Latest / Identity at the Center / #376 - Understanding Device Identity in a Zero Trust Framework with Shea McGrew

Transcript

#376 - Understanding Device Identity in a Zero Trust Framework with Shea McGrew · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:17
I've been working on an article and I decided to basically take
0:23
the article and kind of wrap it around the name of this podcast,
0:26
Identity at the Center. I'm trying to explain the
0:31
concept of identity at the center.
0:33
I think everyone says identity is at the center of
0:36
cybersecurity. There's a couple of like catch
0:38
phrases that go with that, like hackers login.
0:41
They don't break in the whole idea that, you know, we're
0:46
moving towards zero trust. People who have kind of come in
0:49
and are on the network can't be trusted.
0:51
So it's, you know, deny, never trust kind of approach.
0:57
And I think this episode, what we're going to talk today about
1:01
is that it's not just identity in terms of kind of the
1:06
classical thought of a person or even a machine logging in, but
1:10
it's also the device, you know, identifying that device can be
1:14
part of kind of the overall representation of an identity
1:19
and whether or not they should be able to access system or
1:23
data. Yeah.
1:25
I guess this is sort of like where machine identity, server
1:29
machine, you know, non human identity, like all that stuff is
1:31
coming through. Everything has an identity at
1:33
this point. And I know you and I have
1:35
disagreed in the past over the definition of identity.
1:39
Can a non human have an identity?
1:42
I argue yes, you argue no. Do we want to rehash that
1:46
disagreement right now real quick, just so we understand
1:49
each other's positions or have you have you come to my side?
1:52
The good side? It's.
1:53
Also my side I. Don't know that I've come.
1:54
To your side. So Shay's with me on this.
1:56
Let me go ahead and introduce her while So, you know, you're
1:59
like this. This strange voice came out of
2:01
nowhere. Yeah, we've got Shay Mcgrew
2:03
today. She's the CTO for Maricopa
2:05
County in the Grand Canyon state of Arizona here in the United
2:08
States. So thank you for chiming in,
2:10
Shay. It sounds like we got two on one
2:12
today against Jim. Go ahead, Trey.
2:15
Yeah. Oh, hey, I I thought you had to,
2:16
you know, convince us of otherwise.
2:21
Yeah, make your case. Yeah, my case has always been
2:25
that devices have accounts. They don't have identities.
2:29
Identities are reserved for people or representations of
2:34
people. When I say representation of
2:36
people, I think that an AI could be a representation of a person,
2:41
but I've always felt that the proper term for devices and
2:46
machines was accounts. How do you define identity?
2:51
What do you have to have to have an identity?
2:54
I think you have to have the ability to own something.
2:58
I think you have to have the ability to, you know?
3:04
Something like a house or own something to prove your
3:07
identity. So you just have the ability to
3:09
own devices, for example. I totally wasn't prepared for
3:13
this this debate. This is the best.
3:15
And I'm like searching for my answer.
3:18
I haven't thought about it in a little while, but I kind of
3:21
think of the representation of devices as the account they
3:26
authenticate as. So I I flipped the question back
3:29
to you, which is what is an account?
3:32
Yeah, good point. I mean, I think we'll get into
3:35
it a little bit today as we discuss device identity and why
3:38
it's important and how we're how we're actually defining device
3:42
identity perhaps you know here at the county as well as I'm
3:46
sure other folks are as well. But I think we are headed into a
3:50
space where hardware is getting more and more uniquely
3:56
identifiable for that reason. So.
4:00
I feel I feel like we have so much to crown to cover here.
4:03
We didn't even get to like do a proper like origin story for
4:06
you. We immediately jumped into, you
4:08
know, dogtile on Jim. Jim, you're wrong.
4:10
They're, you know, non humans can of identities, machines can
4:13
of identities. But let's start from the very
4:14
beginning. So Shay, first time you've been
4:16
with us here on the show. So I know you've listened to the
4:20
past. So thank you very much for for
4:21
being a listener. Now you're here on the hot
4:24
seats. There's no spicy wings or
4:26
anything like that, but you may be some spicy machine identity
4:29
conversation. Let's start with your
4:31
background. So I mentioned that you're the
4:33
CTO for Maricopa County in Arizona.
4:36
So tell me a little about your role.
4:38
How did you get to that spot and sort of what led you on your
4:40
journey to there? And do you consider yourself an
4:43
identity person, a technology person, a security person?
4:47
Yes to all three. Like give me your background.
4:50
Yeah, I would, I would definitely say yes to all three
4:54
to place a systems thinker who likes to dabble across all of
4:59
the technologies, understand how they best fit together, how they
5:02
support each other, where the dependencies are, where the
5:05
opportunities are. And that's kind of what started
5:09
my journey in IT was just getting into and understanding
5:15
systems, how we use them, how we use them for business, how we
5:17
use them for personal use. And really my IT journey started
5:23
around the time that Sarbanes-Oxley started hitting
5:27
IT, well, hitting organizations, right, to include IT shops and
5:32
so, you know, freshly minted helpdesk administrator working
5:37
with some seasoned system engineers, systems
5:41
administrators, and of course, Sarbanes-Oxley kind of turned
5:45
identity into a compliance later layer rather than like an IT
5:49
operations component. It became a core platform for
5:55
organizations to be able to prove that they were secure,
5:58
that they were compliant. And of course, during that time,
6:02
a lot of organizations scrambled to rethink their IDP, reorganize
6:06
Active Directory. And the beautiful PowerShell was
6:11
was not quite yet out when Sarbanes-Oxley hit.
6:15
So we're talking like VB scripting.
6:18
And I worked with a wonderful senior systems engineer who
6:24
could just manipulate Active Directory to her whims.
6:28
And of course, we have all of these audit findings from
6:32
Sarbanes-Oxley. She looks at it, I look at it,
6:35
I'm like, that's like hours of work.
6:37
She's like, now this will take me 5 minutes.
6:39
I'm like, what? And so that really sparked that
6:43
love for initially Active Directory and then of course,
6:47
following that, the identity path through my engineering and
6:53
architecture journey to where we are now.
6:56
And I can say that I'm not completely surprised that
6:59
identity is now at the center once again for the way that we
7:04
we manage, operate and secure our resources.
7:09
So yeah, I, I came up through the ranks.
7:11
I came up on the infrastructure engineering side, got into
7:14
architecture and then with the county, got into the CTO role.
7:19
And now again, I get to dabble across multiple domains, which
7:22
is always fun. It's like a giant puzzle putting
7:26
everything together. So I love the story.
7:29
So I, I knew I liked you right away because I also kind of got
7:32
started in IT in the help desk. So amazing career journey to go
7:35
from like help desk analyst to CTO, right?
7:38
I think there's that's very aspirational for a lot of people
7:41
have. So one thing that I've never
7:43
forgotten, though, is my roots. Going back to the help desk is
7:45
like, OK, yeah, yet another call for printer support at 3:00 AM.
7:50
Printers were my nemesis. I still hate printers.
7:53
I won't. I won't do it.
7:54
Yeah. Have you tried turning it off
7:55
and on, Right. That's probably the number one
7:56
troubleshooting, you know, the things out there.
7:58
What is something that you took from your, you know, help center
8:02
days, help desk days that you've kept with you throughout this
8:06
entire journey and you keep with you today as ACTO?
8:10
It's a great question. Certainly customer service and a
8:16
sense of I'll call it extreme ownership looking or getting an
8:22
issue in at the help desk and then being able to track its
8:26
path all the way to resolution even if it's way outside of your
8:30
realm, right. And I think that's really what
8:33
helps accelerate my career to CTO is ensuring that I was, I
8:40
was leading with curiosity and understanding why is this an
8:43
issue for the user and identifying those stomach
8:47
problems, right? If I got 5 calls from a user as
8:50
I was sitting on the help desk for a very similar issue, you
8:54
don't just solve them and then, you know, hang up the phone and
8:58
wait for the next call. You start to ask why, why is
9:01
this happening? And so that's probably one of
9:03
the biggest things I took away from help desk 'cause you're at
9:05
the front lines there, right? You get to see really they're
9:10
kind of like the bridge, the first bridge for from a business
9:13
and technology perspective. You get to understand how
9:16
technology is impacting that end user and how you have to change
9:20
technology to influence or change their experience.
9:24
And truly, that's at the roots of being a CTO as well.
9:29
What do you find as the hardest and best parts of being a CTO?
9:38
Well, the, the best parts again are definitely seeing that
9:43
bridge between business and technology.
9:45
So I also have a little bit of a business background MBA with an
9:49
emphasis in enterprise information systems.
9:52
And I went down that path for that reason, right?
9:55
Because I do think that we're starting to see a change where
10:02
IT is not this backroom kind of somewhat enabling supporting
10:07
technology. It is starting to become a
10:10
leader and perhaps enabler, a bigger enabler of business
10:16
strategy. And so one of the most enjoyable
10:20
parts for me as a CTO is being able to draw those connections
10:23
for business leaders and how they can take advantage of
10:27
technology and to really show them that the technology,
10:31
especially the technology that we have, the capabilities that
10:34
we are building within our organization, you know, can
10:38
speed up, you know, a Business School that they thought would
10:42
take 10 years, we could do it in maybe 5, maybe 1.
10:48
So best part is just again, applying technology and and
10:52
being able to put together the right pieces to enable business.
10:57
It also becomes one of the hardest parts of course, is
11:02
getting into the conversations with the business and being able
11:06
to articulate technical concepts in a way that makes the business
11:12
excited, makes them want to adopt and partner with IT.
11:18
And so, yeah, as a, as a CTO, especially as a CTO in local
11:22
government, all of the business different, the different
11:27
business lines that we have, you really have to structure those
11:31
conversations uniquely for, for every single one, right.
11:36
It's. You don't have a a standard way
11:38
to approach anything really. So where does identity fit into
11:44
your strategy at a CTO level? Obviously you're on, you know,
11:48
the Identity Center podcast. I was going to say at the
11:50
center, of course. OK.
11:52
So right answer, first of all, so congratulations.
11:54
But talk to me a little bit about, you know, realistically,
11:56
right? I get it.
11:57
There's so many different, you know, pieces of the puzzle that
12:00
have competing priorities for time, budget, resources, you
12:04
know, the political, you know, things that are happening within
12:08
any organization. How do you manage and balance?
12:12
Where does identity fit with all that?
12:14
Is it something that is part of like an information security
12:16
strategy? Do you carve it out separately?
12:18
Because I want to ask you some questions about how you know you
12:22
and, and really you know the county are going after the
12:24
program. Yeah, great question.
12:27
And here at the county, we did carve it out separately.
12:30
And so we have been running a specific identity and access
12:34
management program for a number of years.
12:37
And it did really start kind of, as I stated, with recognizing an
12:42
underlying problem that was occurring at the county.
12:45
And I think this occurs across many orgs, you know, local,
12:49
state, Gov, all of it everywhere.
12:52
And that was a kind of the, the decentralization of identity.
12:59
So we had, when I started at the county, you know, I had multiple
13:03
logins and I had to understand when and how to use those
13:08
logins. And of course, if you go back to
13:11
those help desk groups and you go talk to the help desk,
13:13
they're like, this is crazy. Like password resets are in the
13:17
two hundreds per day, right? And so truly being able to
13:22
recognize some of the, I'll call it operational, operational
13:28
problems within identity causing significant impacts not only to
13:33
IT operations, but also to the employee experience and then
13:38
starting to curate solutions to those problems.
13:41
And that's really where the roots of the identity and access
13:43
management program grew. So years ago we were able to
13:48
collapse our our domain infrastructure, our forest
13:52
infrastructure, I'll even say down to a significant less
13:58
number of domains that we had to manage across the county.
14:02
And we all came together and agreed that from an employee
14:05
experience perspective, trying to standardize on one identity
14:10
for an employee was our goal. And so those were kind of the
14:14
roots of our identity program. And over the last year here,
14:19
we've expanded and gotten a little bit more specific about
14:23
how we want to tackle that. So the program that we are we
14:30
are running right now is separated into 3 core identity
14:35
types and two kind of capability categories just to keep us in
14:39
line. Cause again, you know, there's
14:41
lots of problems to solve out there, lots of opportunities to
14:44
tackle. So we have to know which ones
14:46
come first and which ones are most valuable.
14:48
So our three core identity types that we're focused on are
14:52
internal, external and device identity.
14:56
And our 2 core kind of capability categories are
15:00
identity management, which includes the foundational pieces
15:04
like how, like what attributes are associated with what types
15:08
of identities? How do we manage those
15:11
attributes? Where is the identity originated
15:13
from? And then access management as
15:16
the second meaning how does that identity get access to the
15:20
network, get access to data, get access to other other assets
15:23
that it needs access to. So kind of a, a three by two
15:28
approach to how we tackle identity, kind of allowing our
15:32
teams to really focus in on where where they have subject
15:38
matter expertise, right. And the county still doesn't
15:41
have really a centralized identity team that focuses
15:45
across any identity type. We do have kind of the classic,
15:49
you have your system administrators, help desks that
15:52
work on internal user identity. You have kind of the developers
15:56
or the business who works with external identity and then
16:00
desktop support working a lot with like or system admins
16:03
working with the device identity.
16:06
And we can start to really focus and utilize those teams in the
16:09
in, in those areas in parallel. And the goal, of course, is to
16:15
see accelerated outcomes with that model.
16:18
So you just spit out a whole bunch there and I wonder, you
16:21
know, how do you get buy in and support to do this?
16:25
Because this is not an overnight shift where you can say, OK, I
16:29
snap my fingers and give me a bunch of money and it's done
16:32
right. There's no easy button.
16:33
It takes years, sometimes longer decades to to to have these
16:37
seismic shifts in the way you approach really any large IT
16:41
transformation. But identity typically has a lot
16:43
of moving departments. So I'd like to understand a
16:46
little bit about how you kind of explained everything that you
16:50
just said to somebody who is not a technology person or not an
16:53
identity person. Because I think the one thing
16:55
that a lot of people listening here today might be thinking is,
16:58
OK, that's great. I, I get it.
16:59
We know what we need to do. How do I communicate that to the
17:03
rest of my organization? Yeah.
17:06
And that is going to be probably somewhat unique depending on
17:09
your org. I will say at the beginning, I
17:13
had some great partners in HR of all places who helped us to
17:20
drive the single source of identity being an HR record for
17:24
the county. And then from there we were able
17:28
to, you know, explain why, why that was, why that was critical
17:32
to have a single source of identity.
17:34
I think. I think on that one, the
17:36
business could feel that pain. So that was an easier one to
17:39
explain. Like, hey, instead of, you know,
17:41
writing down all of your passwords and sticking them
17:43
under your keyboard for the 50 accounts that you have, we're
17:46
going to give you 1. And this is how we're going to
17:47
do it. As the program is progressing,
17:52
of course, the the cyberspace has has rapidly changed over the
17:56
last, you know, 5 to 10 years. As our assets became more
18:03
digitalized, especially our information assets, of course,
18:06
they became more targeted and the perimeter shifts and all of
18:11
this great stuff, right, which kind of provided routes for the
18:16
concept of zero trust and zero trust became kind of a buzzword,
18:21
right. So of course a core pillar of
18:24
zero trust is identity. So I did grab on to those coat
18:27
tails. And for that one, the
18:30
explanation from a business perspective that we're going
18:34
with is kind of like the airport analogy where, you know, you can
18:40
walk into an airport and not show anybody any identity.
18:43
You can wander around, you can have lunch, but if you want to
18:48
say go to a different terminal, there's going to be a security
18:52
checkpoint. They're going to make sure that
18:54
you are safe. They're going to make sure you
18:56
say who you are, who they say who you say you are.
19:01
And to do that, you have to, you know, show identity.
19:03
You have to walk through a metal detector.
19:06
And then even from there, if you want to get onto a plane,
19:10
essentially get access to the asset, right, You have to show
19:15
identity. Again, you have to show proof
19:17
that you should be there. So I, I like the airport analogy
19:23
because it really hits home with, Oh yeah, like, yeah, we
19:27
have to show our identity all the time.
19:29
This isn't, this isn't new. We're just going to put some
19:33
security checkpoints up around our, all of our buildings in a
19:36
digital fashion. And, you know, your device is
19:38
going to be screened through the metal detector to make sure that
19:42
it's harmless. And you will show your identity,
19:46
you know, in the form of a certificate essentially.
19:49
And then you get access. And in that space, of course,
19:54
the the the reduction in risk, especially for like cyberattacks
20:01
is a big driver for support in that space.
20:06
I love that airport analogy because I use the same one and
20:09
it's, it's really something I think that resonates with a lot
20:11
of people because most people have gone through some sort of
20:14
airline experience, right? Whether it's flying or taking
20:16
some of the airport, whatever it may be, you're showing your
20:18
ticket. You know, you're going through
20:20
maybe a security line, but you're not showing it just once.
20:24
You're showing your credentials, your identity throughout the
20:27
process. So for me, living in Asheville,
20:29
our airport is currently under construction.
20:31
So like half the terminal is a mess.
20:33
I have to show ID three times before I get onto the plane,
20:37
sometimes four, once at the security check for TSA, another
20:41
one when I board the plane. And then I go outside on the
20:44
tarmac and they usually, and this is one of those smaller
20:46
reports, we're actually on the tarmac where the plane is,
20:48
right? So you walk out there and then
20:50
there's another person who asked me for another piece of, you
20:53
know, information, seat number, name, right, things like that.
20:56
And then I walk across tarmac to the stairs that go up into the
21:00
plane and there's usually another person there just to
21:02
make sure that nobody got lost in the entire shuffle.
21:05
So it's like almost like, you know, this concept of continuous
21:07
identity access management, I think it's something that kind
21:09
of works the route. There was one thing that you
21:12
mentioned and you mentioned 0 trusts and you know, you kind
21:16
of, I think half jokingly, but maybe not really kind of
21:19
mentioned like, well, everything's zero trust now,
21:20
right? And it was like the security
21:21
buzzwords and those things come along.
21:23
How much do those buzzwords matter?
21:26
Like when you're having conversations with people who
21:28
aren't IT or security or identity, they hear zero trust,
21:33
like, oh, that sounds cool. Are we doing it?
21:35
Like, does does the marketing spin help at all?
21:37
And then you kind of have to like correct it or or maybe you
21:39
ride the coattails of it. Well, I'd say a little bit of
21:43
both. And so we've definitely had that
21:48
pendulum swing both ways, right, where, you know, again, it's a
21:53
buzzword and, and leaders will say, I want zero trust.
21:58
Can we do it next year? Well, probably not.
22:03
And there's others who will say, yeah, we, we follow the zero
22:06
trust framework, right? We've, yeah, we, we do all of
22:10
those things. And you say, well, what things
22:12
do you do? Well, people have to
22:13
authenticate, OK, not, not quite, not quite the the ZTA
22:19
framework there. So it does take a lot of
22:22
conversation, it does take a lot of storytelling.
22:25
And truth be told, I mean, we're, we're still working
22:28
through how do we best do that. We've luckily gotten a lot of
22:34
great support from the business from an IT perspective, from an
22:38
IT project perspective. But like that never, that never
22:43
ceases, right? We with every milestone we hit,
22:46
we have to be able to craft the story of what, what did we
22:50
accomplish. And one of the great things our
22:53
CIO has done is create a business value report where we
22:57
have a place to highlight the business impact of some of those
23:01
technology investments. Because again, again especially
23:05
I mean at least Americopa County are, are are are ROI
23:09
calculations, it's not formalized, right?
23:13
They're not strong. We don't, we don't often report
23:22
on the return on investment for RIT investments, but this gives
23:27
us the opportunity to do that in a, in a story, right that
23:32
business can align with. And then what that gives us is
23:35
the the foundation to continue to build onto those successes as
23:39
we move forward. But I wouldn't say that we've
23:43
got it. We've got it down perfect, but
23:46
we're working on it. Hey, nobody does.
23:49
You mentioned the three work streams, right, Internal,
23:52
external and device. And I thought device was real
23:56
interesting because I think everybody does it, but they
24:00
don't do it all as a separate work stream.
24:04
And so I'm wondering what what brought that decision for you.
24:09
Why is device identity such an important concept or working
24:14
area that you set it up as a separate work stream?
24:17
Great. Question.
24:19
Some of that was probably resource organization and the
24:24
ability to strategize within that pillar without clouding or
24:30
complicating the strategy with some of the other identity
24:33
components, right or identity pillars, identity types because
24:39
when and we still see it even though our work streams are
24:42
separate. When you start talking about
24:43
one, it's easy to start going down the path of, well, like
24:47
users going to do this, this and this and this with our work
24:51
streams being separate from a internal external device, We
24:56
could kind of corral that back in and say, OK, that's great.
25:00
Internal identity is looking about they're handling that.
25:03
Let's focus on the device itself.
25:05
What, what is the best outcome and what are the things that we
25:08
need to do on the device? Almost absent of the user,
25:12
right? Because in a, in a true ZTA
25:16
architecture or, or, or framework, it doesn't matter.
25:21
Like I could log in on any device, right And you get the
25:26
information from the device and you get the information from the
25:28
user. You combine those and that's
25:30
what creates the, the access, right, The the underlying
25:34
entitlement. And so I didn't want us to think
25:38
about it. Well, that's Shay's device.
25:40
She's always going to use that device.
25:42
We trust her. So you don't care We don't care
25:45
about her device. I wanted them to think about it
25:47
and if if anybody grabs any device, what do we want to make
25:51
sure that that device does or has or is in order for us to be
25:57
able to trust it, right or it to be able to verify it.
26:02
So it was kind of a a multi, multi reason, but mainly to be
26:09
able to focus the discussion and to focus the teams into those
26:13
spaces where we could build the appropriate capabilities without
26:18
getting too crisscross across the other identity types.
26:24
You mentioned the zero trust architectures ETA and it feels
26:29
like 0 trust. I think it's one of the most
26:32
important architectural concepts in all of infrastructure.
26:36
I think sometimes it gets mocked because of it.
26:39
So for you, it's like you went to conferences for a while and
26:42
everything was 50% more zero trust.
26:46
So we made fun of it on this show at some points.
26:49
But I mean, as far as like architectural principles or
26:53
guidelines go, it's about as important as it gets.
26:56
I would think it's especially important in a large
27:00
organization like a county government, because you have
27:03
departments and agencies and folks have to move around the
27:08
network and regardless of where they are, you know, kind of be
27:13
that that same person using that same devices, that part of the
27:17
drivers that why is zero trust what's so important?
27:20
Are there other things on top of that?
27:22
Yeah, I, I mean that's probably one of the strongest drivers,
27:25
right. So I mean local government
27:27
shares structural similarities to like a large conglomerate.
27:32
There's a lot of different like semi autonomous units, some some
27:37
dependencies across those units, Jim, to your point, like users
27:42
exist in the same spaces from a location perspective.
27:47
And ideally like all of these things at the end of the day,
27:50
work together and can synergize appropriately to provide public
27:55
services, right? And so that creates an
27:57
environment where a concept like never trust, always verify
28:02
starts to become very appealing because again, semi autonomous
28:08
orgs, they can stand up their own systems.
28:11
They, they have their own kind of regulations, their own data
28:14
types, their own threat surfaces.
28:16
But at the end of the day, we need a way to be able to trust
28:20
each other so that we can do business, right?
28:23
And like that's zero trust, right?
28:26
Those, that those are the principles of zero trust.
28:29
And so I think that in any organization that doesn't have
28:35
that centralized line of control, zero trust makes a lot
28:38
of sense. And I think it was probably
28:40
going to be kind of the way even if it didn't become the
28:44
framework that it is today that large, you know, multi business
28:50
line, semi autonomous to autonomous IT shops got to
28:56
anyway. So, yeah, I mean, I, I think it
29:00
helps to give us a, I'll say a similar vision right across all
29:09
of our different AT shops. It gives us a vocabulary that we
29:13
can use and a, a justification for why are we putting all of
29:20
this in place? Well, we're putting this in
29:22
place because, you know, I, I run this case management system
29:27
and your users are going to connect to it.
29:29
And I have no control over your users.
29:31
So you have to give me a guarantee that you're doing the
29:34
right things and you're managing that device and you're managing
29:38
that user to a, a baseline level.
29:42
So I will give you access to my data.
29:45
So, yeah, I, I think that's a, that's a big driver just based
29:48
on the organizational structure of the county and and
29:54
potentially any local government.
29:56
And when we talk about devices, I think there are generally a
30:00
few different types of devices, right?
30:03
There's the managed devices that you issue from the county.
30:06
But in this world of BYOD, people can bring their own
30:10
devices. You can't manage those
30:13
necessarily. There's IoT devices, there's OT
30:17
devices, which may not be in your scope, but kind of what is
30:23
the approach for each of those? And can you come to help us for
30:26
people who aren't familiar with that language that I just used,
30:31
what are those different types of devices?
30:35
Yeah. And this is actually been a
30:37
great discussion that we've had even within the county, you
30:40
know, across departments, across units, even to come to a solid
30:48
definition, managed was much easier to define managed and
30:53
unmanaged. I'll say BYOD was like a whole
30:55
nother animal. But so from a managed
30:58
perspective, the way that I would define that is a device
31:02
that you have control over, you have in your inventory you're
31:07
you're getting information from, you can put configuration onto
31:14
to include an identity like a certificate, right?
31:17
So truly it is managed. If you wanted to turn it off,
31:21
you could turn it off. If you wanted to wipe it, you
31:24
could wipe it unmanaged. Of course, is the other side of
31:27
that spectrum where you have no control.
31:32
You, you don't have it in inventory, there's there's no
31:36
validation of health, there's no validation of configuration or
31:40
patch levels. It's truly outside of your
31:44
purview. And then there's BYOD, which for
31:48
the county can actually fall into the managed or unmanaged
31:51
definition. And so that's why this one was
31:54
was a lot of fun. We're still we're still talking
31:58
through how how we successfully define and manage ABYOD approach
32:05
for county resources. Now when I started at the
32:08
county, we did have like a like the any device anywhere, anytime
32:15
approach to doing business, right?
32:18
Meaning we would have to have a good way to secure our apps and
32:25
our data even in the event that an unmanaged device or BYOD
32:30
device wanted access. Working through that of course,
32:36
but so BYOD for us or bring your own device.
32:40
Right now we have two flavors of that.
32:44
One is a BYOD approach where they sign a waiver that says,
32:51
hey, Maricopa County, you can manage this device even though I
32:54
own it, which kind of puts them into the BYOD managed category,
32:59
meaning if they lose it, if it becomes compromised, we have the
33:04
ability to wipe it, we have the ability to lock it etcetera.
33:09
We also have the BYOD approach for some of our cloud services
33:15
where you know you can, you can log in and you can consume that
33:20
application with just your user identity.
33:24
Meaning we don't manage the device, we only manage the user
33:27
identity and the data that we're allowing that device to have
33:30
access to. And so that's the unmanaged BYOD
33:34
approach. Of course, ITOT can also fall
33:38
into both the unmanaged and managed categories.
33:41
And that one's one that we're starting to tackle and working
33:47
to identify what of the ITOT categories can we manage and
33:52
which ones can we not. And then how do we, it's very
33:55
similar to the end user devices, how how do we like segment and
34:00
control their access appropriately for their level of
34:04
management? I think where the rubber really
34:06
hits the road on this topic is how do you take the device
34:11
identity and actually enforce access around it?
34:17
So I'm thinking about kind of like how device identity and
34:21
infrastructure come together to say, all right, you can go here
34:25
and you can't go there. So maybe you can talk a little
34:27
bit about that for again for the identity of practitioners who
34:31
are trying to figure out how does this all work, maybe give
34:36
kind of our primer on that. Yeah, and that's a great
34:39
question. I mean, the classic architecture
34:42
in that space is 802.1 X, right? So wired and wireless network
34:48
access control using the platform such as ICE to be able
34:52
to validate that that system before it connects into your
34:57
network is healthy and can prove its identity.
35:02
Going back to our the beginning of our conversation, right?
35:06
I mean, the hardware is coming now with like ATPM, of course,
35:09
it's always had a Mac, but there's some, there's some
35:12
definite considerations around Mac when you're trying to use it
35:15
for any, any type of validation, but also certificate, right?
35:19
So I think for device identity, especially for any type of wired
35:28
or wireless network access control, it comes down to how do
35:33
you validate that device's identity.
35:35
For us, we we are leaning into a certificate validation.
35:39
Of course, there's some some new great technologies out there as
35:43
well that use like apps on the device, right to grab device
35:51
identifiers and creates truly create a device identity out of
35:55
that information that's used for validation for access either
35:59
onto the network or access to apps in the cloud, etcetera.
36:03
I kind of think that behind the scenes here there's a level of
36:07
certificates, maybe PKI infrastructure at work.
36:12
Am I on the right track? How does that fit in?
36:16
Yeah, so I do think a strong certificate architecture is a
36:24
foundational component for user and device identity.
36:27
As stated there. There are perhaps some ways you
36:31
could do it without certificates.
36:32
And I don't want to say certificates are the easy button
36:34
because certificates are never easy, but they are.
36:39
They are something that especially in a autonomous, semi
36:44
autonomous org, can span spheres of control and can create trust
36:51
chains that can be shared, you know, regardless of where that
36:55
device originated, right? So leveraging something like
37:00
certificates, our accounting IT shops don't all have to agree
37:04
that we're going to put, you know, client X across all of our
37:07
workstations and that's going to be managed by some central IT
37:11
shop. They can can manage a
37:15
certificate architecture that has a similar trust chain that
37:20
we can then use at our security gateways.
37:22
I'll liken it to you like different passports, right, to
37:26
prove identity at the airport. Everybody knows and understands
37:30
what a passport is. There's, there's an official
37:33
route trust agency that can validate that passport and
37:39
that's what I consider the certificate in, in our
37:42
architecture. Again, there's other forms of
37:45
identity that can be leveraged, right?
37:47
A driver's license, an ID card, you know, the list could go on
37:52
shortly. I don't know what else they
37:54
accept at the airport, honestly, but to that point, everybody
38:00
knows that the passport is is a proof, proof of identity and
38:05
they know what to do with it when they're presented that form
38:08
of identity. Again, allowing the accounting
38:11
to still have the county IT agencies still have autonomous
38:16
control over their device management, meaning other
38:20
departments don't have to know what they're using to manage the
38:24
device or anything really, right.
38:27
They, they manage that device A in a platform like Workspace One
38:31
or Intune and Workspace One or Intune gets the certificate to
38:36
the device and then just sends the hey, this guy's good, let
38:40
him in. I validated everything
38:43
appropriately and we trust that and it just gives us a an easier
38:50
approach without having to all come together and agree on an
38:57
external vendor, a partner platform in that space.
39:00
Yeah, well, one other form of identity.
39:03
So I was flying last week and I saw a lot of people whip out
39:07
their mobile driver's license. Yes.
39:09
I don't have one personally. My state doesn't support it, but
39:12
I'd love to get there. Come on over to Arizona.
39:16
We've got them. You've got them.
39:18
You guys have Waymo. I mean, we got.
39:20
Everything. You really do, really do.
39:25
Talk about device identity, like hopefully those autonomous
39:28
waymo's they can identify them 'cause they're all over.
39:32
Exactly, exactly. So you know, the last question I
39:37
wanted to ask about because I'm familiar with some framework
39:42
that this has that can apply to kind of a device identity
39:48
program. But leading into that, I'm just
39:51
kind of thinking one thing I've seen as consultants.
39:54
So Jeff and I are unfortunately we can't just podcast full time.
39:58
It doesn't pay enough of the doesn't make enough of the
40:01
contribution to pay the bills. But we we get to work with a lot
40:06
of clients. So we get to see in the private
40:08
sector. NIST is becoming extremely
40:11
popular. I know in the public sector it's
40:13
extremely popular. Maybe you could talk about what
40:17
that level of influence is like, how it affects your program, and
40:21
then if you can speak at all to how it might, those guidelines
40:26
that exist for detect and respond work with from the NIST
40:33
framework are being adopted at the county.
40:38
Yeah, that's a great question. And I am seeing a lot more
40:42
reference and reliance on that framework, especially in the
40:45
audit space, which of course then motivates business to start
40:51
to notice and comply. For us though, the business
40:56
framework really at its core, again provides a common language
41:02
for us to talk and a way to structure our strategies so
41:11
folks know what the desired outcome is for our projects,
41:14
right? We could pick out bits and
41:17
pieces of that framework and say we are, you're doing this
41:21
project so that we can have these outcomes.
41:23
These outcomes are aligned with the NIST framework.
41:27
And of course they have like a AZTA, they have like the access
41:30
controls, they have the identity components.
41:34
So it really does give us a a foundational road map for what
41:38
are we trying to do and and at the end of the day, have the
41:42
conversation about why it's important and to what degree
41:47
it's important to the county. Now just like any framework, of
41:50
course, Nists, you could go all the way to the extreme.
41:54
And I don't know that there's anybody who probably can say,
41:58
Yep, we are. We adhere to every single missed
42:02
guideline that is out there. So organizations have to be able
42:07
to structure some level of like a maturity model.
42:10
So we're not spinning our wheels, implementing things that
42:14
are not providing value, especially based on the
42:19
investment. And I do think the NIST
42:21
framework again, helps us structure that conversation so
42:24
that we can create an appropriate maturity model and
42:28
we can create a an appropriate strategy for how we tackle any
42:34
aspect. I mean, of course NIST covers
42:35
all sorts of things, but specifically for this
42:38
conversation, something like device identity or internal
42:40
identity or zero trust. So it's in the name, right, NIST
42:46
framework, not NIST law. So you have to like, you know,
42:49
take that into, you know, accordance with what things
42:51
going on. A lot of this conversation is
42:53
focused on technology and sort of how things work and the
42:59
interdependencies between all that.
43:01
But a big part of this is still the people side.
43:03
So I'm curious, how do you, how do you make this real, you know,
43:06
from a long term perspective to say, OK, that's great.
43:10
We are, you know, 100% more 0 trusts, right?
43:13
Whatever that looks like, right. It requires A-Team to put that
43:16
in place, not only to stand it up, but to maintain it and keep
43:20
it relevant for the future. So how do you look at that from
43:23
a long term perspective to say, OK, that's great.
43:26
We've got technology, but there's also people in process
43:29
that needs to be part of this. Yeah, technology is always the
43:32
easy part. So yeah, great question.
43:34
And it's it's one I think as leaders that we we have to take
43:39
into consideration, especially as we ask our teams to embark on
43:43
these huge transformational projects.
43:46
If you know, zero trust or identity being being examples of
43:51
very transformational projects because they they do change the
43:54
underlying way that we support technology for the business.
43:59
So, I mean at the county we, we have these conversations often.
44:05
So it, it, it revolves around how do we skill up our teams.
44:10
So as we are deciding on solutions or platforms or
44:16
systems, a good part of that conversation is your folks know
44:22
this like if we pick this, how, how are we going to support it
44:27
to your point, Jess. And so being able to get the
44:32
training to our our technical folks at the right time with the
44:37
right context is key. Now I will say we've had a
44:42
number of transformational projects where we did training
44:45
say at the beginning and it was a three-year project and by, you
44:48
know, year 3 it was gone, right. And so we, we had to redo the
44:53
training. So really evaluating the timing
44:55
and when and how to engage partners, I think is, is
45:00
critical. We are very lucky to have a
45:03
number of great partners in our identity program right now.
45:06
And of course those partners live and breathe identity.
45:09
They can make identity decisions on the fly based on their
45:13
experience. And our, our, our teams don't
45:16
necessarily live and breathe identity, right?
45:18
It's just one component of the work that they're responsible
45:21
for. And so we have to be able to
45:23
balance and, and we do ask our partners to ensure that they're
45:27
having good conversations with our teams to explain why we're
45:31
making the decisions that we're making, why we're implementing
45:35
the things that we're implementing.
45:36
And wherever possible, let our team members drive, let them do
45:41
the work to a degree, let them make some of the mistakes,
45:45
right? And let them be involved there
45:47
so that when it comes to operations, they understand
45:51
those guts. I mean, we've had both great
45:55
examples of where we've done an implementation and on the other
45:59
side folks just felt good. They were excited they could
46:02
support it. And then of course the other
46:04
side of that spectrum is implementations where the
46:09
partner stepped away and everybody just looked at each
46:11
other like don't touch it. So as we, we're in our identity
46:17
journey as, as we're, as we're changing the architecture of the
46:23
organization for zero trust, right or zero trust
46:28
capabilities, we've changed the way our teams operate to a
46:34
degree. So our, our DCIO did create a
46:39
network security and access management team, which is
46:43
focused on like the security gateways that we're putting in
46:47
the policy. And that's coupled, of course,
46:50
with that access management or the identity component.
46:54
So those two pillars aren't separate across A-Team, right,
46:58
Where there's one team that knows the identity side real
47:01
good and one team that knows how to put policy in place, they're
47:05
together, which of course allows us to create more robust policy,
47:11
right, 'cause they understand how the identity underneath is
47:13
structured. So creating new teams that
47:17
canmore effectively support, especially if the solution is
47:22
across domain or across team type of solution.
47:26
Also have done the same for our desktop support guys, like a, a
47:30
workspace and platform support team that can support the
47:33
platforms that we're putting in place with an understanding
47:36
about like the devices that are connecting something like, you
47:39
know, Intune. So you do, you do have to
47:44
examine is our organizational structure appropriate and do we
47:48
have silos that are going to impact our, our momentum or our
47:56
innovation in these spaces? And if you do have the
47:59
conversations about how do you solve for that effectively the
48:03
other side of that, and I was very excited when we did this,
48:08
but we started an OCM team. So an organizational change
48:11
management team. It's only, it's only two great
48:15
gals right now, but they make a huge impact, right?
48:18
So a lot of folks see organizational change management
48:21
is almost like just a marketing team, but it's not it, it really
48:26
does get to the heart of your question as we get into projects
48:30
and these two gals will will ask us as leaders, can your team
48:34
really support this and like force us to answer that question
48:38
in order to be ready for taking on that project, which is
48:42
fantastic. So they're doing some of that
48:45
organizational change management from doing assessments or
48:49
interviews to some of our IT support staff on how is this
48:52
going to change your job and then giving that feedback back
48:56
to us. So again, we can structure the
48:58
right training, the right teams, etcetera.
49:01
So big, big one, especially as digital transformation and
49:07
modernization. I mean, it's not slowing down,
49:11
right, especially with AI, but. So I smell a Part 2 with Shi
49:15
Mcgrew coming down the road where we talk OCM specifically
49:20
for these large transformational projects because it does come up
49:23
quite a bit. And I think a lot of my
49:25
background is operations, right? It's help desk.
49:27
And then it's, I am sort of help desk specific and I would get so
49:31
tired of people just throwing things over the wall and saying,
49:33
oh, well, you know, help desk will still take care of it or
49:36
whoever's going to answer the phone like, no, no, no, we got a
49:38
plan for that kind of stuff. So I, if you're up for it some
49:41
point in the future when you're ready and we can invite those
49:44
other folks on your team as well to have a conversation around
49:47
OCM and what does it mean to be good at it?
49:50
Because there is bad OCM and then there's effective OCM.
49:54
And I think most people want to be on that good, effective side
49:57
of things. So hopefully you'll come back
49:58
and we can have a conversation about that in the future.
50:01
Yeah. I would love that because it is
50:04
especially in IT right, a topic that I don't think we, we
50:08
consider a touch on enough because it's kind of the the
50:12
softer marketing side, right. It's the communication side and
50:16
IT just wants to do right. Well, yeah.
50:18
What's the ROA on doing, you know, change management?
50:21
It's like it's, it's most of the time it's like it's just an
50:23
added cost approach. I don't know, like that is such
50:25
an important part to make sure you get it right.
50:28
It's, it helps you avoid mistakes of the past, mistakes
50:32
that other people have had and helps you really kind of get
50:34
things going. So I don't, I don't want to get
50:36
too far into it now because I definitely want to do like an
50:38
episode on that. We've got a few minutes left.
50:40
I want to talk real quickly about the future of device
50:44
identity here specifically. So maybe not necessarily like a
50:47
lightning round, but maybe kind of a more brief conversation,
50:49
like where do you see this going from a device perspective?
50:52
Because now we've got, you know, super disruptive things like AI.
50:55
Hey, we just made it, you know, 50 minutes without mentioning
50:58
AI, which is probably a record for any IT conversation right at
51:02
this point. So like, where do you see things
51:04
like AI or things and frameworks like shared signals framework or
51:09
behavior analytics, you know, Cape continuous access
51:12
evaluation profile. Hope I got it right tool.
51:15
But things like that where, you know, we're starting to use data
51:19
and analytics to improve things or measure things like where do
51:24
you see that specifically on the machine identity side or I'm
51:26
sorry, the device identity side? Yeah.
51:29
And so I, I, I think to your point, it's going to be right in
51:32
line with how we're applying AI everywhere, right?
51:36
It's, it's going to be a question of what, what data do
51:41
we have and how, what, what do we want to do with that data and
51:46
what correlations are going to make our decisions more
51:51
powerful, right, more impactful, better etcetera.
51:54
And so in the device identity space, you know, a lot of the Ed
51:59
Rs are already collecting like mass amounts of data from the
52:03
devices to be able to articulate relatively clearly like their
52:09
health status, right? Like, hey, this hard drive is
52:13
going to fail in 10 days. So we're going to see it
52:17
everything from like just as the simple operational pieces,
52:21
right? As well as, and I think we're
52:23
already seeing this to a degree, like just with Copilot and your
52:26
ability to interact with your machine, the ability to leverage
52:32
AI to troubleshoot a device problem.
52:35
So for an end user, if you know their settings are off or
52:40
whatever, you can pull up a a chat, have a natural like a
52:44
language based conversation with whatever AI platforms out there
52:49
and fix your problem. Of course, that alleviates our
52:53
poor help desk folks from a number of things, so we'll have
52:56
to skill them up and have them focus on other higher value
52:58
tasks. But yeah, so absolutely
53:02
everything from just operational efficiencies at the end user and
53:06
back end perspective to our ability to detect and respond
53:11
threats more effectively. Now the flip side of that is
53:14
it's also going to be used to attack more effectively,
53:16
especially at the device level, right.
53:20
So it will be a balance certainly I think the
53:22
correlation across multiple systems for all of the things
53:28
that we can get from a device, you know, location, who's logged
53:32
in, when's the last time this person logged in, where were
53:34
they before? And then be able to create
53:38
feedback to, you know, our security teams in regards to the
53:43
level of threat that that device poses to the organization and
53:46
make decisions based on that. And this is all this isn't like
53:50
super future, 'cause this, this all is capability today.
53:53
We haven't quite got there yet. So it's my future, but it's not
53:57
a technology future. That's, that's all a possibility
54:00
today. And then where we'll go from
54:03
there. I, I don't know, like I
54:05
especially as devices start to, to morph, right like the
54:11
smartwatches, smart glasses and how do we leverage all of those,
54:16
especially from a business perspective?
54:19
Yeah, we're going to be wearing a whole bunch of identity things
54:22
on us given point. Yeah, Phones, tablets, watches,
54:27
right, chips, you know, brain implants, all kinds of stuff.
54:31
Yes, we started off this episode ganging up on Gym, which I
54:34
absolutely love. So anytime you want to come
54:36
back, we can beat up on Gym a little bit is good.
54:39
Jim, I want to come back to you. You had about 4550 minutes or so
54:41
to kind of think about this conversation around machine
54:44
identity versus, you know, can a machine or a non human have an
54:49
identity? Are you prepared to come back at
54:51
us with some fire that we need to chew on?
54:54
I know. I'm kind of like barking up a a
54:57
tree with this one. I'm old man yelling at cloud but
55:01
it's really the vocabulary of it.
55:04
So here's how I've always thought about identity and
55:06
accounts. If Shay has an identity or an
55:11
account in action directory and the travel system and in the
55:17
accounting system, how many identities are there?
55:21
Well, the caustic argument is there's one, there's one Shay,
55:25
and those are accounts, right? Well, I don't see why it would
55:29
be any different with anything else.
55:34
And by the way, the perspective of each of those system owners
55:37
was like, hey, we have all these identities.
55:40
When you talk to Active Directory administrators, they
55:42
say I've got 10,000 identities in my system.
55:46
And those may pair off for the most part one account to one
55:50
person, but those are accounts. Those are not identities.
55:53
Identities are in the HR system or in the contractor system.
55:58
That's where they're originally started.
56:00
And even those are probably accounts or that identity, but
56:03
the identity is the person. And so you extend that.
56:08
Now let's take the question of OK, devices.
56:12
Do they have an identity? Well, what's a device?
56:16
Is it just something that is like a laptop, a phone, a
56:22
tablet? What about a printer?
56:24
What about a thermostat, thermostat that's smart and are
56:28
all those identities? What about a thermostat that has
56:33
multiple sensors on it? Are each one of those sensors
56:36
identities like so where does where do you draw the line
56:39
between they just have an account so they can authenticate
56:42
to report data versus they're actually enough to say that they
56:50
have an identity. And to me it comes down to are
56:53
they kind of a life form or not? That's where I think that the
56:57
word identity should be used properly.
57:00
And the one exception I've made in my deranged mind is that AI
57:07
may get smart enough, that is doing all the characteristics of
57:11
life form a human being would do and could potentially make
57:15
decisions as good as a human being or better, and therefore
57:20
would qualify as an identity. But even at at this stage in the
57:25
game, I would say AI would have to be considered, you know, the
57:30
accountability of some human being performing the actions.
57:34
And that person would be the one who decided whether or not they
57:38
had access in an account to get onto your network.
57:42
So that's why to me, it's like, is it an identity or an account?
57:47
There's definitely Gray area, but I always kind of go back to
57:51
that, an identity as a human being.
57:54
I have thoughts Shay, do you have anything you want to say
57:58
before I unload? Well, so I mean, I would say, I
58:01
think it still comes down to like how you're defining
58:04
identity, right? So I mean, Jim, you're defining
58:08
it as like somebody who is, who has a soul.
58:12
That's exactly what I was thinking of.
58:13
Like the existential question of like a soul.
58:16
Right. But I mean, I think you could
58:19
also classify identity as like a set of characteristics,
58:22
attributes or proof that make an entity unique and recognizable
58:29
and hopefully trustworthy given the context, right?
58:32
And in that definition, I would say certainly what we're trying
58:36
to build is the capability of hardware to have those things so
58:40
that we can do some level of validation of their
58:43
trustworthiness. Now, if you're getting into the
58:47
yeah, the, the philosophical soul sense of identity, I would
58:51
have to then lean to Jim's direction and say, OK, the maybe
58:56
it's the Webster's definition of that identity is associated
59:02
somewhere like this along the lines of like personality or
59:05
something that makes you uniquely identifiable.
59:10
That, that today a machine can't have that.
59:13
But I do think that they can have identity in the sense of
59:18
recognizable characteristics that allow us to make decision.
59:22
I feel like this is where context matters, like anything
59:24
else. So of course we have to, you
59:26
know, think about that. So I get it.
59:29
But I feel like yes, a machine, a non human can have an
59:34
identity. We have Mac addresses.
59:37
That's how you identify a device on a network, for example.
59:41
There is a unique identifier associated with it.
59:44
So I think there's that. I'm not going to answer the soul
59:47
question because I think you could argue some people have
59:51
souls, maybe some don't. I think now you want to, you
59:53
know, portray I. Think we can agree that Nope,
59:55
printer has a soul. I can I can agree.
59:59
Yes, that's probably correct. But the machine does have an
1:00:02
identity, because how else do you address it?
1:00:05
You've given it an identity by a Mac address.
1:00:08
You've given it an IP address to say, OK, this is where I live on
1:00:12
the network. Yes, it is an identity.
1:00:15
Yes, it may have a whole bunch of sub accounts that run
1:00:20
underneath the context of that identity.
1:00:22
Right inside of a printer, for example, you probably have a
1:00:24
whole bunch of microcontrollers that are controlling the
1:00:25
principal or that are controlling the display unit
1:00:28
that are controlling the network information coming in.
1:00:31
Those are all accounts that are running certain mining, you
1:00:34
know, tiny service accounts that are running on the in the
1:00:37
identity, in the scope of the printer.
1:00:39
The printer certainly, you know, is not a person that it doesn't
1:00:42
have autonomy beyond what it's directed to.
1:00:47
Do you hope unless printers start coming alive, Right.
1:00:51
But I still think yes, you can. Yeah.
1:00:52
Yeah. You know, wait till the AI
1:00:54
printer comes out, you know, then then we're all screwed.
1:00:58
But I still think you can have identities all over the place.
1:01:01
And I think it is the definition.
1:01:02
How do you define what an identity is?
1:01:06
I just feel like, yes, you can have both identities and
1:01:08
accounts. Identities can report to other
1:01:12
identities. That's why we have things like
1:01:13
org charts and, you know, family trees and all kinds of different
1:01:17
stuff like that, right? Where, you know, even on, on my
1:01:20
network, right? I probably have, I don't know,
1:01:21
200 IoT devices, you know, that are in my house.
1:01:25
I have a smart thermostat. It has an identity.
1:01:29
It has remote sensors I'm OK on right now in my basement where
1:01:31
my office is that is connected as an identity back to my
1:01:36
thermostat that then connects to my smart, you know, home app
1:01:40
that gives me the temperature and, you know, does all the
1:01:42
controls around that. So I do feel like I, I don't get
1:01:47
stuck. For me in the soul concept,
1:01:50
identity is identity. What is human is a different, is
1:01:54
a is a totally different thing. Does that make sense?
1:01:57
So if we were to get down to definition, you're saying if it
1:02:02
has a Mac address, it has an identity?
1:02:06
A Mac address is an identity. That's what it is.
1:02:08
Its purpose is is a unique identifier for, in this case a
1:02:13
network device. So if a network card has
1:02:17
multiple Mac addresses, it has multiple identities.
1:02:22
A network card having multiple one network card.
1:02:25
That would be software based probably, but it would.
1:02:28
Run in the context of another, what if a server has seven
1:02:32
network cards in it, 7 Mac addresses?
1:02:35
Then you're saying that server has seven identities.
1:02:38
Well, so in a, in a instance of like a technical identity for a
1:02:43
person, I know the, the conversation is going to be, are
1:02:46
those accounts or those personas or are those identities?
1:02:50
But my identity as a Maricopa County citizen and my identity
1:02:55
as a Maricopa County employee are distinctly different.
1:02:59
And how you validate those identities and how I use those
1:03:02
identities are going to be different as well from a
1:03:05
technical perspective, right. And possibly even from a real
1:03:08
person perspective, the way I, you know, go to work or the way
1:03:12
I, you know, consume county services different, right?
1:03:18
So I, I would consider those two different personas or I mean two
1:03:24
different identities if I was managing them as objects in any
1:03:28
type of store, right? Because they wouldn't, they
1:03:31
would be uniquely identifiable apart from each other.
1:03:36
I wouldn't smush them together necessarily.
1:03:40
I. Totally agree SO.
1:03:42
I can have multiple identities. And not just your head, I mean,
1:03:50
Jim, you're not we have multiple identities, right?
1:03:51
I mean, a lot of people think we do the podcast full time, but I
1:03:54
wish that doesn't that's this is what we do at nights and
1:03:56
weekends. We have an identity as podcast
1:03:59
people. Our day job is where identity,
1:04:01
our identity there is well identity consultants kind of a
1:04:04
bad you support there, but we are contact switching between
1:04:09
those identities. I don't know if those are
1:04:12
different identities or different personas.
1:04:14
Well, maybe one or another, but we, you know, we I.
1:04:17
Would argue that the Mac is a different persona then because
1:04:21
it's it's there to do a different operation.
1:04:23
The reason why you'd have, say, a separate network card or a
1:04:26
separate Mac is to separate some, some process, some service
1:04:32
very similar to a a human identity, even very similar to
1:04:37
the ones in your head. See, now my brain starts to
1:04:42
explode and it's like, all right, how how far do we take
1:04:44
this? We now like explode the Mac
1:04:47
address or the network card and. On those podcasts, Yeah,
1:04:50
exactly. This is something maybe I'll
1:04:53
include this like in a future game show as part of my majority
1:04:56
rules like can a machine have an identity?
1:04:58
Yes no, whatever. And let's see what the crowd
1:05:01
comes back. So maybe I'll.
1:05:02
Definitely as as we get into as we get deeper into non human
1:05:06
identities that are essentially potentially reporting up through
1:05:10
an org structure, right. And I that one is probably more
1:05:14
future focus. But I, I do think that that's
1:05:17
gonna be a future at some point we will have to treat them and,
1:05:26
and apply the same constraints as we would for human identity
1:05:31
to a degree, right? Especially, you know, AGI type
1:05:37
entities, robots, whatever we want to.
1:05:39
Call these agentic AIS running around autonomously, either
1:05:42
doing things off of a routine right that someone has set for
1:05:46
them, or them developing their own routines correct.
1:05:49
And so I think it's it's a very interesting question for our
1:05:52
time right now because Jim, I think we are hitting that
1:05:54
inflection point of how do we define it?
1:05:57
And how do we, and this gets into some AI ethics which is
1:06:00
probably a whole nother show, but how do we handle device
1:06:06
based identity for things that are doing human like work?
1:06:11
See, now I'm really glad that we didn't, that we named the
1:06:14
podcast what we did, identity at the center.
1:06:15
We didn't call it human identity at the center or non human
1:06:18
identity at the center. It's just identity at the
1:06:20
center. No, didn't.
1:06:23
Call it a council center, that's for sure.
1:06:25
Persona's at the center. Persona's at the center.
1:06:27
Yeah, pretty soon we'll have AI at the center.
1:06:29
That'll be our our spin off show.
1:06:30
All right. We've gone in like over an hour
1:06:32
and I, I know you're very busy, Shay, So I really appreciate the
1:06:35
time. I do kind of want to wrap up on
1:06:37
a letter note, kind of getting to know each other before the
1:06:39
call. One of the things that you
1:06:41
mentioned was that you are kind of like a little bit like me.
1:06:44
I call my, you know, a little bit of a Renaissance man where,
1:06:46
you know, you get interested in a bunch of different topics and
1:06:49
you kind of maybe get an inch or a foot deep and you kind of have
1:06:52
like this, you know, wide range of knowledge.
1:06:56
And I feel that's kind of the way I've always been interested
1:06:59
in things as well. And so I want to pose a question
1:07:02
to you. If your approach to learning,
1:07:06
which it sounds like it is, is digging those thousand different
1:07:09
holes and maybe they're only an inch or a foot deep, right.
1:07:13
If it was an Olympic sport, what would you call that?
1:07:17
And then what would the medal ceremony look like?
1:07:20
Yeah. That's a good one really start
1:07:24
to to hit that creative side of my brain here.
1:07:27
I could I could go boring and just say call it a career and
1:07:31
your paycheck is the I was kidding.
1:07:35
Hopefully we all, we all are lifelong learners, right?
1:07:38
Especially in IT because there's so much change there.
1:07:41
But if it was an official Olympic sport, I'd love to have
1:07:46
something like curiosity. Like curiosity cap.
1:07:49
I don't know. That's kind of boring.
1:07:50
I probably could get more creative than that if I had a
1:07:52
little bit more time to think. But curiosity cap.
1:07:54
And of course, there's not necessarily a loser medal
1:07:59
ceremony. Yeah, you get, I don't know, you
1:08:03
get gold for see that and the curiosity and learning is a hard
1:08:09
thing to measure. So I don't even have to think
1:08:11
about how in the world we would measure it as an Olympic sport.
1:08:16
Maybe the award is more questions.
1:08:19
Right, more, more knowledge. Curiosity, right?
1:08:21
Yeah, it's like, OK, well maybe that's the hook here, right?
1:08:24
Is, you know, you like to learn new things.
1:08:27
You're always picking up new things like, oh, that's
1:08:28
interesting. And you kind of, you know, learn
1:08:29
that and then it it just never ends.
1:08:31
Like that's the reward is there is no end.
1:08:34
And you just, there is no end. You just keep on this loop.
1:08:37
Yeah. Yeah, yeah.
1:08:39
I mean, that's a, that's a good question.
1:08:40
Yeah. I mean, it's, you just have to,
1:08:43
yeah, create a gamified version where there's there's no true
1:08:47
end and it's just always a what are you going to learn next and
1:08:52
next and next and next? And the award is like a bunch of
1:08:55
different gift cards from a bunch of different stores
1:08:57
because you can't pick just. One hopefully it's like
1:08:59
education, right? You get credits to like go sit
1:09:02
in on classes at Stanford or Harvard or get.
1:09:07
Exposure stuff available. So you couldn't do it today,
1:09:09
right? The mass was a mass education
1:09:11
type stuff, yeah. Yeah, yeah.
1:09:13
You get to get to sit with great minds and ask questions.
1:09:19
And annoy them. They're they're part of it is
1:09:24
they have to be patient. That that is true.
1:09:27
That is true. It's almost like, you know when
1:09:28
you have a child, right? And everything is like why, why,
1:09:30
why like OK, right. All right, we'll get through
1:09:33
this. I mean, why is another good name
1:09:35
for the the games? Why, Yeah.
1:09:38
The Y. Games, I don't know, yeah, the Y
1:09:40
games. I mean, you could play on that.
1:09:42
X Games Y Games X. See.
1:09:45
OK, see, now we're getting. Into now we're getting
1:09:47
somewhere, yeah. We need some OCM now to make
1:09:49
sure that we roll this out correctly.
1:09:52
Right, right. Jim, do you have any thoughts on
1:09:56
on sort of that learning exercise?
1:09:58
You mailed what I was going to say, which is never end.
1:10:01
So it would be like you started during the Olympics and four
1:10:05
years later it would still be going.
1:10:07
So then it would just keep going and going.
1:10:10
I kind of went through this and I, you know, I was having a
1:10:14
conversation with our colleague Brian Lindstrom today.
1:10:19
I don't know if Brian hold on to the podcast for this long.
1:10:24
We're already in over an hour, but we're talking about like,
1:10:28
hey, we're in our 20s. We just like had this burning
1:10:34
desire to learn. And for me, it was, I started
1:10:38
learning about computers. I just love computers.
1:10:41
I wanted to get a file from this computer to that computer.
1:10:44
I wanted to figure out how to do it.
1:10:46
And so I would get a book or, you know, the Internet wasn't
1:10:50
what it is today, so I'd have to mostly use books and try and
1:10:54
figure it out. But I hated not knowing
1:10:58
something. If I read a book and it's talked
1:11:00
about TCPIP, be like, what's this TCPIP thing I need to learn
1:11:04
about it. Oh, Mac address.
1:11:05
What's a Mac address? Why is it formatted this way and
1:11:09
how do I talk from one Mac address to the other?
1:11:12
What are the commands I write? And eventually it led to me
1:11:16
doing the Microsoft NT4 MCSE, which was like a bunch of exams.
1:11:22
But that was another part of the obsession was not only knowing
1:11:27
these things, but trying to score perfectly on the exams.
1:11:31
Like I knew every intricate detail of these things and I
1:11:37
wonder like how many people are in their 20s today who kind of
1:11:42
attack it that way. But I think that is how you go
1:11:46
from kind of like your entry level job out of college to a
1:11:53
more senior level positions. Like you have to have that, that
1:11:57
burning desire to learn and you know what you know is never good
1:12:02
enough. And obviously it comes and goes
1:12:05
as you go throughout your life. But like that time when you're
1:12:09
first out of college, like that's when you have to just
1:12:12
consume and build your knowledge.
1:12:14
And I think being able to straddle the non Internet age
1:12:18
and the Internet age learning is overwhelming now.
1:12:21
So it's really a exercise of focus and being able to, Jim, to
1:12:26
your point, like really take in the subject and not get
1:12:30
distracted by the 50 other things that are going to be in
1:12:33
front of you as you're looking into that one thing.
1:12:37
At least that's my my struggle right now.
1:12:38
It's just, there's so many things I know I don't know now
1:12:42
because you're exposed to so many things that picking the
1:12:46
that that path gets more difficult for, for our folks
1:12:49
coming out of college, I think. I just think of like squirrel
1:12:53
and then all of a sudden like there's something new.
1:12:54
I don't want to figure what that is.
1:12:56
Not a squirrel or whatever it is.
1:12:59
OK, let's go ahead and wrap up. This has definitely been a
1:13:01
longer episode, but this has been a fantastic conversation.
1:13:03
Shay, open door policy. When you're ready to come back,
1:13:06
we want to talk about OCM or anything else.
1:13:09
Let's do it. And yeah, appreciate you being
1:13:11
on the show and set aside some time for us.
1:13:14
We normally will put our guest LinkedIn profiles in our show
1:13:17
notes. So hopefully, you know, that's
1:13:18
it'll be OK. Give me a thumbs up or not.
1:13:20
If it is absolutely OK, cool. And people can reach out if they
1:13:24
have questions or, you know, want to wax poetic around, you
1:13:27
know, what is human? Maybe, you know, hit us up on
1:13:30
comments here or on, you know. My LinkedIn inbox.
1:13:34
It'll be, you know, along with the recruiters fam, and for me
1:13:37
like podcast promotion experts, right?
1:13:39
All that other stuff. So, yeah, but I appreciate you
1:13:42
spending some time with us. And, you know, thank you all for
1:13:45
watching and or listening. You've stuck with us this far.
1:13:47
And yeah, find us on the web, idacpodcast.com and we'll talk
1:13:51
with everyone in the next one. Thank you.
1:13:55
You've been listening to Identity at the Center.
1:13:58
We hope you've enjoyed the show. Make sure to like, rate and
1:14:02
review, and we'll be back soon. But in the meantime, hit the
1:14:06
website at identity@thecenter.com.
1:14:10
See you next time on Identity at the Center.