Latest / Identity at the Center / #369 - A Practitioner’s View on Identity with Anthony Viggiano

Transcript

#369 - A Practitioner’s View on Identity with Anthony Viggiano · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
I am fantastic. How are you?
0:18
I'm doing good, but guess what? I got an awesome for you today.
0:23
I got something for you. I mean, you didn't ask me why I
0:25
was fantastic that it. I normally say not so bad, but I
0:28
was kind of hoping you'd ask why I'm fantastic.
0:30
Why are you? Why is it fantastic, Jeff?
0:33
Well, I have a major announcement to make regarding
0:37
this podcast and you're going to be here with me as I do this
0:40
live. You can see my mouse and I am
0:42
clicking. What did I just do, Jim?
0:46
Did you change the color in your background?
0:49
Nope, that's. I mean I do, but not this time.
0:54
I don't know what you did that was a million subscribers.
0:58
I wish a million subscribers, but you're very close.
1:00
We just crossed 1,000,000 downloads for the podcast.
1:03
So I just posted to LinkedIn that we are officially crossed
1:07
over into a million download territory.
1:09
So big shout out to everyone who supported us along the way.
1:13
Very humbling, very exciting. Never would have thought this,
1:15
you know, 6 plus years ago when we started this, but yeah, here
1:18
we are. Yeah, man, you're going to get
1:20
the raw emotions. I can't believe that we.
1:24
I mean, I knew it was coming, but man, it's really hit me.
1:27
I, I just want to say thank you to everybody who supported us
1:31
along the way, All of our sponsors, all of our listeners,
1:34
hardcore listeners, people who just pick it up for a few
1:37
episodes. I mean, we appreciate it all.
1:41
Yeah, super cool, monumental and yeah, I guess on for the next
1:45
million. But you know, I guess a plea for
1:48
those out there, if you haven't checked us out or you're not
1:50
subscribed, you just kind of listen to one off check us, you
1:52
know, subscribe, hit that like button.
1:54
It is, you know, get us on YouTube or Spotify or Apple or
1:57
wherever you want to do it. But that definitely helps kind
2:00
of, you know, show that we've got people out there.
2:02
But a million downloads? That is absolutely crazy for an
2:04
identity and access management podcast with 0 advertising, all
2:09
word of mouth and that's it. Yeah, The funny thing is, like
2:13
it probably. How many years did it take to
2:15
reach 100,000? It's a failure.
2:18
It's just picked up steam over the last couple years and so,
2:23
you know, all of our friends, but our friends over at IT Pro,
2:28
you know, being the official podcast of IT Pro, it certainly
2:32
didn't hurt. No, it's, it's super cool.
2:35
And you know what, birds of a feather flock together or, or
2:38
something like that. But yeah, super cool.
2:41
So I just want to take a moment. I was, I'm going to steal the
2:43
banter from you. I figured and said, hey, I've
2:45
got something, you know, hit me up first.
2:49
Yeah, I mean you. You.
2:51
I'm glad you did. I'm glad you did.
2:53
So now on to our normal broadcasting.
2:57
Regular schedule broadcast. We've got a bunch of different
3:00
events. I just told you before I hit
3:01
record that I'm on the road like every week starting next week
3:05
through October for a bunch of different things between like my
3:08
real job, you know, consulting day job and then the podcast.
3:11
But we've got cybersecurity summits taking place in Chicago
3:14
and Philadelphia. Those are both in September.
3:17
I will be at both of those. We've got discount code CSS25
3:20
dash, IDAC free pass share it would love, I'd love to see a
3:24
bunch of people in Chicago and Philadelphia.
3:26
I know more, I know way more people in Chicago than I do in
3:29
Philadelphia. But it'll be cool to meet up
3:31
with people in bulk locations, so people will check that out.
3:35
The new one that we just kind of figured out this week is
3:38
Authenticate 2025. So we are coming back again and
3:43
we have some exciting things planned with Megan and Adrian
3:45
and Andrew and crew for this next year.
3:49
So we have a discount code for that one as well.
3:51
That one is in October and that's the one that's in
3:53
Carlsbad, CA, one of my favorite conferences.
3:55
But if you enter the code IDAC 2025, you get 20% off.
3:59
So I'll have that in our show notes.
4:01
We actually have all these in our show notes.
4:03
We'll check out. So another conference that's in
4:05
October and then we've got yeah, go ahead.
4:09
Well, what I was going to say is like authenticate some people
4:12
might think to themselves like, oh, that's a little intimidating
4:16
or that's not in my lane. Or they might be looking at some
4:20
of the other conferences that you mentioned that are, you
4:23
know, big umbrella cyber and thinking, well, my lane is
4:26
identity. I'd be intimidated to go to
4:29
those conferences. But I think what you see as a
4:32
trend in this identity industry is that the tent is expanding,
4:37
the umbrella is expanding, and you need to know cyber, you need
4:40
to plug into it. You should be opening your mind
4:43
to what's going on with Fido and Pass keys and just the
4:47
pastoralist revolution because that's where everything is
4:50
heading. So even if you think, well, this
4:54
hasn't been in my lane, First off, they're fantastic
4:57
conferences. And 2nd off, like you should be
5:01
learning things that are outside of your lane.
5:03
That's how you're going to become the better practitioner
5:06
of tomorrow, yeah. A a good identity professional
5:11
is well-rounded. They don't know just identity.
5:13
They're able to talk through other parts of security to
5:16
understand how those parts contribute to identity.
5:18
So yeah, even though some of these might be, you know,
5:20
cybersecurity conferences, guess what?
5:22
Identity is part of cybersecurity.
5:23
So you're probably going to learn something or be able to
5:25
share ideas or, or things like that with kind of, you know,
5:27
other folks, but definitely encourage people to come out and
5:30
check it out. So, yeah, so we've got, let's
5:33
see, cybersecurity summits. We've got the Authenticate
5:36
conference, then we've got the Identiverse Washington DC event
5:39
coming up in November. Of course, we have a discount
5:42
code for that one as well. IDV 2, five dash, IDAC 25 gets
5:46
you some percentage off. I forgot to write it down, but
5:48
it is our on our website, 25, I'm going to guess 25, but you
5:53
never know, it could be the year, who knows.
5:56
And then after that, we've got the Gartner conference, the IAM
6:00
Summit in Texas in December and we'll have a discount code for
6:03
that coming in October. So be on the lookout for that.
6:06
Again, everything will be on our our web page, IDC podcast.com.
6:10
Just Scroll down on that main page and you'll see everything
6:12
that we've that we've currently got active.
6:14
So hopefully people are able to take advantage of that.
6:16
Definitely supports the show, shows that we can bring people
6:19
to the conference and and have some fun with it too.
6:22
Absolutely. You know, and, and Speaking of
6:25
which, This is why conferences are especially important.
6:29
Like you've always said, the best part is the hallway
6:32
conversations and the people you get to bump into and the people
6:36
that you meet for the first time.
6:38
Our guest today is somebody we met for the first time at a
6:42
conference this year, and he's somebody that he's got some
6:45
really big ideas in the identity space, and that's why you and I
6:50
were both so excited to get him on to the show today.
6:55
Yeah. Let's go ahead and introduce our
6:56
guest. His name is Anthony Viggiano.
6:58
He's one of the iron weeders in our space.
7:00
He's a member of the Identity Underground.
7:02
He's a member of ID Pro. I met him at Identibeer at the
7:06
Identiverse Conference in Vegas earlier this year.
7:09
And yeah, welcome to the show, Anthony.
7:12
Hey, thanks, Jeff. Jim, this is really an honor to
7:14
be on your podcast talking about my one of my passions, identity
7:18
and access management. Really thank you.
7:20
And also want to thank the broader industry, the identity
7:23
and access management industry. Yeah.
7:24
You know, go into these conferences, you show up, you're
7:27
like, OK, am I going to be able to contribute?
7:29
Am I going to meet anybody? What's it going to be like?
7:31
And all the conferences that I've been to RSA, you know,
7:35
Identiverse, people want to meet, people want to talk,
7:38
people want to share their own passions about what they do and
7:41
they want to build relationships.
7:43
And then best of all, what I found out is people want to
7:46
help. I've been on the hunt for my
7:48
next identity actors, management, leadership role.
7:50
And everybody that I talked to, when I kind of mentioned that
7:53
they're like, oh, I know of an opportunity or I know this
7:55
company is doing something and people have been getting me
7:57
connected. I've been applying to roles and
7:59
I'd, I would reach out to my network and I'd say, hey, do you
8:02
know anybody at this company? And they say, yeah, let me shoot
8:04
the hired manager an e-mail. I'm so thankful to to Jim, you,
8:08
you, Jim and Jeff for for helping out with that And and
8:12
just the community more in general.
8:13
And I just wanted to say thank you.
8:15
But also at Identi Beer, thanks to my wife, because if it wasn't
8:19
for her, I don't think we we would have met because I
8:22
probably would have shown up. Who here loves going to these
8:25
big open, you know, social events where you don't know
8:28
anybody? And when I'm walking towards
8:31
those events and I hear everybody talking, I'm going up
8:33
the stairs like my feet feel like lead.
8:35
I don't want to climb that next step.
8:37
I'm like thinking to myself, man, all I have to do is go back
8:39
to my hotel room. I can watch a movie, I go watch
8:41
2 movies. I can go to bed early.
8:43
Anything is better than, you know, walking into a social
8:46
event. But she came to Vegas with us.
8:49
She was there. She was like, no, let's go do
8:51
it. And she supported me and helped
8:53
me. And she helped, you know, start
8:55
the conversations. And she's a kindergarten
8:57
teacher, so she is just as good at talking with her little
9:00
kindergarten students. Oh, you got a new toy at
9:01
McDonald's? That's amazing.
9:03
Or, oh, you're AC. So for a large company, that's
9:05
amazing. Tell me more.
9:06
And she could just hold the conversation with anybody.
9:09
But she makes me feel like I can do anything.
9:10
And so I just really appreciate her.
9:11
I'd be in there with me. Yeah, that's super cool.
9:13
I remember meeting her and we were, I, I think I asked her
9:16
more questions about kindergarten than I asked you
9:18
like stuff. But the whole point was to, you
9:20
know, get to know each other and stuff like that.
9:22
But yeah, super cool. And look, that's a great part of
9:25
identity, right, Is it's a big tent as sort of, you know, Jim
9:28
mentioned earlier in previous episode, as well as there's a
9:31
lot going on, a lot of really good people.
9:32
And that is one of the strengths of the identity community at
9:35
large. You get groups like Identity
9:36
Underground, you get groups like Identity ID Pro, right, for
9:40
example. Like that's just cool, man.
9:43
I mean, no other articulate way to put it other than just it's
9:47
super cool. So let's talk a little bit about
9:50
that journey into identity. You've been kind of doing this
9:52
for a while now. Tell us, how did you get to the
9:54
identity space? Is it something that you chose
9:56
or did it choose you? Yeah.
9:58
So it's 2019 and it was a little bit of both.
10:01
So we, the company I was a part of just acquired another large
10:04
organization. We were combining and there was
10:06
org changes and my managers were moving to a new team and nobody
10:09
really knew what was going on. And so somehow I had this
10:11
opportunity where where I was asked, what do you want to do?
10:14
Where do you want to go? And I said, I want to go with my
10:17
manager. I really liked what he did.
10:18
He was very supportive of my career.
10:20
And I said, I choose choose this role.
10:23
Little did I know that that meant identity and access
10:26
management. And so it was the very first
10:28
week my, one of our auditors sat me in his office and said, we
10:32
haven't been able to do these access reviews.
10:34
And you've got two months before our next audit.
10:36
Here's what you've got to do. And, you know, try to explain
10:39
what an access review was. And, and all these things.
10:41
All I remember is I have no idea what you're talking about, but
10:44
we'll figure it out. And we did.
10:45
And, and I'm happy to kind of share, you know, that that
10:48
journey and, and how do you be successful at the identity
10:51
governance and, and different things like that?
10:53
But, but I chose it and, and even if I knew what I was
10:56
getting into, I think I still would have chosen it because
10:58
it's been an awesome last six years.
11:02
That's super cool. I mean, there's so much that
11:03
that kind of happens in this space, in your time in identity.
11:08
What's something that you see is like a real fundamental
11:11
challenge today that you know, all of us are facing in our
11:13
different roles? Data, I think data is one of the
11:17
biggest challenges because if you don't have the data, let's
11:20
say for example in whatever IGA platform that you're using, how
11:24
can you perform the controls? That you need to perform.
11:27
If you need to run an access review, but you don't know who
11:29
has access to what, you can't run an access review.
11:31
If you have the access review and you send it out to their
11:34
managers, but the descriptions aren't that great, we're hardly
11:37
going to know whether or not they should say keep a revoke.
11:41
And, and so I think that's the biggest challenge.
11:43
And then how do you solve that challenge is, is through data
11:45
integration and being able to get those applications the
11:48
source of truth that who has access to what into your
11:51
platforms. And, and same thing with
11:53
privileged access management. If you've got that automated
11:55
rotation, then it works. Then then you're getting the
11:57
value there. But if those passwords aren't
11:59
being automatically rotated, then the, you know, the
12:02
privileged access management, the, the value isn't there as
12:05
much. So it's that data integration,
12:06
the application integration, I think that's a building block
12:09
that's going to continue to be very important.
12:13
Such an interesting answer. I think it's, it's a very
12:18
receptive answer. It's obviously somebody who's
12:21
tackled the these challenges in the real world.
12:24
I'll tell you what, Anthony, I thought you were going to say
12:26
non human identities because where I met you first was that
12:30
Identiverse in the NHI workshop NHR standing for non human
12:35
identities. And it was a full day workshop.
12:37
I mean the the topic is white hot right now and I'd love to
12:43
hear your insight on why you think it's so hot at the moment.
12:47
Sure. Yeah, I think, I think it's hot
12:50
right now at the moment because it's been a problem for a very
12:54
long time. The the surface accounts, as we
12:56
used to call them, have been been around for 1020 years.
13:00
So it's not a new problem. But what's making it more
13:03
urgent, as I think we all know of AI is you've got the same
13:08
problem then now you're going to plant on top of that, you know,
13:11
these this new technology, you can't solve the AI problem, the
13:16
agentic AI problem with the way we do things today.
13:18
So I think the questions that we're trying to answer and what
13:21
we talked about at that panel was one, how do you build a new
13:25
foundation? How do you kind of clean up the
13:27
problems that you have now? And then how do you start fresh
13:30
so you can build on top of that for the new technologies and
13:33
capabilities that are coming down the road?
13:35
Yeah, I mean, agentic AI definite plays into it.
13:39
I kind of feel like this they used to happen so to me and like
13:43
you had enterprise IT where you had the service accounts and the
13:47
application accounts. Then you opened up cloud and
13:50
platform and it's like it bursts on this scene with a whole bunch
13:56
more non human identities workloads.
13:59
And now AI is going to be the next frontier.
14:02
I feel like 1. I feel like practitioners have
14:06
struggled to say, how do I solve this with my existing tool set?
14:11
Or do I need to go out and buy something new?
14:14
I mean, that's a whole thing that organizations are
14:17
struggling through right now. I mean, do you have a
14:19
perspective on that? Yeah.
14:21
So I think first you can solve the problem or at least get a
14:25
solid start without new tools. So I think, I think anybody can
14:29
start any big large enterprise can start right now with the
14:32
tools that you have. If you want to automate and kind
14:34
of streamline those capabilities and really make it more
14:37
scalable, then you're probably going to want to invest in some
14:39
tools. But start start fresh.
14:41
And and that is really just your old good old fashioned Excel
14:44
spreadsheet is you run reports out of your source of truth,
14:48
which is, you know, can be Active Directory, it can be your
14:50
windows machines, it can be, you know, the the Linux machines
14:53
anywhere where those non human identities live.
14:56
Run those reports, discover what exists, figure out what they
15:00
have access to. Are they administrative accounts
15:03
on these servers or do they have just really basic access to to,
15:06
you know, run, you know, run a report on a daily basis or
15:09
something because, you know, there's all, all kinds of
15:11
different use cases. Prioritize them and then figure
15:15
out, OK, what ones do we still need and which ones we do?
15:18
We not. And there's a lot of manual work
15:20
that goes in into play there. It's now you've got the data.
15:22
You let's say you have 50,000 non human identities.
15:25
Well, now we got to figure out who owns them.
15:26
We got to figure out what they do.
15:27
We got to figure out if they're still used.
15:29
And that's, you know, that's a huge thing is I'd, I would bet a
15:32
lot of those accounts that you're going to discover aren't
15:35
even used anymore. And wouldn't it be great to
15:38
eliminate those and reduce your attack surface instead of just
15:40
letting them sit around saying, I'm a little nervous to
15:43
terminate them because I don't know what they do.
15:45
And I don't want to, you know, break, break a system.
15:48
So, you know, there's a real balance there.
15:50
But that's how I need an example of what you can do now without
15:53
any new technology. It's a pretty pragmatic
15:55
approach. I think if I was to summarize
15:58
it, because I was thinking this as you're going, yeah, don't let
16:02
the don't let perfection be the enemy of better, right?
16:05
Like if you can get better, if you can solve.
16:08
And I think the other elements, like we've been talking about
16:11
this in the beginning for so long, it's like having a good
16:14
inventory, having good visibility and that data
16:19
element, like do you understand what these accounts, where the
16:23
accounts are? And then what do they do?
16:26
And some people get mad because they use the term accounts, but
16:29
I don't really care. But here, So here's a question.
16:34
So just I will say you read the most memorable statement from my
16:39
perspective in like dinner verse 2025, which is you said access
16:44
reviews are security theater. And I was like, holy cow, who
16:50
goes to an identity conference, goes on stage and says that that
16:54
takes some guts. But I, I kind of wonder, like,
16:58
OK, you know, we have all this data now we know what is going
17:02
on with the data. Don't you have to involve the
17:05
user? So what is your perspective in
17:07
terms of access reviews and what's their security theater?
17:12
Yeah, No, thanks. I do believe that.
17:13
Yeah, at scale, at large organizations, it's going to be
17:18
more theatre than it is actually reducing risk.
17:20
And yeah, you know, I kind of say that to get a little bit of
17:22
attention and looks like it worked.
17:23
So thanks for pointing that out, Jim.
17:25
But, but let me explain that to your point.
17:27
Let me unpack that a little bit. So just think about how much a
17:31
company spends on performing an access review.
17:34
Let's just say, you know, they have a team maybe cost
17:36
$2,000,000 per year for that team to run.
17:38
That just focuses on access reviews.
17:40
OK, so 2,000,000 per year. And then you've got, let's say
17:44
for, you know, an organization with 100,000 users, you've got
17:47
10 1000 managers now that on a quarterly basis have to go into
17:51
and perform these access reviews.
17:53
So let's just say it takes them an hour.
17:55
You know what, what's the value of somebody's time?
17:58
Multiply that by by 10,000 four times per year.
18:02
That's millions of dollars per year than an organization is
18:06
spending on performing exact these access reviews.
18:08
And so that's, that's the, you know, that's the the cost
18:12
aspect. Now let's look at the return
18:13
aspect. So if you don't have all that,
18:17
you know, life cycle management, all that and stuff that we
18:20
talked about a minute ago in terms of not great descriptions,
18:23
you don't really know what this access does.
18:25
How many managers are going to take the risk and say, yeah, I
18:28
don't think he needs us anymore. So let me just revoke it.
18:30
Well, then your, your team doesn't can't do their job
18:32
anymore. So often times, and you can just
18:35
look at your data, you know, what is the revoke rate for your
18:38
access reviews? Is it just a couple percent per
18:42
per cycle? So you've got a, you know,
18:43
3,000,000 lines and and only, you know, a few, you know, a
18:46
couple percent points of that was revoked.
18:49
Is that really providing the risk reduction that you're
18:53
looking for? Maybe it should be 10%, maybe
18:55
should be 20%. I don't really know what that
18:57
that threshold should be, but I know it's probably not one or
18:59
2%. So that's where, you know, I say
19:02
take a look, is the investment, is the money that you're putting
19:05
into these access reviews, is it giving you the return, the risk
19:08
reduction that you're looking for?
19:09
Now, on the other side, we can't forget about audit and
19:11
compliance. That is important.
19:13
Yes, we want to make the investment.
19:15
We need to be compliant. We need to pack, pass our access
19:18
reviews, our audits. And so that's an important
19:20
thing. So I would never say, oh, forget
19:22
it, you know, don't do it. We don't need to do it anymore.
19:25
But in terms of risk reduction, yeah, if we think these access
19:29
reviews are truly reducing risk in some cases, I I would double
19:33
check that. Yeah, Sante, you're, you're
19:37
targeting the the whole idea behind it.
19:40
It's the how's it actually approached?
19:43
How's it actually done? Is it being done in an effective
19:46
way? So given that I think you are in
19:50
favor of identity governance and, and by the way, I'm just
19:54
calling, I'm, I'm linking identity governance and access
19:57
reviews. They are kind of linked.
19:59
For. Sure, but it's not like the
20:00
whole thing about identity coverage.
20:02
Where do you take identity governance?
20:04
How do you make it more effective?
20:06
Fair. Yes, I love identity governance.
20:08
That was really the focus of of my job and why I'm so passionate
20:12
about the access reviews. So one, let me let's kind of
20:15
like think about a, a whole new approach to access reviews.
20:18
Again, not saying we stop what we're doing, but if we want to
20:21
reduce risk, who is better to to know what access I need to do my
20:26
job than me? Nobody I know when I need to do
20:30
my job. And yes, maybe, maybe again, the
20:33
descriptions aren't as great and different things, but I'm going
20:35
to know more than my manager's going to know in terms of most
20:37
in most cases what I need. So how do we one do a
20:41
self-service access review? Doesn't have to be audited,
20:45
doesn't have to, you know, be an artificial control, but then
20:49
incentivize these employees to actually reduce the, the, the,
20:54
the entitlements because then it'll be the same thing.
20:56
We'll just rubber stamp everything.
20:57
So you got to provide that incentive.
20:58
And this was an idea of one of the, my team members on my team.
21:01
She thought, you know, we were like talking about it.
21:03
And she's like, oh, well, you know, get them to do it, give
21:06
them an incentive. So you've got points, you know,
21:08
some companies have these, you know, points systems.
21:10
Give them 10 points for entitlement that they revoke
21:13
her. If you could do cash, do cash,
21:14
$5 for every entitlement and I bet you're going to have people
21:18
that have been at the company a long, a long time that can go
21:20
out and buy a brand new TV just by eliminating some of these
21:24
these entitlements and now you are truly reducing the attack
21:29
surface. So if one of those accounts gets
21:32
fished, that attacker has less access than they would have
21:36
before you had did that exercise.
21:39
This idea of gamification is something that I've, I've been
21:43
a, a fan of for a very long time.
21:45
I remember when I was first rolling out self-service
21:47
password reset a few decades ago at this point, and we were not
21:52
getting the, you know, the, the number of enrollments and
21:55
registrations that we wanted. It was kind of languishing
21:57
despite us doing, you know, communications and emails and
22:00
stuff like that. And this would have been like
22:01
late 2000s, I would say. And so I don't remember who came
22:05
up with it, but you know, we had a team and it was like, all
22:08
right, let's give away an iPad. So this is when iPads first came
22:11
out. Yeah, I think at that point
22:13
there were $400.00 or whatever it was, right?
22:15
So I was like, all right, let's give away an iPad and anybody
22:17
who is registered in our self-service password system
22:21
basically has an entry in the system and would be raveled off.
22:26
And we went from something like 30% enrollment and we gave it
22:29
1/4 just to kind of get the message out there and get people
22:31
rolling. And by the end of a 1/4, we had
22:33
gotten up over like 90% enrollments just for $400.00
22:38
iPad. The best money that we spent in
22:40
$1,000,000 IAM program was a $400.00 iPad to drive awareness
22:44
and incentivize people to like to do it.
22:48
So yeah, you're totally right. You know, there's lots of points
22:50
system stuff like that. I mean, my mom used to give us
22:52
points when we're growing up. I don't know when I'm going to
22:53
be able to cash those in, but I must have a zillion points at
22:56
this point. Jeff forgot to mention that and
22:59
it's a great iPad. He still has it.
23:03
If you know me, you know that I, I, I I enjoy the finer things in
23:07
life and tend to rotate my equipment on a yearly basis.
23:10
But I think. And I know you and I know you
23:13
wouldn't do that and take the the integrity out of it.
23:18
I was actually wondering, Anthony.
23:19
So let's stay in this identity governance lane and one of the
23:24
other areas that gets talked about in terms of being ripe for
23:28
revolution. And by the way, I love your
23:30
idea. Not only on the giveaway, but
23:34
having people or the gingification, but having people
23:37
do their own reviews. And it kind of like flies in the
23:42
face of or it, it's like a revolutionary idea and like why
23:47
can't we have kind of these big ideas?
23:51
The industry's having a big idea right now, which is that maybe
23:54
RBAC isn't all it's cracked up to be.
23:57
And I'm wondering, where do you stand on our back?
24:01
Yeah, No, I, I definitely have some thoughts on that before we
24:04
go there though. And if I can go back to access
24:06
reviews because I want to share a little bit more about how do
24:09
we make access reviews successful?
24:10
Because yes, maybe they're a little bit of theater and and
24:13
maybe we have some other approaches that we can kind of
24:16
take care of reducing risk other ways, but still got to do an
24:19
access review. How do you make a successful
24:21
and, and early in the days when and I was kind of talking about
24:23
my first experience, we really struggled and one people weren't
24:27
even completing the reviews is, you know, you go in, you send
24:30
out the emails, you get what, 70% response, 50% response.
24:34
So if you're struggling with that, your is a really fun trick
24:37
that we learned and is it's people's human nature when you
24:40
give them a due date to wait until that due date to take the
24:44
action. So we would send the e-mail,
24:47
we'd say you've got 30 days to perform this access review.
24:49
We'd give them the 30 days and then guess what?
24:51
How many people do you think completed those access reviews
24:54
in those 30 days? Very few people, they waited and
24:57
then you got to the deadline and then oops, I ran out of time.
25:00
I got other priorities, not going to do it.
25:01
And then you know, and it was a little bit messy.
25:04
So our approach was a couple of different things #1 as soon as
25:08
possible, no deadline, do not give people a deadline when it's
25:12
urgent. And it's important is say this
25:14
has to be done as soon as possible.
25:15
And then we'd set, we drill them with e-mail, we do three
25:18
different emails every other day and they would get those, those,
25:21
those emails. So it within one week.
25:24
Now we went from, you know, not great response in 30 days to now
25:28
90% responsiveness within the first one week.
25:31
So that was a huge, huge transition.
25:33
And then number 2 is on the second week.
25:35
That's when we start escalating and we'll copy people's manager.
25:39
And now the manager will say, oh, OK, yeah, maybe, you know,
25:41
the person's out of the office. Maybe they, you know, really are
25:43
doing it for their priorities, you know, whatever.
25:45
It doesn't matter what what the issue is.
25:46
And now the managers out motivate their their team
25:49
members. But it's, you know, tiny subset.
25:50
It's 10% of of of the total population.
25:54
And then by the time we get to that 10 day mark, we're at 99%.
25:57
And then, yeah, you know, we're just going to, you know,
25:58
message, direct message people, you know, figure out people are
26:01
reassigned, different things like that, get that last 1%.
26:04
But that was that was a big thing for us.
26:06
And then really improving the communications is giving them
26:09
the right information. So, you know, instead of getting
26:11
this kind of cryptic e-mail, I get all the instructions.
26:14
I get one click, boom, I'm in and I see the instructions in
26:16
the e-mail. Very simple to understand.
26:18
Do that communication to leadership.
26:21
So now they can get reports on a daily basis to say to track, you
26:24
know, their team, you know, by leader who you know, who on my
26:27
team is getting it done and who's not getting it done.
26:29
They're really just data key performance indicators and
26:33
communication was was what made it made our transitions from not
26:38
so successful access reviews to very successful access reviews.
26:42
All right. Now, Jim, to get to your
26:43
question on role based access controls.
26:45
Let me button there for a second though, because please, Jeff,
26:47
one of the things that I think a lot of people struggle with is
26:51
access reviews and getting a response.
26:53
So I, I have to imagine, you know, myself included, we've all
26:57
tried sending a bunch of emails and saying do this and then they
27:01
don't do it or they rubber stamp it and it's like not an
27:04
effective, you know, it's security theatre at that point.
27:05
Kind of to your point, right, how you have to have some sort
27:10
of carrot and, or stick or maybe both for that e-mail to be taken
27:15
seriously. What is some tips or guidance
27:18
to, you know, to get that? Because I think a lot of people
27:21
struggle with this. You know, myself included when I
27:23
was doing this was like, I can send as many emails as I want,
27:26
but short of me walking over their desk, getting them in a
27:29
headlock and make them sit at their computer and make a
27:31
decision, yeah, people just don't do it.
27:35
Or they find other reasons or excuses not to do it.
27:38
Or worse, they rubber stand it. Which is a real problem, yeah,
27:41
yeah, I've done all those things minus the head headlock.
27:43
So. But I thought that would be just
27:45
as effective, aggressive. Negotiations is what I will tell
27:48
you about. That's better.
27:50
Yeah. So the for us, it was making the
27:54
the e-mail very clear, helping people understand what's in it
27:59
for me or why is this important and kind of building that on the
28:03
culture. So we made it very clear you are
28:07
responsible for the enterprise's security, you are responsible
28:11
for the enterprise's audit and compliance.
28:14
And here's how you can help. And then so we communicate that.
28:17
And then we just try to really communicate how we hear people
28:21
like, yes, we know this is not the greatest experience.
28:24
We hear you. Here's the changes that we make
28:26
or hey, we have bi weekly or twice per week lunch and learns
28:30
where you get this e-mail. And if you don't understand what
28:32
you're doing, click this Webex at this time and boom, you'll
28:35
join and you'll we'll help you. We'll walk you through it.
28:37
So it's really more support, more hands on approach where
28:42
people can come for the help. So they're not just kind of
28:46
frustrated where they're going in, they're trying to figure it
28:48
out, can't figure it out and don't know what to do.
28:50
And then now to your point, it's you have to go track them down.
28:53
We're giving them the avenue, the communication, the channel
28:56
to come find us and remake it easy, easier and easier for them
29:00
to find us. But then to, you know, more
29:01
importantly, just to be able to get it done on on the first try.
29:04
For example, investing a lot in improving our descriptions.
29:08
And that's time intensive. You have to go to the
29:10
application team, you have to ask them what it does.
29:13
You say, no, that's not a great description.
29:15
Let's make it a little bit more user friendly.
29:17
Doing all those things that that takes time, but that really pays
29:20
dividends because now as a manager, you see, Oh yeah, I
29:22
know what this does. Easy, easy decision.
29:24
Yes or no versus I have no idea what this does.
29:27
Rubber stamp. So now my RBAC question.
29:32
OK, yeah, let's let's get to RBAC.
29:35
So RBAC very just like a lot of governance is complex.
29:40
And when you start small and you're like, Oh yeah, this
29:43
should be simple. Let's let's do this.
29:44
Let's you know, for example, give anybody the ability to
29:47
request a role. Sounds like it won't be a big
29:50
deal. But then a few years later
29:52
you've got 15,000 rolls and some of those roles have the same
29:58
entitlements, some of those roles have only one or two
30:01
entitlements and you've just got a mess on your hands that the
30:04
people that requested them are long gone.
30:06
So it's a life cycle management problem there.
30:09
And, and, and that's not scalable.
30:11
So opening it up like that and kind of letting it be just no
30:15
standards, you know, no, you know, anybody can do what they
30:18
want. That's not going to work.
30:20
And, and we, you know, discovered that the hard way.
30:21
So what can you do instead if you want to do roles?
30:24
Because you know, the question is, what's the value of roles?
30:26
Well, going to access reviews, if I could review, you know, 5
30:30
roles versus 100 individual entitlements, that's going to be
30:33
a lot quicker. So there's value there.
30:35
And if I'm being on boarded and I only need to request a couple
30:38
different roles and instead of, you know, again, hundreds of
30:40
entitlements, there's value there, you know, that the person
30:43
can do their job much quicker. So there is definitely value in
30:46
roles, but now we want to choose, OK, how do we simplify
30:51
it and choosing just a good structure and it could be
30:54
anything. For example, you could choose
30:56
the structure at the senior leadership level.
30:58
You probably don't want to get down to the individual manager
31:00
level because you know, if it's a large enterprise, again,
31:02
you're going to have the same problem.
31:03
But maybe at the senior leadership level, OK, the senior
31:06
leader for all his team gets, gets this role.
31:08
And yes, it's not going to be everything for everyone, but it
31:11
might solve some basic problems. Or you could do it at the
31:13
project level. This is going to be a three-year
31:15
project. This is everything in the
31:16
project that you need the, you know, different shared folders
31:19
and such. Anybody who joins that project,
31:22
it's the role and, and that's pretty simple.
31:24
Or you could do it at the application level.
31:25
Instead of having to request 5 different entitlements or global
31:28
groups for an application. You're this job, you need to do
31:30
this function, you get the, you know, get this role.
31:33
And, and so that is how I would recommend implementing it and
31:37
keeping it much more simple and laid back and not trying to give
31:41
everybody everything they need. Just enrolls.
31:43
You're going to have to still go outside of roles, but if you can
31:46
kind of do the mass and then ROLS, I think you can find the
31:49
nice balance of value there. Yeah, it seems like you're
31:53
you're applying like a pragmatism to it as well, which
31:56
is why I love having practitioners on the show,
31:59
because it's taking the theory and then taking the reality and
32:04
mushing them together and figuring out what works.
32:07
But I mean there, there are advances in the technology and
32:11
when those advances come along, I think it's our job to kind of
32:15
consider them and how can we work them in.
32:17
What do you think of kind of some of the newer approaches
32:20
like P back and not really new, but a back like where, how do
32:25
you fit those into an enterprise identity governance program?
32:29
Yeah, I think, I think you could, you could kind of pick
32:31
and choose which approach you want to take or you can kind of
32:34
do a hybrid model. Yeah, that attribute based
32:36
access control. I really like that.
32:38
And I think some of the new identity governance tools are
32:40
trying to build on that and, and I think that has a lot of
32:43
potential. And you know, the use case there
32:45
is based on all the attributes that I come into a company with
32:49
location, team manager, job title, all kinds of different
32:55
attributes. Based on those attributes, I'm
32:58
going to automatically get the access that I need to do my job.
33:01
Now here's the question, just like RBAC that requires rules.
33:06
So who is going to manage the rules that that automates that
33:10
those settings and and who's going to be responsible for
33:13
that? So I think at scale, again, if
33:16
you, if you try to, you know, complicate it and just say, Oh
33:18
yeah, everybody's going to get everything they need
33:19
automatically everywhere. Don't know if that's going to be
33:23
scalable or if you're going to be able to implement that and
33:25
maintain the life cycle of that on a large enterprise.
33:29
So I think you'll kind of see similar issues.
33:31
So I am on record as not being a fan of RBAC.
33:34
I think it's a big quagmire that a lot of companies struggle
33:36
with. I am a big fan however, of
33:39
attribute based and policy based because I feel like those are
33:42
easier to start with. But it goes back to almost the
33:46
first topic you talked about, which was data.
33:48
You have to have good data to do any of this, but it is
33:51
especially important for attribute and policy based
33:54
access controls which rely on data to make those decisions.
33:57
So what happens if I don't have data?
33:59
Am I stuck or can I use at least what I have and and hope that
34:03
it's good? Like where would you start if
34:06
you were just joining an organization and you're like,
34:08
OK, how do we, how do we fix authorizations and try to get
34:12
them managed from a, from a life cycle standpoint?
34:15
Yeah, no, it starts with the data and and you know,
34:18
integration and understanding the data.
34:21
So let's start with provisioning as an example.
34:24
You can use that should be based, you can use RBAC.
34:27
But if those applications aren't fully integrated and you have
34:30
people, humans that are getting a ticket from your request
34:34
system and then you're waiting 10 days and then that person
34:37
gets the ticket and then they go and they provision that access.
34:40
There's going to be problems. They're going to maybe
34:42
accidentally, you know, provision the wrong thing, you
34:44
know, the baby, they'll forget, they'll miss the ticket.
34:46
Maybe when somebody's terminated, that ticket won't
34:48
get processed in time. And now you've got, you know,
34:50
access that that is, is there for too long.
34:53
We need to integrate those applications and we need to get
34:56
those data that that automate that provisioning and that
34:59
termination process. And then Jeff, that kind of gets
35:01
to your, your question on where do we start?
35:03
Well, now if you have all these provisioners that no longer need
35:06
to do provisioning, now you've got a army of people that can go
35:09
after the data. And I think that's where we can
35:12
kind of make that transition is 1 integrate systems so that
35:16
we're getting the data feeds #2 leverage those people to improve
35:21
the quality of that data. And then now you've got the, the
35:26
two things that you need in place, the automation and
35:28
integration and the data quality to implement any of these rules
35:31
that you want to implement, whether it's a back R back, you
35:34
know, authorization, just in time authorization, all kinds of
35:38
different capabilities that rely on the data and automation.
35:41
Now you've got that that problem solved.
35:44
So when are you done with roles? Can you be done with roles or
35:50
when do you call it done? Is it 80% of my access is a role
35:54
or an attribute based bundle or some sort?
35:57
Is it 50% 'cause I'll give you my my hot take is I don't think
36:00
you're ever done and I don't know if 100% is actually
36:03
realistic. Right, Yeah.
36:05
And I think you can apply that same thought process to just
36:08
about any identity governance approach is you are never going
36:13
to be done 'cause as long as there's people coming in and out
36:16
of your company and you've got new owners for non human
36:19
identities or for roles or for entitlements, you've got new
36:23
applications coming in. It is never going to be done.
36:26
You're always going to be making changes.
36:28
So that's why having the foundation of a life cycle
36:32
process, a system in place that's going to manage all of
36:36
your identity assets, everything this, you know, very similar
36:39
process for all of these things where it's easy for if I leave
36:43
the company who who's going to, you know, take ownership of
36:46
that? All that stuff is very easy,
36:48
very well communicated, automated.
36:50
So yeah, Jeff, you're right, it's never done.
36:52
You're always going to be changing things and but you can
36:55
build life cycle and process that.
36:57
That can really simplify it. You know, I've seen the term
37:00
roles choose to mean so many different things at different
37:02
organizations all the way from, you know, very vendor specific
37:08
definitions to just talk about director groups, you call them
37:12
roles or applications calling their specific entitlements
37:17
roles. So I think that's one of the
37:19
things that as an industry, you know, we that term gets turned
37:24
around to me in so many different things.
37:26
But one of the, the things that, what I found a lot is that a lot
37:31
of organizations strive to get to 1 roll per person.
37:36
And then essentially what you wind up having is if you have
37:40
2500 employees, you have 2500 rolls.
37:44
It's like, what's the point? No point.
37:47
There's no point, right? But we have roles.
37:51
Right, yes. So there you go.
37:52
We we have roles and we're like access.
37:54
Reviews. We could say we got it.
37:57
So I want to kind of string along this part of the
37:59
conversation and get into more of the authoritative source
38:02
things because they think this is kind of important for
38:04
anything that we're going to do around authorizations and life
38:06
cycle is how do we know where the data is coming from?
38:10
What is the authoritative source for humans?
38:14
And then when you talk about humans or we talk about
38:15
employees or we talking about non employees like contractors
38:18
or vendors. Or.
38:20
Customers or patients or XYZ, right?
38:24
There's a whole bunch of personas out there.
38:26
I think generally speaking most companies do a pretty good job
38:30
of managing their people. We're still a lot stumble, but I
38:34
think it is getting better is the non employees of an
38:38
organization typically are not as well managed.
38:42
They may not be in the same system, they may not be in a
38:44
system at all. They might just live in an ad
38:47
hoc spreadsheet. I've kind of seen it all at this
38:49
point. Where do you come down on this?
38:51
This one of the holy wars we've had for a very long time,
38:54
especially in the IGA world, is what is the authoritative source
38:56
for all of our humans? Should it be the HR platform?
39:01
Should it be a a neutral platform?
39:03
Should it be like maybe the identity government's system?
39:05
Maybe that's the source? Like where do you fall into sort
39:07
of that human versus or sorry, not human employee versus non
39:11
employee? And then the extension of that
39:13
question obviously gets into, OK, so now we've got non human
39:16
identities. Where do we source those from?
39:20
Yeah, yeah, a couple, couple layers there.
39:23
First, that is important because you know, employees, you know,
39:26
most companies are going to vet the people, the identity
39:30
proofing themselves and they probably have a really good
39:32
system And so they can rely on I'm hiring Jim McDonald and, and
39:36
I know that when you're comes comes to contractors, often
39:39
times we're relying on third parties to do that background
39:42
check and that vetting. And haven't we seen a growth in
39:46
laptop farms where we've got people from North Korea that are
39:49
actually getting jobs in U.S. companies and their laptops are,
39:53
are somewhere physically in the US, but the person is actually
39:57
not who we, we think that they are.
39:59
That's happening in real life. And so that is, that's a real
40:01
scary thing because now, now they have access and, and
40:04
they're acting like a normal employee.
40:06
It's really hard to detect. After that, So yes, So what your
40:10
question is very important because of that as one one
40:12
example as an attack factor. So in my opinion, I like one
40:16
source for all of people and you know, some sort of like a work
40:20
day platform or, you know, whatever kind of platform that
40:22
you want to use. And you can have different
40:24
points of entry though, for example.
40:26
So you know, for work day, you've got, you know, you can
40:28
have your employees coming in and then for contractors, you
40:32
can have them coming in through requested through a completely
40:34
different platform, but they're going to live in in the same
40:37
source of truth and and that will get fed into your identity
40:42
governance platform with different attributes.
40:43
So you can kind of tell, tell the difference.
40:46
And then I want to build on that when it comes to, you know, we
40:48
talked about source of truth. Applications are your source of
40:52
truth when it comes to who has access to what, Because now
40:55
that's important because if you know, you need to make a
40:57
decision, well, who has access to this application or who has
41:00
administrative access, you know, the only way you're going to
41:03
know who has the risky access, you know, where the, you know,
41:06
you want to make that investment of what you want to protect, the
41:09
access you want to protect and the people and the accounts that
41:11
you want to protect is you need to know what they have access
41:13
to. So that starts with the source
41:15
of truth, which is the application or Active Directory
41:18
or the servers. And then I kind of
41:21
differentiate, maybe we could use different terms, the
41:22
authoritative source, which is really where you aggregate all
41:26
that information. And I want my identity
41:28
governance platform to be an authoritative source.
41:32
And in order for that to happen, that means I need to have good
41:35
data feeds, good integration in into there.
41:38
And I'll just give you one example.
41:40
What what we've done is a lot of you know, like is the first
41:43
thing you want is you want integration, you want automation
41:46
there. But if you can't do that, or
41:47
maybe you can't do that right away, is you can build an ETL,
41:51
which is basically you get a flat file from the source of
41:55
truth, the application. It's it's a, a standard format.
41:58
It follows a template and then it gets dropped in some sort of
42:01
shared location. And then your identity
42:03
governance tool consumes that data, that standardized data.
42:08
And now you've got that. And let's say you do that on a
42:10
weekly basis, that's almost as good as an automated feed.
42:13
So those are some, some things, some solutions where, OK, I
42:16
can't build out integration because I got this legacy
42:18
platform, but you still can build some level of integration.
42:21
And now you've got your authoritative sources talking to
42:24
your, your sources of truth talking to your authoritative
42:27
sources. And you have everything on that
42:29
one, one identity governance platform.
42:32
So I'm glad you made that distinction between source of
42:34
truth and authoritative source, because I think that is very
42:37
important to highlight here. Data comes from sources.
42:41
The collation of that data and the aggregation and the
42:43
correlation of that data is where your authoritative source
42:46
lives. So maybe that is the IJ
42:47
platform, for example, maybe it's a privileged access
42:49
management platform for like non human identities, right?
42:51
Things like that. What I find happened quite a bit
42:55
is that IT solves the problem on their own without involving the
43:00
business or having the business be accountable for non employee
43:06
identity. It's well, it's left up to the
43:08
managers and they kind of figure it out.
43:09
And we all know managers are great at doing you know what
43:11
they've been asked because they do access certification so well.
43:14
So. You know what happens when there
43:17
isn't a process and IT has to kind of figure it out And maybe
43:21
if the IM team kind of has to figure it out and all of a
43:24
sudden IT or the IM team or some combination in there owns the
43:30
population of non employees, what happens in that scenario?
43:34
How do we get back on track for that?
43:36
Sure. So what I've kind of learned or
43:39
the approach I like to take is centralization.
43:42
So when you have fragmentation for pretty much, I wouldn't say
43:44
any system, but for, you know, let's say governance, identity
43:47
governance is you've got different teams doing different
43:51
things or nothing at all. So I would rather centralized a
43:56
system and a life cycle and say I'm going to be in charge of
43:59
this life cycle and this process, but here is your
44:03
responsibility. And then kind of distribute that
44:06
out to the business, to our technology partners and make it
44:09
super easy. So for example, non human
44:12
identity management, life cycle management, I'm going to say
44:14
this is the source of truth. They're going to live in our
44:17
identity governance tool. Maybe they live in our Pam tool
44:20
and everything's going to be in there.
44:22
And here's how you get it in there.
44:23
Here's how you register it. And then you're going to
44:27
maintain that. So every year you're going to
44:29
change the password, you're going to make sure it's
44:31
automatically rotated in, in the privileged access management
44:33
tool. It's going to have a, a
44:36
compliant password, not just, you know, password 123 or you
44:39
know, different things like that.
44:41
And but that's going to be centrally managed.
44:43
And then we're going to distribute that and we're going
44:44
to know who owns it and we're going to communicate to them and
44:47
say, here's your responsibility and we're going to simplify
44:50
that. That's the other aspect of it is
44:52
if it takes me a month to create a new non human identity for the
44:55
application that I was supposed to stand up two weeks ago and I
44:58
can't because I don't have my account yet, who do you think is
45:00
going to want to go through that process again?
45:02
They're going to the next application, they stand up,
45:04
they're going to say, well, I got a surface account that
45:06
works. I'm just going to use that all
45:08
over again. And it's used over again and
45:10
over and over. And now you need to reset that
45:12
password because it was compromised or you, you know,
45:15
want to keep it rotated and now nobody knows knows where it
45:18
lives. So Jeff, to answer your
45:19
question, centralized system process and management and then
45:23
very clear communication to the owners with a life cycle
45:28
management. And then great communication to
45:30
leaders saying you own these accounts.
45:33
You're the accounts that are in compliance under your ownership.
45:35
And here's the ones that are not.
45:36
And we're communicating to your teams 9060 thirty days out when
45:40
the password needs to be rotated or when something needs to
45:42
change. And here's how easy we're making
45:44
it for you to follow the standards.
45:48
Yeah, I wanted to ask you a question about, you know, what
45:51
is your advice to practitioners to future proof their identity
45:55
program. And I don't think you can future
45:57
proof it, but I think you can approach it with the framework.
46:00
So we brought up, you know, how enterprise IT was done in the
46:05
past and, and we brought in the cloud and became like a big
46:11
issue for identity people because I did see this trend
46:15
coming in a lot of cases and didn't prepare for it and said,
46:18
I'm going to continue doing what I'm doing.
46:21
And then this thing came along and became half of the
46:24
enterprise. The next thing you can see
46:26
coming is AI. Like if you're not thinking
46:31
through these problems and seeing where the industry's
46:32
going, it's going to sneak up on you.
46:36
So for me, like it's it's almost like I'm destroying my own
46:40
question. I don't think there is a way to
46:42
future prove it. But what kind of tips do you
46:44
have for your fellow practitioners in terms of
46:47
building a program that doesn't get blindsided?
46:50
Yeah, that's really hard. I mean, that's finding the
46:53
balance between managing your technical debt, which is, you
46:57
know, those passwords that you're, those accounts that you
46:59
don't know who owns the passwords aren't rotated, you
47:01
know, the, the large attack surface and being able to do, to
47:04
do the new technology. Because yes, if we're, you know,
47:06
a company and you're not looking at AI right now, you're probably
47:09
going to get left behind. But at the same time, if you're
47:11
not also investing and cleaning up and managing the life cycle
47:14
and, and reducing the technical debt, then by the time you're
47:17
ready to implement AI, are you going to be able to, because it
47:20
doesn't have the data it needs to do its job or, or different
47:22
things like that? Somebody, Jim, it's going to be
47:24
hard, but I think we try to have to, you know, make a balanced
47:27
approach and try to do both. Well, no one always said
47:30
identity and access manager was easy.
47:31
That's why we've all been doing it for decades at this point.
47:35
So I want to kind of wrap up the conversation here.
47:37
I and I have a professional Segway I talked to earlier about
47:40
climbing the mountain to 1,000,000 downloads.
47:44
And so I want to come down that mountain on a mountain bike.
47:47
I know that you are a mountain biker.
47:49
I have never been, but I live in an area where it's very popular,
47:51
Asheville, NC area. So lots of trails, lots of stuff
47:55
to do that. I think the last time I rode a
47:58
bike was probably 10 years ago. So I could probably test out
48:04
that, you know, that theory that you never forget how to ride a
48:07
bike, and that would probably be pretty ridiculous.
48:08
But how often? I mean, I know you're a mountain
48:11
bike. How often do you go?
48:12
Tell me about this. And for a newbie like me, how do
48:15
I get started? Sure.
48:18
Well, I see mountain biking as kind of a metaphor to life.
48:22
You're, you feel like you're going uphill most of the time
48:27
and it's hard and it's a slog and sometimes you don't feel
48:30
like you're ever going to get there.
48:31
But then you get to the flat where even better the downhill
48:35
and you just get into this flow state and you're just having the
48:37
time of your life. And so that's, that's one of the
48:40
things I love about mountain biking, but even more is
48:43
teaching youth mountain biking. My son who's 15, he mountain
48:46
bikes. My daughter who's 11, she
48:48
mountain bikes and she just did a race and got third place up in
48:52
Vermont this past weekend. And it's just, it really brings
48:56
a tear to my eye to watch these little kids doing just that,
49:00
climbing up these hills, sometimes having to get off
49:02
their bike and pushed up the hill, but doing it because they
49:05
want to, doing it because they know they'll they'll make it up
49:08
and doing it because it's fun. And and I want to instill that,
49:12
you know, that kind of thing in in the kids lives.
49:14
And so so I'm passionate about that.
49:16
But how do you get into it? Yeah, I think Jeff, just hop on
49:18
that bike, find some easy trails and I can I can send you some
49:21
some links to to those. But yeah, start on the road and
49:24
just really have a good time. I'll tell you the E bikes they
49:27
make these days are pretty awesome.
49:29
I haven't tried 1 yet, but I think they make mountain biking
49:32
more accessible to anybody who wants to try it.
49:35
And it definitely makes going uphill even easier.
49:38
So that's that's the life I want to live where it's like I'm I'm
49:41
on AE bike all the time and and going up hills no problem.
49:44
OK, so you stole my next question because I was going to
49:46
ask if using an E bike is cheating because then I'm then
49:49
I'm all in. If I can use an E bike.
49:50
That sounds a little more recreational, you know, for me
49:54
is there. OK so let's say I want to get an
49:56
E bike. Like how much easier is it to
49:59
use an E bike versus like a normal bike?
50:01
Yeah. Is it I think still easier?
50:03
Yeah. It's, I think the, the great
50:05
thing is the technology's pretty good.
50:06
So it doesn't feel that much different in terms of just the,
50:09
the riding dynamics because they're still pretty light.
50:11
Yeah, maybe they weigh, you know, an extra £20, but that's
50:14
not going to make too much of a difference.
50:15
So the riding experience is going to be about the same.
50:18
But it's, it's really the going at pills and maybe if you're
50:20
riding with a group trying to keep up that that's where, where
50:23
it really helps. And I think it's worth it,
50:25
especially if you're you're new or you really want to to try
50:28
right out. I I love the idea of E bikes.
50:30
I have to imagine they're probably split out as a separate
50:33
like class of bike or something. When you're doing races right,
50:37
it's E bikes only versus no E bikes.
50:39
Yes, they do. They do.
50:41
And those those E bikes go pretty quick.
50:43
They they shave a few minutes off every lap.
50:44
I was just looking at that for that for the recent race.
50:47
I was like, oh, how much faster did they go than me?
50:49
They went a lot faster. I can absolutely do that because
50:51
I was in Amsterdam over the summer break for while we were
50:54
at EICI spent the week there and there were bikes plenty, which I
50:58
thought was very cool. And then I, and then there was a
51:00
few people on E bikes and boy, were they moving on some of
51:03
those streets and some of the park pass that that we were kind
51:05
of traversing and it seemed a lot easier to me.
51:08
And so I was kind of a fan of that.
51:09
I think so I have actually thought about getting an E bike
51:12
because I, I, I do enjoy biking. I just don't have like the, I
51:18
don't know the, the, the, the gumption to get out there and,
51:22
you know, get my Huffy Sigma out, which is the, you know, the
51:25
bike that I grew up on with electron sort of, you know,
51:27
covers, you know, stuff like that.
51:30
But E bikes interest me, Jim. Have you ever have you ever
51:33
ridden on an E bike, Jim? Never on an E bike, no.
51:36
I mean that is about the speed that I'm at now though.
51:41
I used to trail run and everybody's like, who has not
51:46
into running is like, why would you do that to yourself?
51:49
But what they don't realize is once you get into a level of
51:52
fitness where it doesn't hurt, your heart's not pumping out of
51:56
your chest. You're, you know, maybe you're
51:58
breathing heavy, but you're used to it.
51:59
So it's not that bad. It's a great way to, you know,
52:05
it's, it's almost like like meditating while you're running.
52:10
But I was going to say I did give mountain biking a chance
52:14
when I was like college age and I really liked it.
52:17
But here's my tip for anybody. If you think you can go to
52:20
Walmart and buy what looks like a mountain bike for $99.00 and
52:25
ride that, you're going to be sorry.
52:28
And here's what I mean. So I had one of those bikes
52:31
since I won, I didn't have any money and I wanted to do this
52:34
thing. And so there was like a flight
52:37
of steps that it's obviously not in the mountain, but it was on
52:41
the campus and I rode down the flight of steps and it bent my
52:45
rims and became like Oval shaped.
52:48
And I'm like, what the heck is going on here?
52:51
So now I can see why somebody would pay $400.00 per rim
52:56
because if you don't, the last thing you want to do is like go
53:00
up all the way up the mountain, start going down and then you
53:03
can't ride down. You got to carry your bike out.
53:05
And I had a friend who said, and she said if you ain't hiking,
53:10
you ain't biking. So that was when Anthony was
53:14
talking about carrying that bike out.
53:15
And that's what I was thinking with the E bike.
53:18
I'm wondering, are those things like 10 times heavier than a
53:22
regular mountain bike? It's not too bad.
53:25
They're not too bad. OK.
53:26
So maybe you can carry those? Yeah, if you need to, but
53:29
they'll they'll push you up just about any, any angle that's not
53:32
and the heavy. Part is what?
53:33
The battery probably, right? Yeah.
53:34
Is the battery the heavest part? Yep, OK, I I.
53:39
I've toyed with it. I have to explore it.
53:40
I think it's super interesting. I've thought about, well, maybe
53:43
E bike. Well, I don't just get like a,
53:45
you know, electric motorcycle or something like that, which is
53:48
probably the next step. Jim, I know you used to have a
53:50
bike. Do you sell a bike?
53:52
Motorcycle, No. I sold it when I moved because I
53:54
did want to move it across country.
53:56
But Denise has a Harley and I'm going to get something.
54:00
It won't be a Harley, it'll probably be an Indian.
54:03
I think there's a really sharp looking or I might get something
54:06
custom or something electric. I really haven't decided yet.
54:10
I would be very impressed if you got an electric bike.
54:12
That would frankly shock me, but I think it would be super cool.
54:16
I think it would be cool, Yeah. No, I mean, why not?
54:19
I mean, I drive electric cars and they're super fast and super
54:21
quick and I that's what I like about them.
54:23
I can't imagine an electric motorcycle I would instantly be
54:26
in the hospital just by looking at it.
54:28
I bought electric dirt bikes for my kids when they were real
54:31
little and they used to just zoom around the house.
54:34
And the thing was, they're cheap and they broke all the times.
54:38
But that wasn't because they were electric.
54:40
That was because they're cheap. OK, well, shout out to any E
54:44
bike makers. If you want to sponsor an
54:45
episode, come on, we'll make an exception for Yeah, for for non
54:49
identity sponsors and stuff like that.
54:50
I'll, I'll, I'll take an E bike. That's fine.
54:53
Absolutely. All right, Anthony, it's been a
54:55
great catching up with you again.
54:57
It was great meeting you at Identifer.
54:58
Say hello to your wife and hopefully she's got this new
55:00
school year probably coming up here in the next few weeks, if
55:03
she doesn't start already. Yeah.
55:05
And hopefully we'll see you at some of these conferences coming
55:07
up and we'll see you in the ID pro channels and I'm sure
55:10
Identity Underground and all that kind of stuff.
55:11
But yeah, thank you for spending time with us.
55:14
I'll have you get our show notes for your LinkedIn profile so
55:18
people can reach out and either ping you with IM questions or
55:21
mountain biking or whatever. Yeah.
55:24
No, to my earlier point, I really want to support the
55:26
community. So please reach out if there's
55:28
anything you think I can help out with.
55:29
I, I want to help. So, so, so reach out and also
55:32
shout out to my, my team. A lot of the stuff that I talked
55:35
about, they're the ones who are in the trenches doing the work
55:38
and have all the ideas that kind of got us to where, where we had
55:42
the last six years. I just want to say thanks to
55:43
them and all their hard work because they're they're doing
55:45
the hard part. I am heroes left and right all
55:48
over the place. But the one thing I will caution
55:51
is heroism is not a strategy. I had a call last night with
55:54
some folks. Heroism is great, but it is not
55:57
a strategy. So shout out to all that I am
55:59
heroes out there, you know, with the sheer force of will making
56:01
their organizations work. So with that, we'll go and close
56:04
out for this week. Find us on the web,
56:06
idacpodcast.com. Congrats, Jim, to you and me for
56:09
a million downloads. Here's to the next million.
56:12
Like subscribe, share with a friend, share with an enemy.
56:15
I don't care as long as people are liking and subscribing,
56:17
that's all matters. And we'll go ahead and leave it
56:19
for this week. Thanks everyone for watching and
56:22
or listening and we'll talk with you all in the next one.
56:26
You've been listening to Identity at the Center.
56:30
We hope you've enjoyed the show. Make sure to like, rate and
56:34
review, and we'll be back soon. But in the meantime, hit the
56:38
website at identity@thecenter.com.
56:42
See you next time on Identity at the Center.