Latest / Identity at the Center / #337 - Adaptive Authentication and Fraud Prevention with Ping’s Patrick Harding

Transcript

#337 - Adaptive Authentication and Fraud Prevention with Ping’s Patrick Harding · Identity at the Center

0:00
Policy enforcement decisioning have to be very local, but the
0:03
policy itself that's going to be used in the in the policy
0:06
decision engine, it can be pushed in so it can be
0:10
administered somewhere else and then pushed in.
0:12
So that it basically is, you know the policy decisions
0:15
running locally and that that addresses the performance
0:18
concerns which a lot of these SAS applications are going to
0:21
have in in these situations. So I guess that's the benefit of
0:25
standard, right? Is that absolutely all the
0:29
applications can kind of subscribe to the same standard
0:33
and you get greater adoption of this model?
0:36
Yep, yes, I mean that. And again, this is this is not
0:39
available now, this is still early.
0:42
This is some of the evolution of all of Zen and where it, you
0:44
know, where it's sort of going to, but it's to enable some of
0:48
these use cases where, you know, a policy can be developed, you
0:52
know, and controlled by a, you know, a customer organization
0:56
and pushed into lots of different SAS applications.
0:58
So they all you know, so you all have individually different
1:02
policy that you can use in those situations.
1:09
This is identity at the centre if it has anything to do with
1:14
IAM. This is the go to podcast now
1:19
your hosts Jim McDonald and Jeff Stedman.
1:29
Welcome to the Identity of Center podcast.
1:31
I'm Jim McDonald. I am not joined today by Jeff
1:35
Sedman. Unfortunately, he was not able
1:37
to make it today due to business travel, but I've got a great
1:42
show lined up for you today. We're going to talk about
1:46
adaptive authentication and fraud prevention.
1:49
So if that's right up your alley, you're on the you tuned
1:52
into the right episode. You know, before we get started,
1:55
it's our tradition to go through our discount codes.
1:58
I've got only two today, but there are big ones if you're
2:02
going to the European Identity and Cloud Conference that are
2:05
known as EIC 2025. It's in Berlin and the dates are
2:10
May 6th through May 9th. We've got a code, it's IDAC 25
2:16
MKO that gets you 25% off the conference rate.
2:21
The second conference discount code we have is for Identiverse
2:25
2025. It's in Las Vegas.
2:29
It's that's the Mandalay Bay this year.
2:30
So if you haven't been to Mandalay Bay, it's going to be
2:33
exciting for that reason, but it's always one of the best
2:36
conferences of the year. That's June 3rd through June
2:39
6th. We're going to have you use the
2:41
code IDV 25, dash IDAC 25. That will get you 25% off these
2:50
two codes. By the way, you're not going to
2:52
find better out there. So I get the temptation to go
2:57
out to Google and look for discount codes.
2:59
I'm just going to let you know ours is the best one available.
3:03
So as I mentioned, we're going to talk about adaptive
3:05
authentication and fraud prevention.
3:07
Joining me today is Patrick Harding.
3:10
He's the chief product architect at Ping Identity.
3:13
Welcome to the show, Patrick. Jim, thank you very much.
3:17
Thanks for having me back. Appreciate it.
3:19
Yeah, I'm really glad to have you here.
3:21
Let me ask you a quick question. Are you going to be at night
3:23
Danvers this year? I am actually going to be at
3:26
universe, yes. Also probably going to be at EIC
3:29
as well so I'll be at both. Oh good, good.
3:31
We can. We can share a beer and one or
3:34
both, or not share a beer. But I have a beer at the same
3:37
time and the same. Value, Jim.
3:38
I'll buy. I'll buy you a beer.
3:40
How's that? Let's do that.
3:41
All right. All right, And I don't have to
3:42
share with anyone. That you can do.
3:44
It's all yours. All yours.
3:45
I can. Almost Yeah, my my girlfriend
3:49
might have might argue with that, she might want me to share
3:52
with her, but. Well, there you go.
3:54
So Patrick, you, it's kind of our tradition around here to ask
3:58
how did you get into identity and did they choose you or did
4:02
you choose it? Actually, so Jim, I'd say it's a
4:06
little bit of both. Back in the day, late 90s, I was
4:12
doing cybersecurity before it was called cybersecurity,
4:15
actually doing a lot of firewall infrastructure, network security
4:19
infrastructure, things like that.
4:21
In the kind of the early days of the web at a company called
4:25
actually Fidelity Investments in Boston, I quickly realized at
4:29
that time that poking hose holes through firewalls kind of wasn't
4:34
going to be the right approach to secure web interactions and
4:38
stuff like that. So I ended up looking and
4:41
thinking about kind of identity and, you know, those sort of
4:46
things. And actually coincidentally, at
4:50
around the same time, Scott Mcneely, the CEO of Sun
4:53
Microsystems, contacted the CEO at Fidelity and said, hey, Ned,
5:02
there's this thing called Microsoft Passport that I'm sort
5:04
of worried about basically. And, you know, think of it as
5:08
centralizing all authentication on the web, owned and controlled
5:11
by Microsoft. We don't think that's a good
5:13
idea. We'd like you and a bunch of
5:15
other companies to join us at this thing called Liberty
5:17
Alliance and you know, come up with approaches to basically
5:21
deal with that. Obviously back at that point in
5:24
time, you know, 2000 and one 2002, Microsoft's reputation was
5:29
very different than it was than it is today.
5:31
I would say. So if Fidelity joined, I got
5:34
involved and that work at Liberty Alliance ended up being
5:39
the foundations of what was what became SAML or SAML 2 to be more
5:44
specific. That work I did with SAML 2 led
5:48
me to Ping Identity where we started to do the first, you
5:52
know, Federated single sign on capabilities, dedicated
5:54
Federated single sign on and you know, gives me 20 years later
5:59
basically, you know, still, still solving identity problems
6:03
because, you know, we, we, we, we, we never finished it seems
6:07
basically. It's kind of a cool story.
6:09
I kind of feel like you just said something like, so I was
6:12
sitting there with Thomas Jefferson and John Adams and we
6:17
were kind of talking about, Hey, what if everybody came to the
6:21
table and voted for the leaders and, and, you know, like had
6:26
that level of conversation because you just being dropped
6:28
some some heavy hits in the beginning of, you know, identity
6:32
kind of becoming what it is. So I thought that was a pretty
6:36
cool, pretty cool story. Put you right there in the in
6:39
the as a founding father. Yeah.
6:42
Well, it was early days, definitely.
6:43
And it's it's kind of come a long way.
6:48
Obviously we'll talk later about the evolution of Samuel and Open
6:51
ID Connect and stuff like that. But yeah, there's a there's been
6:53
a lot going on over the years. Yeah, yeah.
6:56
So I wonder every once in a while I like to do a topic that
7:02
you kind of feel like, all right, we've been talking about
7:04
this for a decade or more, maybe 2 decades.
7:09
And it's kind of old hat. But we got to remember new
7:12
people are coming into the industry and trying to kind of
7:15
wrap their brains around some of those.
7:17
And I had a recent conversation with one of my colleagues and he
7:22
was asking me about authentication and more
7:25
specifically adaptive authentication.
7:27
So he had a SAS application that he had a particular part of this
7:33
SAS application that this kind of that admin section and he
7:36
wanted to force users when they access this part of the
7:42
application to give a multi factor authentication.
7:48
So it's kind of like the the classic use case for adaptive, I
7:52
think. And so I was thinking this would
7:56
be a great topic for a podcast and then you and I started to
8:00
collaborate about having you on. I thought you'd be the perfect
8:03
guess to talk about this. So I'm just starting with, I
8:07
want to start, Patrick, with, you know, what are some of the
8:09
questions that you had asked this friend of mine in terms of
8:13
trying to uncover what he was trying to do?
8:17
So what what he's trying to do is something we used to be able
8:22
to do quite easily actually back in the days when we were, you
8:26
know, when organizations were running these applications
8:29
themselves in the data center. We had, we had much more
8:34
flexibility in terms of being able to apply policy essentially
8:41
to, to different things. And I would say I, I would point
8:44
at the, the WAM products, the web access management products
8:48
back in the day like the site minders, the Oracle access
8:50
managers, you know, the Sun had a product in that world.
8:55
Everybody had a product in that world.
8:57
They, they were actually very good at helping companies
9:00
actually do this. We can, we can talk about why,
9:05
but with the evolution of SAS, you know, SAS really emerged
9:11
where the, the point of SAS was that it's going to be easier and
9:16
simpler for you to, you know, to, to use this application, you
9:20
know, Mr. Enterprise, but we're going to take away a lot of
9:23
flexibility, all right? We're not going to give you all
9:26
the bells and whistles you might have had if you were able to run
9:28
this same application on premise.
9:30
And so that if you're going to get what you get and don't get
9:33
upset, as I used to say to my kids basically.
9:36
So you know, that's really, you know, the fundamental sort of
9:40
issue here is that SAS applications have not done a lot
9:44
over the years to cater to, you know, different enterprise
9:50
requirements that might emerge on a case by case basis because
9:54
they don't give you a lot of flexibility.
9:55
I, I kind of had the same thought pattern that you just
9:59
went over there where, you know, when you had what we call legacy
10:04
authentication or web authentication, web auth and
10:08
systems, you'd have essentially some sort of filter in front of
10:12
your web server that would examine every request that
10:16
you're making. And you can set a policy that it
10:19
would look at that HTTP and say you're trying to access slash
10:23
admin. We're going to kick it back and
10:27
determine whether or not you're authenticated at the right
10:30
level. And if not, we're going to step
10:32
you up. Absolutely.
10:33
That's where I started as well. And then I started to think,
10:36
well, you know, there's the legacy piece, but there's also a
10:40
lot of application now, single page applications.
10:43
And you can't always just do URL filtering.
10:48
So it's that too. So I think I so in, in terms of
10:53
that really, you know, so where we are today, I think in so we
11:00
don't see a lot of adaptive authentication being enabled on
11:03
SAS applications. We are we still seem to see it
11:08
though on I'll say and when SAS applications are more focused
11:13
on, you know, for enterprise and for workforce, things like that.
11:17
But we do do it see it in our customer facing applications
11:20
where organizations are building and developing and deploying
11:23
those applications themselves. Because you know, to me
11:28
adaptable adaptive authentication is actually a
11:32
authorization or policy enforcement problem.
11:35
You, you basically need to apply policy at certain points in the
11:40
application where you where you want to make a decision on, OK,
11:45
do I want to essentially reauthenticate, step up the
11:51
authentication, whatever it might be at this point on this
11:55
transaction essentially. And as you said, when we had WAM
11:59
products, web access management products, we could use a web
12:02
agent or a, or a proxy as, as a place to do that enforcement.
12:08
You know, we could check a certain URL, things like that.
12:11
You can also do that with AP is as well.
12:13
API gateways can do the same sort of thing, which is how you
12:15
might address it with single page apps that might be talking
12:20
against APIs as opposed to sort of legacy sort of, you know, web
12:23
interactions and stuff like that.
12:25
So we can do adaptive auth on applications, SIM applications
12:30
that are built and deployed by, you know, different, you know,
12:35
by our customers, but much more difficult now to do it with SAS
12:41
applications because we don't have the ability to do that
12:45
enforcement so easily. Essentially, you're kind of at
12:48
the mercy of the the provider of that application, right, the
12:52
service provider. Absolutely.
12:55
So the one thing they've done is they've enabled, you know,
12:59
single sign on, all right. So they've basically given you
13:01
flexibility to control how authentication's done.
13:03
And we do that with things like SAML, you know, SAML mostly with
13:07
SAS applications, but, and that allows you to sort of do
13:13
adaptive authentication at login time because you control, you
13:17
know, you, you control the login essentially as an organization.
13:21
So you can basically make a, you know, a decision at that point
13:24
based on different factors about what level of authentication you
13:27
might want at login. But once the once the user is
13:32
inside is is, you know post authentication interacting with
13:36
the SAS application directly. Very few SAS apps give you the
13:42
controls the policy controls to allow you to make policy
13:46
decisions at different points in the applications for.
13:50
Different places, right? Anywhere other than the front
13:52
door, right? Pretty well, yeah.
13:54
So there's been, so there's there's been a sort of attempts
13:58
and efforts at that. So if you think, if you look at
14:01
the what was called the Casby market, like the cloud access
14:05
security brokers, I think they were called, they've acted as
14:09
proxies in front of SAS applications.
14:12
So you know, there's an element of, of of attempting to apply
14:17
policy there. But that tends to be more, you
14:22
know, sort of risk based where if they think there's this is a
14:27
risky device now they might automatically push you out to
14:31
get you re authenticated. It doesn't allow you to do very
14:34
easily do policy that says, all right, on this transaction type
14:41
with this entitlement in this situation, this is, this is high
14:46
risk. And I want you to
14:47
reauthenticate. Think, think of, think of the
14:49
analogy to a banking application, all right, where
14:53
like a, you know, we, we have a, we have a banking application
14:56
and you know, they want to set policy that says, OK, if it's
15:01
high risk, if it, you know, if I think the user's high risk, then
15:05
reauthent, reauthenticate them, you know, adapt, you know, adapt
15:08
the authentication. But they have other policies
15:10
that says if this is a payment, all right, automatically re
15:15
authenticate them. Or if this is a payment and it's
15:17
over $10,000, re authenticate them.
15:20
So there's certain, you know, application transaction types
15:24
that can get quite granular where they look, you know, that
15:27
are considered a high risk. And and you know, not every
15:29
organization is the same, not not every bank's the same, not
15:32
every customer of sales force is the same in in their risk
15:36
profile. And that's where we've lost that
15:39
level of customization on the risk policies that people might
15:44
want to put in place, I would say.
15:46
Yeah, yeah. And you're getting into an area
15:48
that I really want to explore, but you've mentioned the earlier
15:52
that got me thinking about, OK. So if the depth of
15:56
authentication, it's hard to do it kind of that that next level
16:00
which I always call that coarse grained authentication or coarse
16:05
grained authorization. Right.
16:07
And it seems like this, you know, kind of SAML IDT model
16:12
really works at like the resource being like the front
16:16
door for the application, like you either have access or you
16:19
don't have access. Maybe we're going to send some
16:22
attributes in the payload, but for the most part, based on how
16:27
you come in and you were talking about the device luxuriacy, but
16:30
there's more context to it, right?
16:32
At least the kind of the way I conceptualize it in my head is
16:36
you've got the the actor, which has a context.
16:42
That could be the device, it could be where the person is
16:44
coming from, it could be, you know, several different
16:48
attributes about that actor and they're trying to access a
16:51
resource. And at some level, I mean, and I
16:55
don't know if it's just marketing buzz or if this is the
16:57
way it really works is that the actor has a risk score via that
17:02
score of like, you know, very low or very high.
17:05
However, it works and the resource has a risk score and as
17:09
long as the resource matches or is better than the excuse me, if
17:16
the actor is less risky than what's required to access the
17:21
resource, they get right in, but if not they get challenged.
17:25
Is that kind of the way it's working in like the modern actor
17:30
or modern description for adaptive authentication?
17:36
Really. Yes, somewhat.
17:37
I mean, I just think that with SAS apps, there's, there's,
17:41
yeah, from what we see, there's just limited controls right now,
17:44
I think. And and I don't think we can
17:48
really apply the agent prop, the agent model or the proxy puddle
17:52
very well. And it's also very difficult.
17:54
I mean, we've externalized authentication from these SAS
17:57
applications, but externalizing authorization is actually much,
18:01
much more difficult, All right. And the SAS applications
18:05
themselves really don't want to do that as much as possible.
18:08
But one of the one of the things the SAS applications have done
18:12
is they've exposed APIs to allow you to programmatically control
18:18
entitlements. All right, things that you're
18:20
allowed to do. And that's something we never
18:22
had on traditional on Prem applications like, you know, we
18:27
never had that level of programmatic control where I can
18:30
call an API to adjust the entitlements.
18:33
It used to be you had to go into the database and change them
18:35
manually or go through some, you know, weird web console to do it
18:39
and stuff like that. So what we can actually think
18:42
about doing now as an alternative to this actually is
18:45
to think about it as you know, you're standing privileges of
18:50
what you can do in this SAS application are fairly limited
18:53
and that you might be granted privileges to do certain things,
18:59
you know, for periods of time. So as I mentioned, quite often
19:02
when you want to do adaptive auth, it might be on higher risk
19:06
transactions like I want to download the financial data for
19:11
the company or, you know, I want to approve a, a money transfer
19:18
of X, things like that. So you could actually think
19:22
about this now to say, all right, maybe by default, I, I'm
19:27
not allowed to do this and I have to request permission
19:31
basically with a with, with basically just in time access
19:34
where I rest request permission for this entitlement, it gets
19:38
approved. And then I'm able to do this for
19:40
some period of time, maybe 15 minutes, 20 minutes.
19:43
And then it's then it's taken away from me basically.
19:46
So it's another way to think about how to control and limit
19:49
risk essentially, which is what this is all about limiting risk
19:53
on what people can do in these applications essentially.
19:57
So it's just a slightly different approach, but.
20:00
It works within the constructs of what SAS applications allow
20:03
you to do right now essentially if they have this API based
20:06
access to control entitlements. I want to get into the other
20:11
scenario that you're talking about.
20:12
You were giving that banking example and you know, further, I
20:19
can't really go back to my original example.
20:22
Talking with this colleague, he actually wanted to do more than
20:27
just protect this admin application.
20:30
You want to say, well, kind of take it to the next level and
20:33
I'm going to make up an example that there's these workers from
20:38
France and if somebody goes in and wants to access their
20:44
account, that within the admin application, actually if they
20:50
want they want to access their account or change their account,
20:54
that's when we would kick him in the backroom.
20:58
So in other words, we would trigger that risk score based on
21:02
a an action and that action might be based on the data.
21:06
So it's kind of like, you know, if you're transferring 10,001
21:09
dollars, it gets flagged. If you're transferring 10,000,
21:12
it doesn't, but it's based on the data and some kind of policy
21:16
or rule set. Yep, that seems to me like
21:19
that's advanced fraud analytics. That's more than your typical
21:24
IDP is going to achieve for you, right?
21:27
There's there's some kind of additional system that is kind
21:33
of examining that process, is that right?
21:36
Yeah. I mean, unless the application
21:38
itself like a sales force, you know, I'm talking about
21:41
workforce applications now, like a sales force or a service now
21:44
or a work day, unless they build that in directly into their into
21:49
their applications, you know it, you know, they're going to have
21:54
to take those requests from customers and sort of add that
21:57
capability basically. And you know, not a lot of them
21:59
are doing that where just because what, what is considered
22:06
risk risky for different, you know, different customers is
22:09
different. Basically the fact is that in
22:11
this case it was France. France is a big deal.
22:13
They've got to they won't have different policies because it's
22:15
a French, it's a French user, non French user.
22:18
That might not apply for other, you know, for other customers.
22:22
What but what I think can be done and what's evolving is
22:30
standards that allow us to externalize policy from the SAS
22:35
applications. The SAS applications might make
22:38
the policy decisions and, and, and the enforcement themselves,
22:43
but the policy itself as opposed to actually, you know, creating
22:48
it inside the admin console of Salesforce based on what they
22:52
can do. There are opportunities to
22:54
externalize that and use standards like emerging
22:58
standards like Author's Ed or ZED or Zen or Zen, I should say.
23:03
Also. Zen yes, as a as a, as a
23:09
mechanism to build those policies externally and then,
23:15
you know, push them into the applications essentially so that
23:18
that starts to give you the flexibility of all right,
23:22
different, you know, different policies can be written by
23:24
different customers, but they can be enforced by the
23:28
applications and enforced locally basically in this
23:31
situation and that gives you more flexibility.
23:34
So the application winds up reaching out to this external
23:38
process. I was wondering if there's
23:40
actually like some kind of proxy that data would.
23:44
I would, I would, I would say it's working the other way.
23:47
One of the things that when you, when you talk about centralizing
23:51
authorization is that if you think of there's policy
23:57
enforcement and policy decisioning and you know,
24:00
basically those things generally need to work very fast.
24:05
All right, You can't, you can't be calling out over the Internet
24:09
for every policy decision to be made.
24:11
You can't be phoning home like Salesforce can't call back to
24:15
their customer for every policy decision to be made.
24:18
Essentially, it's, it's just too slow.
24:20
So policy enforcement decisioning have to be very
24:23
local, but the policy itself that's going to be used in the
24:27
in the policy decision engine, it can be pushed in so it can be
24:31
administered somewhere else and then pushed in.
24:33
So that it basically is, you know the policy decisions
24:36
running locally and that that addresses the performance
24:39
concerns which a lot of these SAS applications are going to
24:41
have in in these situations. So I guess that's the benefit of
24:46
standard, right? Is that absolutely yes, all the
24:50
applications can kind of subscribe to the same standard
24:54
and you get greater adoption of this model.
24:57
Yep, yes, I mean that. And again, this is this is not
25:00
available now, this is still early.
25:02
This is some of the evolution of all of Zen and where it, you
25:05
know, where it's sort of going to, but it's to enable some of
25:09
these use cases where, you know, a policy can be developed, you
25:13
know, and controlled by a, you know, a customer organization
25:17
and pushed into lots of different SAS applications.
25:19
So they all you know, so you all have individually different
25:22
policy that you can use in those situations.
25:25
I'm kind of getting the sense from this conversation that it's
25:29
really like the the benefit of a SAS application is that it's
25:34
easy to get integrated with initially.
25:37
You can provide the services and a pretty good level of security,
25:41
at least from an authentication standpoint by integrating into
25:45
your IDP. The downside is that if you want
25:48
to get real fine grain, you know, there's only so much that
25:51
you can do. So that's kind of where I
25:54
summarize where we are so far. But something that's in the back
25:57
of my head is also, you've got SAML to as the methodology to
26:04
integrate, you've got Open ID Connect.
26:07
And I'm wondering if there is, if the ability to handle
26:13
authorization is part of the reason why you would choose one
26:17
over the other. Is there a major advantage to
26:20
integrating with Open ID Connect versus SAML when it comes to
26:24
this whole topic that we're talking about and being able to
26:28
either Dr. Adaptive authentication or, you know,
26:32
have more control over authorization?
26:36
So this, so it's interesting, I think it's, it's, it's
26:41
interesting how SAML has become sort of the, the de facto
26:45
default SSO standard for enterprise SAS applications.
26:49
And that was originally driven by Google and Salesforce
26:53
adopting it back in, I don't know, almost 20 years ago.
26:56
And generally speaking, most SAS vendors now kind of adopt that
27:01
by default because they know that most of their customers are
27:03
going to have a SAML IDP capability.
27:07
But there hasn't really been much innovation happening in
27:09
SAML for the last 1015 plus years.
27:12
It kind of works. It does it's thing where where
27:16
we are starting to see innovation still is in the Oauth
27:19
and Open ID Connect world. And even though I'd say today
27:22
Open ID Connect doesn't offer any major advantages, probably
27:26
the, the one major one is it's kind of easier to set up and
27:30
configure and you, you can avoid some of the complexity around
27:35
certificate management and stuff like that because it can be more
27:37
dynamic in it's nature that, you know, some of the innovation
27:42
emerging there. Well, any innovation we do is
27:45
going to emerge in those areas. So I, you know, that's why I
27:49
believe all the Zen is actually part of the is happening within
27:53
the constructs of the Open ID Foundation.
27:55
All right, so it's close. It's going to be closer to Open
27:57
ID Connect than ever. It's going to be the SAML.
28:00
So definitely as we evolve to some of these newer protocols to
28:05
address problems, you know existing problems, they're all
28:08
happening in that open ID connect oriented world.
28:12
I don't think there's ever going to be a pre req that you need
28:14
open ID connect, but it it's all happening there and I think will
28:18
evolve there over time. And you know, most generally
28:22
speaking, any customer today that has a IDP that supports
28:26
SAML, that IDP is also going to support Open ID Connect as well.
28:29
So it's not like it's it's more the SAS vendors themselves
28:33
choosing to build something beyond SAML, given that that's
28:37
been the default for so long. So it's the advantage that there
28:41
are today, but it's also where everything is heading, or I
28:44
shouldn't say where everything is heading, but if you're
28:47
expecting innovation, especially like things to do with Austin,
28:53
any kind of let me just make city easily where things are
28:57
heading. If you have the choice between
28:59
Samuel and OIDC, choose OIDCI. Think you made the point earlier
29:04
though that you know, if you look at a basket of size
29:08
applications, it's more than likely that the majority
29:12
supporters, Samuel, they're still, I always find it like
29:16
amazing and there's an enterprise grade application
29:19
that doesn't even support SAML or that they they charge the
29:24
integrate via SAML. And that I was going to, I was
29:28
going to mention that there's two things actually.
29:30
So one thing with we've seen over the last few years is that,
29:34
you know, a lot of a lot of large organizations still have a
29:37
lot of, I'll call them on premise applications or
29:40
applications that might be now deployed in, in their, in their
29:44
cloud infrastructure, basically as cloud native, like running in
29:47
that customer's AWS environment or GCP environment or Azure
29:51
environment. So, you know, I'll just say it's
29:53
a, it's a derivative of on Prem. It just happens to be in their
29:55
cloud. They still want single sign on
29:59
to those applications. And actually what we've seen
30:02
there is, you know, 15 years ago, 10-15 years ago, they might
30:07
have used a web access management product.
30:09
They've actually instead now shifted over to support Open ID
30:12
Connect. So you're seeing Open ID Connect
30:15
used for those sort of on Prem cloud native applications that
30:19
the enterprise is using, but it's quite often SAML for the
30:22
SAS applications. So I could definitely see SAS
30:26
applications evolving to Open ID Connect as well, just to make it
30:30
consistent across the organization actually.
30:33
Do you find? That do.
30:35
You find that the level of refer to.
30:39
Let's say, you know, you had some application that 10-15
30:44
years ago you wanted to quote UN quote webify and you had a
30:48
consulting firm come in. They they filled this app.
30:52
It's not integrated even with SAML, but now's the time.
30:56
It's like maybe you have it behind a reverse proxy, but you
30:59
say it's not going anywhere. You want to get reverse proxy
31:03
out of your environment and you say OK well I could convert it
31:08
to SAML or OIDC. Is there a significant
31:14
difference in the amount of effort to do one over the other
31:19
and is that driving developers decisions a lot of times?
31:23
Yeah, I think, I mean, traditionally, you know, you
31:25
know, we learned a lot from SAML.
31:27
The Open ID connect is definitely a lot simpler.
31:31
Just you know, because we learn a lot from, you know, you know,
31:33
there were certain mistakes and things we did in SAML that, you
31:36
know, we chose to fix an Open ID connect.
31:39
And actually now with with open ID connect, there are servers
31:45
and even, you know, web agent plug insurance and and proxy
31:48
plug insurance like nginx plug insurance to and you know, open
31:51
ID connect enable your applications.
31:53
Like a guy that used to work for me, Hans, you know, built, built
31:59
the Apache, you know, you know, the Apache and the nginx mod
32:04
open ID connect as a, as a plug into Apache that you can
32:06
basically use to open ID connect your applications.
32:09
So it's a, it's a lot, you know, it's, it's, it's a lot, lot
32:14
lower barrier to entry to have your application support those
32:17
protocols right now. So there's really no reason they
32:19
shouldn't, essentially. Yeah, absolutely.
32:22
I want to go back to your. I want to go back to your point
32:25
though, about SAS applications now charging for SAML and what,
32:33
what, what completely freaks, you know, freaks me out here is
32:37
that I've, I've heard more, yeah, more and more SAS vendors
32:41
are charging for their enterprise grade features.
32:44
I'll say that you've got to pay extra for them.
32:46
And those enterprise gauge features include SAML single
32:49
sign on. But now there's, you know, you
32:53
know, companies emerging that are saying, Hey, we, you know,
32:58
you can, we'll give you single sign on to your SAS
33:00
applications, but but do it in a way that you don't have to pay
33:04
the SAS vendors to support it. And the way they're solving this
33:08
is actually through password vaulting, all right, which is
33:11
basically goes back to what we were doing 20 years ago in, in
33:16
terms of password vaulting people to get access to these
33:19
applications. We've now gone back to it
33:21
because people don't, don't want to have to pay for single sign
33:24
on anymore through things like SAML and stuff like that.
33:27
So it's kind of, I don't know, kind of annoying anyway.
33:32
There's a website called SSO dot tax.
33:38
It's kind of the single sign on Wall of Shame.
33:42
OK, I hadn't actually even heard of that.
33:44
That's interesting. I've got to go check that out.
33:45
But yeah, this is like it. You know, you try and do the
33:48
right thing and, you know, capitalism gets in the way.
33:51
I'll say that. So, Patrick, in the future, you
33:54
know, you keep hearing about these AI agents and they're
33:56
going to play a pretty heavy role in terms of how we get our
34:01
work done. And I think adaptive
34:05
authentication winds up playing a role in that because we wind
34:09
up delegating work to them, right?
34:11
So they're authenticating on our part.
34:15
They're essentially, you know, pretending they're us or getting
34:18
work done for us. And obviously, there's the
34:23
potential that they will be seen as robots, bad code, malicious
34:28
code, whatever you want to call it.
34:32
Let's keep the basic and first start with this concept of AI
34:35
agents. What are AI agents?
34:38
And then feel free to kind of go off on what I just said, whether
34:43
I was right or wrong, You know, how does this topic of adaptive
34:47
authentication fraud prevention play into, you know, this AI
34:52
agent future? Sure.
34:54
So, but we've been thinking a lot about AI agents over the
34:58
last probably 12 months and the impact they're going to have and
35:01
the impact's going to be huge. And I don't think people quite
35:04
understand yet how big an impact they're going to have.
35:07
Honestly, the, you know, we kind of didn't touch on it earlier,
35:13
but you know, one of the key points about adaptive oath is
35:16
the fact that, you know, it might not be policy based, it
35:19
might be risk based. If you get a risk score back
35:21
from your fraud system, you might choose to adjust how you
35:23
authenticate. That's a really traditional sort
35:26
of model. And those frisk and fraud
35:28
systems quite often are looking to detect bots and stuff like
35:33
that to prevent ATATO attacks and things like that.
35:37
So then, you know, as we evolve into, you know, the notion of AI
35:40
agents, you know, think of, you know, to me, AI agents are
35:44
different because they are processes that can actually, you
35:50
know, reason and dynamically change over time.
35:54
So unlike a traditional computer process where you have a certain
35:57
set of inputs and you, you know, you know, you're going to get
35:59
the same outputs every time, AI agents evolve and the input, you
36:04
know, you know, the inputs one day will drive different outputs
36:09
over time as they, you know, as they dynamically learn, you
36:13
know, they reason, you know, they, they just, they get
36:15
smarter over time, stuff like that.
36:17
So a lot, a lot changes with the way you think about an AI agent.
36:21
So AI agents are going to sort of appear in a couple of
36:25
different ways. Where I think it gets
36:28
interesting is when AI, an AI agent can actually interact with
36:34
a gooey, like the gooey that's on your on your laptop and it
36:40
appears like a human. All right.
36:42
I mean, this is like what the operator operator tool from open
36:47
AI does. It'll literally drives the
36:49
browser and it does that while it actually, you know,
36:52
basically, you know, tries to complete a, a task or a set of
36:55
tasks. So now if you can imagine you've
36:58
got AAI agent on your desktop that's basically looking to do
37:03
things automatically add things to your calendar, automatically
37:06
update Salesforce with certain data that you got thick that
37:11
that's, that's workforce examples in consumer examples,
37:14
it could be automatically search across 3 websites looking for a
37:19
cheap pair of jeans and then buy those jeans, stuff like that.
37:22
Whatever it might be. We now have to basically, you
37:27
know, AI agents are going to see, you know, be used.
37:31
How do websites differentiate an AI agent from a bot?
37:37
All right, where traditionally we've thought of bots to be bad.
37:41
So we have to have ways to basically distinguish an AI
37:43
agent from a bot. And then we have to have ways
37:47
for that AI agent to be able to authenticate through that
37:52
website, all right, such that it can do things on behalf of the
37:56
user. One of the, you know, one of
37:58
the, you know, and obviously adaptive fits into this in many
38:03
ways because we're going to adapt basically understanding
38:05
whether this is a bot or, I'm sorry, an agent or a human.
38:09
And if it's an agent, we want to handle authentication
38:12
differently, things like that. The in the case where the AI
38:20
agent now needs to authenticate, the last thing we want to do is
38:24
have the AI agent essentially impersonate the user.
38:28
And by that I mean just use the credentials that the user
38:34
generally uses. So I don't want the AI agent to
38:37
basically just take my ID and password and log in as me.
38:42
All right, What what we're creating at that point is
38:44
essentially what's what, you know, what we, what a lot of the
38:48
in the banking world, the Yodelies and the mints have the
38:52
world did when they did screen scraping to basically use my
38:56
banking credentials and log into the bank, screen scrape stuff
39:00
and return it. The banks hated that.
39:03
And you know, there's all sorts of security risks associated
39:06
with that and AI agents, if we don't fix this or address this
39:10
and just going to do this, you know, 10 orders of magnitude
39:13
more, it's going to happen everywhere.
39:15
So what we really need to, you know, address or push for is the
39:18
notion of delegation. All right, by Patrick and going
39:22
to delegate this AI agent to go do this on my behalf.
39:25
So that means applications that want to be kind of agent aware
39:30
need to sort of support this notion of delegation where, you
39:33
know, I can delegate responsibility to this agent
39:35
acting on my behalf to do things basically.
39:38
And you know, the agent still has to authenticate itself, but
39:41
it can do that. You know, we, we can start to do
39:44
that in ways that doesn't require, you know, similar to
39:49
the ways we might have done this with sort of traditional Oauth
39:52
and stuff like that where you, you consent to an Oauth client
39:56
to act on my behalf to do things, things like that
39:59
basically. So that's what.
40:01
We're going to evolve to yes. I mean, you think, think about
40:05
the way you talked about there with so, so the security problem
40:10
is systems that are meant to detect bots, while the AI agents
40:14
are bots if they're doing their job by saying you can't proceed,
40:19
but they're good bots. So now the question is, how do
40:22
you tell the good bots from the bad bots?
40:25
So we're, we're actually looking at, we're actually looking at
40:28
ways where a website can advertise and, and, and, and let
40:35
AAI agent know that, hey, if you're an AI agent, go do this,
40:42
all right. And it basically, you know, it's
40:44
kind of lets the AI, it tells the AI agent what to do
40:47
essentially. And it would be distinct from
40:50
what a human would be doing if they're interacting with the
40:53
website in that way as well. So it, it's, it's challenging
40:58
and actually it's going to force a lot, a lot of organizations to
41:05
have to update the way and how they sort of they think about
41:08
interacting with these things basically to support this if
41:11
they want to, you know, if they want to take advantage of it.
41:14
Yeah, I heard one of these quote, you know, quote UN quote
41:17
outlandish statements. What will be the first one
41:21
person company worth a billion dollars, you know, and the idea
41:25
is you could have agents or bots running your entire company.
41:30
You can imagine actually the example that you bought or you
41:33
brought up, which is you go out, look for the cheapest pair of
41:36
jeans. Now say you're doing that on a
41:39
wholesale level, you're buying them.
41:41
Maybe you're warehousing virtually and you're shipping
41:45
virtually. So you're taking orders online
41:48
and you're just moving these items and taking payments and
41:53
your whole company is basically bots.
41:55
Yes. Well, the, so the other example
41:58
here is, you know, I gave an example of where a user is kind
42:01
of, you know, bringing in their own agent and it's, and it's
42:04
going to do work on my behalf. But there are also examples of
42:08
agents that are being created that are kind of more autonomous
42:12
and they're acting as kind of digital workers where they're
42:15
autonomous off basically independently doing things, you
42:19
know, for an organization. And there might be 10s of
42:23
thousands, hundreds of thousands of these digital workers that
42:27
are going off performing tasks. Those agents likely are going to
42:31
need identities of their own, because to me, they're no
42:35
different to a human user, especially if they're
42:38
interacting with systems that humans interact with.
42:41
And now the digital worker, that agent is a digital worker is
42:44
doing it instead. Those applications are going to
42:47
have to actually know, all right, this digital worker has
42:50
an identity. It's going to authenticate to
42:52
me, all right? It's going to be given a set of
42:55
entitlements to do things. It's going to, you know, the
42:58
entitlements and, and it's identity is going to have to be
43:01
this life cycle of management around that.
43:03
It's going to have to be, you know, granted and taken away.
43:08
Access is going to have to be approved.
43:10
It it's going to act very similar to the way we think
43:12
about kind of IGA today for human users and what they can
43:16
do. But we're going to apply it at
43:18
massive scale for, for these, you know, you know, digital
43:21
workers that are, they're essentially just AI agents in
43:24
these situations. So there's, there's a whole
43:27
other class of stuff that's happening there sort of inside
43:29
the organization as well in terms of what's happening too.
43:32
So, you know, again, it's, it's, it's, it's all coming.
43:37
And I know a lot of people are thinking about this and talking
43:40
about this, but I think it's going to come a lot faster than
43:42
we than we might imagine actually.
43:46
So do people wind up being replaced by the AI agents in the
43:53
end to do we serve any purpose if the AI agents can do it all
43:58
themselves? I know it.
44:00
It almost seems like a silly question, but people brought it
44:03
up a long time ago. And every once in a while you
44:06
hear somebody say I'm not going to have a job in two or three
44:09
years because this does all the you know, you look at like say
44:14
the copilot assistant or the transcriber in the teams
44:19
meeting. Now you don't need anybody to
44:21
keep notes. In fact, usually the notes that
44:24
you're going to get from the teams that you are way better
44:26
than a person could keep anyway. So I, I, I mean, I've been
44:31
thinking about this a lot and I, I think this boils down to
44:37
efficiency, all right there that we are going to make people,
44:42
people are going to become much more efficient in what they do
44:46
if they have access to these AI agents to essentially do you
44:51
know, the repetitive stuff effectively that we've done,
44:54
done before. And I'm not saying that AI
44:57
agents won't require at least for some period of time, sort of
45:01
a human in the loop before we, we're ready to actually just
45:04
give them full autonomy. I, I imagine that humans are
45:07
going to be in the loop approving things that an AI
45:10
agent sort of says, does Axon creates whatever that that'll
45:15
exist for a while. So I, you know, that that
45:17
doesn't go away, But I, I think people, they just become more
45:21
efficient. And I don't think it's any
45:24
different to when, you know, the personal computer emerged and
45:30
everybody thought the personal computer was going to replace
45:34
all sorts of, you know, roles and jobs and stuff like that.
45:38
The stenographer, the, you know, the, the typing pool, the, you
45:43
know, whatever it might have been, yes, you know, they get
45:47
replaced. But I still think there's, you
45:50
know, it's not like there's all these people out of work.
45:54
People's skills evolved. People learn how to use these
45:56
things. They'll become more efficient.
45:58
They've got to embrace it and go with the times sort of thing in
46:03
that regard. Yeah, I, I feel the same way.
46:06
It's like you can't prevent progress, right?
46:10
The progress is going to happen. So you have to position yourself
46:13
on the right side of it. You don't want to be the person
46:16
who's constantly falling behind, like the person who went around
46:20
and lit all the street lights before there were Electro
46:23
lights. If they they stuck to it and
46:26
maybe they were lighting the last few.
46:28
Eventually they have new skills for the future.
46:33
I'd say, look, you know, this is something that Andre has shared
46:36
with me multiple times over the years.
46:38
Andre, the CEO of, of King, that organ, you know, capitalism, you
46:43
know, and, and you know, and organizations are hyper focused
46:48
on that they will find and drive efficiency, you know, constantly
46:52
or good organizations will, you know, and capitalism drives
46:55
efficiency. Basically everybody's looking to
46:57
do things faster, cheaper, better all the time.
47:03
All right? And it, it's constantly moving
47:05
in that direction, I say, and this is just the most recent
47:08
example of it. I think that we're going to see
47:11
so. Yeah.
47:11
What is your question, Patrick? If you were, if you had a son or
47:16
daughter who was in college, what would you tell them to
47:23
learn right now? And and don't tell me art
47:24
history, because that's cheating.
47:28
So yeah, what? You know what's interesting?
47:30
I've got like I've asked this, a couple of people have ping as
47:34
well. And so it the, the one thing
47:42
that none of my kids have gone into which I went into was
47:46
computer science. So my kids didn't go into
47:49
computer science. One of them is doing pre Med.
47:53
My oldest son that graduated, you know, did actually business
47:57
and data analytics are my youngest sons doing kind of
48:01
business and doesn't really know yet.
48:03
So I, I'm actually, you know, to me, honestly, learning the
48:10
business side of things gives you the opportunity to
48:14
understand how to run a business, how to build a
48:17
business, be a little bit more entrepreneurial, all right,
48:19
because you understand how businesses function.
48:21
And I still think that's going to be necessary.
48:23
People who understand how to operate and run a business is
48:25
always going to be needed, irrespective of what that
48:27
business is. And I think that's just a great
48:30
set of skills to have. I, I'm more way more concerned
48:35
if I was, you know, about going into computer science now,
48:38
because I, I mean, I was a software developer and I wasn't
48:40
a very good software developer, perfectly willing to admit it,
48:43
all right. And I don't think I would
48:45
survive through what it means to be a developer now, given how
48:52
much more efficient developers can be made using things like
48:57
now what's it called, you know, tow pilot and stuff like that,
49:00
that the. If you're a lazy developer, you
49:02
could you might be able to get by right?
49:04
You figure out all the ways to get.
49:06
Yeah, but I, I all. Your work is done by doing
49:08
nothing. That's true, but I just think
49:10
the number of, I mean, again, efficiency is going to drive
49:13
that, you know, developers are going to become more efficient
49:16
and therefore we're not going to need as many developers to to,
49:19
you know, develop the code. And the other thing is, look, I
49:23
mean, what's a developer really doing?
49:24
A developer is translating business analyst type
49:29
requirements into a language that a machine understands.
49:34
If I can now just use natural language to tell the machine
49:38
what I want to happen, do I really need that post in the
49:42
middle that's turning, you know, those requirements into code?
49:45
I can just give the machine, you know, I can just give the, you
49:49
know, the AI the requirements. So now becomes sort of more a
49:53
case of, all right, maybe people should be learning about prompt
49:57
engineering and understanding how to actually define these
50:01
requirements in a way that the AI can use it to actually build
50:05
the applications itself essentially.
50:08
So it just becomes a different language you have to learn
50:10
essentially to be able to, you know, develop the applications
50:13
that people want to. Use.
50:15
Yeah, I've been encouraging my son to do the prompt engineering
50:20
and really get good at that. He's a little sophomore in a
50:23
cybersecurity degree program, and I wouldn't say he's a lot of
50:31
a tinkerer. He was a tinkerer.
50:33
You know, early in his years he was setting up his own PC for
50:38
doing video games and trying to figure out how to, you know, get
50:42
the fancy sorting in his game without actually doing the work.
50:46
So, but I would love to see him tinker with getting the open
50:51
source code and seeing what he could do, seeing what kind of
50:56
data sources he could plug it into and figure out how it
51:00
works, because I think that's the skill that businesses are
51:05
going to be very hungry for. Yeah, absolutely.
51:08
And I don't think that, you know, I talked to him about,
51:10
like, are they teaching you this in school?
51:13
And he's like, no. And I believe him because I, I
51:16
remember going out in his when he was, you know, looking for
51:20
colleges and asking questions about things such as that, such
51:26
as cloud computing. And it's like these professors,
51:31
they were behind where we are even in, in the business world.
51:35
And I was like, man, oh man, I can't believe you guys aren't
51:38
like on the cutting edge of this stuff.
51:40
Maybe it's just the schools we were looking at.
51:42
I don't know. Yeah, that's a problem, I agree.
51:45
But yes, I think, you know, learning and understanding how
51:49
to translate, you know, so, and this gets back to the business
51:52
side of things. It's like being able to
51:54
translate the business requirements instead of actually
51:57
into code as we know it, But into, you know, to to to
52:01
basically tell an AI what it what you need.
52:03
I think is the where this evolves to over time
52:06
essentially. There'll still be need for
52:08
hardcore developers obviously, but I just think a lot of
52:13
organizations aren't going to need as many of them you know
52:16
it'll be. It'll look very different in 10
52:17
years time as an example. Oh yeah, for sure.
52:21
Patrick, you've been super generous of your time.
52:23
We had a great conversation today.
52:26
I know you're out there on LinkedIn, so I sent you an
52:30
invite to get connected. I don't know how you are
52:32
connected given you're on the show before, but I'm sure other
52:36
people after the show will be sending you invites.
52:39
I already get a number of invites per day and I love it.
52:42
I want to talk to all of our listeners and get to know you
52:45
all. And a great way to get to know
52:48
people is through the conferences mention we've got
52:51
discount codes for EIC and Identiver, so please make sure
52:56
to take advantage of those. And Patrick, I'd like to go out
52:59
today with a a lighter note question.
53:02
Given those two conferences, EIC in Berlin and Identiverse in
53:07
Vegas, what are your tips for each of those to do's for
53:13
whether it's a first time conference goer or maybe
53:16
somebody's been there a few times, they've got any like
53:19
secret Nuggets for each one of those?
53:23
I, I've spent a lot more time at, at Anniversa over the years
53:26
than EIC, so I'll sort of focus on that.
53:31
It's, it's honestly you, you got to get it outside your comfort
53:35
zone and just engage and talk to people and you know, you know,
53:40
at whether it's at, you know, might be a lunch or a breakfast,
53:43
you know, sit down at a table where you don't know anybody,
53:46
start talking to people. Everybody starts in the same
53:49
situation where, you know, they don't know a lot of people in
53:51
the community. But I've always found the
53:53
identity community to be very open and embracing of new people
54:00
and old timers essentially. So you know, that to me is, is
54:03
the key here. You know, everybody, everybody
54:06
was in your place at some point in their career and felt the
54:10
same way. So, you know, don't be afraid
54:12
just to open up and reach out and ask questions and introduce
54:15
yourself and stuff like that. Essentially is the is the key.
54:17
The same thing applies in the EIC as well with with Martin and
54:21
those guys too. So, you know, I would say the
54:24
same thing there as well. Yeah, this seemed to be my first
54:27
time in the EIC. I've been to Germany before, but
54:30
never Berlin. I hear that, you know, it's a
54:35
very lively city. Of course, there's a lot of
54:38
history there, a lot of places to check out like the Berlin
54:42
Wall and you know, I mean, heck, I'm not going to do as good of a
54:45
job. If you're interested in looking
54:47
for sites to see YouTube, Google, there's tons of
54:52
information out there. I have actually been to Las
54:57
Vegas probably 20 or more times. I my biggest pro tip is to pace
55:05
yourself. I mean, especially if you're
55:07
somebody who likes to have a good time, you get to Vegas.
55:10
If it's your first time in Vegas and all those lights are on and
55:13
you go into, you know, go through the casino, they just
55:17
have a way with all the bells and the lights and they pump
55:21
extra oxygen into the room, makes you feel energized and you
55:26
should enjoy that. My recommendation with my my
55:30
recommendation with Vegas is don't end up inside for three
55:33
days like I have a couple of times.
55:36
Get out and get some fresh air in the middle of it if you can,
55:39
because you know, I, I've, I've inadvertently spent three days
55:42
indoors in Vegas and never saw the sun.
55:44
So. Yes, that's that's good advice.
55:47
I've I've never done the whole 3 days indoors, even though Jeff
55:51
has told me he's done that a few times.
55:55
I'm not like a when I was a kid I wanted to be outside around
55:59
the clock, but you know, as I've gotten older, found lazier about
56:03
it. But I think for a certain amount
56:06
of time, I'd just go stir crazy in indoors and and but here.
56:11
So my advice is pace yourself. Don't try to have all your fun
56:15
fun upfront. You know, a little bit at a
56:18
time. There's a lot of like after hour
56:20
parties, but that doesn't have mean you have to be out until
56:23
midnight every night because the shows you know, take place in
56:28
the morning. Get off to a fresh start, have
56:31
breakfast, get in there, be mentally aware, engage.
56:35
Try also to break away from work for a little bit because yes, I
56:41
know, I understand. And I've fallen into this trap
56:43
many times over the years where you're right in the middle of
56:46
like a hectic project. But if you travel all the way
56:49
out from Las Vegas and you go to two, two of the sessions or
56:55
something like that, you're really going to regret it.
56:57
You've got to try to find a way to get up early, do your call,
57:01
maybe save some of the calls till later today.
57:03
Maybe take a break in the middle, but make sure you're
57:06
going to a number of the sessions otherwise you're going
57:09
to end up being disappointed in the end.
57:12
Yep, good advice. Yeah.
57:14
So that's what I've got for you for this time, Patrick.
57:17
Again, thanks for joining us. For everybody out there, find us
57:23
on the web idacpodcast.com and our YouTube channel is
57:27
idacpodcast.tv. That'll drop you right into our
57:33
YouTube. Again, love hearing from
57:36
everybody on LinkedIn, so find us there.
57:39
And thanks again, Patrick. Until next time, everyone.
57:43
Thanks, Jim. Bye.
57:46
You've been listening to Identity at the Center.
57:49
We hope you've enjoyed the show. Make sure to like, rate and
57:53
review, and we'll be back soon. But in the meantime, hit the
57:57
website at identity@thecenter.com.
58:01
See you next time on Identity at the Center.