Latest / Identity at the Center / #7 - How the IAM Value Proposition Has Changed

Transcript

#7 - How the IAM Value Proposition Has Changed · Identity at the Center

0:06
Do you know who has access to what?
0:08
If you are looking for identity and access management talk, you
0:11
have come to the right place. This is the Identity at the
0:14
Center podcast host Jeff Steadman and Jim McDonald are
0:22
strategic advisors with the dentropies advisory Services
0:25
practice and are here to talk about a wide range of identity
0:28
and access management. Topics, comments, questions and
0:36
accolades can all be sent to identity@thecenter.com.
0:39
And now on to the show. So today we've got a special
0:52
guest, Luis Almeida. He's.
0:54
VP of Business Development here at Edentropy.
0:57
And we thought it would be interesting to have him on to
1:00
talk a little bit about how the value proposition of identity
1:03
management has changed. And I know that this is
1:05
something that's been near and dear to his heart for a while.
1:08
And we've also got Jim McDonald here too, guys, you want to say?
1:14
Hey guys, Jim McDonald here. I'm really excited about having
1:18
Luis on. Luis has been a veteran in our
1:21
industry. For many, many years.
1:24
I'm not going to steal his Thunder by doing his
1:26
introduction, but you know he's worked at several identity and
1:29
access management because companies in the past.
1:33
And so he has a really good unique perspective on the
1:37
industry and he's really good at telling stories.
1:40
So Louise, why don't you do a quick introduction of yourself?
1:44
Thanks, Jim. Thanks, Jeff.
1:47
So it's for me. It's a pleasure to be here
1:49
because. The respect I have for the real
1:53
practitioners in the space, right, and then especially Jim
1:56
and Jeff who have done it, they've been on the other side
2:00
of the table really managing programs and doing the hard
2:03
work. You know, so these are people
2:06
that, that that I have a great deal of respect for.
2:09
I think the really good sales people are the ones that try not
2:15
to speak, try try to give the customers a lot of space and
2:19
listen. So this is a little bit
2:22
uncomfortable for me, but but I'll do my best and I and I
2:25
really appreciate the kind introduction guys.
2:28
I think this is a model opening for all of our guests.
2:31
If they can show the appropriate amount of deference to Jim and
2:33
I, everything is just going to go great.
2:36
Yeah. And I really mean it.
2:37
So, so thanks for having me. But you know, as Jim was saying,
2:42
I've been in the space really 15 years over the over 15 years.
2:48
I got my start at CA back back when it was Computer Associates.
2:53
I was a storage guy really selling backups that, you know,
2:59
you could do the backup but then you couldn't restore, which was
3:02
really a horrible business to be in.
3:05
And a good friend of mine, Mark Potter, who ran Identity for the
3:09
Southeast for CA at that time. He heard me on the phone banging
3:13
away trying to help customers and he said I want you to come
3:16
join the security team. And I looked at him and said I
3:20
think you're crazy. There's absolutely no way.
3:22
I know nothing about security. And I picked up the phone and
3:24
kept dialing and and he insisted and it was the best thing that
3:27
ever happened to me in my life. And so I was there for eight
3:31
years. I was very successful selling
3:34
sight minder and CA identity manager.
3:37
And you know, we used to say we'd sell out of a hole because
3:40
people. One always pleased with their
3:43
experience with CA, so we really had to work hard there.
3:47
And after eight years, Mark left CA and went to join the team at
3:50
Quest Software. He started the Identity and
3:52
Access management team and I was his first hire at Quest and that
3:59
was kind of a. A risk for me because Quest had
4:02
just acquired Volcker Informatica, a German identity
4:06
and access management company. You know, we knew Quest is a
4:09
tools company, 80 management, and we went over there and we
4:13
actually did relatively well. We were there for, I was there
4:15
for three years and then we suffered through a process where
4:18
Vinny Smith was going to take Quest private.
4:22
And then Michael Dell said, no, you're not, we're coming in and
4:25
buying you. Michael Dell's engine spoke
4:29
louder. And we ended up going to work
4:32
for Dell and that Dell, you know, large large sales
4:36
organization. I felt Identity was going to get
4:38
lost in the shuffle. Identity being such a specific
4:42
thing to sell in position that that I left Dell and was
4:45
fortunate enough to come join our team here at identropy.
4:48
I've been here five years. It's just been for me just a
4:51
tremendous experience. And the reason for that is, I
4:55
think in the identity space, consulting services is so
4:58
important. And you know the ability for us
5:02
to listen to the requirements a customer has and to be able to
5:07
position value beyond products, right, looking at programs and
5:13
and the stuff the advisory team does is just just easier.
5:16
It's more flexible, we can be of more service.
5:19
So. So that's it, that's that's
5:21
that's my background and and here we are.
5:25
I think that's really interesting, Louise.
5:27
You're there kind of in the the early days of identity
5:30
management and you know the approach has changed so much
5:34
over time and the vendor landscape has changed over time.
5:40
I think that's been driven a lot by the the value proposition for
5:45
customers and I was hoping you could maybe talk about was kind
5:50
of walk us through that history. So where were customers getting
5:53
value? Of and what was driving their
5:57
investment say 10 to 15 years ago and how's it changed over
6:00
time? Sure.
6:03
So you know I'm, I'm, I'm somewhat a big fan of the
6:06
Gartner product hype cycle, right.
6:09
So that's the curve that, you know, the the product increases
6:13
in hype over time and then it, you know, dips down into a
6:17
trough of disillusionment, starts to slowly go back up and
6:21
then goes into the plateau of productivity.
6:24
So I would say that I missed the upturn towards the peak.
6:28
I really joined the identity space really at the peak of the
6:32
hype, right. That's when CA acquired
6:34
Integrity. All these other acquisitions
6:36
were going on and and identity, they really weren't identity
6:41
practitioners really I mean but the people really had high hopes
6:44
for identity and at that time what we were telling customers.
6:51
Is and we believe this and I think it's really important to
6:54
say you know the people that I know that do well in sales and
6:58
in in service providing and and helping others, you know they
7:01
come from a from a place of sincerity, right.
7:05
The the place is one of helping and you get paid and and you're
7:08
going to make money but if your heart has to be in a in a mode
7:13
of helping. So I would go out to my
7:15
customers when I first got hired and and and and try to help
7:18
them. And what everybody expected that
7:20
we were going to help them with was something called automagic
7:25
provisioning. Okay.
7:27
We were going to give everybody access to the systems they
7:34
needed programmatically, with the right permissions and
7:38
entitlements across thousands of applications.
7:42
And it was really an IT optimization value proposition
7:45
and it was something we were sure we were going to be able to
7:47
do. We were all setting out to do
7:49
it. And you know that really it was
7:52
a, it was a it was a value around making people's jobs
7:55
easier and of course enhancing security because you're you're
7:59
somewhat facilitating, least privileged.
8:03
And Louise, if I could jump in for a second, these are the
8:07
early days of Active Directory, right?
8:09
So you're going back around? 03/04 time frame.
8:13
I think Active Directory really started with Windows 2000 so it
8:16
took some time to get established and within the
8:21
enterprise walls wasn't like, you know, people set up Active
8:25
Directory and they integrated 200 applications into it.
8:28
So if you automated Active Directory, you're good to go on
8:33
a large part of your IT landscape.
8:36
This is the days where applications for the most part.
8:39
Each had their own username and password, those usernames to
8:42
vary things like that. So from my recollection and kind
8:46
of being in that space and being a a practitioner, it was about,
8:51
wow, we've got this Wild West of of Access is being managed in
8:55
different ways across different applications and there was not a
8:58
central identity store for the most part.
9:03
Yeah, I do remember it that way. And and and the way I remember
9:06
it, really. To me, which is really symbolic
9:10
of that time, we're all the role engineering exercises, right?
9:15
People would get locked in a conference room for years and
9:20
Ernst and Young or Accenture, whoever would come in and just
9:23
do these huge role engineering exercises to create these
9:27
buckets of permissions that then we would use to to provision.
9:33
I was very fortunate back then that.
9:36
I met a good friend of mine. He's still a great friend of
9:38
mine him and the model all. Who's the CEO of Simeo today And
9:44
you know I I linked up with him and that, you know, remember I
9:48
was a storage guy. I didn't really know what I was
9:50
talking about so I'd let him do all the talking.
9:52
We always led with this concept of role engineering, right?
9:55
You need to know what you're going to provision and.
10:02
That's what we led with. And I think Jim, you know we
10:04
weren't looking at groups, right.
10:05
We were really looking at what were those entitlements,
10:07
permissions inside of the application and it was very
10:11
large services projects in a large enterprise and they were
10:15
very challenging. Yeah, and a lot of, a lot of
10:18
mainframes to be quite frank, you know, legacy systems,
10:22
applications that were hard to integrate with.
10:25
Yeah. That was, that was my
10:26
background, you know when I was in first getting involved in
10:29
IEM, was with Walgreens way back when.
10:31
And you know there were four of us who were responsible for
10:35
creating mainframe accounts, Lotus Notes, e-mail accounts,
10:40
which is a total nightmare to try and do anything with when it
10:43
was IEM as I found out later on in my career.
10:46
But. But yeah, it was very, it was
10:49
very account based and we hadn't even considered really the
10:52
concept of roles at that point. This would have been, yeah,
10:56
early early 2000s. We're going through that
10:58
process. But it's funny, we didn't really
11:01
even consider an I M tool at that point.
11:03
Even though we were a fairly centralized team, there were
11:07
still only four of us, you know, for this entire, you know,
11:10
pharmacy chain essentially handling all the corporate
11:12
enterprise stuff. It took a few years as we
11:16
started to really skyrocket from a access need perspective within
11:21
the organization to recognize and need that okay.
11:23
We really need to start to figure out how we're going to
11:25
scale because Slas become a concern and.
11:29
You know, this is, this is back in the old days where, you know,
11:33
it's Friday and we're all working out of 1 mailbox and
11:36
there's literally nothing to do, right?
11:38
So we're fighting over tickets to see who's going to grab it,
11:40
who's going to grab the e-mail because there's something to do
11:42
because otherwise you're really kind of just sitting there
11:45
because of the man wasn't there. You know, flash forward a decade
11:47
and you know, you've got thousands of tickets in a queue
11:49
and, you know, you're managing a group of people.
11:51
But it really was kind of a very simple time from an I M
11:55
perspective. And and this conversation is
11:58
really reassuring, right, because we really didn't know
12:01
what we were doing. You know, we had a yeah, we had
12:05
we had a vision and and we thought we knew where we were
12:08
going. And together we tried to solve
12:10
problems. But what that time became was a
12:15
graveyard of failed implementations and unfulfilled
12:19
promises and extremely disappointed customers and.
12:26
You know, and a lot of hard working sales people, a lot of
12:29
hard working consultants, they're trying to figure this
12:31
thing out. That was the vision and it just
12:34
wasn't working. And you know, a couple reasons
12:38
for that. You know, you do your role
12:39
engineering exercise. It took forever.
12:42
You tried to do implementations where it was, you know, Big
12:46
Bang. You try to do everything at
12:48
once. There wasn't this concept of,
12:52
you know. Delayed perfection, but what it
12:56
what is it that Chad says all the time, you know, incremental
12:59
progress which we really think about today.
13:04
So there's a lot of field implementations, a lot of money
13:06
spent. And you know, to this day we
13:09
still see some remnants of that. I mean, there's some large
13:12
organizations that are still suffering with a large
13:16
investment sunk into an identity program that's connected to
13:19
Active Directory and that's it after, you know.
13:23
Five years, 10 years. So that was a tough time for all
13:27
of us, I think. Why do you think from your, I'm
13:30
curious to hear your perspective on this because I've been
13:33
involved with implementations that have started off great
13:38
having been on the customer side and then they die out and I know
13:42
why those died out. It was a very good reason why
13:45
I'm curious from your perspective.
13:48
Where do you see the failure when it comes time to kind of
13:52
figure out post mortem, you know why?
13:54
Why is only Active Directory integrated with our I M system
13:57
after, you know, two years, three years, whatever it may be?
14:00
You know, I think that goes back to what the work you guys do.
14:04
I always tell clients that if you enter the partnership with
14:09
us in advisory, our chances of success are much higher and I
14:13
think that is because we create executive support.
14:17
And more so when you say, you know, executive support, that's
14:20
kind of like a buzzword. What does that really mean?
14:22
What that really means to me is making them understand how
14:25
difficult this thing is. Going to be.
14:28
And making them understand that we're going to need the
14:32
cooperation of the application owners of HR.
14:35
We're going to need the the cooperation across the
14:37
enterprise. And I think what happens in our
14:40
projects, they used to, if you don't manage them correctly,
14:44
they'll happen. Now is people get tired.
14:46
Right, the the project team gets tired.
14:49
They get tired of finding the political battle, and Active
14:53
Directory usually goes first. It's supposed to.
14:56
Be one of the easier ones, right?
14:59
And the AD team is one team. You go and you bang one team on
15:02
the head. But you know, you think about
15:03
people that are trying to on board and and bring into the
15:07
identity program hundreds or thousands of applications and
15:11
that's a long, a lot of difficult conversations for one
15:15
team to be having. Yeah.
15:17
I think that exactly support one is an important one because in
15:19
my mind that's money. I think when I think about where
15:22
I was, you know, a decade ago and really kind of starting to
15:26
roll out I M Systems, you know, for for the corporations that
15:29
I've worked for, it seems like they were really only funded for
15:33
a point in time, right in the next two to three years.
15:36
There wasn't really much planning beyond that, you know,
15:39
and and that's just something that you kind of have to think
15:41
about is this is a program, not a project.
15:43
Yeah, I I remember having a conversation with the guy.
15:46
You know, he was like a director level professional, super go
15:49
getter. You know, he wanted to fix
15:51
things and he called me and I was really just giving advice
15:55
because he didn't want to buy services.
15:57
He didn't want to buy product. It was he had he'd been given by
16:00
Microsoft. I think at the time it was MIM
16:03
or FIM. And he's like, I'm going to do
16:05
this. And I said, look, man, I'm not
16:07
trying to sell you anything, I promise you.
16:10
But I'll tell you that if you embark on this journey by
16:12
yourself, you were entering what I like to call a career
16:15
Culdesac, because you're not going to be able to do anything.
16:20
And people are going to have expectations because they're
16:23
like, you've got the licenses for free.
16:24
Why isn't this thing done? And you just aren't going to be
16:27
able to do it on yourself? And I think that really
16:30
resonated for him, you know? Free enterprise software is not
16:34
free. That's what I found, you know.
16:36
We see that a lot of times with, I've seen it personally with,
16:40
you know, Oracle license or free from an IM perspective because
16:44
they get databases or something like that.
16:45
But there's a lot of implementation that goes along
16:47
with it and there is that expectation that's free.
16:49
Why didn't we have it up and running already?
16:51
You know, there's a way way more to it, and that really applies
16:53
to any software. So, so back in the day, it was
16:57
super hard. We were trying to solve a super
17:00
difficult problem. We didn't really understand
17:02
exactly where we were doing. This whole coordination in the
17:05
in the enterprise was difficult and we entered into what Gartner
17:09
calls the Trophic disillusionment to the point
17:12
that it wasn't just one meeting, it was several meetings that I
17:15
went into that my sponsor said don't mention identity.
17:19
You know, don't, don't, don't call this an identity project.
17:22
And I I was like, what do you want to call it, man?
17:25
You know, that was, that was an interesting point in time.
17:29
And then I remember being in an event and my good friend, I'll
17:33
mention him again, Mark Potter pointed to a booth and he said,
17:36
oh, that's a Vexa. That's hot stuff.
17:39
And next to a Vexa was sale point.
17:41
And I'd never heard of a Vexa in sale point.
17:43
You know, I had been competing with IBM and Oracle.
17:49
And I got in and ignored it. You know, it's never really a
17:52
visionary. I was really, you know, I sold
17:53
the cars that were on the lot and did what I had to do.
17:56
But lo and behold, those dangers were going to become very close
18:00
to me. And so I, I, I, I really be
18:03
started competing with. And I think they played a major
18:08
role in changing the story around identity.
18:16
You know, so I'll keep going. I paused there for you guys to
18:19
interject, but I'll keep going. So.
18:21
I was trying to think of a way to disagree with you, but no,
18:23
you're right. Yeah.
18:25
It was two. There were two of them.
18:26
So and at that same time, which was really interesting was there
18:32
was something happened called Sarbanes-Oxley was just about at
18:36
that same time as well. And this isn't my quote.
18:39
This is I was at his conference and I heard somebody say this
18:42
what it must have been 12 years ago or so.
18:45
That the best identity sales guys were Sarbanes and Oxley,
18:48
right. They really got our space moving
18:53
and it was at the time where AVEXA and Sale Point entered and
18:58
pretty much what AVEX and Sale Point did was they said you know
19:01
what this stuff right here that I, BM, Oracle and CA are trying
19:04
to do, that's really hard, you know and that's not really where
19:07
the value is. We're not looking for, we're not
19:11
looking to make IT people's jobs easier.
19:15
We need to keep the CFO out of jail and we need to allow
19:21
accountability for access to be moved from IT down into the
19:27
business. And that's when the value
19:29
proposition shifted from IT optimization to governance right
19:37
to and and and and the the sequel to governance or the
19:40
symptom of governance is security, right?
19:44
Yeah, Sox was a huge driver from from my background.
19:47
I mean it essentially doubled my team just trying to just trying
19:52
to manage Sox compliance, right. It's, you know, it's, it's in
19:56
its basic form. It's very simple, right?
19:58
Just make sure that the access is approved and that you keep a
20:00
record of that. You.
20:02
Can keep all your records and e-mail and you know and and
20:06
older taking systems that really weren't easy to search for or
20:09
like a generic ticket. It was super hard to try and
20:11
demonstrate that the otters that would come sit down at my desk
20:14
and say okay here's these 30 people you know they've all been
20:18
terminated. Prove to me that they've been
20:20
terminated. How do you prove a negative
20:22
right. The account doesn't exist.
20:24
So you're having to look back through, you know, sometimes
20:27
paper and you know, at that point and it was just a total
20:30
pain in the ass. I think one of the the things
20:34
that I remember from that period that Louise was talking about
20:38
was those come, I don't know who to attribute this quote to, but
20:44
it's we still use it today. They talked about who has access
20:47
to what. You need to be able to show who
20:49
has access to what and that's what there's their solutions
20:53
specialized in and it's that's just resonated with everybody.
20:57
Like how could you argue with that?
20:58
Well, who has access to what? Not only does that resonate from
21:02
the standpoint of like, yeah, that makes sense.
21:05
Everybody needs to know. But remember, now we're no
21:07
longer trying to do the really difficult thing.
21:09
So it was like every identity guy just ran over to that and
21:13
said, yeah, let's do this. Because Jim, you know, even in
21:16
our projects today, the aggregation of identities,
21:20
right, the consolidation of the identities into the identity
21:24
system and then correlation and doing the unique ID and cleaning
21:30
the system, that's I'm not a practitioner, but from what I've
21:34
seen, that's much easier than trying to automatically
21:39
provision with entitlements and permissions, right.
21:43
So everybody kind of flocked to that, I think.
21:46
Not everybody though that, that was just the one thing that I
21:49
wanted to interject was we spent the previous five years or 10
21:54
years training up the ladder that.
21:58
We need to automatically provision because there's no
22:01
other way. I mean that's that's what we can
22:03
do. That's how we can solve this
22:04
problem. So there was a a mindset shift,
22:08
at least where I was in my career that's happening kind of
22:11
grassroots of managing identities that I started to get
22:15
it and I had to, you know, move that information up because I
22:18
was working for somebody who said well.
22:21
You know, yeah, South Point of X are great.
22:23
But I need to, you know from an efficiency standpoint, I still
22:27
need to do automatic provisioning for thousands of
22:31
applications. And I think you know my, my
22:35
feeling and I, I feel like I'm going to say what you're going
22:38
to say next was that I think South point of XI heard that
22:41
they started to bolt on to their solution, the ability to manage
22:46
identities right at the same time.
22:49
The big legacy vendors, the CA, Oracle, IBM saw hey sale point
22:55
and of XR stealing our our lunch we need to start doing
23:00
governance. So you see for example, I was in
23:03
a CA shop around that time or a little bit later and you know
23:08
they had a governance minder product, CA bought a bought a
23:11
company, I don't remember which one you probably do.
23:15
Eureka 5, right. And then they said governance
23:18
Winder. So that was a bolt on and I
23:21
think the advantage was it's easier to bolt on.
23:25
Administration and provisioning are really not easier, but more
23:28
sensical than to bolt on governance.
23:30
Where you've been pushing out, now you have to pull in versus
23:34
you're pulling in now you have to push out that.
23:37
That's a really interesting point and because it's really
23:39
like kind of the legacy products, how they evolved over
23:42
time, right. It's like all these
23:45
acquisitions, the new drivers would arise and I remember that
23:48
happening with role engineering, you know, son bought value.
23:53
I think Eureka Fi might have been, I think Eureka Fi was
23:56
actually the role engineering piece that CA bought.
23:58
There was another one that was as Israeli company IDM Logic
24:03
that was kind of the governance piece as well.
24:06
And these things became really hard to manage because it was
24:08
just bolted on. And you know, even to this day,
24:13
I don't want to criticize too harshly, but I BM has a problem
24:17
where you know their their product, their their legacy
24:20
product, the two aspects of it don't, don't work through the
24:24
same interface as far as I understand and it can.
24:27
We're still living that in the legacy world.
24:29
And now if you think about it, it's funny how in the software
24:32
world things repeat themselves. This issue with maturity of the
24:36
products becoming legacy vendors and we see it going on over and
24:40
over. One thing I wanted to mention
24:42
before we keep walking down this line here, the the, the, the,
24:46
the hype cycle, is that, Jeff, something you said where your
24:50
team doubled right when socks happened, To me that's a direct
24:54
indication of executive support, right?
24:58
So not only did the problem get easier to fix, the products
25:02
improve. We're on the second generation
25:04
of products and now CFO's cared because they want to stay out of
25:08
jail. Exactly.
25:09
It's a big help, right? Yeah, keep the auditors off
25:12
their back and you know they were happy.
25:14
And I think every organization approached a little bit
25:16
differently. You know the most experience
25:20
that I have, we decided to create centralized kind of I am
25:23
centers of excellence, right. So things that were being
25:27
disparately provisioned all around the enterprise, we pulled
25:29
into one central group common set of processes.
25:34
A way of doing things. And then we had a strike team,
25:38
Leslie and Ray, if you guys are listening, they went out and
25:42
they were brought in specifically to help pull in
25:45
socks applications or applications that were
25:47
identified as having socks relevance into our group and
25:51
then scoring through that. So there were.
25:53
I want to say at least several dozen that kind of fell into
25:55
that. When you consider mainframes, I
25:57
series, you know, kind of all that stuff, but there was
26:00
definitely support to staff it. What I didn't really see as much
26:05
support though was on the software side until it became a
26:08
scaling problem where yeah, we're going to have to double,
26:12
triple, quadruple the size of the team just to keep pace with
26:15
the volume of requests as the, you know, business continued to
26:19
grow because when I first started.
26:21
We were on store 4000 at Walgreens when I left.
26:24
I think we're like 8000, so we doubled just the store count
26:28
alone. If you imagine that's hundreds
26:30
of thousands of users trying to manage all that.
26:32
We definitely had to make an investment from the technology
26:34
side just to keep pace, yeah. And something Jim said, right,
26:40
the provisioning requirements still remained right and and
26:43
people were still doing that. Yet I think you know these side
26:46
projects around governance were going on even when people had
26:49
CICAIBM and Oracle, they were deploying sale put it of Vexa in
26:54
parallel to that and we had two magic quadrants, right.
26:57
We had the identity management, nobody says they did any
27:00
management anymore, right. We had the identity management
27:03
Magic quadrant. We had the Governance quadrant
27:08
and then we started to suffer a lot of business disruption in
27:11
this space, right. A vexing got acquired around
27:16
this time I think by EMC and then EMC got acquired by RSA,
27:21
the RSA and then he means EMC and then Dell you know so.
27:27
So things started getting shaken up in this, in this space.
27:32
Meanwhile BMC was falling off. Remember Guy BMC had a product
27:37
here and sale point I guess acquired the BMC customer base
27:43
or licenses. I wasn't really close to sale
27:46
point at that time. So I don't know exactly how that
27:48
went down, I was competing with them.
27:50
But the net, net is what Jim was talking about was you know the
27:53
products got integrated and you had I provisioning and
27:58
governance in the same product that became a requirement.
28:03
And Gartner released the identity governance
28:06
administration quadrant, which is still what we're what we're
28:09
seeing today. And we were on our way kind of
28:12
moving up that height, back up to where we weren't a bad word
28:16
towards the the plateau of the plateau of productivity.
28:21
You know, another thing that's happening in the background in
28:23
this time frame time frame, was major public, publicly announced
28:31
data breaches. And so we're also seeing, you
28:36
know I yeah, TJMaxx, Home Depot, things like that target.
28:42
But you also you know you'd have the the smart executive 1015
28:48
years ago would say well you know you want me to invest
28:51
$1,000,000 in security. Show me how it's going to save
28:55
me more than $1,000,000. How's that a good This is your
28:58
best. The shock factor of saying, hey,
29:02
what if you suffer a data breach that cost you $300 million in
29:07
brand equity that that wasn't even a conversation back then.
29:10
Now it's like people know that that's that's a reality, right?
29:14
I mean all over the, it's all over the news.
29:17
So that's happening in the background I think more because
29:21
one of the other things that you see, you know Gardner does a
29:24
really good job, I think all the analyst firms do.
29:27
But talking about how the investment and security is you
29:31
know increasing every year and it's just that it enabled the
29:38
industry to grow. And one of the other I keep
29:41
taking these sidetracks, but I think it's important to point
29:43
out is that the identity and access management industry is
29:46
always being driven by startup companies.
29:50
So you we talked about CA and Oracle.
29:53
Neither one of the those companies really started their
29:56
identity management system. I think, you know I was really
29:59
more close to Oracle. They had some things, they went
30:02
out and bought objects. Then they went out and bought
30:04
the worst of small companies that grew into big companies.
30:07
And you know and you still see that today where this is an
30:10
industry where you can start, it's a very small company build,
30:15
you know a killer technology and then get bought out by.
30:19
A larger company and added to a suite and then sometimes those
30:22
companies go, you know, take a sale point or an Octa for
30:25
example. They'll start as a startup and
30:27
grow all the way and become a public company on their own.
30:31
Jim, this conversation is great because I'm remembering things
30:36
that I hadn't thought about in a long time.
30:38
So about this time, you're absolutely right.
30:41
People would come to us and they'd say, all right, this
30:43
sounds great, Can you, can you guys do an Roy analysis?
30:47
And I'm not kidding. I look at the we as sales guys,
30:50
we would look at that guy and we would say no, you're not ready
30:53
to buy this. We really, we really did not do
30:56
them and we ran away because this was a governance.
30:59
Play so security play. You just do this.
31:03
You don't ask me for an ROI. So you took me back to the day
31:07
there, man. It's.
31:08
All these cold shivers and. Bad memories, one of.
31:12
My one of my stories is, you know, we.
31:16
The company I was working for eventually went out and we
31:18
bought obliques, which later became Oracle Access Manager.
31:22
But we try trying to convince an executive they should spend a
31:27
lot of money on on the technology called obliques that
31:30
they've never heard of before. They have to explain what it
31:33
does and why it's a good investment and things like that.
31:36
And again, data breaches weren't in the news all the time, so we.
31:42
Went back to the Alex sales Rep, who by the way was Tom Neckle
31:46
who had been to the dentropy who later up.
31:49
I know, Tom, Yeah. I was here a little while with
31:51
him. He was here at I dentropy for a
31:53
while. He was our sales guy and I asked
31:56
him the same kind of question. I think he gave me the same
31:59
cross eyed look, but ultimately their the way they would build
32:03
an ROI was well how much do you guys pay for a password reset,
32:08
Password reset? Now you're now you're going to
32:10
the you're digging deep in the album crate here man.
32:16
That's right. Yeah password recent.
32:18
We used to love that cuz we'd be like that is ROI.
32:20
There was tons that we'd justify the whole identity project with
32:24
password reset. That's how I got into it, and I
32:26
spent way too much time running reports trying to figure out how
32:30
many passes we were doing. And it was just that's exactly
32:33
how ours started. And that's funny too because you
32:37
know that is significant value to the business, right?
32:41
Like that's an identity value proposition where the users are
32:46
grateful. The only thing perhaps better is
32:49
single sign on. And if you remember back in this
32:53
day, and I'm I'm mixing Gartner quadrants, I'm missing mixing
32:56
sectors. But everybody wanted to do what
32:58
we called enterprise Single Sign on, which was single sign on
33:01
inside the organization, which was a pain.
33:05
It was not easy to do. And then things shifted again,
33:08
right? It became more about web single
33:10
sign on. It became and more things were
33:12
Active Directory centric. It wasn't really single sign on,
33:16
it was simplified sign on where you just used the same password
33:20
over and over, but you didn't just automatically have access
33:23
without authenticating. Yeah, you'd have like little
33:26
listeners running on a D They'd pick up a password change,
33:29
right? And then?
33:30
Push that out so it wasn't synchronization.
33:32
Yeah, exactly. Spent a lot of time in Windows
33:35
genus, right? Trying to make sure those things
33:36
were. Working right for the user.
33:39
Yeah, so go ahead. I was gonna say, I know you guys
33:44
don't want to have a 2 hour podcast.
33:46
I know we could probably. How are we doing on time?
33:50
I think I got a couple minutes. I want to ask you a couple
33:52
questions outside of this and I want to ask you the first one
33:56
is. From a hype perspective, what's
34:00
something that you see today that is either really overhyped
34:03
or underhyped, in your opinion? AI, AI.
34:09
And is it over or under? I mean, so I think this is
34:13
really interesting, right? This is actually now let's get
34:15
the plateau. So what happened?
34:18
Right, these things became easier.
34:20
Applications have programming interfaces.
34:24
Now that we can go in, the synchronization probably became
34:27
simpler. Expectations are less so.
34:29
I don't want you to provision entitlements, some do, but you
34:33
know I'm okay with you creating the account.
34:36
So got easier. The environment got less got you
34:40
have more access to build these integrations and we hit this
34:44
plateau where where is working like we can look at our clients.
34:47
So we can say it's going to work.
34:49
We have you know 30 active projects.
34:51
You know a couple people might not be 100% satisfied, but
34:55
generally we're doing our jobs and we're coming in under budget
34:58
and they're on all these issues. So now enter this new era right
35:03
now, right, where everybody knows that the enemy is within,
35:09
right? Everybody understands insider
35:11
threat, Everybody understands the walls are gone.
35:15
People are accessing our data from outside of our data center.
35:18
So the old paradigm of firewalls and keeping people out is gone.
35:23
So what's left for us, right, is identity.
35:27
You know, if everybody's coming in and out, at least I want to
35:29
know who's coming in and out where they're going, right?
35:33
And then you know these concepts of deep learning and machine
35:36
learning and A I and all of this stuff that could process data
35:39
more fat, more quickly and look for behavior patterns.
35:43
That's the big promise we're all living right now.
35:46
And to me that creates now getting us out of this plateau
35:55
and starting a new hype cycle, right?
35:58
A new hype towards behavior based auto magic provisioning
36:04
and behavior based authentication and authorization
36:08
and all of these things that I'm sure you're seeing as well.
36:11
Would you agree with that, Jeff? Yeah, I think probably talking
36:14
about things like adaptive authentication, conditional
36:17
logic, those types of things, right.
36:19
I wonder if it's AI is because there really hasn't been.
36:24
A real good application yet in the I M space, I think there is
36:28
logic, right? And you're trying to detect
36:30
behaviors. I think that's probably just one
36:32
phase of it. I look at more from the end user
36:34
side, right? When am I going to go and say,
36:36
hey, I don't want to trigger my things in here, but you know, if
36:38
I say Alexa or Google or Siri, when are they going to that
36:42
natural language kind of input going to be able to infer, you
36:47
know what I'm trying to do and then how does it help me get
36:50
access to what I need you? Know going forward, you know so
36:54
I think what we're seeing in a I that's not necessarily over
36:57
hyped is you could apply a I within the product to simplify
37:02
tasks right. Repetitive tasks no longer need
37:06
to be manual. There are things inside the
37:08
product that are are are made easier let's say.
37:12
But the real value spans the product and it really creates
37:17
spans outside the product, it creates new product categories
37:21
right. So we're seeing the opportunity
37:24
for integration between behavior analytics and identity
37:28
governance, where identity governance tells us who has
37:30
access to what and now we have to start caring about what
37:33
people are doing with that access, right.
37:36
So there's a whole new shift that involves identity that
37:42
surrounds identity that's wrapped around a I and
37:46
intelligence and and machine learning that is going to force
37:51
us to reevaluate our organizations that say, OK, I
37:55
had identity over here and I had seen and behavior analytics over
37:59
there. These teams need to collapse or
38:01
at the very least they need to start speaking with one another,
38:04
which somewhat reminds us, remember when you said you got
38:07
your strike team formed. I think this this is happening
38:11
again and I think it has to happen.
38:15
Yeah. There could be obviously
38:16
maturity in the in the space as well, right.
38:18
So products need to find some way to.
38:21
How do you make either get more value out of that or explore new
38:25
avenues and you know you know other ways to kind of get feet
38:28
in the door to fix security things right like blockchain,
38:31
right. Everyone's been talking about
38:32
blockchain. You know for I AM I'm still not
38:35
quite sure where where that's going to be really applicable.
38:38
Yeah in an enterprise situation I understand the benefits,
38:41
right. You've got your distributive,
38:42
Ledger etcetera. But how does it fit in an I AM
38:45
space beyond just a management of an identity?
38:49
You know, that's maybe more self sovereign.
38:51
Well, I think that's yours and Jim's job, right.
38:53
That's what's so interesting because we sit somewhere between
38:57
the vendor and the client. Our interests are aligned with
39:00
the client. Always what the client expects
39:03
for us is to push them or pull them or help them really evolve
39:09
right and improve. So once you're doing that,
39:11
you're not no longer doing meat and potatoes, you're you're
39:14
really encouraging people to to progress.
39:17
So in that sense we're moving towards the vendor yet we're
39:20
looking at the vendor and looking back into the customer
39:22
saying well we've never seen that done before, right.
39:25
And and and I think that that's really our biggest value
39:28
proposition from an advisory and consultative perspective.
39:33
Execution's huge, right? Chad and Wolcott who runs our
39:35
services, his teams and screwing it in, it's like the two people
39:39
you gave a shot out to. That's the Super hard work.
39:42
But I think our job is also extremely valuable to say, yeah,
39:46
you know what, I don't really buy that.
39:47
I don't really know if that's going to work, but we can try it
39:52
and we can mitigate risk and we can do it in a pilot, but we're
39:57
not just going to sell you that hook line and Sacre.
40:03
All right. I think you should probably
40:04
start to close it out here. Jim, do you have anything that
40:06
you want to add? You know, I just just the
40:10
thought that I was having, as you guys were talking about
40:12
that, it seems to me that one of the areas where, you know,
40:18
Louise identified the AI piece as overhyped.
40:22
I think it might be overhyped from the standpoint of whether
40:25
or not it actually gets a foothold, but in terms of the
40:29
promise of what it could. Deliver.
40:31
I mean, I think that's the biggest threat to organizations
40:34
is that they won't even know when they're breached.
40:37
But the data is there. I mean all these systems are
40:40
being logged. It's just you need the
40:42
technology to piece it all together and put it on a
40:45
dashboard to somebody to say hey something fishy is happening
40:48
over here, or to figure some automated actions to disable
40:52
accounts, things like that, potentially either identifying
40:57
or preventing data breaches before they occur.
41:00
So I feel like the the promise of where you know, hey that the
41:06
identification of this is the potential solution to the main
41:10
problem that we have. I don't think that's overhyped.
41:13
But whether or not the technology of user behavior
41:17
analytics really ever gets there, the thing that I've found
41:21
that I think holds back technologies from really
41:24
succeeding is any kind of lack of standards.
41:27
So if the smart people or the. You know the big leaders within
41:31
the industry to come together and form a group to set a
41:35
standard like the SAMOL standard or the XML standard, you know,
41:40
and people really dot. And there are a lot of examples
41:44
of those standards that haven't been nearly as successful as the
41:49
ones I just mentioned. However, I feel like that could
41:53
potentially help drive things products build around those
41:57
standards. Then companies have an easier
41:59
time adopting them. Yeah.
42:02
So I agree. I think the technology's there,
42:05
right. And it goes back to the same
42:06
problem we saw with Identity is that, you know, we work a lot
42:10
with X of being their great friend of ours, great friends of
42:13
ours. We pick them to integrate with
42:15
sale point because of phenomenal product, phenomenal team.
42:18
But the experience in the end user is what are the use cases,
42:22
right? What are the data sources we're
42:24
going to bring in? And in the intersection of
42:26
Exabium and sale point, you know what are the use cases, what how
42:30
can we leverage this extremely powerful tool.
42:35
So I think it's organizational and the vendors push and lead
42:40
the way. But you know I challenge our
42:44
friends out there. They're doing the hard work in
42:46
the IT teams and the security teams, the practitioners to
42:49
really consider and and they don't have time to do it, but to
42:53
consider. How can we cooperate with these
42:56
other people, you know, and how and how can we get our processes
43:01
together? How can we make these different
43:03
tools all a part of our program? And I know we're wrapping up,
43:06
but I'll just say, you know, along those lines, an example of
43:10
that is pretty much everybody owns MFA, right?
43:14
Everybody owns a Pam tool. Everybody to some degree kind of
43:17
has an IGA tool be it you know an AD tool like Active Role
43:22
Server or Oracle Identity Manager.
43:25
The challenges, how, how are we going to integrate those into
43:29
our processes and how do we tie all those things together.
43:32
And I know that's what you guys struggle with and that's why
43:35
I'll end the, I'll end my piece here where I started it, which I
43:39
always have a great deal of respect for you guys that are
43:43
customer facing in the account. Challenging and helping people
43:49
move forward. I think my job's a lot easier.
43:53
I agree. You know, and going back to
43:56
Jim's point, as we'll close out here in a second, you know,
43:59
there's, there's so much data out there that's just not being
44:01
used. And I think a I definitely can
44:03
help with that or at least, you know, the behavior analysis
44:04
parts of it. There's an old saying and I have
44:07
no idea where I heard it or when, but there's two types of
44:10
companies. There's ones that have been
44:11
hacked and the other ones that don't know it yet, right?
44:14
It's just there's and it's just the way it works so.
44:18
So I think with that we'll go ahead and wrap it up here.
44:20
Louise, totally appreciate your time.
44:22
Being able to have a conversation like this is great,
44:24
but hope you come back and. Hey guy, it's a privilege.
44:29
Just for the record it is Friday at 4:00 PM and you know a sales
44:33
guys about this time of day on a Friday we start we start you
44:36
know wondering what we're doing here in front of the laptop.
44:39
But it to me this was great and and thank you guys for having me
44:42
and you know have a great weekend.
44:49
You've been listening to the Identity at the Center podcast.
44:53
To access all episodes, visit identity@thecenter.com.