Latest / Identity at the Center / #101 - AWS Cognito & CIDPRO with Sarah Cecchetti

Transcript

#101 - AWS Cognito & CIDPRO with Sarah Cecchetti · Identity at the Center

0:09
You're listening to the identity of the sender podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:27
sender podcast, I'm Jeff. And that's Jim.
0:29
Hey, Jim. Hey, Jeff, how are you?
0:32
Oh, not so bad yourself. Good.
0:34
Keep him dry. Like I said I'm looking out my
0:37
window at my pond it will probably be a lake.
0:41
Tomorrow might be Oceanfront, we got the big hurricane that's
0:45
going to go right over top of my house hurricane.
0:48
Elsa. Hurricane else is going to let
0:50
it rain. Let it rain.
0:51
I guess is the way it's going to go, huh?
0:53
Yeah. I'm less worried.
0:54
About the reign of my particular situation, but we've got some
0:58
trees that I'm, I guess I'm more concerned about the wind blowing
1:02
a tree over onto my, my roof. I have a roof over my head, so I
1:06
don't have a whole lot to complain about, but the trees
1:09
could change that this is true and I think you know, from a
1:12
tiny reflective, it probably works out pretty well because I
1:14
know you're going to be on vacation and a couple of weeks.
1:17
I think you're going to somewhere in Florida, right?
1:20
Yeah actually. I'm going what I thought was the
1:23
original path. Of the Tampa and looks like the
1:27
the storm change path, changed his path, a little bit so that
1:32
it went a bit north of that. But now it's going to be
1:35
directed over my home in Augusta Georgia to make a path over to
1:39
Columbia South Carolina. Anyway, this is not the Weather
1:42
Channel, so I'll stop it there into that.
1:46
The late weather news as you're listening to, this may be weeks
1:48
or months after it took place. Yeah.
1:50
For my, we are all the content. This is what we strive for on
1:53
the identity of the sender. Cast, absolutely.
1:56
Well I think important thing is the timing right?
1:58
You're on vacation you're going to Florida.
1:59
I'm actually going to Key West in a couple of weeks myself.
2:02
So I'm not looking forward to, you know being part of a
2:06
hurricane situation at that point either but we'll see how
2:08
it goes. Well folks are interested in how
2:11
the sausage is made. We're recording with Sarah, you
2:15
know, a couple days before this one will go live, but we've been
2:18
recording some backup pisode. So, that while we're on
2:21
vacation, we don't miss our publication schedule.
2:25
We've been pretty anal about that in terms of getting our
2:28
episodes out every Monday at 12, noon eastern time.
2:32
So planning to keep that. Keep that going throughout the
2:36
throughout the year. Yeah, two years 100 episodes and
2:40
101 is going to be this one. You mentioned Sarah.
2:42
So why don't we introduce her? Her name is Sarah.
2:45
Chickadee she is the principal product manager for AWS
2:48
identity. She's also the co-founder board
2:51
member and president for Ida Pro, which is a lot of different
2:54
things going on. Welcome to the show, Sarah.
2:57
Thanks very much, Jeff. Yeah.
2:59
So I'm excited to have you on here because for a while, for a
3:02
couple reasons, right? So Friday Pro.
3:03
I've been a member, I think since Inception, which I know
3:06
you found her that a couple years ago, 2017, I believe.
3:09
So I've been there since the beginning, little bit of find a
3:12
wall, but I did have served on a couple of boards, one for the
3:15
board selection committee, whatever its I am, butchering
3:20
the name on that one, but for that.
3:22
And then most recently on the ID Pro Surfer, Station or CID Pro
3:25
which we'll talk about later. But before we get too far along
3:30
what. I'd like to understand though,
3:31
is from your perspective, you know, how did you get into the
3:34
identity space? Is it something that you chose
3:37
door? Did it choose you?
3:39
I sort of fell into it sideways, which I think is more or less.
3:42
What happens to everyone. My undergraduate degree is in
3:46
physics. I was really excited about being
3:48
a rocket scientist when I was in my early 20s and then, Got my
3:54
undergraduate degree in physics and realized that one
3:57
undergraduate degree is not quite enough to go.
3:59
Be a rocket scientist that you need a lot more school.
4:01
And I was not up for a lot more school at that point in my life
4:05
and so I didn't really know what I wanted to do.
4:07
I when I got like a secretary job at a non-profit and their
4:11
website was god-awful and so I took it upon myself to make a
4:15
website better and like they were using a Content management
4:18
system bait, huh, pythons? So I taught myself Python and
4:22
then they moved their headquarters from Where I'm
4:24
based to New York and I said well, moving to the are going to
4:29
secretary salary, just really doesn't seem like a good life
4:32
plan and so I'm going to say in Seattle and I'll take the
4:37
severance package and but while I'm doing that, can you change
4:39
my title to like a technology Services?
4:41
Something something. And they said sure.
4:43
Like that's the least we can do, we feel super bad for letting
4:45
you off and so they changed my title.
4:47
I became a technology Services, something something, and then
4:50
eventually I got recruited by an identity team who basically said
4:54
We know identity really well. This is at the University of
4:56
Washington. They've actually built a lot of
4:58
the identity tools that other universities used in open source
5:01
to them. And they said, you don't need to
5:04
know identity. We can teach you and like you
5:06
have a year to ask all the stupid questions and that was
5:10
awesome. And I had just gotten out of
5:13
grad school at the time and so the first thing they said was
5:16
hey, you should go and read all of the new specifications and
5:19
like summarize them and tell us about them.
5:21
And so I went and read Fido and I went and read Yuma and And
5:24
read oauth and everything that was going on at the time.
5:29
And then I started going to conferences and I met the people
5:33
who had written the standards, which is really amazing.
5:36
And so I got to ask them, like why is it this way?
5:38
Why did you put this in there? Why do tokens like, why are
5:42
there only Vera tokens? Why are there other kinds of
5:44
chickens? And like got like long involved?
5:47
It. Like normally, when you go to
5:48
technology conferences, people do not have time.
5:51
They did not want to answer your questions.
5:53
They will not. Not like sit and explain things
5:55
to you. They get very impatient with
5:56
that. And identity people are not that
5:58
way at all. Identity, people are super nice
6:00
super generous with their time and they're so happy that
6:03
someone has read their standard and that anyone cares and they
6:07
will happily like sit in the bar for two hours and explain to you
6:10
why Bearer tokens are bearer tokens.
6:13
And so I got to learn the identity field really well and
6:17
eventually people said, oh wow, you've like you've read all
6:19
these standards and you understood them.
6:21
Like can we hire you? Will you work evenings and
6:23
weekends. Can we come like, will you come
6:25
to our office and explain these to us?
6:27
Because we don't have time to read all of them.
6:30
And so I said, sure and I started kind of Moonlighting in
6:33
addition to my university job as a contractor and eventually it
6:38
was working 20 hours a week as a contractor in addition to my 40
6:41
hour week job, but I was making twice as much money Contracting.
6:44
And so I was able to jump ship and I quit my full-time job and
6:49
became a contractor and my my company was called engage
6:53
identity. And that's Roughly when I
6:55
founded Ida Pro. So in Blazer who runs identity
6:59
for Salesforce and I, where, I think we were at a bar at RSA
7:04
and we were bemoaning. The fact that security gets so
7:08
much attention and privacy you get so much attention, right?
7:11
They have c-suite positions and identity like is this third leg
7:15
of the stool that's critical to both of them and it gets no
7:18
respect, no attention. We don't even have a
7:20
professional organization that identity nerds can join and like
7:23
learn About their own fields. And isn't that a travesty?
7:27
And then like we looked at each other and were like, shit, we're
7:30
going to have to do all this work ourselves, aren't we?
7:32
Like we're going to have to found this thing.
7:34
We're going to have to move forward.
7:36
And so we did that and we found it ID Pro that was in 2017.
7:40
And then after that, I spent a year at ping and then I came to
7:45
AWS and I have loved AWS. I'm like a fish in water.
7:49
Here it is. Totally my culture and my jam
7:52
and I'll probably be here for a long long time, what makes it?
7:57
So sorry. That's it's a fascinating story.
7:59
I, especially liked the part where you sat at a bar and we're
8:03
thinking, how are we going to solve this issue of awareness,
8:06
right around identity? Because I feel the same thing,
8:07
right? It's it's always been kind of
8:09
tucked under, you know, infosec or, you know, maybe audit in
8:13
some earlier stages and things like that.
8:15
But it really is foundational from a any security component
8:19
has to have identity in it. And if you don't have that
8:21
addressed, you're going to have a bad time.
8:23
You're probably going to In the news for all the wrong reasons.
8:27
So I'm glad that you started it. I'm glad that it started at a
8:30
bar, that's even better. And we've had we've had in on
8:33
the show as well. I think he kicked off our first
8:35
episode for 2021 so he's a good dude.
8:39
Definitely will Echo what you said too about the identity
8:42
industry being so welcoming. I think it's one of the
8:46
industries at least that I've been part of where, you know,
8:49
everyone really is, you know, willing to share their
8:52
knowledge. It's not an arms race.
8:54
Race when it comes to trying to be better or worse.
8:57
I mean, I understand there's probably some of that when it
8:59
comes to product, you know, for sure.
9:01
You know, people are trying to, you know, have the best product
9:03
out there. But at the end of the day, all
9:04
the people who were in the industry are very willing to
9:07
share information and we have, we had them on this show and we
9:10
talk to them at conferences, you know, and we're going to all
9:13
times different things. And, you know, people are very
9:15
gracious with their time. And I would certainly encourage
9:16
folks who you know, are looking to get an identity or if they've
9:20
only been an identity for a short time, or if they've been
9:22
an identity for a long time, Reach out and talk to somebody,
9:25
right? I mean I think you'll find most
9:26
people are, you know, pretty open have that.
9:28
And they are certainly receptive to having their work read and
9:32
commented on otherwise you know it dies somewhere in a LinkedIn
9:36
post somewhere where you know, maybe not a lot of people might
9:39
see it so definitely Echo that for sure.
9:41
Yeah and a lot of the work that we do and identity has to do
9:45
with interoperability, right? So we are unlike other
9:47
Technologies in that we have to work together and the way to
9:52
make our customers have better experiences.
9:54
Is for us to talk to each other and make sure that all of the
9:57
attributes that we have are coming across and that they're
9:59
coming across correctly and in the way that customers expect.
10:02
And so identity is kind of an unusual field to work in in that
10:05
you have to work with your competitors and we have these
10:08
kind of teams of Rivals all the time where we have to build
10:11
standards together and so we all know each other and we can all
10:14
share knowledge and that's really the only way to learn
10:17
this feel like there is no accredited undergraduate degree
10:21
for identity and access management.
10:22
You can't get one you Have to learn it on the job.
10:25
It's the only way. So I got imagine that.
10:27
Not everyone always agrees when you're sitting in these rooms
10:30
and you're trying to come up with something that is
10:32
interoperable between different products.
10:35
What is what is something that people might argue about?
10:40
Well comes to integration, I mean I'm not looking for you
10:43
know dirt or anything but I'm curious as someone who's not
10:45
taking part of these conversations you know, what are
10:48
some of the things that you guys are trying to figure out and
10:51
maybe one organization or one person, you know thinks it
10:53
should be done this way and another person another way, how
10:56
do you kind of, can come come to consensus around that?
10:59
So one of the big contentious things, I was one of the
11:02
co-authors of the nist digital identity guidelines, which were
11:05
Rewritten in 2018. And one of the really
11:08
contentious things was that Wanted to deprecate SMS MFA
11:14
because when you send a multi-factor authentication code
11:17
as a text message that text message can be intercepted with
11:21
off-the-shelf, hardware and software, we know that.
11:24
And so, it's not very secure, their Sim jacking, right?
11:27
There's lots of ways for an attacker to get to that to get
11:30
to that, message SMS as an infrastructure was never
11:33
intended to be secure. And so the Telco companies
11:39
obviously took issue with us publicly saying, this is
11:42
insecure and we need to deprecate it and said, look, we
11:46
have ways to detect some jacking.
11:48
We have ways to time limit these codes, so they can't be used for
11:51
very long. Like this is an okay way to do
11:54
multi-factor authentication and it's better than just a
11:57
password. Like there's no question about
11:58
that and it's really easy to deploy.
12:01
It doesn't require anyone to install an app and so there are
12:05
a lot of benefits to it there, a lot of drawbacks to it and the
12:07
same thing is happening. I'm like the same sort of
12:10
discussion is happening right now with using email for
12:12
multi-factor authentication for a long time.
12:14
We said no, no, no, that doesn't even count as multi-factor
12:17
authentication because it's supposed to be something, you
12:19
know, something you have and something you are.
12:22
And if you just have a password and email, then that's something
12:25
that's protected by a password and something else that's
12:26
protected by a password. And so you're not protecting
12:28
against different kinds of attacks.
12:31
But if you're in a corporate environment where you can put
12:34
multi-factor on the email, then, maybe that is a valid.
12:38
Of MFA because you know that that person has had another
12:41
Factor checked via another chill right?
12:44
And so a lot of companies are having this struggle with like
12:49
okay what counts as MFA what doesn't count as MFA does it
12:52
have to be just more secure than just a password or is there a
12:56
higher bar for security that we want to talk about?
12:58
So yes. Identity nerds love to argue and
13:02
we're very bad at agreeing on things and but we're good at
13:06
moving forward. We do build new technologies.
13:08
Really quickly like the identity field moves.
13:10
Moves forward really fast. Yeah, I think even fissionable
13:13
forms of MFA are better than no MFA at all.
13:19
You know, it's funny because those listening to your how you
13:22
got into. I am story and you're talking
13:24
about all these standards and people are like, you understand
13:27
these and you're like, yeah, they have to remember that you
13:31
were you and to be a rocket scientist and you have a degree
13:33
in physics, so it all adds up to me anyway.
13:39
But the other part kind of the the endpoint of your journey or
13:43
the last where you currently are AWS putting together or being
13:49
responsible for the AWS Cognito project is fascinating.
13:55
I mean I work with clients all the time and when were you know
13:59
working on customer I am projects and strategies the
14:04
question asked is always what about Amazon?
14:07
What about Amazons A customer. I am capabilities and so that's
14:13
AWS Cognito right. Maybe you can tell us a little
14:16
bit about what it is, who's it for and all those great things.
14:22
Yeah. So the way that AWS thinks about
14:24
identity as we divide it between Workforce and consumer and it's
14:30
it's absolutely huge here. So the between the two of those,
14:34
we do over 500 million Authentication.
14:38
Authorization calls per second. So it is just like the scale
14:43
that you work at an AWS is just Bonkers.
14:45
Wait you said 500 million per second?
14:48
Yeah that's ridiculous. It is completely ridiculous.
14:53
Only slightly less than what Bezos makes per hour but anyway
15:00
Yeah, so so the part that I am really excited about and that I
15:03
am diving. A lot of my energy into is that
15:05
the Amazon could be do product, which is our consumer-facing
15:09
product. And the reason I'm really
15:11
excited about is because I don't think that any company is really
15:14
delivering a great consumer identity product.
15:17
Right now as a service, right? Consumer identity is a friction
15:20
point at the beginning of every app at the beginning of
15:23
everything you want to do, right?
15:25
And there's no great way to have.
15:30
Have end-user remember a password or have to enter an MFA
15:35
code, right? That's always a pain.
15:38
And so we're looking for more researching new ways, how can we
15:41
make this easier? How can we make it less
15:43
friction? How can we make it harder for
15:46
attackers to get in and easier for good guys to get in and
15:50
that's a really interesting problem for me.
15:53
And Amazon company do is just a lot of fun because it's it's a
15:57
Swiss army knife or I like to say it's like a So identity
16:00
Legos like you can build a whole bunch of stuff with it.
16:03
It's got a native directory. It does oid.
16:05
See it does sam'l. We just had a token revocation.
16:08
Like, there's a whole bunch of stuff you can build just with
16:11
Cognito and so just talking to Cognito customers are our
16:15
customers, do all sorts of really neat things with the
16:18
product that we never expected them to do and so we can talk to
16:23
them about. Hey, what are you building?
16:25
Oh, you're building a castle. Cool, that guy over there is
16:27
building a car. Like if we built a Wheel like
16:30
would that help both of you somehow and so we're building
16:33
new stuff all the time and talking to people about how
16:36
they're using the product and it's a lot of fun.
16:38
I won't claim to be an expert on Cognito.
16:40
So for the folks who aren't as familiar with it, you mentioned
16:44
Workforce and customer. I am, is it the same product for
16:49
both? So kognito is both, and then
16:51
it's just a matter of configuration or is there
16:53
something more to it? That people should be thinking
16:55
about it when they're talking about either constituency.
16:59
Nope, so cognito Is the consumer identity piece and then
17:04
Workforce is handled by a product called aw ssso, okay?
17:07
So we have ssom Cognito and then on the kidney do side, I guess
17:12
who's taking advantage of Cognito?
17:14
Is it app developers who are already building on AWS
17:18
services? Do you see uptick from maybe
17:21
through who are using other platforms like Azure Google
17:24
Cloud but then they come in and use Cognito for some reason.
17:27
Can you can I help me understand how you know What does it look
17:30
like from a development perspective?
17:31
If I'm trying to layer on I am on top of my product we do.
17:35
So we see multi-cloud use cases and we see AWS native use cases.
17:39
And we see just like, hey, I'm hosting a an app on like
17:43
Rackspace or whatever dreamhost whatever my web developer is.
17:46
And I just want to add some identity on top of it.
17:50
So yeah, we get customers from all over the place using Amazon
17:53
Cognito, but it's mainly after developers.
17:55
Yeah, it's people who are building something new and they
17:58
just needed an easy way to Log people in and we call that
18:01
undifferentiated, heavy lifting right?
18:03
They don't want to do all of that heavy lifting.
18:05
It's not going to make their company a better company to
18:08
build a whole login system from scratch and try to do it in a
18:10
secure way. But they know that at amazon
18:14
security is job 0, and if Amazon is holding all the passwords and
18:17
no passwords ever go through my system, I feel way better about
18:20
that than I do about trying to build this all myself to a
18:23
standard that would be considered best of breed.
18:26
So sir, what are the use cases that Cognito supports today?
18:31
Is it just the authentication? Do you have a directory?
18:35
Do you do you know have registration widget or talk to
18:39
us about what's there today? And maybe a little bit about
18:43
what we can expect to see in the future.
18:45
Yeah. So today it is.
18:48
It's a native directory. It's a federation service, it is
18:52
authentication and we have a Service called a hosted UI where
18:57
we will host your login page, your account recovery page, or
19:02
MFA page, anything that has to do with user credentials or
19:06
creating the account recovering, the account that those you can
19:10
host on AWS servers. They'll still look like they're
19:13
on your domain. So there won't be a change in
19:15
the URL, but it will be hosted by AWS so that credentials,
19:21
never go on your server. You never have to touch any of
19:23
that. And so you are the Ability of
19:27
having to deal with passwords and usernames.
19:29
And and all of that is taken away from you which our
19:33
customers really like and we're going to continue building.
19:36
As I said, we want to make this an easier experience with less
19:40
friction and more security. And so those are the types of
19:43
things. You'll see us releasing on
19:45
cognitive in the future. I believe I heard somewhere that
19:49
you kind of taken a low code. No code approach.
19:54
Is that correct? And Whether it is, or isn't it?
19:59
Sir certain developers skill set or language?
20:02
That people need to kind of be familiar with in order to have
20:09
success with Cognito, or is it something where you guys
20:13
support, pretty much whatever bring your own kind of language.
20:20
Yeah, so we kind of go both in the direction of if you want to
20:24
do a bunch of custom code, we have API so you can call and you
20:28
can use Cognito for that and that's totally fine.
20:30
But we also recognize that a lot of people don't want to do that,
20:35
like they want a low code, no code option.
20:37
And so we're building out more and more functionality in the
20:39
AWS console that is just like do you want MFA?
20:43
Yes. Or no clicker.
20:44
Radio button, click save and you're done like you don't have
20:47
to write all that code and And we will even host the page for
20:52
you. And so there is like you can
20:53
have a Cognito instance up and running with zero code which is
20:56
really cool. That's something that you know,
20:59
when I started an identity that was not an option for many
21:01
vendor and so we're hoping to get more and more people into
21:07
identity just as administrators who know who know the security
21:10
implications of the decisions they're making, but don't
21:13
necessarily have coding skills. Yeah.
21:16
Struggle with organizations that are looking to build something
21:19
that already exists. As a product somewhere else.
21:21
And I think what you hit earlier was something that I always
21:24
agree with is, you know, who's spending more on security?
21:26
Is it going to be, you know, an organization is doing 500
21:29
billion medications per second or is it going to be, you know,
21:33
an organization that, you know, builds Transmissions?
21:36
I'm gonna go with, you know, the company that's actually probably
21:38
spending more money, you know, on the actual security part of
21:40
it, because chances are, they're probably be more successful with
21:43
it. And it's not core competency or
21:45
really core to the product or the mission right for another
21:47
organization. So it makes a lot of sense of be
21:49
able to take advantage. Of those types of solutions and
21:52
I definitely see the low code. No code approach, I love the
21:55
Lego brick analogy. I think that's something that,
21:57
you know, that that I've seen elsewhere, you know, we see it a
22:00
lot and like itsm tools, so things like service now and Pega
22:06
and other things like that, where it's becoming more
22:09
business-friendly to configure identity services.
22:12
But all that does is really masking, the hard work that
22:15
takes place behind the scenes right to make sure that that
22:18
stuff works and interoperability. 80 and things
22:20
like that. And I think that leads me to
22:22
kind of the next conversation topic that I want to bring up
22:24
which is around ID Pro itself. Because I do think it takes a
22:28
army of really smart people to kind of come up with these types
22:31
of standards and having the conversations right to allow,
22:37
you know, companies to interact in a safe way through their
22:41
identity mechanisms. So why don't we talk a little
22:43
bit ID Pro? And I know that, you know, just
22:46
for a starting topic. Let's say you recently were at a
22:50
Reverse and announced the new CID Pro certification.
22:55
I know it's something that has been near and dear to a lot of
22:58
people's heart within Ida Pro itself and kind of figuring out.
23:01
How do you prove that you can actually do?
23:03
I am work right? Are you qualified?
23:06
So maybe why don't we start with that?
23:08
And you know, what is this CID Pro, you know, who is it for?
23:12
Yeah, so this kind of goes back to the conversation that Ian and
23:16
I had when we founded ID Pro, right?
23:18
Like identity is Critical to the success of security and privacy.
23:22
But security has cissp, right? And privacy has a certifications
23:28
as well, but there's nothing for identity.
23:30
There's no vendor neutral way to prove.
23:32
Yes, I know General identity skills.
23:34
I can do critical thinking about security issues until now and so
23:39
we decided, hey we're going to build one.
23:41
We started building a body of knowledge last year where ID Pro
23:46
members who are people who have been in the industry for
23:49
decades. Kids are writing scholarly
23:52
Journal level articles, about identity, and access management
23:55
topics. And we said, oh we can certify
23:57
against that and so you Jeff and a lot of other identity
24:02
professionals all got together and wrote questions that said,
24:06
hey someone with like our Target candidate is someone who has two
24:09
years of experience either as a developer or an administrator
24:13
with an identity system. And so these are questions that
24:17
are aimed at someone who's been in the field for two.
24:20
Years and hey, this is what you should know.
24:21
By the time, you've been in the field for two years, this is
24:23
what you should be up to speed on and so someone with two years
24:27
of experience should be able to take the test and pass it
24:30
without studying, that's our goal.
24:32
So, I think it's a good target audience if I like it because
24:36
it's still, you know, relatively entry-level but does require
24:40
some experience in the industry, right?
24:42
To be able to kind of come up the stuff or at least be able to
24:45
read the body of knowledge on the ID, Pro dot org website,
24:48
which is a, which is a It reads, I think if people are looking
24:51
for good identity content, go there and I don't say that just
24:55
because we're on the list is a podcast but also because it is,
24:59
you know, there's a wealth of information out there and I do
25:00
like the fact that, you know, if you're looking to work the
25:03
certification process through ID Pro essentially, that's the page
25:08
that you can go to to study, right?
25:09
There's most of the questions, I think have sources that come
25:13
from that area to make it, you know, I won't say easy, right?
25:17
Because you still need to have the knowledge and demonstrate
25:19
it. But easy from the fact that
25:21
you're not having to scour the web eight different, you know,
25:24
websites a bunch of YouTube channels, you know however
25:28
people are studying for things like Security Plus and C is
25:30
ESPYs and you know, things like that.
25:32
I think it's a good place to start.
25:34
You mentioned that the certification focuses on more?
25:38
Do that like the technical of the administrator side of
25:41
identity? I think there's a large
25:43
constituency of people who are maybe not as technical they
25:45
might be more on a business analyst or process-oriented when
25:49
it. That identity.
25:51
What are your thoughts around? How do we include those people?
25:54
As part of that is is this test for them as well?
25:57
Or do you see like a different path to kind of demonstrate?
25:59
Maybe I am as a process knowledge and maybe less, so on
26:03
the technical side of things. So a couple of things one is
26:06
that it is intended for them. We intentionally crafted the
26:10
question so that they're not gotcha questions, right?
26:12
There's nothing that requires like rote memorization of the
26:15
phyto standard where you must know exactly what string, this
26:18
API returns, right? Like that.
26:19
It's not the kind of thing that were testing against the
26:23
questions are things like, hey, a developer is making an
26:28
identity system and he has a, he's getting a token from a
26:34
federation situation and he decides not to check the
26:37
signature on the token because his system works fine without
26:40
checking that signature and he's got stuff to do.
26:42
And so he just push to production and leaves the
26:45
office, right? If you are an identity person,
26:47
who doesn't know that like you should be checking signatures
26:50
Tokens to make sure that they actually came from where they
26:52
said they were coming from. You should fail this test.
26:55
And so, if you don't know those sorts of things that require
26:58
like critical thinking and understanding of this system and
27:01
why we trust the system, those are the types of things that
27:04
we're testing for not specific, gotcha questions.
27:09
However, people have expressed interest in future,
27:12
certifications, and going deeper.
27:14
So we've had people say, hey, I want to do a whole certification
27:17
about governance and how you govern an identity system and
27:21
how the business processes work, how you make sure that all of
27:24
these mechanisms are in place that keep the system healthy and
27:28
hey I want to do a whole legal certification about what are the
27:31
legal restrictions and requirements and enablement
27:34
Surround identity and and can I prove that I know those things
27:39
and so for future certifications like we could go in that
27:42
direction or we're going deep into one, specific role and
27:45
Identity or we could go by industry and we can say hey Finn
27:50
Identity has its own special requirements and Healthcare
27:54
identity has its own special requirements.
27:57
And like, Hospitality identity has its own special
27:59
requirements, right? And so we could go that
28:01
direction like kind of a horizontal direction as well.
28:04
So there's a few different ways to slice it and if all of you
28:07
listening out there, have opinions, please join, I do pro
28:10
join the certification committee because these decisions are
28:13
decisions that are being made now and they're going to affect
28:16
identity Professionals in the future.
28:18
So I think this is Such important work and it's really
28:22
providing some credibility or, you know, if somebody needs to
28:28
have some kind of certification to kind of advance in their
28:32
career or at least prove some base level, Baseline level of
28:36
knowledge, I think that's where certification can be really
28:40
handy, and it's also kind of a way for folks who are kind of
28:44
early in their career. You know it's interesting sorry
28:47
because I think in the beginning of the Episode where you were
28:51
kind of describing your background of whether you chose
28:54
I am or I am shows, you think you said kind of of course I am
28:58
chose me right? Because folks from who have been
29:02
in this industry for a long time?
29:03
That's how you know, 99% of us got into, I am, was it shows us,
29:09
you know, we kind of lucked our way into this, very cool
29:12
industry, but I think in the future that's actually going to
29:15
change, you know, maybe somebody will have their entry into I am,
29:19
Via our project but they others might choose like, hey, that's
29:24
an industry. That I know somebody who's in
29:26
the industry, I want to get into that industry and they start by
29:31
getting certified. And what the certification
29:33
really means to me, like what you're talking about with the,
29:37
you know, the signing tokens. Like those are kind of like some
29:41
baseline knowledge that if you have that, you kind of
29:44
understand what's going on when it comes to I am.
29:48
So I think it's very important. What you're doing.
29:50
And I think it really helps that next generation of I am
29:55
practitioner get into the space, which I think is important for
29:59
all of us to do is kind of like handing handing this industry
30:03
down and making sure that the next round of qualified people
30:08
don't have to kind of kill themselves to figure it out that
30:12
we're, you know, giving that passing our knowledge on.
30:18
But I wanted to get into Kind of some of the the Tactical
30:21
components. Now if somebody wanted to take
30:24
this exam you know, do they need to be my ID Pro member?
30:29
Where would they go to sign up? And you know how much does it
30:33
cost to take the certification exam?
30:37
Sure you don't have to be a member it's open to the public
30:40
you sign up at ID Pro dot org, slash CID Pro.
30:45
That's for a couple or calling certified identity
30:47
professionals, CID Pros, the credential you get However, if
30:50
you pass the exam you do get a year of Ida Pro membership for
30:54
free so you can come hang out with all of the idea Pros.
30:58
We have a slack that we all hang out on all day.
31:00
And lots of people ask random questions of like identity
31:04
professionals who have been around here, you've been around
31:06
for 10 years. Like how did you handle this
31:08
problem? How did you do this?
31:10
Those sorts of things. The exam is $750 and Ida Pro is
31:16
a non-profit, nobody's making money off of this.
31:18
This is what it costs us. To develop and deliver the test.
31:22
And we're hoping to make this a sustainable program where we can
31:24
deliver more tests in the future of different subsets of
31:27
identity. So I think it'd be interesting
31:29
to see identity as a formal education path, right?
31:35
I think there's a lot of in information security but
31:38
building out the curriculum for someone to show career
31:41
progression specifically with my identity would be interesting to
31:43
see and I think this is kind of one of those first steps towards
31:46
that. I will tell you right now that
31:49
the slack All for ID Pro is just a loan that is worth the price
31:54
of admission for an ID Pro membership which I believe is
31:57
$150 a year. Yes, if I remember.
32:00
So just that slack Channel alone is well worth it and then you
32:05
get everything else. So I think we're burying the
32:07
lead a little bit. It's like that's that's where we
32:09
want people to be at because there are really smart people
32:11
and really friendly people who are asking questions answering
32:16
questions. And yeah if you're struggling
32:18
with and I am questions. Um where you know, there's
32:21
forums like you know, probably date myself stackoverflow,
32:23
right? And things like that, right?
32:25
Where people go to ask questions.
32:26
It's a great spot to be able to really pick the brains of, you
32:29
know, I'd sell though. Identity nerds out there to, you
32:33
know, answer things that chances are someone might have seen it
32:36
or solve that already or can tell you what doesn't work.
32:39
So you don't go down a rabbit hole of, you know, making
32:42
mistakes that have a misstatement made before.
32:44
So I think that's always really helpful.
32:47
So I'm a big supporter of ID Pro for sure.
32:50
And I love the fact that there's a certification for it.
32:53
I wish I had contributed more. I think I have one question the
32:56
test and there is others who are out.
32:58
There are definitely double digits you know like yourself
33:00
and know. Ian has written about a lot of
33:02
questions. I think people like Matthew
33:03
Carter and Chris Phillips they believe of also you know
33:06
contribute a lot. So it has taken a lot of work to
33:09
get to this ditch you know to the to the state you're in right
33:12
now in a launch release. I guess from start to finish.
33:16
How long did it take to actually get this?
33:19
Into. Okay, we've got something.
33:21
Let's announce it and let's laugh.
33:23
Let people start registering. It was it six months a year
33:26
longer than that? It took almost a year.
33:29
Yeah, I so I took three months of Levi took maternity leave an
33:34
early 2020 and I came back in July.
33:40
I expecting that the board would have moved forward on this
33:42
project. I do pro board and they had just
33:46
been super busy and nothing happened.
33:47
And so I had Cleared my calendar to take leave and I was like,
33:51
all right, I'm going to take this on like I'm going to do
33:54
this. We're going to bring this in and
33:56
like I'm going to launch it it identifies next year so so what
34:01
happens when you show up at identifier sand and you have
34:04
that that presentation that you gave to kind of announce it,
34:07
what was it like to can I get out on that stage and say okay
34:10
this thing that we've been thinking about here it is.
34:13
Have at it. What's what was the reaction to
34:14
it? It was so amazing.
34:16
Jeff. Like I literally did a happy
34:17
dance on stage. I was so so so happy we could
34:21
finally open registration for the test and everyone was
34:25
stopping me in the hallways and going I'm so glad you did this.
34:28
I'm going to sign up. I'm going to have my whole
34:29
company sign up. I'm going to have my whole
34:31
consultancy sign up like we're getting a huge amount of
34:34
traction for it so it's just really great to see that as the
34:39
industry was clearly ready for this.
34:40
Like, this was the right time. I'm kind of sad that I didn't
34:43
get to identify first this year. You spoke it identifies.
34:47
You just kind of alluded to it. Doing the happy dance.
34:52
Can you give us a recap of the conference?
34:54
I know I'm definitely going next year, you know, God willing, but
35:00
can you give us kind of a recap and tell us a little bit about
35:04
what you enjoyed? What was your favorite session?
35:07
Sure, the conference this year was a lot smaller because of the
35:10
pandemic. And so the people who came were
35:13
really industry veterans and they really pulled out all the
35:16
stops. I think they were, there are so
35:18
excited to be there. That the sessions were like
35:21
extra well-done and extra research.
35:24
I think it also helped that they had to pre-record beforehand
35:27
because it was a hybrid event where half of it was done online
35:29
and so they couldn't just put in their slides the night before
35:32
they actually had to at least 21 try run to record it for the
35:35
online audience. But it was it was really
35:39
awesome. There's a great session by Tori
35:44
Mayer. Who's a first-time identifier
35:45
speaker. She's a product manager at
35:47
paying and she's About why you need product management in your,
35:52
I am team in order to have strategy and listen to
35:56
customers. And not just do project
35:58
management of like Gantt charts and how you get things done.
36:02
But really making sure you're doing the right things and
36:04
making sure you're doing the right things for the long term.
36:07
That's a really great talk. David Lee of cloud entity gave a
36:11
great talk on diversity in the identity industry and how we can
36:15
do real work there and have real solutions.
36:17
And not just do sort of thoughts and prayers.
36:19
Kind of do this is bad. I hope it gets better kind of
36:22
thing. Brian Campbell gave a great talk
36:26
on the new par standard John. Lennon did a talk.
36:31
That is actually going to be a book.
36:33
I guess, he wrote a whole book on actually identity at AWS.
36:36
So, there were a ton of good talks this year, and I think the
36:41
online portal is still open so people can watch those.
36:44
And then normally identifies puts them up online for free a
36:49
few. Later.
36:50
So they may be coming to the internet soon but I don't know
36:53
for sure on that. Yeah, I'll have to keep an eye
36:55
out for that cuz I, yeah, I think usually they do have them
36:57
online somewhere to view and I'm sad to, I didn't make it.
37:00
This is the first one I've missed since 2016, at least.
37:05
So, for whatever reason I was I'm looking forward to traveling
37:10
and just didn't make it to this one.
37:12
So, definitely. Next year, for sure it's a great
37:14
conference. I think it's the best identity
37:16
conference at least in the u.s. that I've been to.
37:19
Ooh not that other ones are bad but I think this one being so
37:22
specifically focused on identity and the fact that while it's
37:26
hosted by ping, I think pink does a good job of separating it
37:29
out that it's not all about ping and it is separate, you know
37:33
enough where there are certainly competitors there and it really
37:36
has turned into you know not just the Ping Identity
37:40
conference. It's it's own thing, right?
37:42
And I think they've done a really good job of having that
37:44
level of abstraction that layer of second of Separation to make
37:47
it a little more vendor neutral, which That's what we try to do.
37:50
On our show to is, is not do commercials or anything like
37:52
that and really kind of more talk more substance.
37:55
One thing I thought was really interesting as we were kind of
37:58
prepping before the call. Is you mentioned your fondness
38:01
for escape rooms? So I think there's a couple
38:04
things you told us a story about one that you attended in Denver,
38:07
but before we get to that for folks who aren't familiar what
38:11
is an escape room? So, an escape room is a series
38:16
of puzzles. They actually started in
38:19
Seattle. Where I live.
38:20
So it's not like who incidental that I'm into this.
38:23
It's in the first one. You were literally locked in a
38:26
room and the key to get the door was like in a safe and you had
38:31
to get the code to the safe in order to get that I could to the
38:33
save, you had to find all the pieces of the puzzle in her to
38:36
find all the pieces of the puzzle.
38:37
You had to find all these keys and you had to do all these
38:40
solutions to different puzzles around the room and some of them
38:43
involve like mirrors and lasers and some of them involved like
38:47
literal jigsaw puzzles and some of Involved like getting a
38:51
magnet through a maze. And so, it's a whole bunch of
38:55
fun, puzzles that you have an hour to solve, and then if you
38:59
don't solve them, you are locked in that room forever and you
39:02
starve and you die. Hmm.
39:03
Okay. So there's definitely some
39:05
repercussions for for not for not getting a getting things
39:08
done. And this is.
39:09
So, I guess, the important thing, right?
39:10
This is, this is in the real world, right?
39:12
We're not talking about a webpage, although maybe there's
39:14
a computer with, you know what? Page open, but you're actually
39:17
physically in a room and there are puzzles or things and a
39:22
theme usually associated with it, right?
39:24
To kind of say, okay, you need to get to this objective,
39:27
whatever that may be open the safe or, you know, find the key
39:30
to the exit, whatever it may be, which I think is fascinating, I
39:33
have not done one yet myself, but I know people who have and
39:38
they just keep talking about it and raving about it and it's a
39:40
little bit irritating sometimes about how much they like it.
39:43
But why don't we talk about the one that that happened in
39:46
Denver? Because I think it was an
39:47
interesting story on a couple different fronts and I don't
39:49
want to spoil That's a lot. You go ahead and tell it.
39:51
Yeah. So I try to get some ID Pro
39:53
members together and every identifiers to go to an escape
39:55
room. So the last one we did was in
39:58
Washington, DC in 2019. And for that one, we set an
40:02
all-time record for the fastest team to get out of the room.
40:06
Because it turns out that like, identity people are really good,
40:09
creative problem solvers, and so like the very transferable skill
40:13
set. And so this one, we like we had
40:16
really high expectations. Were like, oh yeah, like what's
40:18
the record for the room we're going to?
40:19
Beat that record and we did one in Denver this year and identify
40:24
verse and the record for the room was 27 minutes and we got
40:28
out in 33. So we were pretty darn close but
40:33
we had to haul ourselves all the way from the conference center
40:37
which is more by the airport at to downtown Denver and we were
40:41
going to Uber, but apparently Ubers are really expensive and
40:44
unreliable now because like post IPO, they want to make money or
40:47
something. And but as it turns out, like at
40:51
6 p.m. on a Tuesday, like limos are super cheap and so we
40:55
actually rented a limo and a tidy Pro members, drink,
41:00
champagne, and were ferried to an escape room in downtown 10
41:04
for then and then came back. And so it was, it was an extra
41:09
fancy Escape. So if you need any more
41:11
motivation to join ID Pro, that's right.
41:15
Sarah will pick you up in a limo and take you?
41:18
A escape room. Is that what I'm hearing?
41:20
And you will get out in record time.
41:22
There's a 50% chance. I just imagine this this image
41:27
of like this limo pulling up to identify verse and then a whole
41:31
bunch of identity, nerds kind of like hopping into it and people
41:34
sticking out of the top of the sunroof, whatever drinking
41:37
champagne as they're like, you know, onwards my toe off
41:40
companions are unique, he's back to downtown and then they're
41:44
like jokes the whole way. I mean, this is Now really
41:49
getting into like probably true identity, nor tears nor identity
41:52
and heard territory for sure, but it sounds like a lot of fun.
41:55
So, you know, I think what want to do is probably end up here on
42:00
a lighter note, what is your ideal escape room like describe
42:05
it for us and the listeners. So, let me tell you about a few
42:09
of the Escape rooms that I have really been impressed by, and
42:14
like, some combination of those would probably be my ideal.
42:17
So the first one is in LA. It's on Hollywood Boulevard.
42:19
There is an escape hotel that has, like, eight different
42:22
Escape rooms. And I did not even know this was
42:25
there, but I was there with my family and we walked in and we
42:28
were like, do you have any open it like, and they're like, yes,
42:30
we have lots. Which one do you want?
42:32
And we were like, which one is the hardest?
42:35
And I forget what the name of the room was but they were like,
42:37
it's this room and but you start off blindfolded and chained to
42:42
the floor and we were like cool. We're in like let's do it right?
42:48
And it's in Hollywood, right? So it's Hollywood production
42:50
level. So that one was super fun and
42:53
then, hey, Sarah. Are you sure though that was an
42:56
escape room? Right?
43:02
You have to wonder when they do that.
43:04
Yeah, no kidding. Sorry then there's a great one
43:08
in Austin that we did where we were supposed to.
43:14
There was this whole cabinet that they had built in doors.
43:17
And so you started outside the cabin, you had to break in.
43:20
And then you saw the bunch of puzzles in the cabin, and the
43:22
fireplace swings open. And you're like, okay, what's
43:25
behind the fireplace and you crawl in and there's an
43:28
adult-sized slide to the next level of Building where there
43:32
are more puzzles and so you have to go down the slide, that was
43:37
awesome. And then, my absolute favorite
43:39
escape room is here in Seattle. The company that founded Escape
43:43
rooms is called puzzle break. And they started with two and
43:46
they found that they had groups that were trying to compete to
43:49
see which one could get out faster, but they were two
43:53
different rooms and so it wasn't really a fair contest.
43:56
And so they built two, identical Escape rooms.
44:00
And not so not only can you bring two groups and see who
44:04
gets out faster? But there is a, it's all say on
44:07
steamed and there's like this plastic candelabra on the wall
44:10
that lights up when the other group, it's a milestone.
44:13
So you can sort of tell like who's ahead.
44:15
So like we went in and then like we're looking for things and
44:19
like there's this clearly, this like chest said that we're
44:21
supposed to put together and like there's one piece missing
44:24
that we can't find somewhere in the room and then one candle on
44:27
the kind of labra lights up. And we're like, oh, Oh, hell no.
44:31
Like they already found the chest piece, like we have got to
44:33
get to work, but this is not cool.
44:36
So I think like some combination of like, competitive escape room
44:40
that involves being like blindfolded and chained to the
44:43
floor that also involves slice. Like, that's a combination of
44:48
the best things I've seen. That's an Eclectic mix of
44:51
flavors for your escape room. I like the idea of the
44:56
competition part, right? Kind of bracing against someone
44:58
else. Yeah, I firmly believe there
45:01
should be like Hotel. There should be like, escape
45:03
room Olympics. There needs to be a world
45:06
champion. It sounds kind of like the movie
45:08
Saw. If you think about it in that
45:11
perspective, that's maybe a little bit more morbid way to
45:14
end on a light note. Yeah, don't know.
45:16
Kidding. Right.
45:17
You know, I like to I like to keep it real for the folks you
45:20
know, I haven't done one myself but I would imagine that if I
45:23
were going to do one I would like something that is like
45:27
virtual reality based somehow where You're not constrained by
45:31
the limits of physics, man, you know, where there's some
45:35
component to it, where you're able to leverage, kind of a
45:38
bunch of different Technologies, maybe to kind of solve issues,
45:42
or, you know, puzzles, things like that.
45:45
So, maybe that's one of those in Australia.
45:49
And so you have to change your strategy.
45:55
Oh my gosh. I think we need to do a
45:58
fact-finding mission. To to come up with some sort of
46:02
identity problem that will that needs the identity at the center
46:05
podcast to be there. That's right.
46:07
We're going to use our Char, we're going to need our escape
46:10
room Sherpa, Sarah to help us with that, as well.
46:12
So I think that should be a mission of ours to take on at
46:14
some point first. And what about yourself?
46:16
What about have you ever done an Escape Route?
46:18
I've never done an escape room. I thought about the one that
46:22
Sarah mentioned, where there's a key locked in a sieve, and I've
46:25
got a safe in my house and I know the combination and half
46:29
the time. Time.
46:29
It takes me to three tries to get to get it plugged in so I'll
46:33
see you do it. Like, yeah, once he even if I
46:36
know the combination, I takes me a while to get the safe open, so
46:41
I don't think I would succeed. But I think if I was to say what
46:45
an ideal escape room would be for me, would be something
46:49
that's almost impossible to solve like, finding my keys or
46:52
finding my remote control, you know, even though I was the last
46:57
person to use it and I put it wherever Still can't find.
47:00
It sounds like every day's an escape room for you.
47:03
Jim was true. There's been that way for a long
47:07
time. All right.
47:09
So I think, we think we brought it back up to the lighter note,
47:12
which is what we wanted. So we can forgive my saw
47:14
reference, but before we let Sarah go any final words of
47:19
wisdom, Sarah, that you want to lay on us and lay on the
47:21
listening audience for anything we've talked about today.
47:25
Oh gosh. Yeah, one of the tenets of the
47:29
oauth working group that I have made.
47:31
Also a tenant at AWS identity is make the easy things, easy and
47:35
make the hard things possible. So when you're doing identity,
47:39
you want to make it as easy as possible for things to get
47:43
people to do things that they do every day, right?
47:45
Login change, their password, things like that, and you want
47:48
to make it possible for them to really dig into this system and
47:52
write their own code if they want to make their own custom
47:54
stuff. If they want and and really go
47:56
to new lengths and New Heights. So, that's one of the tenets
48:00
that I firmly believe in what architecting identity.
48:04
I really like that. I think, you know, there's
48:06
enough hard thing to this world. Let's try to make the easy
48:08
things. Easy, that's when I think one of
48:09
things I've been saying recently is, you know, I know identity
48:12
can be overwhelming, but the goal is to make it whelming,
48:18
it's like okay, there's so many things to solve issues, whatever
48:21
right? And you can easily get
48:23
overwhelmed with like a list of a hundred thousand.
48:24
Is that need to happen. Let's just, let's just take it
48:27
down to whelmed, right? Let's just fix the things we can
48:29
fix and just work on in order. And that's how you eat.
48:31
An elephant one bite at a time. Jim, how about yourself words of
48:34
wisdom and words? Wisdom?
48:36
I have is, you know, in preparing for this episode I
48:40
went out to YouTube and watch some videos on AWS Cognito, so I
48:45
actually may have known more about it than I let on with my
48:48
questions. But I'd say anybody who's
48:51
interested, I mean a ton of videos out there.
48:54
Ron YouTube around AWS Cognito. So if you want to start that
49:00
educational Journey, that's one place to start.
49:03
But I would actually even turn it over to Sarah could because
49:05
maybe there's better than than what I found, right?
49:08
I found things on YouTube but where else can people go to
49:11
learn about it? Yeah, and so AWS doesn't annual
49:16
conference. Every year in December in Las
49:19
Vegas, called reinvent and all of the talks from that
49:22
conference go up on YouTube. So if you search for reinvent
49:25
and search for Cognito, you'll find some of the, some of the
49:27
best stuff that are solutions Architects.
49:29
That are our service team has put out there.
49:33
That's a great way to get started on learning.
49:35
Now, you should see reinvent banners around when Gartner
49:38
would do their identity access management conference which I
49:40
believe was kind of like right before it and It's smart.
49:43
I think to kind of, you know, have the two.
49:45
It's almost like black hat and definitely.
49:49
I did both. And I was in Vegas for two weeks
49:51
and that was a terrible mistake. No one should ever stay in Vegas
49:53
for two weeks. No, I did it for one week like
49:55
Vegas, but I wouldn't want to live there.
49:58
I like biggest only because, you know, when I go, I'm staying in
50:01
a hotel, there's good restaurants, you know, usually
50:03
it's, you know, on a company's answer, something like that,
50:06
which is also helpful to this amazing.
50:09
But like, that's part of the problem, right?
50:10
Like you just can't stop eating. Yeah.
50:13
Well, you know, or you don't have to go outside, right?
50:15
You can breathe our official error for, I think, my record is
50:18
four days. I never saw some light once in
50:20
Vegas. Yeah, well, you know, that's
50:25
what gives me. My radiant pale skin, that
50:29
lichens, me to Casper the Friendly Ghost.
50:31
Hey, Jeff. I'm very, how long is the ideal?
50:34
Stay in Vegas for me. It's for days, anything beyond
50:37
four days. So like I cannot wait to get to
50:39
the airport. Yeah.
50:40
I think I would say the same. But I think that's true for
50:45
probably most areas unless you're actually going for
50:49
leisure like a beach or if it's something like you can't go to
50:52
Europe. For example, for four days.
50:54
Or if you're in Europe, can't come to the US or four days
50:56
because it takes you a day to get there today to get back.
50:59
You're going to want to spend more time.
51:00
So you know, I could I could probably swing a week but that's
51:04
I don't drink really that much. I don't gamble but I love to
51:07
people watch and I'll tell you right now, Beast be with Las
51:10
Vegas being one of the best areas and actually Paris, France
51:13
was another fantastic area for people watching.
51:16
I could I could satisfy that that that need you know for
51:20
several days and be good. Sarah, what about yourself?
51:22
What's your, what's your ideal Vegas?
51:24
Stay duration? Yeah, I think for today is just
51:27
perfect and then you got to get out of there and then you're
51:31
throwing your last leftover coins, in the slot machine at
51:34
the, at the airport and your way out, okay.
51:38
All right, I think that's a good spot that we can leave it for
51:40
this week. Sarah, thank you so much for
51:42
joining us. I really enjoyed the
51:43
conversation. Kind of talking about everything
51:45
from from Neva WS Cognito perspective but also just
51:49
congratulations on the ID Pro success and especially on the
51:54
certification getting out there. CID Pro.
51:56
So for folks who want to get more information about that
51:59
certification you can visit ID Pro dot org slash CID pro has
52:04
all the information there, it's open to the public.
52:06
You don't have to be a member which is fantastic.
52:09
Would encourage people to check it out and try to pick out the
52:11
one question that maybe My made it onto the test or not.
52:14
We'll see. So with that we'll go ahead and
52:17
leave it for this week. You can connect with Sarah on
52:19
LinkedIn as well. I'll have a link to her in our
52:20
show notes and linked to CID Pro.
52:23
Also to AWS kognito for folks who want to learn more about
52:27
that specifically. And with that, we're going to go
52:30
ahead and wrap it up for this week, preciate it and thanks for
52:32
listening. And we'll talk with you all in
52:34
the next one. Thanks for listening to the
52:40
identity at the center podcast. If you like what you heard,
52:43
don't forget to subscribe and visit us on the web and identity
52:46
at the center.com.