Latest / Identity at the Center / #324 - RSM & IDAC Present - The Intersection of Cybersecurity and Digital Identity with Tauseef Ghazi

Transcript

#324 - RSM & IDAC Present - The Intersection of Cybersecurity and Digital Identity with Tauseef Ghazi · Identity at the Center

• 0:00
  Cybersecurity has always been an apprenticeship, OK?
• 0:04
  It's always been an apprenticeship.
• 0:06
  It's not a a skill that is just kind of like learned off of
• 0:12
  books. Like you work with a lot of
• 0:13
  people. I've learned a lot of stuff from
• 0:15
  other people. And there's a lot of repeat work
• 0:19
  that you do over and over and over again.
• 0:22
  And it gets better every time you do it right.
• 0:26
  But we don't have but people that are sticking around long
• 0:30
  term to be able to cultivate that apprenticeship models
• 0:35
  anymore the way that it used to be.
• 0:38
  So if we get 2 years here and you've got another year here and
• 0:40
  two years over there, it looks like you've got good experience
• 0:44
  at very large, reputable firms and you were part of, you know,
• 0:47
  their, their cyber team. But if you took that person as
• 0:52
  an individual and you said, OK, let's look at your own personal
• 0:55
  depth on something, right, related to these topics, I find
• 1:01
  it sometimes lacking. And I think that that's the
• 1:03
  shift that that needs to be made is that we've got to bring back
• 1:07
  the apprenticeship model a bit more.
• 1:11
  We've seen that apprenticeship model like if you if you look at
• 1:13
  some of the other countries that are ahead of us in in tech
• 1:17
  development and they're moving faster than we are, everywhere
• 1:22
  you look, the apprenticeship model is intact.
• 1:31
  This is identity at the center if it has anything to do with
• 1:36
  IAM. This is the go to podcast now
• 1:41
  your hosts Jim McDonald and Jeff Stedman.
• 1:51
  Welcome to the Identity at the Center podcast.
• 1:53
  I'm Jeff, and that's Jim. Hey, Jim.
• 1:55
  Hey, Jeff, how are you? It's a bad cowboy.
• 1:57
  How are you I? Was wondering because I was
• 1:59
  going to scold you if you didn't say anything about my hat.
• 2:02
  How could I not? How could you not?
• 2:04
  I mean, you know. OK, so we're at Gartner, I am
• 2:07
  Grapevine, TX, and I'm the only one wearing a cowboy hat.
• 2:10
  A little disappointed. OK, Mom, you sticking out like a
• 2:13
  sore thumb. You've got the you've got the
• 2:15
  cowboy hat and you've got the Hugh Hefner sort of crushed
• 2:18
  velvet jacket. You definitely look like a
• 2:20
  smoking jacket, right? But out of Deadwood or something
• 2:23
  like that. Yeah, well, that's that's my
• 2:26
  jam, you know? We did talk about it with Head
• 2:28
  last year. By the time people were hearing
• 2:30
  this, I mentioned that because you looked like a like a dealer
• 2:33
  in that one and we got a little bit of that in the very
• 2:34
  beginning. I always say I just want to
• 2:36
  blend in. You're doing a terrible job of
• 2:39
  blending in exactly. So I want to say thank you for
• 2:43
  Gartner for having us. We're going to be speaking
• 2:46
  tomorrow, so it'll be in the past at this point.
• 2:49
  But they've hooked us up with a room.
• 2:52
  They've done a really nice job. RSM has paid our expenses to be
• 2:56
  here. So thank you to them as well
• 2:57
  for, you know, making this possible to be here and to put
• 3:03
  this podcast together for the community.
• 3:05
  So thank you. So thank you to Gartner, thank
• 3:08
  you to RSM. Why don't we jump into it
• 3:10
  because this is really the start of a series that we're going to
• 3:12
  be working on throughout 2025. And this whole idea of identity
• 3:16
  at the center, right, That's what we named this podcast.
• 3:18
  And it is all about the intersection of cybersecurity
• 3:22
  and digital identity. And one of the things that I
• 3:24
  think about here is as identity people, we sort of get into our
• 3:28
  silos sometimes like, oh, it's identity thing, but we really
• 3:31
  need to understand how identity plays in other parts of
• 3:34
  organizations, security, privacy, because we cannot be
• 3:37
  successful as an identity individual within an
• 3:41
  organization that needs to be organizational buy in.
• 3:43
  So a lot of these conversations that we have, sometimes you're
• 3:46
  reaching outside of the identity team a lot of times, most of the
• 3:49
  time I would say, and you really need to kind of understand, OK,
• 3:51
  well, what are the, you know, the, the tricks, the, the, the
• 3:54
  tie insurance, right? To how does this affect maybe
• 3:57
  somebody who is in application security or attack penetration
• 4:01
  or maybe even the business or strategy or risk, right?
• 4:04
  So the whole idea here is we're going to put together over the
• 4:06
  course of 2025, about 10 episodes where we kind of pull
• 4:10
  together these ideas and say, OK, so this is the Identity
• 4:13
  Center podcast. What does that mean when it
• 4:15
  comes to X? And today we're kind of setting
• 4:18
  the stage with it, so we'll kind of go with that.
• 4:20
  We're going to talk obviously about digital identity and all
• 4:22
  these, but hopefully that makes sense.
• 4:24
  Anything going to add? I mean, what I'd like to add to
• 4:27
  that is like the biggest theme that's happening at the
• 4:29
  conference and in the industry overall is this idea of identity
• 4:32
  security. So it's that identity is moving
• 4:35
  into a larger role within cybersecurity overall.
• 4:39
  And so I had an interesting conversation with a few folks
• 4:44
  yesterday where it's like, all right, the industry is kind of
• 4:47
  heading to this identity security route.
• 4:49
  A lot of clients are still fighting the, the AB, CS and
• 4:53
  123's of role based access control gave their
• 4:56
  authentication house in order giving privilege access
• 4:59
  management. And that's great.
• 5:01
  Like if you have to, if that's where you are, that's where you
• 5:04
  are and get those things fixed. But this is where the industry's
• 5:07
  heading. So even if that's where you are,
• 5:10
  pay attention to this because a year, 2 years down the road,
• 5:14
  this is where you and your organization are going to be.
• 5:16
  This is where you're going to be making your investments.
• 5:19
  So start boning up on it now. Yep.
• 5:21
  Important to be well-rounded and that's kind of what we're trying
• 5:23
  to do here. So we have partnered up and
• 5:26
  buddied up with our friends at RSM.
• 5:27
  We have a lot of really smart people that we work with.
• 5:29
  So we're going to talk with some people from RSM.
• 5:31
  We're going to talk with maybe some clients that you and I work
• 5:33
  with throughout the year and probably others and experts in
• 5:36
  specific domains kind of help tie us all together.
• 5:38
  So hopefully by the end of 2025, we'll kind of have this
• 5:41
  curriculum where people can kind of go back and look and say OK,
• 5:43
  identities at centre. What does that mean and how does
• 5:46
  that relate to some of these other topics?
• 5:47
  So let's kick it off with the man, the myth, the legend.
• 5:51
  He leads our security and privacy and consulting practice
• 5:55
  here for RSM. I want to welcome Tasif Ghazi.
• 5:57
  Everyone just calls him Ghazi. So welcome to the show, Ghazi.
• 6:00
  Thank you guys. It's such an honor to be here on
• 6:03
  the podcast. You know, I'd say that it's,
• 6:06
  it's not my first time. I, you know, I've been behind
• 6:09
  the scenes probably at least three or four times.
• 6:12
  So I was really privileged and honoured this time around to, to
• 6:16
  get to come and actually speak to both of you.
• 6:18
  So thank you for inviting me. So the first time technically, I
• 6:22
  think that you saw us do our thing was at a Gartner
• 6:26
  conference a couple years ago and we were doing some things
• 6:29
  and I, I, I think it was probably in Vegas when we were
• 6:31
  doing that. And so, all right, who the heck
• 6:33
  are these guys? What are these podcasts all
• 6:34
  about? What's going on?
• 6:36
  And then I think you hopefully started to see it was like, oh,
• 6:38
  you know, we're talking to, you know, really intelligent, smart
• 6:42
  people in the business. We're having conversations, not
• 6:45
  presentations and really kind of getting to the the crux of
• 6:48
  things. So hopefully that made a good
• 6:50
  impression. It must have because we're still
• 6:51
  doing it two years later. And you've been very supportive
• 6:53
  of what we do. No, it was, it was definitely a
• 6:56
  really, really good impression. And, you know, I was really
• 6:59
  floored. I mean, I had listened to the
• 7:01
  podcast before, but you know, just the guests that we're on
• 7:07
  and their perspectives, you know, there was so much learning
• 7:11
  just, you know, I, I just find that really, really intriguing
• 7:14
  because you know, cybersecurity, we're going to get into this
• 7:17
  today. It's not a topic that's can be
• 7:20
  solved by one 2-3 people in an organization.
• 7:23
  It's an organization wide activity, right?
• 7:26
  And there's a lot of lessons that we got to learn from other
• 7:28
  organizations, other colleagues, you know, third parties that are
• 7:33
  helping support one another. You know, there's such a huge
• 7:37
  vendor ecosystem now around cyber.
• 7:39
  So bringing all that together, you know, and getting that
• 7:42
  perspective, I think it's you guys have done a really good job
• 7:45
  at this podcast. And, and I was really impressed
• 7:47
  with the the guests that come on.
• 7:49
  This is going to be the downfall probably.
• 7:53
  Well, flattery will get you everywhere on this podcast.
• 7:54
  I'm very fond of saying that. And now you're in the hot seat.
• 7:57
  So we've got you here for the first time.
• 7:59
  Tradition, when you come on our show that we talk about origin
• 8:01
  stories. So give us the Ghazi origin
• 8:04
  story. How did you get into
• 8:06
  cybersecurity at large? You know, it was really by
• 8:09
  accident. You know, I was a young boy.
• 8:13
  I, you know, really didn't know much about technology, but you
• 8:20
  know, my father was very good about making sure that
• 8:23
  technology was around me always. I used to have AZX Sinclair
• 8:27
  Spectrum plus computer that, you know, most people probably don't
• 8:30
  know what that is, but you know, it was a pain in the neck to
• 8:33
  boot up and, and work on and, you know, I was resilient on on
• 8:36
  making sure that it worked. So it kind of, you know, having
• 8:40
  access to it. One was, was really good, but in
• 8:43
  my, you know, teens, you know, 1718, one of my first jobs was
• 8:50
  actually at a Internet service provider and it was really doing
• 8:54
  customer service work. However, the customer service
• 8:57
  call center was right next to the server room and I was
• 9:00
  fascinated by what was going on in that room, right?
• 9:03
  So I made friends with the the server engineer and I used to
• 9:07
  work the night shift. So, you know, after customer
• 9:10
  service calls died down, after all the kids were offline, mirc
• 9:15
  and all of that, right? him and I would, would sit there
• 9:18
  and, you know, we would talk about routing, we would talk
• 9:20
  about some Microsystems, all kinds of other things that were,
• 9:23
  that were going on. So I got fascinated by that and
• 9:27
  that's how I kind of stepped into it.
• 9:29
  Learned a lot of infrastructure, learned a lot of Windows, a lot
• 9:33
  of Microsoft tech and really started on the infrastructure
• 9:37
  side. And that was really fortunate to
• 9:41
  to, you know, step into the security and privacy and the
• 9:44
  realm. It came through a public
• 9:47
  accounting angle with a big 4. But that gave me an opportunity
• 9:52
  to actually go and build a cyber practice.
• 9:54
  And, you know, that gave me, while I understood the tech, you
• 9:59
  know, it gave me new aspects of what application security means,
• 10:03
  right, what penetration testing means and how do you bring that
• 10:06
  back together. And then that extended beyond
• 10:10
  even enterprise systems into operational technology systems
• 10:14
  do a lot of IT and OT convergence work in my career.
• 10:19
  And little by little that's just kind of grown.
• 10:22
  And I've always been fascinated by cyber security and just tech
• 10:27
  in general. So it's constantly kind of fed
• 10:30
  itself. I have a finance degree.
• 10:32
  So, you know, I, I don't really have any.
• 10:36
  I've never had, I've never felt the need to actually go and
• 10:38
  study it in, in the university and such.
• 10:42
  So, so that's kind of my origin story.
• 10:44
  I've been with RSM about 10 years now.
• 10:47
  I lead our security and privacy practice for North America.
• 10:52
  But my day job is, you know, obviously I, I'm the practice
• 10:55
  team, but I'm a client service professional.
• 10:57
  I'm really helping organizations build their cyber programs to
• 11:01
  help them mitigate against the wide array of risks that that
• 11:05
  our clients face today. And that cuts around identity,
• 11:09
  that cuts around perimeter endpoints, you know, user
• 11:13
  awareness. I mean, you, you pick a cyber
• 11:15
  concept and it's there and then, you know, there's, there's
• 11:19
  industry specialities that you have to have within that realm
• 11:22
  that you have to bring up as well.
• 11:24
  So it's been a very, very good journey over the last 25 years
• 11:28
  in this space and, and just learning from our clients and
• 11:31
  giving back, you know, those learnings to others that don't
• 11:34
  know it. So.
• 11:35
  Gazi, I love that that curiosity angle injector.
• 11:38
  You saw the server room, you got excited.
• 11:41
  You know what's going on in there.
• 11:43
  Let's stay curious, man. You got to stay.
• 11:45
  Curious, you know, and I talked to folks who listen to podcasts.
• 11:48
  I don't think there's anybody's job description that says listen
• 11:52
  to this podcast. If you listen to the podcast,
• 11:54
  they're trying to to expand themselves.
• 11:56
  But I would say that's a key for anybody is to you've got to be
• 12:01
  curious. You've got to put in the extra
• 12:03
  hours to learn. If it's not what you want to
• 12:06
  learn, figure out what it is in this world that you want to
• 12:08
  learn and what you're passionate about, do that.
• 12:11
  But if you want to be in this space, I mean, there's endless
• 12:14
  amounts that you can learn. Absolutely.
• 12:16
  I mean, I tell people that I'm coaching all the time that, you
• 12:19
  know, those learnings don't stay with an organization, right?
• 12:23
  That's investment in your own self, right?
• 12:26
  And you're going to carry that wherever you go.
• 12:28
  So a lot of times people say, well, like, you know, I don't
• 12:30
  want to work 40 hours or I don't want to work 50 hours.
• 12:33
  I'm like, you know, I'm going to do my job and I'm going to go
• 12:35
  home. That's a disservice to yourself,
• 12:38
  right? And I'm not saying that you
• 12:40
  should do your your job in a, in a way that you're overextending.
• 12:43
  I mean, your personal time is very important.
• 12:45
  We'll talk about what I do for my personal time maybe today as
• 12:48
  well. But I do think that there's
• 12:51
  investment that's required, right?
• 12:53
  And bring it back to yourself always.
• 12:56
  So stay curious and invest in yourself.
• 12:58
  Stay curious and then you'll hit the pinnacle of your career
• 13:00
  being on the Identity Center podcast.
• 13:02
  So there you go. Made it.
• 13:05
  So let's talk a little bit about some of these planned episodes
• 13:08
  we've got coming up over the year.
• 13:10
  We're kind of starting this overview with the digital
• 13:12
  identity level and sort of the the overarching kind of vision
• 13:15
  of that. But we're also going to talk
• 13:16
  about things like strategy and risk, compliance and governance,
• 13:19
  architecture and engineering, application security, attack and
• 13:23
  surface management, secure cloud, detect and respond,
• 13:26
  resilience and recovery. Resilience is a big one that
• 13:28
  we're hearing here at the Gartner conference.
• 13:30
  And then of course, emerging technologies.
• 13:32
  There's always something new on the horizon.
• 13:34
  I know I just kind of threw an awful lot out there.
• 13:36
  Are there any things that kind of jump out of your mind?
• 13:38
  It's like, OK, these are things that are really kind of top of
• 13:40
  mind for you right now. I mean, they all are top of
• 13:42
  mind, you know, now, some more so than others, right?
• 13:48
  But I think the important part is that the, the reason that,
• 13:51
  you know, when we were kind of orchestrating this with UVI is
• 13:54
  about the, the, the episodes is because you need every single
• 13:59
  one of these things to kind of work together, right?
• 14:02
  And identity ultimately is that the, the core of everything
• 14:05
  because you can't do strategy and risk if you don't, you know,
• 14:08
  manage identity workflows properly.
• 14:11
  You can't do governance and compliance if you don't manage
• 14:13
  identity workflows properly. You can't do application
• 14:16
  security if you don't manage identity workflows properly,
• 14:19
  right? So whether it's cloud, whether
• 14:22
  it's attack surface management, you know, whether it's threat
• 14:24
  management, emerging tech, we talked about AI now or you know,
• 14:30
  people were talking about blockchain forever, right?
• 14:34
  Tomorrow it's going to be about agents in in, in the space of
• 14:38
  AI, right, And how they're, there's needs to be rigor around
• 14:41
  that. That's going to be another ID
• 14:43
  that we're going to talk about at some point, right?
• 14:46
  All of that cohesively, right? Has to be on top of mind for
• 14:52
  every seesaw like they're contending with all of these.
• 14:55
  A lot of times, you know, you talk to seesaw and you're
• 14:58
  talking to them about identity. But you know, if you think
• 15:00
  about, you know what seesaw thinks about when they're
• 15:02
  sleeping at night. They sleep.
• 15:05
  One, they don't sleep, but when that is what, what are they
• 15:07
  thinking about? I mean, they're thinking about
• 15:09
  compliance and governance and they're talking about
• 15:11
  architectural engineering, right?
• 15:12
  They're talking about resiliency and they're thinking about
• 15:15
  resiliency of their organization.
• 15:16
  That's why they do sleep because, you know, are they
• 15:18
  resilient or not? So you kind of bring all that
• 15:22
  together and it's very hard to dissect this in one go.
• 15:26
  And I think giving it some time and understanding that there's
• 15:31
  all these different pieces, but they all have to come together.
• 15:34
  They have to work together. That's how I think about my
• 15:37
  cyber team here at RSM as well, that we have specialists in each
• 15:44
  one of those areas, right? I'm not an identity specialist
• 15:47
  by any means, right? I'm a operational technology
• 15:50
  specialist. That's what my bread and butter
• 15:52
  was. But you need engineers, right?
• 15:56
  You need identity professionals, you need penetration testers,
• 15:59
  you need, you know, operations managers, right?
• 16:03
  You need governance and compliance specialists and
• 16:06
  strategy specialists. So all of that, you know, has to
• 16:11
  come together. And I, I think that that's the,
• 16:15
  the big hill that everybody has to climb right now is that, and
• 16:18
  it's not one thing. It's which people talk about
• 16:21
  vacuum, all right, or what what that is.
• 16:23
  It's it's always because it's so many of these things, but I
• 16:27
  think that if you're organized about it, you can take credit
• 16:31
  for multiple things, right? If you engineer things
• 16:33
  correctly, right, if you structure your applications
• 16:38
  correctly, then you know you've got benefits on on other sides
• 16:42
  that you can take. Governance compliance is a great
• 16:45
  example of that. If you know you've got to comply
• 16:48
  with this on one side, you can comply with the plethora of
• 16:51
  other requirements, you know, that might be required for our
• 16:56
  organization. PCI compliance or CMMC
• 16:59
  compliance or whatever that is, right?
• 17:02
  Healthcare compliance, you do it one time, you should be able to
• 17:06
  take credit for that because access control is everywhere,
• 17:08
  right? Change control is everywhere.
• 17:10
  And I know that we'll talk about that in more detail, but, you
• 17:13
  know, I think about these these episodes and the structure of
• 17:17
  some of these topics that you just talked about, Jeff, as
• 17:20
  something that is really interrelated, but at the same
• 17:24
  time needs enough time and attention to be kind of
• 17:30
  dissected by themselves, right? So they have to stand on their
• 17:33
  own, but then they have to come together as well.
• 17:35
  So we're hot right now. When I say we're, I mean digital
• 17:38
  identity and sort of this business that we're in this,
• 17:40
  this vertical or industry, whatever we're going to call it.
• 17:43
  Why do you think that is and why, why is it getting heat now?
• 17:46
  You mentioned some things like compliance and security and
• 17:49
  risk, but identity has been around for a long time.
• 17:52
  But now we're starting to see, you know, it's getting a lot
• 17:54
  more top of mind, it's being paid more attention.
• 17:57
  We're seeing more investments in it.
• 17:58
  Why do you think it is now? Is there something that's maybe
• 18:01
  changed within the last couple years or is it just this is the
• 18:04
  normal evolution of kind of how you've seen maybe waves come
• 18:07
  through cybersecurity at large? Well, I think that the change
• 18:11
  happened 10 years ago, maybe maybe even more.
• 18:15
  What's done over the last two or three years is the, I think
• 18:21
  acceleration, right? And I'll talk about that in a
• 18:23
  minute. But I think before that, why is
• 18:26
  identity hot? I think that's, that's a really
• 18:28
  critical question. And I think we've started this
• 18:30
  conversation about why are we talking about identity and
• 18:34
  cybersecurity together, right? They've always been together.
• 18:38
  There's never been cybersecurity without identity.
• 18:43
  There have been times where identity has been carved out
• 18:46
  from cybersecurity because it's it's a massive endeavor.
• 18:49
  And and you know, there's a business enablement component to
• 18:52
  it that you've got to work through.
• 18:54
  But why is it hot? Think about what, you know, what
• 18:58
  hackers do today, right? It's credential theft, right?
• 19:03
  And it's bypassing authentication, right?
• 19:07
  It's impersonation, it's session hijacking.
• 19:10
  It's man in the middle attacks, right?
• 19:13
  Exploitation of token systems. Everything that I just said is
• 19:17
  related to identity one way or the other.
• 19:19
  OK, so I don't know if you've ever played this game, Call of
• 19:25
  Duty. If you play Call of Duty,
• 19:27
  there's a there's a mode of play mode called War Zone, right?
• 19:32
  And in war zone, you kind of see this perimeter, right?
• 19:35
  And then over a period of time, that perimeter shrinks and
• 19:37
  shrinks and shrinks and shrinks, right?
• 19:40
  And it gets to a very, very confined spot till the time the
• 19:43
  the last man is standing. That's how I think about
• 19:46
  identity is because that perimeter has been shifting,
• 19:48
  right? We used to have perimeters.
• 19:50
  We had defined perimeters, we knew what they were.
• 19:53
  And then we went to cloud, right?
• 19:55
  And as we went into into SAS applications and cloud
• 19:58
  environments, we lost the control of the perimeter, right?
• 20:01
  So it started coming in. So then you have to go to the
• 20:04
  next thing. What's the next thing?
• 20:05
  Well, how are you going to protect it?
• 20:06
  Well, identity becomes naturally the place.
• 20:10
  Well, then we added remote workforce right through COVID.
• 20:13
  Well, that accelerated. We also added bring your own
• 20:16
  device, right? So that's accelerated.
• 20:19
  So you have to kind of start seeing all of these things that
• 20:21
  happened in the last and all these things happened in the
• 20:23
  last 10 years. And that's accelerated the
• 20:27
  conversation and really put identity at the forefront
• 20:30
  because honestly, what what else are you going to do?
• 20:33
  How else are you going to protect your environment, right,
• 20:35
  if you can't protect it by by making sure that identity is at
• 20:39
  the centre of it. So I think that's what's changed
• 20:43
  in my mind. I don't think identity has
• 20:46
  become more important. I think it's just become more
• 20:50
  visible to people clearly on what that is.
• 20:54
  And then the technology stack has changed, like what you could
• 20:57
  do with identity 10 years ago, right?
• 21:00
  You, you can do so much more today, right?
• 21:03
  Whether it's role based access control or, you know, secrets
• 21:05
  management and things like that. There's so much more there to
• 21:09
  dive into to, to get a better, you know, security profile of
• 21:16
  your organization and get better protections.
• 21:19
  Yeah, you touched on this a little bit, but so when Jeff and
• 21:22
  I came up with the name of this podcast, it was a 2019.
• 21:26
  So the idea of identity security hadn't even been thought of at
• 21:30
  that point. But in terms of, you know, what
• 21:33
  we were thinking with identity at the center's, identity should
• 21:36
  be at the center. I think right now or back in
• 21:39
  2019, it was silo, silo silo's. Now what you're hearing more and
• 21:44
  more folks come on our podcast and they're like, because
• 21:48
  identity is at the center and they're like, oh, that's kind of
• 21:50
  funny. I'm on the identity at the
• 21:51
  center podcast. But I also think our industry
• 21:55
  can be a bit of an echo chamber. Like it's identity at the
• 21:58
  center. We're in identity, go identity,
• 22:02
  everything's identity. And you know, I hear terms like
• 22:07
  identity is the new perimeter. People are saying that a little
• 22:10
  bit less, but I wonder when I when you hear that that term
• 22:14
  identity is new perimeter, and maybe you just touched on it
• 22:16
  there with like that analogy of the shrinking perimeter.
• 22:21
  What is that? Is that what you're kind of
• 22:23
  getting out with the identity as the new perimeter?
• 22:26
  In other words, you can't trust, I think that the old perimeter,
• 22:29
  the idea was, you know, you have this crunchy shell and the soft
• 22:33
  inside. That was what produced the sale
• 22:34
  time, right? And that doesn't work anymore.
• 22:38
  Like the crunchy shell is just almost might as well not even
• 22:41
  have, even though I'm more in favor of layers of defense.
• 22:44
  In other words, like, you know, get past the crunchy shell.
• 22:47
  Now I get past this, now I get past this and then, you know,
• 22:50
  we're going to instantiate the identity check.
• 22:53
  But I also kind of feel like I have this.
• 22:56
  This is like a a spider web that reaches out into so many areas
• 22:59
  where identity is now part of your your logging mechanism
• 23:05
  where you can start to use behavioral analytics where
• 23:10
  you're watching who's coming in and you're tying it all all back
• 23:14
  to an identity. Or it looks like somebody's been
• 23:17
  compromised. Maybe somebody's laptop has been
• 23:19
  compromised and that shows up an X number of vectors, but a lot
• 23:23
  of them are identity based. So when you hear identity as a
• 23:27
  new perimeter, what what of that resonates or kind of what comes
• 23:30
  top of mind to you? Yeah.
• 23:32
  I mean, it's, it's all of that, right?
• 23:34
  For me, you know, it's, it's really challenging to figure out
• 23:39
  where to put the controls, right?
• 23:41
  As a cyber professional, that's the fundamental job, right?
• 23:45
  Is that where are you going to put the controls?
• 23:47
  So the analogy that I was sharing from this game, right,
• 23:52
  where the perimeter is shrinking, that's what's
• 23:54
  happening. Over the last 15 years, we've
• 23:56
  seen that perimeter shrink, right?
• 23:59
  You, you, you had edge computing and edge protections, they're
• 24:04
  kind of dissipated, right? Then you go inside and you say,
• 24:07
  OK, well, maybe it's on the application level, right?
• 24:10
  I need to put that, well, that didn't work out really well,
• 24:14
  right? So much compromise happened in
• 24:16
  the application security space. Then you can go on the endpoint
• 24:21
  level, right? But endpoint still has the
• 24:23
  challenges of what you said, right?
• 24:25
  What access should you have, right?
• 24:28
  And what is you, you as a person, what should you be
• 24:31
  granted access to? So you start looking at all of
• 24:35
  those challenges. I mean, we've had PKI
• 24:37
  infrastructure used and, you know, public private key
• 24:40
  infrastructure used forever, right?
• 24:42
  It wasn't easy to use. So it's shrinking, shrinking,
• 24:46
  shrinking, becoming more and more difficult to manage and
• 24:49
  ultimately where you settle down.
• 24:50
  Is that OK? Well, I think it's the
• 24:52
  individual. What is the access that you need
• 24:55
  to do your job right? What are the resources that you
• 24:58
  need access to? What are the two or three things
• 25:00
  that you need to have to validate or verify that identity
• 25:03
  that it is you, right? And you know, is it going to be
• 25:09
  multi factor authentication and all of that?
• 25:11
  And you know, or it's going to be a, you know, UB key and you
• 25:15
  know, you're going to have tokens and and other things to
• 25:18
  to support that. Or, you know, it's going to be a
• 25:21
  text message. Whatever the the vector is that
• 25:24
  you're going to use, it's still coming back to the person,
• 25:27
  right? Or the non all the non human
• 25:31
  stuff, right? It's my phone, it's my laptop,
• 25:33
  it's my IoT device that's sitting out there, right?
• 25:38
  But you have to take that in connection with the
• 25:43
  proliferation of those devices. I can't tell you how many people
• 25:47
  I know that walk around with two phones, right?
• 25:51
  They've got a laptop, they've got an iPad.
• 25:54
  So each person, if they're walking around with four
• 25:57
  devices, right? I mean, that's, that's a lot,
• 26:02
  right, to, to work through. So for every single human ID you
• 26:06
  have, you know, fourfold, I would say even probably more
• 26:10
  once you get servers and desktops and all kinds of other
• 26:13
  peripherals accounted for. It's, it's a massive endeavour
• 26:17
  to, to work through. And there is no control point
• 26:20
  other than the identity of that device of that person for you to
• 26:26
  put any, any sort of control on. And that's where it's been very
• 26:30
  difficult actually that's that's been challenging for Cisos in in
• 26:34
  general for for our clients as where does that start?
• 26:37
  Yeah, You're hitting on a very interesting point about the
• 26:39
  control point and understanding access control and what it
• 26:44
  means. Because, you know, you can say,
• 26:47
  all right, we're going to rely on identity as the kind of the
• 26:50
  final perimeter to whatever our data or application, but what
• 26:56
  does that mean? Identity is?
• 26:57
  How did that identity get created?
• 27:00
  How's it authenticating? You know, how's it being
• 27:05
  monitored? So there's all these controls in
• 27:07
  on top of like identity is just one word, but it means all these
• 27:11
  different things. One of the things that I'm, I'm
• 27:14
  really interested in with this series that Jeff and I are
• 27:19
  starting up around the intersection of identity
• 27:22
  security and cyber security is the conversations that we're
• 27:27
  going to get into. So for example, one is secure
• 27:31
  cloud. I mean when I think about secure
• 27:33
  cloud, there's, you know, I think of two types of clouds
• 27:35
  primarily. 1 is your SAS applications and one is your
• 27:39
  platforms or your infrastructures as, as a
• 27:44
  service, really what, what can you manage as an organization
• 27:50
  from a security perspective with those applications?
• 27:53
  Primarily when it comes to SAS applications, all you can
• 27:56
  control, there might be some configurations, but it's your
• 27:59
  identities, you know who gets access to what and then what
• 28:03
  authentication do they go through.
• 28:04
  If you're setting up your IDP, if you're talking about
• 28:07
  platforms, there's more, you know, infrastructural service,
• 28:10
  there's more that you can manage, but identity is probably
• 28:13
  still the key one. When you talk about resilience
• 28:15
  and recovery, that's another conversation.
• 28:17
  One of the things that gets me jazzed up about that is, you
• 28:21
  know, I kind of feel like I did a disaster recovery plan a long
• 28:24
  time ago and you know, it's like the Active Directory on Prem
• 28:28
  Active Directory was like, can we restore that?
• 28:30
  Well, OK, well, you know, check, move on to the next thing.
• 28:34
  Now it's just such a complex web that needs to be up and active
• 28:38
  before you can access anything. So these conversations, I think
• 28:41
  are going to get really interesting.
• 28:44
  For sure. I mean resilience 1 is, is, I'll
• 28:46
  just pick on that one. You know, it's not about the
• 28:49
  business continuity plan anymore or it's not about Emergency
• 28:52
  Management. It's how quickly can you
• 28:56
  recover, right? How quickly are you going to get
• 28:59
  back on your feet and what's the loss right, associated with it?
• 29:04
  So, you know, you start thinking about resiliency very
• 29:08
  differently. In order for you to accomplish
• 29:10
  that, yes, you need a business continuity plan, right?
• 29:13
  But you need to make sure that your vendor ecosystem is just as
• 29:16
  as tightly knit because when an issue happens, it's it's
• 29:21
  especially if it's related identities and those identities
• 29:24
  are cutting across multi cloud, Those identities are cutting
• 29:27
  across multiple SAS applications.
• 29:30
  Well, you got to have all those people in the huddle with you,
• 29:32
  right, to solve for it. Your security operation centres
• 29:38
  need to be be read into it. You've got to have better
• 29:43
  monitoring and, and all of that. I mean, you talked about even
• 29:46
  identity based threat monitoring earlier.
• 29:49
  I think identity based threat modelling is going to be like
• 29:51
  almost a necessity. You can't flip things back on
• 29:56
  until that's working. If you do, it'll be down in five
• 29:59
  seconds. Exactly right.
• 30:00
  So you have to rely on the heuristics and the behaviours of
• 30:04
  people. Ghazi connects from this device
• 30:09
  from this geographic location 95% of the time.
• 30:15
  If he's outside of that, this probably should be a flag.
• 30:18
  Somewhere I'm really excited for that conversation because I
• 30:20
  think another thing when it comes to disasters is the nature
• 30:24
  of disasters is different. You know, OK, you could still
• 30:28
  have an earthquake and your primary data center that you
• 30:34
  manage goes down and then you fell over to Sun Guard or
• 30:37
  something. The new disaster is a hacker
• 30:41
  comes in and encrypts all your data.
• 30:43
  It's an intentional disaster. There's no failing over to
• 30:46
  another data centre. Yeah.
• 30:48
  And we, we consciously you know at RSM, we moved our business
• 30:53
  card community team and you know our disaster recovery teams
• 30:57
  alongside our cyber teams because a lot of those events
• 31:00
  now are, are actual cyber related events, right.
• 31:03
  So you have to be integrated in delivery of that service.
• 31:09
  And it's not just for us to integrate and, and be be able to
• 31:12
  deliver that service, but it's also for our clients.
• 31:15
  They have to think about it the same way, right?
• 31:18
  Because they can't. You, you have to have all of
• 31:21
  these pieces together to be able to solve that problem.
• 31:24
  And it's very difficult when when you know you're in that
• 31:27
  boat where you know you, you, your data is encrypted.
• 31:31
  Yeah, guys, you one thing I want to talk to you about while, you
• 31:34
  know, I don't want to shift completely away from this
• 31:36
  technology conversation so exciting, but you manage a large
• 31:39
  organization of cybersecurity professionals.
• 31:43
  There's a huge skills gap out there and it gets worse every
• 31:47
  year, right, Even though we're starting to build many more or
• 31:51
  create many more opportunities for people coming out to college
• 31:54
  or coming into the industry. However, the gap gets wider and
• 31:58
  wider between the need and what's available.
• 32:01
  And so you had some ideas in terms of some of the, I mean,
• 32:07
  you talked about being from public accounting firm and that
• 32:10
  being a a great opportunity for folks to kind of learn the base
• 32:15
  skills and turn into cyber professionals.
• 32:18
  I was wondering if you could explain why that is?
• 32:20
  Yeah. You know, I, I, I'm a techie,
• 32:24
  right? And I believe in engineering and
• 32:27
  I believe in the bits and bytes of, of everything that that we
• 32:32
  do. However, over the last 25 years
• 32:35
  of, of being part of cyber practices and running cyber
• 32:38
  practices and, and really helping clients stand up there,
• 32:41
  you know, operations and, and programs.
• 32:45
  You need, you know, people that can do penetration testing and
• 32:50
  people that can do cloud engineering and somebody that
• 32:52
  can do, you know, infrastructure as code and somebody that does
• 32:55
  CID to CD pipelining and all of those right, They're all
• 32:58
  required, But there's also a general lack of, you know, kind
• 33:05
  of lifting and shifting. So one of the things that, you
• 33:09
  know, I've found very helpful throughout my career, and this
• 33:14
  wasn't really, this is again, by by accident that that you know,
• 33:18
  this happened when I joined a public accounting firm.
• 33:22
  I actually didn't understand what I was doing right
• 33:25
  holistically. Like I, I joined a cybersecurity
• 33:27
  practice, but a lot of the work that I actually did wasn't
• 33:31
  really cyber security. It was really controls work.
• 33:34
  And that was just the nature of the, the market at that time,
• 33:37
  right? Sarbanes-Oxley was new.
• 33:39
  Everybody wanted to talk about Sarbanes-Oxley, right?
• 33:43
  But if you think about those type of compliance requirement,
• 33:45
  what, what, what is it talking about?
• 33:47
  The fundamental very first thing it talks about is access
• 33:50
  control, right? So you have people that are
• 33:53
  getting schooled and trained in the basics of access control,
• 33:58
  basics of program management, basics of change control, right,
• 34:02
  basics of resiliency like backups and operations and how
• 34:06
  you're going to make sure that your environment is resilient.
• 34:09
  So is there a skill gap? Yeah.
• 34:12
  But there's also people that can shift right and can be skilled
• 34:16
  up. Not everybody needs to be your,
• 34:19
  you know, high end engineer in this space.
• 34:24
  There's a lot of work that needs to be done and it's everything
• 34:28
  from policy writing to making sure that compliance and
• 34:31
  governance is in place, right, to making sure that, you know,
• 34:36
  the programs are being managed appropriately and orchestrated.
• 34:40
  Cost management is a huge portion of it.
• 34:42
  Like you, you know, I mean, there's a lot of cost to cyber
• 34:44
  tools. There's a lot of FDE cost
• 34:47
  associated with cyber management of cyber operations, right?
• 34:52
  So management becomes just as important as the the skill set.
• 34:58
  So I think that there is, there is definitely places you can
• 35:04
  pull from to holistically build a team, right, and orchestrate
• 35:09
  this. It's been really successful for
• 35:11
  me right, to upskill people. It's been really successful for
• 35:16
  for me to actually invest time in the university systems and
• 35:21
  actually help them kind of develop the program that we
• 35:25
  need. Because the biggest issue is not
• 35:28
  that you're not getting people that have a cybersecurity
• 35:30
  degree. I mean, most universities now
• 35:32
  offer a cybersecurity degree. That wasn't a thing 20 years
• 35:35
  ago, right? There was barely an IT was a
• 35:38
  thing 20 years ago. So most whatever they're
• 35:43
  learning in school is better right, from a cyber perspective
• 35:46
  than it was 20 years ago. However, are they coming in
• 35:52
  ready, right, ready to jump in? And I think that there's a gap
• 35:58
  there. So right now my work with some
• 36:03
  of the universities that I recruit at is trying to get
• 36:07
  people more ready for the actual work that needs to happen.
• 36:10
  And the, you know, the actual work is around the, the 10
• 36:13
  things that you Jeff talked about at the beginning, right?
• 36:16
  It is around application security, it's around secure
• 36:18
  cloud, it's around detect and respond, right?
• 36:22
  It's around resiliency and recovery, right.
• 36:25
  But are they touching this at a, at a topical level where they
• 36:30
  just know the the concept or are they getting any practical
• 36:36
  experience with it? Right?
• 36:38
  And that's been the biggest challenge.
• 36:40
  The other thing that goes alongside with, and this might
• 36:44
  be a little deviation from your question, but it's it's skill
• 36:47
  set related, the shortage in the market then, you know, you, you
• 36:52
  get people to move around. But cybersecurity has always
• 36:56
  been an apprenticeship, OK, It's always been an apprenticeship.
• 37:00
  It's not a, a skill that is just kind of like learned off of
• 37:07
  books. Like you work with a lot of
• 37:08
  people. I've learned a lot of stuff from
• 37:10
  other people and there's a lot of repeat work that you do over
• 37:15
  and over and over again, and it gets better every time you do it
• 37:19
  right. But we don't have people that
• 37:24
  are sticking around long term to be able to cultivate that
• 37:28
  apprenticeship models anymore the way that it used to be.
• 37:32
  So if we get 2 years here and we've got another year here and
• 37:35
  two years over there, it looks like you've got good experience
• 37:39
  at very large, reputable firms and you were part of, you know,
• 37:42
  their, their cyber team. But if you took that person as
• 37:46
  an individual and you said, OK, let's look at your own personal
• 37:49
  depth on something right, related to these topics, I find
• 37:56
  it sometimes lacking. And I think that that's the
• 37:58
  shift that that needs to be made is that we've got to bring back
• 38:02
  the apprenticeship model a bit more.
• 38:05
  We've seen that apprenticeship model like if you, if you look
• 38:08
  at some of the other countries that are ahead of us in, in tech
• 38:12
  development and they're moving faster than we are, everywhere
• 38:16
  you look, the apprenticeship model is intact.
• 38:20
  So that's what my, I guess soapbox is that I got I, I
• 38:27
  really, I really struggle with that one.
• 38:31
  Yeah. But I mean that's a a big part
• 38:33
  of you know, developing people. It's not only the long term
• 38:40
  benefit of two through organizations that person is
• 38:43
  going to really appreciate and start to build their career.
• 38:48
  And I think we have this concept of at RSM of the boomerang
• 38:52
  people. So it's like people who go out
• 38:55
  into industry work 3 or 4 years to come back now they've got
• 38:59
  some new skills and experiences. But I do agree with you, the one
• 39:03
  year, 2 year, it's kind of like go somewhere time start to get
• 39:06
  rough. If you stick it out, that's
• 39:09
  where you really build your metal is going through the hard
• 39:12
  times. And I think that's a life skill,
• 39:14
  right? It's you learn more from the
• 39:16
  hard times than from the easy times.
• 39:17
  You guys have been doing the identity podcast for since 2019,
• 39:22
  but you've been doing identity work a lot, way longer, right?
• 39:25
  And I, I bet that even in the last two or three days, you've
• 39:29
  probably learned a thing or two that's new, right?
• 39:33
  And it's always evolving and you're probably going to go
• 39:35
  teach that to somebody, whatever you've learned.
• 39:37
  And that's what it's all about, right?
• 39:39
  So keeping teams together and I think building that
• 39:43
  apprenticeship model, whether it's a consulting business or
• 39:47
  whether it's a, you know, you're, you're in the industry
• 39:50
  and you know, you're kind of running your own operations,
• 39:54
  it's required either way, so. Yeah.
• 39:57
  I mean, one thing I did want to kind of pull out of that
• 40:00
  conversation was that, you know, it's, it's kind of the working
• 40:04
  with the frameworks, understanding the frameworks and
• 40:06
  the access controls. So the access control or I'm
• 40:09
  sorry, the frameworks are designed to help you meet the
• 40:12
  access controls, right. So it's going in and taking a
• 40:15
  NIST cybersecurity framework. Questionnaire and kind of like
• 40:21
  working through that. And I think you you mentioned it
• 40:23
  gets better the more times people end up doing it, they
• 40:26
  understand it more. Now when they go to a position
• 40:30
  where they're applying that framework and building a program
• 40:33
  around that framework, those pieces are really coming
• 40:37
  together. I think it has additional
• 40:40
  benefits as well, right? A lot of cyber stuff still gets
• 40:47
  pushed down because of, you know, compliance requirements,
• 40:51
  right, or governance needs and things like that.
• 40:54
  So some of that actually helps you work out, hey, you know,
• 40:59
  here's what the operational things are, right?
• 41:03
  Here's the tactical things I've got to do, but why am I doing
• 41:06
  some of these things, right? And if you understand the, the,
• 41:12
  the control side of it, you understand the auditable side of
• 41:16
  it, right, versus the actual, the work that needs to be done,
• 41:22
  I think you can be a better consultant, you can be a better
• 41:26
  internal specialist because you understand both sides of the
• 41:30
  house, right? I don't think I had appreciation
• 41:33
  of that till much later in my career.
• 41:37
  I did not like doing the the control work personally.
• 41:41
  I was like, I'm a cyber professional, right?
• 41:43
  I can architect and not work for you, right?
• 41:45
  And do a pen test for you. Why am I doing this other stuff?
• 41:50
  But you realize over a period of time that you still have to at
• 41:54
  some point justify those things, right?
• 41:58
  You still have to be compliant with certain regulations and so
• 42:01
  forth. And by understanding the
• 42:04
  infrastructure side of it, you know what that difficulty is,
• 42:07
  You come up with newer ways or better ways to solve for the
• 42:10
  compliance challenges you have because now you understand both
• 42:14
  sides of the world, right? So you bringing those two things
• 42:17
  together, it's, it's really hard for people because you know, the
• 42:21
  compliance is boring. It's really boring, right?
• 42:24
  But it drives a lot of like budgets for security, right, for
• 42:30
  organization, even for identity, like a lot of big companies,
• 42:35
  they, they do what they do because there are compliance
• 42:38
  requirements that they need to fund.
• 42:39
  Especially in certain industries.
• 42:41
  I mean, that is so that that was my background was I was in
• 42:44
  identity doing a lot of engineering program management,
• 42:48
  but in the manufacturing industry where it wasn't as
• 42:51
  heavily regulated, especially working on a lot of CIA and
• 42:55
  stuff. I ended up in the financial
• 42:57
  services industry doing internal as well as banking and and the
• 43:05
  loan operations. What I found out, especially on
• 43:08
  the workforce side of the House was the regulatory framework or
• 43:14
  regulatory oversight, which led to all the frameworks and having
• 43:17
  the GRC controls in place tested on a frequent basis and making
• 43:23
  sure it's a lot more rigid and demanding.
• 43:28
  And if you don't take the time to understand that and I had to
• 43:31
  kind of learn trial by fire, if you will, but I mean that was
• 43:36
  it's foundational I think for identity as you move up into
• 43:42
  more advanced leadership roles. And it, it's only going to get
• 43:45
  complicated with hybrid cloud environments, right?
• 43:48
  Because what is inherent in the cloud environment that gives you
• 43:53
  those controls, right? What is it that you need to
• 43:56
  build on top of that? Because just by putting your
• 43:58
  stuff in in the cloud, you're, you're not, it's, it's still
• 44:03
  your risk, right? It's still your data, it's still
• 44:07
  your problem, right? Ultimately.
• 44:09
  So sometimes I find it naive for people to say, OK, well, yeah,
• 44:15
  what was in Azure? And Azure's giving me these
• 44:18
  control points, right? What was it configured for that,
• 44:21
  right? If it's not configured for that,
• 44:23
  then you're you're not going to get those control points and the
• 44:27
  auditor will come and and we'll find you weaken those, right.
• 44:30
  We'll talk a little bit more about AI, but I, I kind of feel
• 44:34
  like this is 1 area where if we put AI in charge of making
• 44:39
  decisions about our access, we may have a harder time tracing
• 44:43
  it back to, OK, you know, was the right decision made, was the
• 44:48
  right information provided in order for that decision to be
• 44:51
  made. But I don't want to divert us
• 44:54
  into the. I didn't want to add 1 one thing
• 44:57
  real, real quick because I think it's, it's related to what we
• 45:00
  were just speaking to. One of the things that I've, you
• 45:05
  know, been really contemplating is so the large companies,
• 45:11
  right? Generally, there's a lot of
• 45:13
  conversation around identity at those companies, right?
• 45:17
  We deal with those clients all the time.
• 45:19
  You guys deal with them, I deal with them, right.
• 45:22
  But we have about 30,000 companies that are in the 500
• 45:27
  million to $5 billion range, right?
• 45:30
  In the United States. They don't have the resource
• 45:37
  leverage that that some of these larger companies have.
• 45:40
  They don't have the budgets, right?
• 45:42
  They're still contending with the same proliferation, right?
• 45:47
  They, they have scaling issues, They're still running hybrid
• 45:51
  environments in most cases. They're still kind of on prime
• 45:54
  and then they've got some stuff in the cloud.
• 45:56
  It's not very cohesive, right? They still need to be compliant
• 46:02
  with, with different requirements, right?
• 46:05
  So you kind of think about that demographic and I think that
• 46:11
  we've seen over the course of last so predominantly in the
• 46:15
  last five years that the attack vectors have shifted from large
• 46:19
  corporations right to some of these middle market companies or
• 46:23
  upper middle market companies, right?
• 46:25
  And it's because of that reason, it's because hackers are
• 46:28
  generally lazy, right? They're going to go after what's
• 46:31
  what's easier. And I think within the identity
• 46:34
  space and generally within broadly in the cybersecurity
• 46:38
  space, you can't functionally deal with those companies the
• 46:45
  same way that as the larger companies are because they don't
• 46:48
  have big programs that they that you can tap into.
• 46:52
  They don't have 10 resources to, to go pull on, right?
• 46:57
  They might have a total of five, they might have a total of 2
• 47:01
  cyber professionals that are in that organization, right?
• 47:04
  But they're still rotating through, you know, $2 billion.
• 47:09
  So there are, they need a lot, a lot of help as well.
• 47:12
  And you know, I think there's going to be some changes that,
• 47:15
  that are going to be required on how identities are administered,
• 47:18
  built, managed, operated for that demographic of client.
• 47:23
  And we've been, we've been thinking about that a lot in RSM
• 47:26
  on how we can make that mechanical and mechanise that
• 47:31
  holistically for those that demographic of client.
• 47:34
  But that's, that's huge. That's where most of the attacks
• 47:38
  are right now, and that's. Getting scanned just as much as
• 47:42
  the big companies. And it's kind of like the point
• 47:45
  that you were like, I was thinking like a safari example.
• 47:48
  The lion scans the herd and looks for what the weakest, the
• 47:53
  youngest, whatever, the easiest target.
• 47:57
  And so if we're scanning everybody and somebody's under
• 48:00
  invested and has some weakness like that's the target.
• 48:05
  So I thought I'd I'd mention that a little bit because it's
• 48:08
  been, it's been on my mind lately.
• 48:11
  AI is on the top of everyone's mind right now.
• 48:13
  I think I'd like to do a little bit of a lightning round, maybe
• 48:16
  an identity or security Rorschach test for you.
• 48:19
  So I'm going to throw out some terms and just tell me what
• 48:22
  comes to mind when you hear the term zero trust.
• 48:31
  I don't think there's anything else.
• 48:32
  Zero trust. I think it's a great concept
• 48:36
  like, hey, I don't trust anybody.
• 48:38
  OK? So you have to prove to me every
• 48:42
  single time that you're going to get access to a resource that
• 48:44
  you know you are who you are and you are connecting from where
• 48:48
  you're connecting. Otherwise, no.
• 48:51
  But reality is that it's, it's not been implemented at at an
• 48:58
  appropriate level and it is extremely cumbersome to manage.
• 49:04
  It requires a lot of manual intervention.
• 49:08
  So I feel it's more, you know, I'm not going to throw it as
• 49:15
  that it's not a good concept. It's a great concept, but it's
• 49:18
  hard to implement. It's really, really hard to
• 49:20
  implement. Real world execution is is the
• 49:23
  trick, right? Because it's not just why I
• 49:25
  bought it in a zero trust product.
• 49:27
  Now I'm zero trust. It's it's a combination of
• 49:29
  things. And there's a lot of, you know,
• 49:31
  product conversation around it, right?
• 49:33
  Well, you get this product and you get that in and you know
• 49:36
  it's going to solve the world's problems, right?
• 49:38
  But it's about how it's implemented.
• 49:41
  It's about how it's used. It's also very important.
• 49:44
  The one thing that I find missing in zero trust
• 49:47
  conversation is the, the business acumen within that
• 49:53
  conversation. There's no two businesses are
• 49:55
  alike, right? So what this business needs is
• 49:59
  very different than what this business needs, right?
• 50:01
  And the way that they access things is very different than
• 50:04
  the way that they access things, right?
• 50:06
  And the frequency of the, the the access is very different
• 50:09
  than the frequency of the access.
• 50:11
  So I think that it has to be business centric.
• 50:16
  Does it work? And I don't think that you need
• 50:19
  to have zero trust deployed everywhere.
• 50:21
  I think you need to know what you're trying to protect in the
• 50:24
  1st place and then define, you know, your zero trust
• 50:28
  architecture around that. A lot of companies just think,
• 50:32
  OK, well, that's by default. That's what we're going to go
• 50:34
  do. It's a very, very costly
• 50:37
  proposition to get that through and manage it.
• 50:41
  No, I wanted to throw one thing into zero trust conversation.
• 50:44
  I'm sure you've heard this your entire career of doing
• 50:49
  consulting in the cyberspace, which is you talk to a client
• 50:54
  and they'll say, well, only people who are plugged into a
• 50:57
  network slot can access this. They can get it.
• 51:01
  No password or no MSA. It's like, so as a consultant,
• 51:06
  you just nod your head. It's like, yes, that is better
• 51:09
  than if the outside Internet could come in.
• 51:11
  No, MFAI grant you that. But if you're asking me to say
• 51:15
  that's OK, I'm not going to or the the example we see all the
• 51:20
  time is, but there's only seven people in the domain
• 51:23
  administrators and we know them all, so it's OK.
• 51:26
  It's like if you're asking me to tell you whether or not that's
• 51:30
  OK, the answer is no, it's not OK.
• 51:33
  You can't be. Familiarity isn't security.
• 51:36
  Exactly, that's spot on. So you know, I feel like that's
• 51:40
  a important part of 0 trust. Like the implementation of it is
• 51:44
  like, OK, you may not get 10 out of 10, but let's not just like
• 51:52
  because we, you know, getting from 9 out of 10 to 10 out of 10
• 51:55
  is just so difficult. We're just not going to do it
• 51:58
  fine. 9 out of 10, not ten out of 10.
• 52:02
  No, I, I agree. I I do though, think that the
• 52:06
  zero trust conversation should be uncoupled from least
• 52:09
  privilege. They're two different things,
• 52:12
  right? A lot of times people would just
• 52:14
  kind of combine them together. It's like, well it's least
• 52:16
  privilege. OK, Least privilege should be by
• 52:19
  by DNA right? That do you need 7 domain admins
• 52:25
  or did you need like 3 in the 1st place?
• 52:28
  Does their job actually require them?
• 52:31
  But what if? What if?
• 52:33
  What if that? Then that's how that circle
• 52:35
  expands. Exactly.
• 52:37
  Well, I think. There's also even vendors in
• 52:40
  this technology, vendors in the space that will actually
• 52:43
  encourage organizations to grant people access that they don't
• 52:48
  need by saying, oh, this role is 80% of the people who are in the
• 52:54
  accounting department have access to this application.
• 52:57
  So why don't I just give it to 100.
• 52:59
  It's going to be simpler to manage.
• 53:00
  There is a benefit to simpler to manage this. 20% of people don't
• 53:05
  need the access. By definition of what least
• 53:08
  privilege is, they should not have the access.
• 53:10
  So I don't know, maybe I'm just fighting over principle, but I
• 53:15
  think that's I think that's what it comes down to.
• 53:18
  A lot of times it's like, hey, there's just so much to manage
• 53:21
  that you have that these trade-offs to say.
• 53:25
  All right, well, some, you know, bundling this into roles and
• 53:27
  maybe people get more access than they need becomes more
• 53:31
  secure become because it makes it more manageable.
• 53:35
  I mean, you always have to hedge risk, right?
• 53:37
  This that's that's basically the bottom line is that you have to,
• 53:41
  you may have to make smart choices based off of the cards
• 53:44
  that that are in your hand, right, But you also have to
• 53:49
  learn from what good looks like, right, and what best looks like
• 53:54
  and try to achieve that at the lowest cost point that you that
• 53:57
  you can. That's the name of the game, to
• 53:59
  be honest. All right, next one pass
• 54:02
  password less. What do you think of?
• 54:07
  That excites me password less. Yes, I mean who, who, why, why,
• 54:13
  why are we remembering passwords like it, you know, 2025?
• 54:17
  I wanna have 48 different passwords for things said nobody
• 54:20
  ever. It's like it's, it's just the,
• 54:22
  it's the oldest thing that we've had, right?
• 54:26
  This password less Yes, all the way.
• 54:29
  What do you think stops or maybe slows organizations from
• 54:33
  adopting it 'cause this is a a standard that the Fight Alliance
• 54:35
  has, has really helped kind of put forward over the last couple
• 54:38
  years and it's there, it works, people are using it.
• 54:42
  What is the what is the driver that a CSO needs to say is like,
• 54:46
  we're going to do this? I think Cecil's are pushing.
• 54:50
  I've, I've had a lot of conversations with CSO's where
• 54:54
  they're driving that it's, it's getting comfortable with the
• 54:57
  technology, right, that you're employing.
• 55:00
  It's getting comfortable, it gets getting the the board
• 55:03
  comfortable. It's getting the executive
• 55:05
  management comfortable. It's getting the regulators
• 55:08
  comfortable because how are you going to audit that, right, in a
• 55:14
  regulated environment? So if if you don't have the
• 55:17
  standards for it today, you're going to create one, right?
• 55:22
  So it's it's all of those things, right?
• 55:24
  And people get gun shy because they're like, OK, well, it's
• 55:28
  new. Well, I don't want to be
• 55:30
  bleeding edge, but you know, and it's not, this is not a bleeding
• 55:33
  edge concept. I mean, it's been around for a
• 55:35
  while, but I think the adoption of it is really getting people
• 55:44
  comfortable with the idea that they don't, they don't need to
• 55:46
  know their password, right? And how they're going to
• 55:50
  mechanize their processes are completely different, right?
• 55:53
  It's very much a possession based authentication scheme and
• 55:57
  not everybody has something that they're comfortable using for
• 56:00
  possession based. And there are challenges, right
• 56:02
  field services and other types like, you know, not No2 business
• 56:05
  or alike. It's it's easy where you know,
• 56:07
  if you're connected to the Internet all the time and you're
• 56:10
  connected to a device all the time, OK, great.
• 56:12
  But you know, there's a lot of business.
• 56:14
  It's the edge cases, and I think that's the excuse that people
• 56:17
  give the most on why it won't work here.
• 56:20
  It's that legacy system or the field engineer.
• 56:25
  But I say then carve those out, do password lists everywhere you
• 56:29
  can, and do some other mechanism for the edge case.
• 56:35
  I agree. I mean, I I that one excites me.
• 56:38
  Yeah, like I can't get rid of. So your team password list, I'm
• 56:42
  with you on that. One I'm I'm definitely team
• 56:44
  password. List, how about I'm going to
• 56:46
  call an audible here because I had a couple of different ones
• 56:48
  who were kind of picked through, but you mentioned blockchain
• 56:50
  earlier. So when it comes to blockchain
• 56:53
  and decentralized identity, what it comes to mind?
• 57:01
  You could do a full podcast. On that and we have in.
• 57:03
  My Bitcoin wallet, What's it doing today?
• 57:06
  Yeah. Do you know anybody who's using
• 57:10
  it today out of all your clients and people that you're working
• 57:12
  with? I do not.
• 57:13
  In fact, I, I would say there's a lot of innovation that is
• 57:17
  coming with blockchain, but it hasn't moved as fast as
• 57:23
  everybody thought it was going to move.
• 57:25
  At least that's my impression. OK.
• 57:27
  I, I, I won't speak for companies that are actively
• 57:32
  doing building tools technology on, on blockchain, right?
• 57:38
  But I'm a cyber professional and I've, I've evaluated based off
• 57:42
  of the number of requests that, that you know, are coming to us
• 57:46
  to say, hey, we're implementing this new technology.
• 57:49
  I don't know if this is going to work for us.
• 57:51
  Can you come in and test it out? So far there have been zero
• 57:55
  those requests, right? So it's, you know, it's not like
• 57:58
  there's a ton of them. There are some and there's some
• 58:03
  some really, really creative ones that you go into like, oh,
• 58:05
  shoosh, this is going to, this is tough and it's hard both from
• 58:11
  a, it is, it is well orchestrated from a security
• 58:14
  perspective, right. But then in, in general, I think
• 58:21
  your, your question is more identity and distribution of
• 58:24
  that. It's, it's very hard in a, in an
• 58:29
  environment where you know, you don't have you, you have
• 58:32
  obscurity, like how are you going to regulate that?
• 58:36
  There's this trouble already in regulating blockchain right now
• 58:39
  where you're going to go and, and say a public, public company
• 58:43
  that is a SEC registered that that is going to come and deal
• 58:47
  with identity through obscurity and you can't really manage that
• 58:52
  appropriately. I think it's a really tough sell
• 58:55
  right now. I think it's a great concept,
• 58:59
  but I think blockchain and crypto in general has to kind of
• 59:03
  flush itself out for the masses, for the masses.
• 59:06
  Yeah, I feel the same because I think like it's the solution
• 59:08
  that's been out there now for a while, but I don't know anybody
• 59:11
  who's using it not in the in what I'll call the real world,
• 59:13
  right? I'm sure there are some
• 59:16
  excellent use cases for it. When it comes to decentralized
• 59:18
  identity, I think we have to figure out, OK, well, who's
• 59:22
  blockchain, who's running that blockchain and how are we making
• 59:25
  that interoperable with others? And do you trust the blockchain
• 59:28
  that it's on? I mean, at any given point, half
• 59:31
  the population is for or against government.
• 59:33
  There's healthcare, there's education, there's finance, and
• 59:36
  then you've got social media networks.
• 59:39
  You know, I, I think it's a really interesting, almost like
• 59:41
  a social experiment. It's OK.
• 59:42
  Well, when does this come? Because I've been hearing about
• 59:46
  it now for, I don't know, almost a decade I feel like.
• 59:48
  But I've yet to see a I'll call a normal company adopt
• 59:54
  decentralized identity as part of their identity apparatus.
• 59:58
  I I haven't seen much of that either, so.
• 1:00:01
  I think the interesting thing about blockchain is this
• 1:00:05
  uneditable Ledger idea. I don't know the exact use case
• 1:00:10
  that it's going to be used for from an identity perspective,
• 1:00:13
  but I can tell you this where at Gartner I am it's not being
• 1:00:16
  talked about. So it there's probably somebody
• 1:00:19
  listening to this podcast right now like you dummies, you this
• 1:00:24
  is the this is the future. Yeah, they're probably lighting
• 1:00:27
  up right now, but. I mean, I, I think the the fact
• 1:00:31
  is not like blockchain as a technology, it's fantastic.
• 1:00:34
  OK, So this is not a dig on blockchain in itself.
• 1:00:38
  Is your question is, is it being used today?
• 1:00:42
  I don't see it being used. Are there solutions out there?
• 1:00:45
  Yeah. Are they implemented solutions
• 1:00:48
  where they're working? No.
• 1:00:49
  And just with any technology, it comes with its risks.
• 1:00:53
  You got to still figure out how you're going to make it
• 1:00:55
  resilient, right? How are you going to test it?
• 1:00:57
  How are you going to make it auditably compliant, right.
• 1:01:00
  All of those questions still have to be be answered.
• 1:01:02
  So I think there's work to be done there.
• 1:01:06
  OK. Last one we kind of touched on
• 1:01:08
  earlier, but AI, where do you see AI taking us in 2025?
• 1:01:12
  Let's just do kind of predictions.
• 1:01:15
  It's it's January when people listen to this.
• 1:01:17
  Where do you see AI taking both cybersecurity and identity?
• 1:01:21
  And maybe there's any linkage between the two?
• 1:01:24
  No, I, I think that wherever we're going to go, it's going to
• 1:01:29
  be much, much better. I am really positive on on AI
• 1:01:36
  simple things, right, security operations, there's so much
• 1:01:40
  potential to automate things, right?
• 1:01:44
  I think that there are certain cases that I personally believe
• 1:01:49
  again, it's my belief system. So take it for what it is that
• 1:01:55
  there is accuracy in decision making for for AI because this
• 1:02:01
  it doesn't have the emotion. I don't know if you saw this
• 1:02:05
  report, I might misquote it a little bit, but I think they ran
• 1:02:10
  some experiment where with doctors and they said, OK,
• 1:02:14
  doctors, you know, diagnosing a complex problem for for a
• 1:02:19
  patient and they're, you know, and they are going to do it by
• 1:02:24
  themselves. They're going to diagnose that
• 1:02:28
  problem with the assistance of AI and AI will diagnose the
• 1:02:32
  problem by itself. And I think the AI diagnosed the
• 1:02:36
  problem 95% of the time or 93% of the time correctly.
• 1:02:43
  The doctors identified the the problem like 70% of the time, or
• 1:02:49
  maybe it was 75% of the time. OK.
• 1:02:52
  And doctors using AI actually reduced their competence in
• 1:02:57
  their own ability to to, you know.
• 1:03:01
  Meaning they became more reliant on the AI to make.
• 1:03:04
  The No, they didn't. They didn't trust the.
• 1:03:06
  Game they didn't trust the AI, OK.
• 1:03:07
  So I think it was 65% where where it was.
• 1:03:12
  And so you take that, OK, we take it with a grain of salt,
• 1:03:17
  right, Because I don't know what the experiment parameters were
• 1:03:19
  and all that. But I do think that there are
• 1:03:24
  ample scenarios within cybersecurity, in the construct
• 1:03:29
  of cybersecurity in a broad sense where AI can be used to
• 1:03:33
  automate a lot of those decision making points, OK?
• 1:03:39
  I've seen that within our practice and our security
• 1:03:41
  operation centers already in the amount of alerts that we are
• 1:03:47
  generating now that we can use AI to, to cleanse through what
• 1:03:53
  false positives are and so forth, right.
• 1:03:57
  I think workflows will become really, really big in 2025.
• 1:04:02
  What does that mean? That means in in doing your
• 1:04:06
  day-to-day activities, right? I'm a consultant, so I do a lot
• 1:04:09
  of consulting engagements which require writing reports and
• 1:04:13
  making presentations and, you know, evaluating controls and
• 1:04:19
  evaluating configurations and things like that.
• 1:04:24
  There's very, very simplistic ways of, of using AI to evaluate
• 1:04:30
  those to make the process more efficient and actually increase
• 1:04:34
  the quality in the in, in that right.
• 1:04:38
  But you have to what AI is not, it's not a silver bullet, right?
• 1:04:42
  You still have to, to give it the parameters.
• 1:04:45
  And I, the thing I think that I don't think this will happen in
• 1:04:50
  2025, but it's very soon after it's going to be the ability for
• 1:04:58
  AI to use agents on devices and do different things where, you
• 1:05:02
  know, it can simplify the tasks. And I know people are, are
• 1:05:09
  afraid of that, right? That if, if you've got AAI agent
• 1:05:14
  running on your laptop and it's monitoring for two months of
• 1:05:17
  what activity you do and it's kind of figures out, here's the
• 1:05:20
  patterns, here's what you do, e-mail comes in, you respond to
• 1:05:23
  it this way and then you go do this task, right?
• 1:05:27
  If it can compress that and predict that.
• 1:05:29
  Just to you, it could be you. Right.
• 1:05:32
  But then people take that immediately and say, OK, well,
• 1:05:35
  that means I'm out of a job. OK, well, no, it's it's not
• 1:05:43
  going to happen that way, right? You just have to stay abreast of
• 1:05:47
  it. But at one point we used to have
• 1:05:49
  a Ledger, right? We used to take all the, this
• 1:05:52
  was the accounting spreadsheet. Somebody would like debit some
• 1:05:54
  credits and write it down. And then spreadsheets came in,
• 1:05:57
  right? And you don't see people walking
• 1:05:59
  around with a register underneath their arm, right?
• 1:06:02
  That has all that information, like it's readily available.
• 1:06:05
  And then spreadsheets turn into ERPS and you know those like all
• 1:06:08
  that information is available. Yeah, when's the last time you
• 1:06:10
  bought an encyclopedica for Canada, right?
• 1:06:13
  To that point, but are you are, is the accounting professional
• 1:06:18
  profession done? No, you still need accountants,
• 1:06:22
  right? So it's, I think that you have
• 1:06:24
  to separate the technology and what it can provide you from the
• 1:06:29
  actual, you know, job that you have.
• 1:06:32
  Your job is going to evolve. The people that are going to
• 1:06:34
  lose their jobs are the ones that don't keep abreast of it,
• 1:06:37
  right? You got to make sure that you're
• 1:06:38
  abreast of it, you understand it and utilize it for what that is.
• 1:06:42
  But something that used to take 40 hours can take like, you
• 1:06:45
  know, 10 minutes to do. Yeah, why not?
• 1:06:49
  Why wouldn't we do that? Why wouldn't we take that
• 1:06:52
  efficiency, Right? Why wouldn't a business take
• 1:06:54
  that efficiency? Absolutely we would.
• 1:06:57
  Yeah, I think that there's a lot of thinking that the upcoming
• 1:07:01
  generation, they're the ones that are going to lose their
• 1:07:04
  jobs, say AI, and I think the exact opposite is true.
• 1:07:07
  They're going to be so much more efficient than our generation
• 1:07:12
  was because they're going to be able to use technology and have
• 1:07:15
  technology do all these menial tasks, things we don't think of
• 1:07:19
  as menial tasks right now, but we do them.
• 1:07:22
  They take a lot of our time to write reports or analyze
• 1:07:25
  reports, and they'll just be able to expand the amount that
• 1:07:29
  they get done putting in less time using the technology so.
• 1:07:35
  And, and we'll have to completely update the controls
• 1:07:39
  and the protections and the mechanisms of, of authentication
• 1:07:43
  that we have as that proliferates.
• 1:07:46
  Why? Because the bad guys are going
• 1:07:47
  to have it as well, right? They're going to make their
• 1:07:50
  workflows just as more efficient, right?
• 1:07:54
  So it's not just for, hey, if you use it for, for, for the
• 1:07:58
  good, right? Everything has two sides to it.
• 1:08:02
  And that comes with risks. That means that the security
• 1:08:05
  profession of the future, we'll have to account for that to
• 1:08:09
  understand how how those risks, risks, you know, propagate and
• 1:08:15
  manifest themselves in our clients environments and how
• 1:08:18
  we're going to protect against that, right?
• 1:08:20
  Are their pro, are their programs, you know, ready and
• 1:08:24
  set. And it's, you know, with any new
• 1:08:27
  technology when you roll out, you know, it comes with
• 1:08:30
  learning. A lot of companies are
• 1:08:32
  experimenting with this, right? And there's so many, some
• 1:08:36
  companies have the stance of saying, OK, their acceptable use
• 1:08:39
  policy is that that should not use AI, right, for any work
• 1:08:44
  purposes. There's others that are like,
• 1:08:46
  OK, well, we're going to segment this portion off.
• 1:08:48
  That's where we're going to do it, right?
• 1:08:50
  And there's others that are like absolutely 100% we're going all
• 1:08:53
  that, right? And if the all insurance don't,
• 1:08:59
  I mean, there's a risk, right with AI like you know, what if
• 1:09:04
  it's not secure enough, what if our crown jewels data goes into
• 1:09:08
  our AI model and somehow it's. I mean, there's a lot of
• 1:09:12
  acceptable use conversations around that.
• 1:09:14
  If that doesn't happen, though, they're going to leave their
• 1:09:16
  competitors in the dust. I mean, they're going to get so
• 1:09:18
  much more done. The competitors could go out of
• 1:09:21
  business if they don't. I think you'll see this
• 1:09:24
  happening over the next few years where companies will cease
• 1:09:28
  to exist because they didn't. They didn't transform.
• 1:09:30
  That will transform themselves. And I think that that's going to
• 1:09:33
  be very, very prominent in the cyberspace because we started
• 1:09:38
  this conversation about skills and we talked about gap as well
• 1:09:44
  of people lack of lack of talent that's available, right?
• 1:09:49
  Well, the solution to the talent problem is twofold, right?
• 1:09:53
  1 is OK, Well, upskill other people, train more people, get
• 1:09:57
  more people interested in cybersecurity, right?
• 1:10:00
  Like I'm, I've got a 17 year old daughter.
• 1:10:03
  I'm really passionate about, you know, young girls being in the
• 1:10:06
  cyber field. I think it's a hugely rewarding
• 1:10:08
  field. I mean, it's three of us here,
• 1:10:10
  right? I mean, career wise it's been
• 1:10:12
  it's been fantastic. This is.
• 1:10:13
  Work. This is what I always think.
• 1:10:15
  Feel like this is our job? And this is, I mean, I love it.
• 1:10:19
  So other people should have that, you know, satisfaction in
• 1:10:23
  life that, you know, you can, you can do that something that's
• 1:10:26
  that's going to, you know, take you somewhere and you're going
• 1:10:29
  to enjoy it. But, you know, we nearly don't
• 1:10:32
  have enough, you know, women joining the cybersecurity
• 1:10:36
  professional. I mean, it's better than what it
• 1:10:38
  was, but it's not anywhere close to what it needs to be.
• 1:10:42
  And I find that every time that I have, you know, women in my
• 1:10:46
  team, the perspective is different.
• 1:10:48
  And it's, it's so much, you know, there's diversity of
• 1:10:52
  thought there, right? That that allows you to be be a
• 1:10:55
  little bit richer. But the point on this was the
• 1:10:58
  skill gap is either you, you train people up, right?
• 1:11:02
  And you add more, or you solve it by technology by taking out
• 1:11:08
  the manual work, right? And you transform that with
• 1:11:11
  tech. And that's, that's the work.
• 1:11:15
  And if that's the work, now, if you look at everybody, because
• 1:11:20
  they're all short staffed, if that's the work, well, AI is the
• 1:11:24
  one that's going to help you solve it.
• 1:11:26
  But you, you, you also mentioned we, the, the risk portion of it
• 1:11:31
  is that you can't have publicly available models, right?
• 1:11:35
  You're not feeding all the like, you know, corporations have to
• 1:11:38
  be very careful that they're most organizations in the future
• 1:11:42
  will have their own large language models, right, That
• 1:11:45
  that are supportive for, for their own needs, so that their
• 1:11:48
  their data, their, their stuff is in their own.
• 1:11:51
  Their data center and then eventually it will all be a
• 1:11:55
  software as a service, right? And then you will still need
• 1:11:58
  identity around all of that to manage that.
• 1:12:00
  So identity will stay at the center I think for for a good
• 1:12:04
  bit of time. So.
• 1:12:06
  That was quite the lightning round, Jeff.
• 1:12:07
  No kidding, right? Well, let's go ahead and and
• 1:12:11
  let's let's shift gears a little bit.
• 1:12:12
  I want to talk some music because I know that you're into
• 1:12:15
  music. We've traded some stories around
• 1:12:17
  it. Tell me about your inspirations,
• 1:12:21
  the music you create, your process.
• 1:12:23
  Are you available to edit podcasts?
• 1:12:25
  Tell me all that kind of stuff. I I will I will gladly lend a
• 1:12:29
  hand in editing a podcast, probably do a good job.
• 1:12:34
  What's your inspiration when it comes to making music?
• 1:12:37
  You know, it's, it comes from a lot of different places It comes
• 1:12:41
  from it generally comes from life, right?
• 1:12:46
  But it comes from sad times, it comes from happy times, it comes
• 1:12:50
  from fun times, it comes from stress times.
• 1:12:57
  And it's I've I've I've noticed that the inspiration arrives
• 1:13:02
  weirdly. It's not like I'm actively
• 1:13:06
  sitting down to create something.
• 1:13:07
  In fact, most times I'll actively sit down and create
• 1:13:10
  something, it doesn't happen. You're trying to force the
• 1:13:13
  creativity. But then I'd be on a plane, you
• 1:13:16
  know, going from Houston to Chicago and, you know, something
• 1:13:19
  pops in my mind and, you know, then I then I need to do
• 1:13:22
  something about it, right? So I'll, I'll sketch out ideas
• 1:13:26
  when whenever that happens. So, but yeah, I've been at it
• 1:13:31
  for about 20, five years. I think mostly electronic music
• 1:13:38
  kind of it's a good, you know, way to blow off steam.
• 1:13:43
  There's a lot of learning in that that space as well.
• 1:13:47
  I find, you know, the intricacies of chord structures
• 1:13:51
  and, you know, different genres of music and their intersection
• 1:13:56
  really, really fascinating. So there's a lot of learning
• 1:13:59
  there. I'm I'm a geek when it comes to
• 1:14:02
  audio production. We were learning about our about
• 1:14:05
  our rack deck 4 it's. Got my, my new Mac so yeah,
• 1:14:09
  I've, I've been like, I've revved it up to, to make sure
• 1:14:13
  that it's going to work. But yeah, I've got a full
• 1:14:16
  recording studio. You know, I'll do it for myself.
• 1:14:20
  I'll, I'll have friends come in and you know, they, they want to
• 1:14:22
  record a song or or two, I'll do it.
• 1:14:25
  Got about 120,000 people following me on Facebook so.
• 1:14:31
  Maybe we'll get we'll call a couple more thousand maybe after
• 1:14:33
  listening that's. That's been, that's been fun,
• 1:14:37
  but you know, it's, I think for me having passions outside of
• 1:14:45
  your, your work. It's not like I don't love my
• 1:14:46
  job. I love my job, but you have
• 1:14:50
  three parts to you. It's the, the piece that you do
• 1:14:54
  for yourself, the piece that you do for your family and the piece
• 1:14:57
  that you do for your work, right?
• 1:14:59
  And it's very hard to juggle, but I've noticed that anytime
• 1:15:06
  the cup is empty in one of those three, right?
• 1:15:10
  Life is not stable and you need to do a good job at work and you
• 1:15:16
  need to make sure that you're, you know, you're, you're, you're
• 1:15:19
  creating something valuable. And just like I started this
• 1:15:23
  conversation, you have to continue to invest in yourself
• 1:15:26
  because it's not really who you're working for or what
• 1:15:29
  you're doing, but it's really what are you getting back out of
• 1:15:33
  it personally, The family is, is, is head and shoulders above
• 1:15:39
  all the rest. And then you know your personal
• 1:15:41
  things and it could be anything, right?
• 1:15:43
  Your music or you like travelling or whatever that is.
• 1:15:46
  A podcast. Podcast, whatever that is,
• 1:15:48
  right? You got to have those three
• 1:15:50
  things in check all the times. It's that balance, right?
• 1:15:54
  I think what you're looking for in, you know, the the great
• 1:15:57
  warrior poet Thanos once said balance in all things, and then
• 1:16:01
  he snapped and half the universe disappeared.
• 1:16:04
  He was a badass though I think. It's probably a good spot where
• 1:16:08
  we can leave it. This has been a really good
• 1:16:09
  conversation. I'm really excited for this
• 1:16:11
  series that we're going to put together throughout the year.
• 1:16:14
  And I think this is kind of a great starter, right intro.
• 1:16:17
  It's always, I always enjoy listening to you and hearing
• 1:16:20
  your thoughts and perspective on things.
• 1:16:22
  You know, we're always kind of synthesizing data that we get
• 1:16:25
  from our different sources. And I think this is going to be
• 1:16:28
  a fun run that we're going to have here.
• 1:16:29
  So and, and thank you for the support for the pockets that
• 1:16:32
  you've shown over the last couple years.
• 1:16:33
  I again, you know, I know you all are passionate about it and
• 1:16:38
  we are passionate with you about it because I, I think it, it's
• 1:16:43
  such a good service to the community, the identity
• 1:16:46
  community and then broadly to the, the cybersecurity
• 1:16:49
  community, such a good resource for people to go and listen to.
• 1:16:54
  And you know, it's, it's easy to listen to, right?
• 1:16:59
  And we try. Yeah, a lot of people have
• 1:17:01
  identified with those problems and and you know, I think they
• 1:17:04
  could probably find some solutions through through this
• 1:17:07
  or or at least a a different thought process than than what
• 1:17:11
  they've had. But I think the series that
• 1:17:13
  we've talked about and just generally talking about how the
• 1:17:17
  intersection of cybersecurity identity happened and how,
• 1:17:21
  whether it's risk governance, engineering, you know, all these
• 1:17:24
  concepts, resilience, how they interplay.
• 1:17:28
  I think it's going to be really fun here for you all to to
• 1:17:32
  dissect that and I'm happy to support it.
• 1:17:35
  Well, this is what we do for fun, Jim.
• 1:17:36
  Our day job is identity consulting.
• 1:17:39
  I think we've done a good job with the podcast, people not
• 1:17:40
  realizing that we actually have day jobs.
• 1:17:43
  Well, I always say, people say, oh, Jim, you've, you work really
• 1:17:47
  hard. I'm like, well, it's not quite
• 1:17:49
  like going into a coal mine or something, right?
• 1:17:52
  It's. Oh, we got to pump that up.
• 1:17:53
  Like, yeah, it is. It's terrible.
• 1:17:55
  It is like my. Back all right.
• 1:17:59
  Let's go ahead and leave it there for this week.
• 1:18:00
  Thank you so much, Ghazi, for joining us.
• 1:18:02
  I'm going to have a link in our show notes to your LinkedIn
• 1:18:05
  profile for people to reach out. Maybe if I can convince you to
• 1:18:07
  get your Facebook link for the music stuff so people could
• 1:18:09
  check that out as well. It's it's interesting.
• 1:18:11
  We have such a diverse population of people, not only
• 1:18:13
  in identity, but in cybersecurity.
• 1:18:15
  A lot of musicians we've actually had on the show and,
• 1:18:18
  and, and things like that. So it's, it's very cool.
• 1:18:21
  We'll leave it there. We're on the web,
• 1:18:23
  idacpodcast.com. If you're watching this on
• 1:18:26
  YouTube, thank you. Like and subscribe.
• 1:18:27
  If you're not watching it on YouTube, check it out.
• 1:18:29
  idacpodcast.tv. Connect with any of us on
• 1:18:32
  LinkedIn. We're always happy to have
• 1:18:33
  conversations with folks and, and just kind of engage that
• 1:18:36
  way. And yeah, so we'll leave it
• 1:18:38
  there. Thanks everyone for watching and
• 1:18:39
  or listening and we'll talk with you all in the next one.
• 1:18:43
  Thank you all. You've been listening to
• 1:18:47
  Identity at the Center. We hope you've enjoyed the show.
• 1:18:51
  Make sure to like, rate and review, and we'll be back soon.
• 1:18:56
  But in the meantime, hit the website at
• 1:18:58
  identity@thecenter.com. See you next time on Identity at
• 1:19:04
  the Center.