
and management of those services is happening online.
22:41
If you're a like a county government, for example, you're
22:45
providing a number of services through different departments
22:51
within your within your government.
22:54
Now you don't want your citizens to have to have a different ID
22:57
for each one of those services, right?
22:59
You want to have one central ID and then all of those services,
23:05
they know their their web delivery to leverage that common
23:09
identity. So I think that's important.
23:11
And then also from the back end, now that you have that tie, even
23:16
though you might not have different identities in the in
23:21
the back end, you want to be able to pull that data and say,
23:24
what is John Q public doing with XY and ZA service?
23:29
Now I know there's privacy implications, all that, but
23:32
let's just put that aside for the moment.
23:34
You have the ability to now report across different
23:38
platforms all tied together with the identity.
23:41
Yeah, Well, I think the government side is definitely
23:44
it's coming along, doesn't move as quickly as I think people
23:47
hope, right? You everybody has like X number
23:49
of government accounts. I think at least in the US,
23:52
you've got login.gov. You also got things like ID dot
23:56
me, which are kind of at the top level from a government, a
24:00
federal government perspective. And then you've got your state
24:03
government. And then you might have, you
24:04
know, your local governments and wherever you're at, it'd be nice
24:08
to have, you know, a single account, like, you know, my
24:11
North Carolina ID or for you, my Georgia ID or something like
24:14
that. Why not just use login.gov at
24:16
that point? I mean, it's just, you know, you
24:19
have that probably already for your taxes anyway.
24:21
Right, others computing services, right and so, but I
24:25
think what you're seeing happening like we're going to be
24:28
at Identity Week America in just a couple weeks now, maybe a
24:33
month. And I was looking at the agenda
24:36
today. There are several sessions about
24:39
mobile driver's licenses. I think the state organizations
24:42
are communicating with one another, and there's central
24:48
organizations that are trying to drive the adoption of Sanders.
24:51
So even given the decentralized nature of our government, of the
24:57
Federated system, it's amazing to me to see how much progress
25:01
they've actually made. Yeah, I feel like mobile drivers
25:05
license sounds exciting. And then I were like, Oh yeah,
25:08
it's not in my state. And then I just forgot about it
25:09
because I can't take advantage of it.
25:11
Right. Well, it's one of those things
25:13
that it's probably like AI. It's kind of like an idea, an
25:16
idea and then all of a sudden it hits.
25:18
Yeah. So in 5-10 years, whatever the
25:21
cycle is where OK, now more people are using.
25:24
It's kind of like the REAL ID switch here in the US where
25:27
everybody had to go and get your driver's license if they want to
25:29
fly basically. And I think the cut off is, is
25:33
it over already or is it in the next couple months?
25:34
I don't know. They've shifted a bunch of times
25:36
because it's taken a long time to roll out.
25:39
I never worried about it too much because it didn't affect me
25:41
because I was on one for for a long time.
25:44
Yeah, I've had mine for a while too.
25:46
Just for how much as as you know, I fly.
25:49
Wanted to get that taken care of right away.
25:50
Yeah, exactly. But if can you use a mobile
25:53
driver's license at at TSA checkpoint or do you still have
25:56
to have the the physical card with you?
26:00
I don't know, I. Don't know.
26:01
I have to look that up. Yeah, I have to have to research
26:04
that one. But there's a use case where
26:06
it's like if if I still need it to fly the the value is
26:10
extremely limited for me. Yeah, you'll be happy.
26:15
How when you get pulled over? I rarely I I can't remember the
26:19
last time I was pulled over. I probably was like a teenager.
26:22
Yeah, you know, I got pulled over maybe 10 years ago 'cause I
26:26
rode right near my house. And the weird thing was the
26:30
police officer asked me like, why were you speeding?
26:34
And I said, well, I've been having problems with my
26:36
transmission wasn't shifting And, and this is a true story,
26:41
Like, so I was like stepping on the gas to see what the the
26:45
shifting points were. Yeah, yeah.
26:49
Doesn't sound very likely. They went back and roomed me a
26:52
ticket. I was like, great, that's fine.
26:54
Do that out on a country Rd. somewhere versus I.
26:56
Guess so. Or something, I don't know.
26:59
I was doing it where it was happening.
27:01
So, OK. So that is all I have for that
27:05
question, Jeff. I hope we, I hope we addressed
27:08
it right. I don't know if I mean, maybe I
27:11
feel like he gave us an out with understanding that looks
27:14
different from different consultant perspective.
27:15
But I guess from an education standpoint, I still think trying
27:20
to centralized as much of that data identity data to do stuff
27:26
with provisioning, deprovisioning, you know, single
27:29
sign on adaptive MFA, right, all the bells and whistles.
27:32
I think as much as that as you can pull into the middle
27:35
somewhere, again, doesn't have to be 1 system.
27:37
It's maybe it's a collection of IM systems that are doing this.
27:41
I think that maybe helps articulate it to some degree
27:45
because once you've got it there, then you know you can do
27:49
whatever you want with it. Let's go off and provision those
27:51
accounts. Let's make things that are
27:52
self-service. Let's run into analytics and
27:54
behavior analysis, right? And all kinds of stuff like
27:57
that. Let's let's adopt A single sign
27:59
on and provide options where you can switch your, you know, your,
28:03
your contacts based on whatever your role is at the time.
28:06
OK, I'm logging in as a teacher or faculty.
28:08
I'm logging in as a student. I'm logging in as a parent,
28:10
right? Whatever that looks like.
28:12
I think you're in a better position for success if you can
28:15
centralized as much of that data as possible.
28:20
The the higher Ed space is very difficult, even if things kind
28:25
of just operated like, all right, there's these various
28:28
personas and you know, we cut the politics.
28:33
You just said we got these various personas and we have to
28:36
make them work. That would be hard enough.
28:39
But layer on top of it, Someone at a higher Ed client once told
28:43
me he's like, what gets confused in the university system is
28:48
people confuse academic freedom for administrative freedom.
28:53
And so you had people who were responsible for managing IT
28:57
systems saying we have to have our own directory, we can't
29:01
leverage common directory. I've worked with some higher Ed
29:05
clients who put the kibosh on that and insisted that they do
29:11
centralized certain things and they've been decades ahead in
29:16
terms of their approach. I've seen other clients where
29:20
it's like they nobody ever put the kibosh and they're still
29:24
dealing with those issues where it's like it's hard to do
29:27
anything from a centralized perspective.
29:29
It's hard to do a centralized e-mail, e-mail domain even, or
29:33
an Active Directory because there's so much administrative
29:38
freedom that is allotted to the the colleges that they're just
29:43
going off and doing their own thing.
29:46
I mean, it's true for you. They allow any organization
29:48
where you allow splitting of IM functionality and resources and
29:55
you know, different services. You're going to run into that
29:57
issue at some point. So we had another question.
30:01
We have time for another question.
30:03
Yeah, let's roll. All right, So this question was
30:06
from our listener, Scott. Jim, it might be interesting to
30:09
have a discussion on the Identity at the Center podcast
30:13
about how you confirm identity when you have a user on the
30:16
phone. We have historically used the
30:19
last four of a person's SSN, but with all the recent releases of
30:24
SSN data, we're no longer sure that's secure.
30:28
A secure method to confirm identity.
30:31
I think this is such a good question that highlights
30:34
something that I find in almost every client that I work with is
30:38
weakness in how do you authenticate callers to the help
30:41
desk? Jim, is that you?
30:43
Yep. OK, here's your password.
30:46
Yeah, that's basically what a lot of organizations do.
30:48
I mean, it sounds silly, but it's basically the same thing.
30:52
You're asking for public pieces of information that are already
30:54
out there, whether it's an SSN or tell me who your manager is
30:58
that I can find out on LinkedIn, right?
30:59
All kinds of stuff like that. It's a good question because I
31:03
think it highlights scenario that is maybe not addressed very
31:07
well either by the identity market.
31:08
I can think of one or two products maybe that kind of fit
31:12
in this space. And I think this is AI think
31:17
this is a real challenge for a lot of organizations because
31:19
they do fall back on SSN or they fall back on, well, what's your
31:24
phone extension, right? Little pieces of information
31:26
that are really not, you know, easy or not difficult to to try
31:30
and find. Yeah, I know that's you painted
31:34
the example perfectly, so I again wrote down a bunch of
31:39
notes. I wanted to give these questions
31:42
a fair shake, so I went out to the ID Pro, Body of Knowledge,
31:47
and by the way, plug for ID Pro Fantastic organization, very
31:53
reasonable fee to join and the Slack channel is worth the
31:58
money. Just seeing the conversation or
32:00
being able to drop your questions on that Slack channel
32:04
and get responses, Fantastic. The Body of Knowledge is also
32:09
very, very good. And so Dean Sacks.
32:13
I hope I get that. Yep, that's Dean.
32:15
We're going to have Dean on the show, by the way, because he
32:18
we'll, we'll, we'll segue at identifercy had a talk about
32:21
what happens to identities after people pass on And we got we
32:26
have to like talk about that. It's not it's not a subject to
32:29
talk about, but you know what happens that scenario.
32:31
So I know that we got to get him on.
32:33
So Dean, if you're listening, we haven't forgotten.
32:35
We're going to get you on. Oh, go ahead, Dean.
32:37
Reach out because I'm giving you major props here.
32:40
So I read your body of knowledge article on account recovery and
32:46
you had a statement in there that went something like the
32:49
account recovery process needs to be stronger than that which
32:54
is is recovering. So in other words, if you're
32:57
trying to recover a password said stronger than a password,
33:00
if you're trying to recover a second factor, it's got to be
33:04
stronger than a second, the second factor that you're trying
33:08
to recover. So I thought that was pretty
33:11
genius and I found that kind of like after I wrote some of these
33:14
notes. So hopefully I don't, I don't,
33:19
you know, negate anything that I just said, but I thought that
33:22
was great. I'd get out there for everybody
33:25
and and read that articles in like version three or something.
33:29
Which is great because I was going to point that out.
33:31
It's it's the account recovery V3.
33:34
If you go to idpro.org click the link for body of knowledge.
33:37
You'll see one of the articles there is Account Recovery V3,
33:41
which is great because a lot of times people write articles and
33:44
they just let it sit and then the information comes out of
33:46
date. So kudos for for updating.
33:49
Yeah, and I'll put a link in our show notes too.
33:51
Yeah, put a link that would be great.
33:53
So, OK, so common faulty practice I think is what Jeff
34:00
just said any kind of KBA. So what's your what's your
34:05
mother's middle name? Or what's your favorite?
34:09
Podcast, of course, everyone's going to put a day in the center
34:11
of. Course it's like what what color
34:13
is grass? You know, got to get that right.
34:16
So then I came up with kind of good practices.
34:21
So First things first is like, I think you the best starting
34:26
point is to minimize the number of calls that people are going
34:30
to have to make and have to identify themselves in the 1st
34:34
place. So this whole space is around
34:37
identity verification. If you're getting hundreds of
34:40
calls, it's going to overwhelm your help desk and they're going
34:43
to be more under the gun to close tickets, etcetera.
34:49
So human, humans will human. So if you can use self-service
34:54
password reset, for example, you're going to cut those calls,
34:56
you're going to have fewer people calling into the help
34:59
desk in the first place. I think the next thing is kind
35:04
of like around this subject is training to help desk to the
35:08
extent you that you can on social engineering.
35:11
So social engineering was behind and I hate like naming breaches
35:18
or companies that I have preached but MGM and there was a
35:21
big YouTube. We'll swap out any any company
35:26
name. Chances are that they the reason
35:28
they got breached was probably through social engineering.
35:31
Yeah, social engineering, it's like it's not just your one off
35:35
teenager hacker. There's whole organization built
35:38
around this and they're experts of socially social engineering.
35:42
So train your help desk on what to look out for.
35:46
If you don't know then get on AI and start asking it like
35:50
questions so that you can train your help desk and hopefully
35:54
they they recognize as the same as phishing right?
35:57
For e-mail you get all these like phishing emails where you
36:01
get pretty good at spotting them after a while.
36:03
But that's getting harder now with AI writing these a lot
36:06
better and people putting more information around out there.
36:09
It's becoming difficult to spot. You used to be able to say, OK,
36:12
well, this is clearly, you know, doesn't make sense from whatever
36:15
language you're you're, you know, fluent in.
36:17
This doesn't make sense now. It's almost indistinguishable.
36:20
So I don't think you can count on that anymore.
36:22
But you're absolutely right, like what to look for, you know,
36:26
I, I would also say call your help desk and test them.
36:30
Do a little bit of pen testing on your own right and see and
36:32
see what you can get away with and start to realize you know
36:34
where where some of the issues might be and where you want to
36:37
focus training right or or other processes to help with that too.
36:41
Yeah, some of these things I'm going to mention or like short
36:45
term things you can do like call the person back on the known
36:48
number, use caller ID. Hopefully you know you're not
36:52
getting spoofed on the caller ID, which is something that a
36:57
advanced hacker would probably be probably have in place.
37:02
Third party verification tools like Experian, I think is one
37:06
where you can start asking questions like, you know, which
37:11
of the following cars did you ever own?
37:15
Those ones are, you know, you're not going to ask everybody those
37:18
ones. But if you start to get somebody
37:19
who you know can't answer some of the basic questions, but just
37:23
really needs to be unlocked. This is actually one thing that
37:28
this triggered for me was there's a difference.
37:32
If somebody is calling and they want they need to identify
37:35
themselves to change the password to kind of a low risk
37:39
thing versus if it's somebody who needs access to an employee
37:45
account for example, that's going to put them into the
37:48
trusted network and let them start data breach, so.
37:52
Yeah, let alone admin accounts, right?
37:54
If I'm an ACT to admin calling in for a password reset, that
37:57
should immediately set off a different process to to verify
38:01
that person. Right.
38:03
But your help this has to identify these are you know kind
38:06
of a level one type of account or whatever.
38:12
And everybody's going to assign their own risk to the some of
38:15
these things. But I guess what I'm saying is
38:17
not all these processes are appropriate for all levels of
38:21
unlock. I think things that are in here
38:23
until I got to that last one are things that potentially you
38:26
could employ regardless. Now best practices, I think for
38:32
identity verification are some biometric based system.
38:36
So starting to think about like that selfie thing where you, you
38:41
hold up your ID like your, your driver's license or a passport
38:46
and you do a, a live selfie test.
38:50
Those things, if you can get those in place, like long term,
38:53
that's going to put you in a much better position to do
38:56
unlocks. But it's relatively advanced and
38:59
kind of expensive for what it does, especially when you try to
39:03
think about different identity assurance levels. 123, whatever
39:06
it might look like, yes, it's the best.
39:08
Is it realistic though? For a lot of companies, probably
39:12
not. Maybe finance, maybe.
39:14
I could definitely see the medical, but medical typically
39:17
or health generally don't have as much money to spend on stuff
39:19
like that until there's a problem.
39:21
Government for sure. I mean, they're, they're kind of
39:24
doing that now for a lot of stuff.
39:26
Yeah. So, so dialing back to good, I
39:28
think even multi factor authentication, being able to
39:32
send a code to somebody. Look, I mean if you use you and
39:37
I fly Delta a lot, if you use their chat application within
39:40
their chat application, they require you to go out and re
39:44
authenticate. So anything like that?
39:46
Where chat works for you. Usually it's just me trying to
39:50
get help on a flight and the the in flight Wi-Fi stinks and so it
39:54
doesn't. Know where you go there you go.
39:57
So I, I think some of those solutions are certainly things
40:01
that you can get value from at a low cost, especially if you're
40:05
talking about a, a large customer base when you're
40:10
talking about employee access. I think one thing you said
40:13
there, it's unfortunate, it's like.
40:16
People aren't going to take this seriously until they get hacked.
40:19
Yeah, OK. Well, if that's the case, then
40:21
we might as well just shut up. Stop doing this podcast.
40:24
Let's get rid of let's that's it.
40:25
Identity is no longer at the center.
40:27
It's just a free for all and you know, have fun with all the
40:30
data. Yeah.
40:32
But I think the last point I'm going to make on the identity
40:34
verification stuff is you said, well, it's very expensive.
40:38
It, it might be too expensive for you, but I think it's worthy
40:42
of doing the research and going back and see if you can build
40:45
the business case, you know, certainly could reduce risk
40:48
profile. Yeah, maybe it makes sense for a
40:51
certain population too, right? Executives, admins.
40:55
This does not have to be a binary, all or nothing type of
40:58
approach. I think you need to figure out
41:00
where the risk is and how much you know money do you want to
41:03
apply to reduce that risk. Amen.
41:07
How do you feel about an sending an SMS to an employee?
41:12
Maybe they've already, Maybe you know what their cell number is
41:14
Is Hey, I'm going to text you a code to make sure it's you, I
41:20
think. That's.
41:21
Better than nothing, right? I mean, we know that we know the
41:23
issues with SMS, right? Not the strongest, but better
41:26
than an SSNI would say, right? It's definitely better than KBA
41:30
because it requires that you either somehow hijack the the
41:35
SMS routing or that you have the person's phone, which is a very
41:40
real scenario. I'm sure there's also
41:44
applications you can use to log into the person's account to
41:48
intercept their SMSS if you know there there's cell phone
41:52
credentials. They're using WhatsApp.
41:54
If you're using WhatsApp. Or Facebook account.
41:56
Yeah, yeah. So, but I think if you combine
41:59
it maybe with some other options, so maybe it's just as
42:02
simple as hey, let's we're going to send you a, a text message
42:05
and ask you a couple of questions that kind of validate
42:09
it better than nothing and probably better than what most
42:14
companies I would argue are probably doing today.
42:16
Yeah. I think that if you came up with
42:18
a framework that includes a few of these different things like
42:22
questions, the KBA, some kind of hardware verification, and then
42:28
a framework for like certain accounts, you got to be 10 for
42:32
10 before we're going to unlock you other accounts, you know,
42:37
maybe if you get 9 out of the hand, if you say, I don't have
42:40
my cell, I lost my cell phone, I don't have access to my e-mail.
42:45
You know, it's very real scenarios where that actually
42:48
could happen. And I think you have to look at
42:51
the risk associated with somebody says, I need all that
42:55
and you have their account flagged in your database that
42:57
they're an administrator. It's like, I'm sorry, you're
43:01
going to have to call your your boss and get him to do something
43:05
or. Her how do you feel about that
43:07
having, you know the person's manager get involved in the
43:10
password reset. I think for standard resets is
43:14
it's not a great idea, but I think when you're talking about
43:19
like an administrator account. I'm thinking like scenarios
43:22
where like a lot of companies will maybe have their process
43:25
where, you know, they, they, they recognize maybe that they
43:28
don't have a good way to validate the caller.
43:31
And so they say, I need you to, you know, call your manager or
43:36
we've sent it to, we've sent you the new password to your
43:39
manager, call them for the password or something like that,
43:42
right? Some sort of secondary step that
43:44
kind of goes through the process.
43:46
Right. I mean, I can see that scenario
43:51
getting socially engineered. Anything can be social
43:55
engineered but. Yeah, it's better than just
43:57
asking a Social Security number and then just send you over the
44:00
password, so. Stop using SSN, it's not secret
44:03
anymore and it's not secure. And don't use employee number
44:06
either. Like I see a lot of
44:07
organizations like, oh, employee number and then they print it on
44:10
their badge. Like, OK, well that's not secret
44:11
anymore either. Right.
44:14
Yeah. I mean, I think that, you know,
44:17
the primary factor is the risk that you are being socially
44:20
engineered. And I think there's certain
44:23
accounts and there's quite a few accounts within the organization
44:26
that just can't afford that have that happen and inconveniencing
44:32
somebody is a big deal. But let's say the scenario is
44:36
somebody called you and they said I work for IBM and I need
44:42
to, I'm not picking on IBM. I just just the first thing that
44:45
came to mind and I manage your servers and I need to unlock
44:51
this person's account or I need to unlock my account because I
44:53
can't fix this production system that's down right now.
44:58
And then they can answer like some basic information about
45:02
themselves and who they report to and things like that.
45:05
All things that maybe they got off of the company's Yammer site
45:09
or something like that. Now the person potentially could
45:13
be socially engineered into unlocking that account.
45:15
In other words, there's production system down, and if I
45:19
don't get this thing fixed, I'm going to be fired.
45:21
Yeah. Well, what are the odds of,
45:24
Well, I don't say odds, but I mean, that's how attacks work in
45:27
the real world as they move up and over and laterally until
45:29
they find it. They could have breached a
45:31
regular person's account. They had access to the Yammer.
45:33
They had access to the corporate directory.
45:35
They've done, you know, enough Recon to find the information
45:39
who they want to target and get information around it.
45:41
And that's how it works. And so they work up and over
45:43
right until they get to what they want.
45:46
Right. OK, so do we ask?
45:49
A question imagine this to even have the person password and
45:52
what they're asking you to do is reset the the MFAI just got a
45:57
new iPhone today. Yeah.
46:00
And they want to re re enroll the device or whatever it may
46:03
be, I don't know. There's there's a lot of ways.
46:04
To do that, hopefully that adds some color.
46:07
I don't think there's a black and white answer.
46:08
It depends on your situation, and it's about hardening the
46:14
process to the appropriate level.
46:16
But I think we can agree that SSN is no longer.
46:19
It hasn't been for a long time, but if you're using knowledge
46:23
based authentication and especially knowledge that is
46:27
leaked or easily obtained, right?
46:30
Whether it's an SSN that's part of a massive leak or something
46:33
that I can go on LinkedIn and do a little Recon and say, OK,
46:35
well, now I know who that person's manager is, right?
46:37
Or things like that. It's to move away from stuff
46:40
like that and maybe shift to looking at different risk based
46:43
models based on the type of user or who's calling in, right?
46:47
Or or some of those different kind of options.
46:50
Right. But not SSN.
46:52
Don't use this. I'm going to draw a line right
46:54
there in the sand. Agreed.
46:57
All right. Well, thanks to Scott for that
46:59
awesome question. Yeah, that was a good question.
47:01
And to our anonymous listener, and hopefully we help them out
47:05
with the Identity center. If not, let us know, send us
47:08
another e-mail. We'll we'll take another crack
47:09
at it or we'll hop on a phone and just talk about it.
47:12
We could do that too. And Jeff, I'm just sitting here
47:15
thinking like anonymous e-mail kind of sounds like we made it
47:19
up. I swear we did not make.
47:21
No, they asked for, they asked to be anonymous.
47:23
And you know, we're we're identity and access management
47:26
professional. So of course we're going to,
47:27
we're going to honor that. Of course, if they feel like
47:30
sharing, they can post on LinkedIn after they hear this
47:33
and they can do their own thing. How about that?
47:35
That sounds good. OK, we should have a lighter
47:39
note. We should end this thing on a
47:41
lighter note since we do that every every week.
47:43
What do you think? Yeah, so episode 300, this is
47:47
it. What does episode 500 look like?
47:51
What are we talking about? 200 episodes from now, which is
47:56
probably, let's call somewhere between three and four years
48:01
from now. So when you say we, do you mean
48:06
me and you or AI? Or AI counterparts.
48:11
Yeah, whatever. Episode 500 of the Identity
48:15
Center Podcast. Sounds like blank will be the
48:19
topic that we're addressing, the main topic.
48:23
I mean, we talked about the the whole thing with mobile driver's
48:26
licenses and I think that's going to be very much our
48:31
reality. And we'll probably be having
48:34
discussions about whether or not they should be used by more
48:39
things, if we should be using mobile driver's licenses as kind
48:43
of like a Federated identity capability to authenticate to
48:48
more things. So I do think that's a real one.
48:51
And I think AI, it's like, what are all the possibilities that
48:54
AI can bring to the things we do today?
48:59
I don't think that it's AI is going to be at the point where
49:03
it's managing large pools of identity implementations.
49:07
But I do think that some of the like what we discussed with
49:10
Merrill, where you can go into your system and just use human
49:16
language models, human language to say what you want it to do.
49:20
And we're starting to see the fruition of that come come
49:23
forth. What do you think?
49:26
I hate to say it, but we're probably going to talk about the
49:28
same stupid things. People aren't using MFA or what
49:32
are the basics theories of the time.
49:34
How do I sell I am to my organization?
49:36
People just haven't gotten buy in yet.
49:38
Or maybe they sold it once and they need funding again to catch
49:42
up because they didn't sustain the investment to stay current.
49:46
I hate to say it, but I have a feeling we'll be talking about
49:49
still talking about stuff like that.
49:51
But AI for sure, I think. I don't think it's going away.
49:55
Trying to think what else? Episode 500.
49:58
I mean, three to four years from now, hadn't we been like three
50:01
to four years away from like blockchain identity?
50:04
Now you're like, is is this the next three to four years of sure
50:08
it's coming along, right? Or the end of the password?
50:10
Will we still be talking about the death of the password at
50:12
that point? I think so.
50:13
Yeah. Yeah, I do.
50:15
Yeah, I, I, I, I and I don't mean it to be pessimistic,
50:19
right. These are these are
50:21
conversations that take place in every organization is, you know,
50:25
yeah, we continue to have to sell the value of identity and
50:27
access management. And how do we do that?
50:30
Because there's always going to be competition for dollars and
50:33
resources to get things done. And no organization is
50:37
unlimited. Well, maybe a couple, but there
50:39
are the exceptions. So there's always going to be
50:42
that conversation of, okay, well, what's new?
50:44
How are we staying current or ahead of the curve, right?
50:49
What are the new threats that are talking about?
50:50
AI, I'm sure is going to introduce things we haven't
50:52
thought about. I'm sure somebody's going to get
50:54
creative and quantum is going to become a thing we're going to be
50:57
talking about. Well, how do we make sure that
50:59
quantum is not wrecking all of our our security algorithms,
51:04
right? Things like that.
51:05
So there will be things, but fundamentally, we're still going
51:08
to be talking about the same thing.
51:10
Do the right people have the right access to the right thing
51:13
at the right time? And is that access appropriate?
51:18
There we go. That's good.
51:20
That's good. Hey, I just thought of something
51:22
else. We never mentioned that we got
51:25
accepted to play a part to present A use case at the
51:30
Gartner IM Summit in December. Of this year.
51:33
It's been a couple weeks, man. It has been, man.
51:36
It's like you can barely keep up with the good things happening.
51:40
But on that front, I'm working the angle to try to get us a
51:45
discount code. And of course, we won't have a
51:47
discount code unless it's the best one.
51:50
So keep your ears on the podcast.
51:54
Hopefully we'll have a discount code for the Gartner I Am Summit
51:57
here coming up. Yeah, that's going to be
51:59
exciting. I think we had such a good time
52:00
at the last one doing the on stage sort of, I sort of us a
52:05
mini identity at the center with Becky and Henrique on stage.
52:09
And we may try to do something similar to that again.
52:11
But yeah, it's it's an honor to be nominated and looking forward
52:17
to doing whatever it is we're going to do there.
52:19
Yeah, and shout out to Becky because she really shepherded us
52:23
through the process here. So very grateful for that.
52:28
Becky's good. I am people about that.
52:30
That's a good, good point. All right, let's see.
52:34
Anything else? I know we're gonna be at a bunch
52:35
of conferences. I'll just put all of our
52:37
discount codes in the show notes.
52:39
It's also on our homepage at idcpodcast.com, so I try to keep
52:42
that updated. Now, if you just Scroll down
52:43
just a little bit, you'll see the different discount codes for
52:46
Identity Week, authenticate conference, the Sempress
52:50
conference, hip conf, basically. And then if we end up with
52:54
something for Gartner, it'll be there too.
52:55
But we'll have all that in our, in our show notes.
52:57
And hopefully people come out and either, you know, say hello
53:01
or support us. Use the codes is the best way to
53:02
to support show show that we can, you know, bring bring a
53:05
party to these types of things and have some fun at these
53:07
conferences. Heck yeah.
53:09
Yep, all right. IDC podcast.com at IDC Podcast
53:14
on X or whatever it's called at this point, idcpodcast.tv.
53:19
Please give us a like and subscribe.
53:21
We are trying to grow that Channel as much as we can.
53:24
And if you haven't, if you're listening to this while you're
53:27
walking around, which I know some people do, just just click
53:31
over to the YouTube real quick and just hit like and subscribe
53:34
means a lot for us. Let's see what else.
53:37
And yeah, connect with us on LinkedIn, you know, definitely
53:40
get questions like we got today and we'll keep bringing it and
53:45
hopefully you guys keep listening.
53:46
So with that, we'll leave it there for this week.
53:48
Thanks everyone for watching or listening and we'll talk with
53:51
you all in the next one. You've been listening to
53:55
Identity at the Center. We hope you've enjoyed the show.
53:59
Make sure to like, rate and review, and we'll be back soon.
54:04
But in the meantime, hit the website at
54:06
identity@thecenter.com. See you next time on Identity at
54:12
the Center.