Latest / Identity at the Center / #10 - South of the Border with Arturo Cordoba

Transcript

#10 - South of the Border with Arturo Cordoba · Identity at the Center

0:06
Do you know who has access to what this is the identity at the
0:09
center podcast if you're looking for identity and access
0:12
management talk you've come to the right place and now on to
0:20
the show. Welcome to another episode of
0:26
the identity of the sender podcast.
0:28
My name is Jeff Steadman. I'm on the road this week took
0:31
the show south-of-the-border Jim mean with our friend Arturo
0:35
Cordova who is a senior advisor on the cyber security team for
0:38
7x High Arturo. I like it.
0:41
Hey, Jim, I didn't age files Monterrey Mexico treating you it
0:45
is beautiful coming from Chicago.
0:48
I never see anything more than just flat land and the mountains
0:51
here are amazing. So I am drinking it up as much
0:54
as I can. Is hot but that's okay.
0:57
It is a dry heat as I think you know, some people might think is
1:01
a little bit better. The humidity is not quite as
1:03
high. Although there wasn't very cool
1:05
lightning storm Tuesday night when we were when I was here
1:08
when I got here. So that was kind of neat Archer.
1:10
You're probably used to the weather right?
1:12
It's yeah, I mean dude, you are lucky because this week they
1:15
have the weather is start cooling down.
1:17
Hmm. It was a few weeks back will be
1:19
very high like 40 something in Social Security.
1:22
That's my kryptonite and I can't I can't handle the heat.
1:26
My jam Jim knows good. Oh, yeah, I know and I'm in
1:30
Georgia and it's plenty hot here still but Jeff and you should be
1:34
commended. It's Friday before Labor Day and
1:37
you're still working on the road.
1:38
That means you're going to be traveling home on Saturday,
1:41
right? That's correct.
1:43
And you're there with Arturo and he's rocking the October fall
1:49
beard. I love it.
1:50
He's getting Baseball playoff season.
1:54
That's one of the things I About Arturo is that he's a fellow
1:58
baseball. Junkie.
1:59
Yeah. I am.
2:01
I am actually this next week the local teams here in Mexico with
2:06
the Mexican League. They start playoff next week.
2:09
So my team made it to the playoffs.
2:10
Oh, so you have to get your left leg going.
2:13
Yeah. And so we're going to finish and
2:15
I continue with the Emily V 0 B. Yeah, it's routine and the MLB
2:21
and that's on top that - yeah. Yeah, and they've got company.
2:25
Quite a team this year. So they'll be playing in
2:27
October. Like you said before Jeff.
2:31
We should have a separate podcast on that much value for
2:36
that one. What's baseball?
2:43
So Arturo, I'm glad you're able to have some time set aside some
2:45
time to talk with us. Not Q for having me.
2:48
We've been working with you for Less almost two years.
2:51
I guess coming up pretty soon. Maybe we can talk a little about
2:54
your background. And you know, how long have you
2:57
been? Let's start with I am how long
2:59
have you been in the I am space in the I am is face these
3:03
actually some not clear enough because I am start like 11 or 12
3:10
years ago. Ago in the security space
3:12
information security Simon star like and for like a consultant
3:17
information security consultant mostly for endpoint security
3:21
things and and infrastructure like firewalls IPS things like
3:26
that and eventually wants that we start involving more and more
3:31
secure things. I start like taking projects
3:34
related somehow with identity at the beginning without knowing
3:37
that actually The Entity was I think like a And two thousand
3:43
eleven and twelve and it's like what like six years back.
3:47
So I start thinking like that all taking things like identity
3:51
management and things like that. So I think that I didn't realize
3:58
that I was doing things related with the identity.
4:02
It wasn't until I don't you start reading papers, really no
4:05
intimation exactly. And so at some point I just
4:09
realized I have my identity. Professional right?
4:12
What was the first project that you worked on that was that was
4:15
specific to Identity. The first one was an
4:19
implementation of fun identity manager.
4:22
So we were deploying son identity and different
4:26
countries. So that was my first project
4:30
related with identity. And after that it was like more
4:35
common on until we started like formalized in the department.
4:40
Couple of years back and start doing things in a more formal
4:44
way. And and also I think that the
4:46
same time and probably we are going to discuss that but at the
4:49
same time I just releasing that the entire Market is tried to
4:55
formalize that practice as well like early days of I am and yeah
5:01
related the book no of knowledge that things like Ida Pro is
5:05
working on that. We should talk about I do pro
5:08
Yeah. So basically that one a little
5:09
bit that's relatively a new organization and I know that you
5:12
recently just joined. I've been a member for a while.
5:17
I also helped out with the board selection committee Jim.
5:20
Are you a member of ID Pro? I'm not currently no Jim.
5:31
The reason why I write there is because I was looking and
5:35
actually a couple of years back I started looking for.
5:38
Okay, what are the kind of certification that and identity?
5:40
Personalized you should meet or should achieve so I started
5:44
looking in I find out that there's not any or or if there
5:48
are any is like report number is not something generalized like
5:52
security Library CSP or TSM. Whichever is more like a product
5:56
Focus, right? I'm a cyber-ark engineer or I'm
5:59
a sales Point engine. Yeah, whatever birth specific to
6:02
that Technologies, right? Yeah.
6:03
Yeah, I do pro is something that we're probably gonna have a show
6:07
specific to that at some point. Maybe we can get Debbie from
6:10
that organization. And I come on and talk a little
6:11
bit about it. But it's the beginnings of a
6:14
very specific group to support other people who are working in
6:19
the ID world and I think it's I think it's gonna be a good thing
6:23
overall, but we could bring it back to I am and let's talk a
6:28
little bit about what your view is from your perspective of.
6:35
How does how does I am get viewed here in Mexico compared
6:40
to what you See maybe in other countries or the u.s.
6:43
They very good question. Well Casey, I don't know why but
6:50
I still feel like identity like being part of security somehow.
6:56
I'm still like like identity is being like like the child of
7:00
security somehow or something that it depends security at
7:04
least in most of the organization's right now in here
7:07
in Mexico and when I'm serious like And happened the same for
7:13
security at least from my point of view.
7:16
Like if you think don't security like 10 years back at least here
7:20
in Mexico. It was like something new and
7:22
something that wasn't like, okay, you are a security
7:25
professional. So are you are an IT guy who
7:28
probably overseas or have more privacy rights with security,
7:32
but you are an IT guy. So I think that in the past two
7:37
years security has became like as Security professional with
7:42
certification. We're more things related to
7:44
that and I think that right now identities following the same
7:49
path. So I just feel bad 50 more years
7:53
after that but I believe that identity is going to follow a
7:57
following the same path that security so for right now at
8:01
least here in Mexico is like more I would say like haven't or
8:08
is everything the increasing in the last few years for sure many
8:13
of organizations related to the financial sector like Banks or
8:18
insurance companies. They do have a lot of Regulation
8:21
and that end so are the most mature right now and some other
8:27
International companies like us like Ceramics they are doing
8:30
more things related with security because of the same
8:32
thing like the same drivers feel compliance, but I think that we
8:38
are very early in the sense of adopting new technologies or
8:42
actually that the companies have people really dedicated to to
8:49
Identity specifically to identica.
8:51
Yeah Arturo. So one of the interesting things
8:54
I would think is have you had to go out and hire people with an I
9:00
am background or have you tried to do that?
9:03
And what was your experience with whether many people in the
9:06
market who had the skills? Eels that you were looking for
9:09
or did you feel like you'd have to bring somebody in to train
9:11
them either on I am Basics or or product specific skills.
9:18
Yeah my tell you we start looking for four more people
9:22
since last year and actually guide it was a surprise like we
9:30
we had a very hard time to find people.
9:32
Actually we still do because it Again, it's like very specific
9:40
even though trying to find people focus on security right
9:43
now here in Mexico is not that easy.
9:46
Unfortunately the most of the universities in here, they
9:52
didn't have information security career until just a few years
9:57
back and mean one of their most important universities here in
10:00
Monterey. They didn't have a master degree
10:04
from security until I think that this year is going to Start
10:07
something like that. So I think that in a sense of
10:11
the University's getting Preparing People for that.
10:14
It is relatively new and so so yeah, it's pretty hard right now
10:21
and I have been reading some papers about that or opinion on
10:26
the internet that they tell you about.
10:29
It is better to train somebody like somebody with certain
10:34
skills, like people who is more Tibor because you know that also
10:39
identity at least from my perspective is is like a yes.
10:43
It is a cyber security mindset somehow would also is that
10:48
creativity or that sense of be a problem solving guide rather
10:55
than just a person who knows about technology, right?
10:59
Yeah, and and and some of the articles about that they say
11:05
that it was better like higher. Or somebody and trying to be as
11:10
an IT person. I and identity person.
11:14
I hear that also one of the conference on identifiers this
11:20
year. He was a girl from I don't
11:23
remember the name of the company, but he was trained for
11:26
to be and and identity professional in that company and
11:30
they he was from help desk and I also thinking about that because
11:35
help desk are the ones I have like more sense of the end user
11:41
rather than people who is working on another project so I
11:44
can test that that's my background has helped us.
11:48
You know, I fell kind of into I knew I went to be insecurity and
11:51
just kind of fell into I am as my way to get into security and
11:55
I've been there ever since but you know going back to what
11:57
you're saying about the hiring. I have a very similar take on
12:01
that. You know what I'm what I'm
12:03
looking to bring someone on technology.
12:07
He skills are important, but I can typically trained technology
12:12
what I can't train his personality, you know the drive
12:16
to get things done those sorts of things and this goes back out
12:20
even before to before my 80 days when I was in the service
12:23
industry, you know, waiting tables managing restaurants
12:26
those sorts of things, you know, give me give me a person with a
12:29
good attitude and I can train them to do just about anything
12:33
and I think that's something that's interesting here is
12:35
opposed to when you're it. Difficult to find I am resources
12:39
and Jimmy you seen those as well trying to find very specific
12:44
skills that's is very difficult. It's even harder when it's such
12:48
a competitive market like I am or you have even more limited
12:51
talent pool. So you do have to invest in
12:53
training folks and getting people to the skills that you
12:57
want. But she also have to make an
13:00
environment where they want to stay right and continue on that
13:03
because you don't want your Investments walk out the door,
13:05
you know, two years later or a year later because I died happy
13:07
with the way things are going so is acting on companies to invest
13:12
in their people make it an environment where they want to
13:16
stay right in anyways is not easy because it's not like okay
13:20
just took the train train for I don't know from certain
13:24
Technologies. It's not clear the path for the
13:26
training either so you have to figure out what is next.
13:29
So if you need somebody who's going to be the overall, I am
13:32
architect. It's you don't want to take
13:35
somebody who doesn't have I am You don't want to have to train
13:39
for too many different elements. I kind of agree with where
13:43
you're going or you're both you guys are going skills, like
13:47
intangibles like creativity and and having good customer service
13:51
Focus. I think those are your
13:54
must-haves but then if you're going to have somebody who's
13:56
going to be your your you know in a large organization, you're
14:00
number one. I am person.
14:03
They need to have some some relevant background some It's
14:07
skills kind of going into that position.
14:10
Yeah, you really have to know what your Runway is, right?
14:12
If you've got a long Runway, you might be able to invest more
14:15
time, but most most organizations.
14:17
Don't at least of the very beginning right?
14:19
They need to get things going right now.
14:21
You're starting at I am program what's too much turnover in your
14:26
group ready to you have an I am team that consists of 10 people.
14:29
You don't want to be losing five of those people every year if
14:32
you're not going to have much continuity in your program.
14:34
If you do I'd say one of the things that I've seen In terms
14:38
of organizations that are successful in maintaining large.
14:42
I am groups and having Heights highly skilled people are those
14:46
that either have multiple locations where they can Source
14:50
people from or they have a work from home culture and this is
14:54
something that I wanted to put back to Arturo is, you know,
14:58
especially with Mexican companies.
15:02
The question would be, you know, do you feel like there's a
15:05
culture where? Working from home would be
15:08
acceptable or having full-time remote employees or what's it
15:13
like it is the culture more driven towards everybody needs
15:16
to be in the same place. Well right now or start shifting
15:20
to more open to remote office or having this room Open Spaces
15:26
into the buildings of the companies and it's something
15:31
relatively new and most of the times this is Raven because of
15:38
The problem with transportation in big cities like here in
15:40
Monterey. So we are facing right now is
15:43
wait. I know people moving from one
15:45
place to another like one hour or more than an hour like two
15:48
hours drive to from home to the office.
15:51
So it's not you cannot maintain that lifestyle.
15:55
So so start changing that most of the consultancy companies do
16:00
it and it's finally susceptible and for some other companies
16:05
they are thin the Is like having smaller surfaces or reducing the
16:11
times for moving from one tip for one location to another but
16:16
I think that that Mexico is moving into that cultural
16:19
probably a little bit behind you guys, but they are doing some
16:22
changes on that end and also in general the culture because of
16:26
the new generation, you know, like like Millennials right now.
16:29
They are getting to be companies like these or all companies like
16:33
10x that more like a hundred years old and so the company
16:37
Need to make this transformation and actually be very open and
16:42
very attractive for this new talent because otherwise the new
16:45
Talent will go for the ones that have the more fun stuff into the
16:51
office or or more flexible in terms of of the discovery of the
16:56
time and things like that. So I think that if the companies
16:58
are not willing to transform they will eventually die or they
17:01
eventually get in trouble to get people more because otherwise
17:05
they don't have anything else on that.
17:07
What are some of the challenges that you see as usual as we're
17:10
working on that? I am program here at stomachs.
17:13
What are some of the challenges that you see just starting that
17:16
up and getting it going that you've run into over the last
17:18
few years the most challenging in general and what identity?
17:22
Yeah just about starting up the program.
17:24
I do that. The first thing is that how you
17:26
communicate that identities. Actually, I think I mean and
17:31
it's important. Yes.
17:32
Yeah. So what are you talking about
17:33
some are you talking about security ID data or most of the
17:37
the time it really helps like using like friend topics.
17:41
Like I don't know like security most of the times compliance for
17:45
sure will help but it has been like a process like a processing
17:53
where you need to actually communicate along with the
17:56
conversation around security because at least we are part of
18:00
the security team here. So it is like the conversation
18:04
driving in the security side, but also Saying that they miss
18:09
something new and something that is not only about security but
18:12
also about compliance. It is also about user experience
18:15
is about also about the all the other benefits that you have
18:20
with along with those and in passing the message like okay,
18:25
this is this something unethical and how a program as a whole
18:32
will help you on that. What are some of the I guess you
18:37
use Cases at the business comes to you for our from an IM
18:40
perspective. You see any differences between,
18:44
you know this region of the world compared to maybe what
18:47
you've heard from Congress has that we've been to like you Pro
18:50
or edu Pro height identify verse or Gartner or black hat at a
18:56
very similar use cases morning off-boarding or there are other
18:59
things that might be. Yeah.
19:00
I think that the Arts can malaria and do something that
19:03
really was the warlike make me. Happy because I am not a lot of
19:09
these so so weird. Yeah, because because at the
19:11
beginning I was still saying that probably these use cases
19:15
are very particular for us as a region but in Hora Sasa has
19:20
company because we have location in more than 35 countries.
19:24
So I thought that it was based on on the type of company
19:29
probably but I realized knowing more peers really a in the
19:33
security security and identity space that the challenge are the
19:36
same and and they are struggling with MFA deployment.
19:39
They are struggling with the automation of certain
19:42
Technologies. So they are I don't know having
19:46
a bad time with one particular event or things like that.
19:48
Right? So in the are the same so I
19:51
actually sometimes this kind of conference.
19:53
I like like a shoulder to cry right along with your peers.
19:57
Yeah, and it's it's fun, but that same time it's like hey was
20:01
so we are not alone that road and and we can share experience
20:05
and share tips. That hey, but yeah most of the
20:08
cases and for instance based on region and things like that.
20:12
We just recently finished World Wide deployment for for
20:16
multi-factor authentication and and we had certain challenge for
20:20
different countries and regions because not all the people like
20:24
like for example in Mexico or in the u.s.
20:27
They are willing to use their phone even that this personal
20:30
phone for doing MFA right but in some other countries they are
20:33
not so they are saying like why I'm should I use my personal
20:36
phone for a country? Elated to work as an
20:38
expectation. And if you're making users from
20:40
where you really should be paying for it or I dragged you
20:43
that yeah in some other countries, even they have like a
20:45
very very strict work until you have so you'll have to lead with
20:50
that as well. So it is different from country
20:54
to another right. Do you notice any difference
20:56
from an expectation of things like SLA or how long it takes to
21:01
get the things done? You know, what's maybe take
21:04
like, I'm boarding. For example, you know, I think
21:06
you know everyone would love to Of the automated and it works
21:08
just automatically but the reality is some companies they
21:11
take two days to work on on that or a week or two weeks.
21:14
Do you notice any difference with being a global company
21:16
where you know in the US the expectation is that this work
21:20
will be done in two days, but in you know, let's say Germany the
21:23
expectation is that it's one day.
21:25
Do you notice any differentiation and that not
21:27
really, I mean usually that process that we were able to use
21:32
cases from one country to another I think quite the same
21:36
and Probably is because we are very globalized were so if you
21:40
go into LinkedIn and you see like people saying, oh, I'm just
21:44
going to this company. If you show the photo from the
21:47
Welcome Keith with all the previous and all the things
21:50
there. So I think that HR is the kind
21:53
of experience that they are trying to deliver to their
21:55
customers which are the employees and so I think that in
21:58
terms of expectation there's you're trying to expect the same
22:02
and in recent Years also HR department are Leaving this
22:07
transformation with different tools from their side.
22:10
So they are looking for things. So how we can on board people in
22:13
the fastest way. So other concern not for HR, but
22:17
for security is okay. What about the vorlon?
22:20
Probably HR is not really concerned about the wording
22:23
because they are just saying bye-bye and v as long as they
22:27
could from the payroll system, but for security standpoint, we
22:31
try to look for. Okay, we need to make sure that
22:33
the wording also works at the At the right time, right?
22:38
Right. What about language support?
22:40
Do you find that because of being a global company that
22:44
there may be language challenges or have you settled on a certain
22:47
language is sort of like the default and that's a really good
22:50
point. Actually, we usually struggle
22:52
with that and most of the cases we ended up making of our own
22:57
translations, even though that the system for instant the sun
23:01
migration at the time we had to translate a lot of things from
23:05
the out of the box with So we usually work with the local it
23:10
or HR department in to make that translation.
23:13
So even that the product come up with French language, the French
23:18
guy will look and say this doesn't make any sense.
23:20
So they make the change from the translation from the own
23:24
language of the and and I think that in Spanish happened the
23:27
same and also we have Spanish from Spain from Latin America
23:30
from Argentina. So we have that variation as
23:33
well in some languages 40th. This is another challenge as
23:38
well and happen right now the same with Cloud Technologies and
23:42
it's more difficult. They could be stationed there if
23:45
I die. So do you find a lot of
23:47
Technologies are more English focused at this point or they
23:50
doing a pretty good job of having native better native
23:55
support for yeah. We just did are getting better.
23:58
I'm they're not the same like 10 years ago, but they're getting
24:01
better. I think that they are not
24:03
reaching a point yet in where they have like strong language.
24:07
Yeah, and also the other thing is that the worst getting more
24:11
globalized. So it is true that the most of
24:14
the princes administrators employees can handle in
24:19
different languages at least in global companies.
24:22
But also there is true is that we have a lot of local Workforce
24:26
which has focused on the their own language like in friend in
24:30
front and friends. They would be French and that it
24:33
happened the same here in Mexico, right?
24:35
So, yeah, it's something that is needed.
24:37
It and companies had doing better right now.
24:39
But still I think we can when you're working on different
24:44
projects. Do you see a lot of kind of
24:47
language things come up, you know sitting here thinking I was
24:50
thinking back to the workshops that we held with Arturo and the
24:54
folks there and I thought everybody spoke excellent
24:58
English. I mean better than I was
25:01
expecting going into the meetings, but one of the things
25:04
that we have to remember is that almost every large Creation has
25:08
factories or folks in the field. And that's where you know
25:14
leaking back to everybody everybody speaks English at
25:17
least as a second language breaks down, right and you got
25:20
the point where you have to make your systems available in
25:24
multiple languages, I definitely remember the days, you know a
25:28
decade ago with systems like sun or Oracle and it wasn't specific
25:33
to this systems, but it was just you know, we need To make all of
25:37
our Solutions available in multiple languages and most of
25:41
them had language packs yet. They didn't have you know
25:44
translations for customizations that you put into the system.
25:47
So if you added some language you have to add in whatever
25:52
number of languages you wanted to support make those language
25:55
files available. I haven't run into it as much
25:59
these days. I think a lot of Enterprise
26:03
deployments companies make the decision to make their Was
26:07
available in English only and usually I think the biggest
26:11
driver of that decision is cost quite frankly.
26:16
I think the other thing is that there are more Technologies now
26:20
that are browser-based that will do some automatic translations
26:24
and sure they probably come out funky.
26:26
I always point back to I wanted to take my wife and I wanted to
26:32
go on a vacation to Iceland for going There for our honeymoon.
26:38
This was 20 years ago and found an Iceland tourism site.
26:43
And there's a it was obviously translated from whatever the the
26:48
local languages into English and it said, you know, don't forget
26:51
to bring your your swimming costumes and I thought that
26:55
would areas where I was like, I don't know how to swim because
26:57
you but actually, you know, as we were talking about all this I
27:02
was thinking also about you know, I know that Arts are is
27:07
that some stage in his privileged access management
27:11
deployment privileged access management deployments in my
27:15
experience often run into a lot of resistance, you know from,
27:21
you know primarily from the folks that do system
27:24
administration what they're used to, you know, knowing accounts
27:28
on the servers and that's kind of a seat see theme in their
27:32
mind in terms of they can always get into their systems now you
27:35
want to put Something in between and you want to look over their
27:39
shoulder. So I'm wondering are Tara what
27:41
has been your experience so far in rolling out privileged access
27:45
management has there been much in the way of resistance will do
27:48
well and in terms of for is heaston, I think that for sure
27:52
Pam he's one of them but I think that in general it any change
27:56
that may impact the end user they will require this kind of
28:02
management of the change and it's interesting because In I
28:07
haven't worked with or I have you working with different
28:11
partners here related with either time implementation or
28:15
single sign-on implementation with Microsoft Technology for
28:18
instance and a lot of companies right now, even though they are
28:23
companies focus on technology or identity security.
28:27
They are either working with a parent company or like a smaller
28:33
company or a sister company that that is dedicated to
28:38
organizational change management.
28:40
So I think that in the last few years also the technology
28:44
companies in this case related with any kind of deployment that
28:48
involves the end user. There are they are adding this
28:53
important piece of organizational change management
28:55
is something that also here the company has been working in the
29:00
past four years now and and having this department in charge
29:04
of that, but it's something that I don't know likes it.
29:07
Years ago at this here in Mexico.
29:08
You don't see that kind of change management.
29:11
So right now I think that companies are releasing that is
29:14
important and it's something that need to be added.
29:17
And and yeah, actually this way that we were reviewing about the
29:21
we aren't still in the planning phase for Pam and and we need to
29:27
include into the deployment and into the whole project that is
29:31
because since the beginning we knew that is going to be
29:33
important to to manage the change in a better way.
29:37
Why so what what what comes to my mind in that when we were
29:41
reviewing that is like, okay, that's interesting because the
29:44
companies are including this but usually they have Focus team or
29:49
an even a focused company on in only change management.
29:52
So to be ideally it is important and probably with had the help
29:57
of these companies is where you are getting into more strategies
30:02
around. How do you convince your
30:03
atmosphere of how you sell internally to your administrator
30:06
or The idea or not idea about the benefits because their
30:11
benefits are for sure, but it's not always as easy for everybody
30:16
to get all the benefits. So this is where change
30:19
management comes into play and they really help you to
30:23
understand what it what is the benefit on this.
30:25
It happened the same with MFA. So we what is the benefit of
30:28
this? I don't get it.
30:29
So just Haiti bother me with this except bottom that I'm
30:34
gonna cheat for that, but it's a lot Lot of benefit with behind
30:38
that so it's important that organizational change management
30:41
takes place and say okay. This is important because of
30:44
this and that the security department works with them to
30:48
pass messages through that's your million-dollar idea for the
30:52
just want to change management company.
30:57
Yeah. No, no what I mean is it's
30:59
really spot-on. I mean, I think it was something
31:01
that was much more overlooked in the past, but it's a key
31:05
component of being successful. Is thinking through what is the
31:09
impact of this technology or process that we're going to
31:13
create change for people? And you know, how are we going
31:19
to make sure that we minimize the impact of the negative
31:23
impact of the change so I know we're running up on time, but I
31:29
did want to touch on one more Topic at least which is gdpr and
31:34
Global privacy. A Shinzo overall Arturo and kind
31:39
of how are they impacting you so far in terms of your job and and
31:44
having to make accommodations for global global privacy
31:48
regulations, at least here apparently company.
31:50
These kind of topics are handling by medical plans
31:55
apartment. But yeah, definitely we were
31:59
involved on some of the changes that were needed for that see
32:06
more on the compliance. Yeah, at least we're here.
32:08
Yep, right. All right.
32:11
I got one last question and it's really more around the work that
32:16
the studying that you did for your Masters around blockchain.
32:20
So can you tell me a little bit or maybe talk a little about the
32:24
dissertation you did regarding blockchain and identity
32:27
management. Yes.
32:30
Well, I did my master's degree in 2015 15 to 16 I did.
32:37
Master degree on cybersecurity and University of Southampton in
32:41
the UK and I went there just to I need like I need a break after
32:46
eight years try to work and I went there.
32:50
Let's go update and in this cyber security space in general,
32:53
so it was pretty cool because you you unplug everything from
32:57
your regular life and you go back to the to the classroom and
33:02
you simply Express. Yeah, and you you could phrase
33:05
actually it was like A lot of work because you have like in
33:10
the UK is just one year for your master degree is different than
33:13
the other countries that usually have two years for that and it
33:18
was very good in terms of going back to cybersecurity and grasp
33:22
a lot of topics. So one of the topics that really
33:25
crossed my mind that end was the blockchain technology and at
33:29
that time there was a lot of hip on everything related to
33:33
blockchain and Bitcoin and things like that and and And so
33:37
I decided to hit that topic blockchain and I added the
33:42
identity because at that time I were working on identity as
33:45
well. So I was talking with my with
33:50
the professor that I will working on that tradition and
33:54
she said she was only an Italian Professor.
33:56
He said okay, let's combine both of them.
33:59
Let's take identity to the state blockchain and let's do have
34:02
some research about what is the market doing and where?
34:07
How things are going in that and so one it was basically we
34:12
didn't build something in terms of building a product or
34:16
something. It was more like a resource or
34:19
wear these as well as working blockchain apply.
34:21
Where would it make sense to use for my identity perspective.
34:24
Is that the kind of yeah, it was taking a general.
34:26
So General Bloch thing what it is how it work and and then also
34:31
taking the identity par. So how you can apply a
34:34
blockchain, you know that blockchain.
34:36
Elegy, they have like different use cases and different
34:41
implementation ways to implement.
34:44
So one of the things was okay. What about identity in one of
34:47
the main topics for that was OK, what are the issues with the
34:51
identity systems right now, right and one of the particular
34:56
issue that I've found is that you have everything in a single
34:58
location. So most of the hacks related to
35:01
for instance the certificate Authority thing in where they
35:04
have all the keys in one place. So they attack Get into that
35:08
systems and install can just all in all the whole T's, right so
35:12
you're screwed not that time. So and there's so it's how we
35:16
can separate that and how we can take advantage of the distribute
35:20
layering where you perhaps can have like distributed all that
35:25
information and at some point why not the the end user or the
35:30
user can keep all that sensitive information.
35:33
So if somebody breaks into the main, Main location there's not
35:38
any key. There's nothing like that for is
35:41
taking blockchain as a distributed ledger to have that
35:47
bread different systems and don't have everything in a
35:50
single location. And one of the proposal was also
35:55
to use thorough knowledge proof, which is another type of
36:01
implementation cryptography implementation to don't share
36:06
all the information. Even with this case with the
36:09
service provider. So imagine that you are an
36:12
identity provider and you need to prove something to the
36:17
service provider. So in that proof how you can
36:20
actually prove whatever they are asking for something without
36:23
revealing the whole information that you have.
36:26
So using this kind of cryptography you are able to
36:29
somehow make that proof without actually rebuilding the whole
36:32
information. So it's it's more in a privacy
36:34
standpoint where you say, okay. What if there are there is any
36:38
way in where you can actually prove imagine everything in your
36:42
your personal life that you need to prove to somebody that you
36:46
are more than 20 years old for buying a beer or you are I know
36:52
your title or your certification every proves that you need to
36:56
made you can made it the proof without revealing any extra
37:00
water this information. So it's like a lot of Concepts
37:04
around that is our for for privacy and Or getting back to
37:08
privacy to to the actual user and this is also a very
37:14
interesting topic because right now as you may know a lot of
37:18
facts related to privacy right over to to who are doing
37:24
companies like Google or Facebook in terms of privacy,
37:26
there are not they are exploding that part rather than keep it
37:30
private. So are a lot of conversation
37:33
around that is also to how we can take back that privacy of
37:37
how we can take back control our own things and have that privacy
37:42
and these are protocols that help you and that unfortunately
37:45
at least at that time three years back, they weren't any
37:52
more efficient protocols for that.
37:55
So the implementation of that were just just in the lab or
37:58
only with some research doing IBM was working on that at the
38:02
time. So yes, I think those are very
38:06
good. Elegy and a lot of good things
38:09
going around that so hopefully in the near future if the
38:13
research are continue working on that or if more people willing
38:16
to research on that, we will have interesting implementation
38:19
either around blockchain or protocols like Heroes proof.
38:23
Can I see it being more affable to more like the consumer space?
38:28
I'm still struggling to find a good application for where it
38:31
makes sense to use blockchain inside the Enterprise.
38:35
I mean, there's probably some up there and I would certainly
38:38
welcome anyone who has thoughts are on that because you know,
38:41
I'm curious what those might be that would be practical today
38:44
for botching use, but I certainly see a more external
38:48
facing right? It's more government focused its
38:51
School medical records. Those are the things where you
38:54
do need to have an expectation of privacy and you want to take
38:57
the concept of you know, the zero knowledge is really kind of
39:01
the least the concept of least privilege right?
39:04
Maybe think about it from a data attribute.
39:06
So how do I prove that? I am 21 years old or 18 years
39:10
old. Do I need to show my full idea?
39:12
We're talking about this at lunch right where it has my
39:15
address and my name and everything else in addition to
39:17
my to my age or can I have just a system that says it's binary?
39:22
Yes. No, is this person 18 or older?
39:26
Yes. Does it matter if I'm 50 40 30
39:28
or you know new 18 probably not that case and I can see use
39:33
cases like that where you need to demonstrate.
39:36
Certain things right with that that that that knowledge right
39:41
with that mean blockchain is something that we can talk like
39:44
he's talking forever chapter will probably have to leave it
39:48
at all yet have a separate one. So I think that's probably a
39:50
good place to leave it with the the utter confusion that
39:52
blockchain tends to invoke amongst people.
39:56
I feel like I've had I've sat through and listen to the so
39:59
many blotching things that I probably know it and I still
40:02
feel like I don't know I think yeah, it's a little
40:04
conversation. Yeah.
40:05
Colleagues here that he he's in charge of the complaints
40:10
department and he say that the a blockchain is only for financial
40:14
things in related to yeah to have a coin and something in
40:19
particular like that Bitcoin is like that and yeah, actually
40:23
he's true because it is a way that was created.
40:28
But but they are finding some different implementation ways to
40:33
do it and that doesn't mean that you cannot do it for for
40:36
something else is the same concept but applied in a
40:38
different way. It'll get ya it'll adapt and
40:40
move to something or it'll spark something new and it's just
40:43
that's just the way that technology and Innovation Works
40:45
in general. No and in something that really
40:48
surprised me was that there are studying or in researching more
40:52
about Bitcoin is that all the Technologies involved in the
40:56
concept of Bitcoin and blockchain where the real ones I
41:01
mean distribute system already exists a lot of Concepts all of
41:04
them already exist. Years back was until somebody
41:08
put all the pieces together and say is the idea frame.
41:10
So this is something that is really I mean real surprise me
41:14
and at the same time really give me a lot of Hope for the future
41:17
because how many application or how many technology that we
41:20
already have could ended up in some kind of idea like that.
41:24
So and I interesting as a professional podcaster because
41:28
I'm going to call myself now that goes back to the creativity
41:31
that you were talking about earlier, right?
41:33
It's it took the creativity of someone to say Hey, what if we
41:36
combine these pieces in this specific order and the specific
41:38
way and all of a sudden you had this brand-new space that I mean
41:43
you put blockchain in your in your name and you know people
41:46
were throwing money at you left it right now and then the other
41:49
will be serious about about they degrade or yeah who is created a
41:53
right, but you're not come out too.
41:54
So yeah, exactly. It's very personal.
41:56
Yeah, who knows now? We're getting into the
41:59
Illuminati and the problem is solved.
42:05
Go for it Jimmy everything you want to close out with know you
42:11
guys killed it there. All right.
42:14
Well, I certainly appreciate the timer turbo.
42:16
It's always good to see you. It's always good to see the
42:18
mountains of Monterey and look forward to coming back soon.
42:21
Appreciate the time you spent with us and we're going to go
42:24
ahead and leave it there for folks who are listening.
42:26
Hope you enjoyed this and if you like what you heard like
42:29
subscribe put out a five star rating or eight.
42:33
Tell your friends. Tell your Jim's dad, if it
42:36
wasn't the last week's episode, you know, we're always looking
42:40
to have different ideas come our way and if there are things that
42:42
you want to send to us, you can get a hold of us at questions at
42:46
identity at the center.com and we'll talk to you on the next
42:50
one. Thanks.
42:51
All you guys the way you've been listening to the identity at the
42:57
center podcast to access all episodes visit identity at the
43:01
center.com.