Latest / Identity at the Center / #156 - IAM in M&A

Transcript

#156 - IAM in M&A · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity at the
0:25
center podcast I'm Jeff and that's Jim.
0:27
Hey Jim hey, Jeff, how are you? Oh, not so bad yourself.
0:30
I'm doing pretty good. So crazy week of business
0:34
travel. Of course, right.
0:37
Prior to going on, all those trips, I put a contract in on a
0:43
house, right? So made a purchase offer was
0:46
accepted. And when I was looking at the
0:49
house, I asked the question doesn't have high speed
0:53
internet. The answer was yes.
0:55
Yeah, no problem. I looked around.
0:57
I mean the the house had TVs had no satellite dishes but now that
1:01
I've looked into it further, it appears there's there's no
1:06
connectivity from fiber perspective like eighteen.
1:10
T Xfinity doesn't run all the way to the house.
1:14
So I'm kind of thinking right now that Broadband is not going
1:17
to be available. The more I looked into satellite
1:22
internet, it doesn't look like Good option unless you're with
1:25
starlink, which is the Elon Musk satellite internet.
1:30
And actually, I talked to somebody this weekend.
1:32
Jeremiah, if you're listening, thank you.
1:35
That has started link instead, it's fantastic.
1:38
You can do video calls on, it loves it, but it's not like you
1:43
just order it and it shows up in your on it, especially, you
1:47
know, kind of in the Southeastern us.
1:52
So I might I have to actually have to cancel the contract
1:56
which would really stink. That's killer.
1:58
When you find a nice house like that, I totally emphasis M and
2:03
precise and agree because, you know, I just moved as well and
2:07
that was like a deal breaker for me, like we told the realtor
2:10
Mike has to have high speed internet.
2:11
Like I'm not, I'm not willing to compromise on that, there are
2:14
things I will but high speed during it was one needs to be,
2:18
you know, gig speed. Preferably and fortunately, the
2:21
place we have here is good and I do have Speed.
2:24
But I mean if this we're talking 2022 this should be a service
2:29
that is like a no brainer and certainly certain homes haven't
2:34
been able to keep up with that for any number of reasons,
2:36
right? Could it's probably not the
2:37
homeowners fault, it's more like, just the, the Broadband
2:40
infrastructure has a kind of reached that point of
2:42
saturation. Yeah, saturation yet, the
2:44
Starling captions pretty interesting, though.
2:46
I think the, the issue that I've had with satellite internet over
2:49
the years has been the latency which isn't great for Obviously
2:54
gaming, but voice conversations and video calls and obviously
2:59
the stuff that you and I do for the podcast, relies on that
3:02
quite a bit. I'd be interested to see how the
3:04
starlink option works. I know that it's maybe a little
3:08
bit expensive, but if that's the only option that is tenable
3:12
then, who knows. Maybe it's maybe, it's the right
3:14
way to go. I don't know.
3:16
I mean, you know what's what's more important is it that the
3:20
high-speed internet or is it, is it the house or Well, I mean,
3:24
the high-speed internet is how I make my money, so I can't afford
3:27
to live in the house without high speed internet.
3:29
So it's it's kind of a catch-22. The funny thing is, I mean, it's
3:34
not like this house is in the, you know, the middle of nowhere.
3:38
It's apparently a Teensy fiber and Comcast run to within a
3:44
couple hundred yards of the driveway right.
3:47
There they go. Down that street, they only run
3:49
into as far as somebody who's on the street orders.
3:53
It has to Connected into their house.
3:55
But can you imagine calling either one either?
3:57
One of those companies 18z or Comcast and trying to explain it
4:01
to a level one support engineer that you need somebody to come
4:05
out and extend the service to your house.
4:07
So, you know, being that I don't even have the house and can't
4:11
even place the order yet, right? I don't know.
4:17
It might just be too expensive of a risk to take and the
4:21
startling sounds like it'll be available.
4:23
See, I kind of feel like you're talking to Jeremiah with his
4:28
experience, like if I could get starlink, I think I would take
4:34
the risk that that's going to work but, you know, it doesn't
4:39
even sound like that's an option until next year.
4:42
Maybe not. I found a Reddit topic, we're
4:45
about a year ago. People that aren't that far from
4:49
this new address actually got star like but it seems Like
4:53
everybody who got it. Never went on to post on how
4:57
good it was. So it's like, yeah.
5:00
It got my, I got my confirmation.
5:02
That my dish is on the way and that was it.
5:05
That was the end of the conversation.
5:06
But I mean, we look with what we do and we're not the only ones
5:10
we work from home, you have to have high speed internet, it's
5:14
got to be reliable. Well, maybe I said something
5:16
that if you're listening out there, if you're a star link,
5:21
have somebody with starlink experience, you know, pink.
5:23
My LinkedIn, I'm sure more data points would probably help them
5:27
out and look at the website right now.
5:28
It says that you get latency as low as 20 milliseconds, which is
5:32
pretty good. Actually, you know, I don't it's
5:37
marketing. So who knows, right?
5:38
As low as 20 sounds great. What is the realistic you know,
5:44
measurement will be much more interesting?
5:47
Well, I think if you're under 50 to 100, you're probably ok but
5:51
past that you might have some struggles.
5:53
But who knows? I don't know if you have
5:55
starlink experience in the real world ping Jim.
5:58
I'm sure you know, good or bad, he would appreciate it.
6:01
Yeah, I would and I know people don't tune into a Denny's, the
6:06
center podcast, he ever met all my problems.
6:08
But imagine this also is that the folks in the house.
6:11
Now tell me that they have a, and t, and t DSL, which doesn't
6:16
sound good enough, right? But it's worth investigating.
6:20
When I called AT&T, they said, sorry, we can't read dies, That
6:24
address. So somebody's lying.
6:28
Yeah, there are other houses out there, I guess.
6:32
But yeah, first world problem but of extreme importance for
6:36
you and I based on kind of what we do for a living.
6:38
So for sure. Absolutely What else we got
6:41
going on? We got Gartner coming up in
6:43
August's you and I are going to be there, we're going to be
6:46
there. We're going to be podcasting,
6:49
the more of our listeners who can link up with us because we'd
6:54
love to get people on to spend 5 10 minutes with us.
6:58
Just telling us about you know, what sessions they've been to
7:01
what was their favor session. What would their big takeaways?
7:04
I think if we can compile a few of those things into you know
7:08
some episodes be great In we haven't figured out our whole
7:12
strategy but, you know, based on the authenticate conference that
7:18
I ditched you for, because I had covid.
7:20
So I didn't really I will never let you live it down.
7:22
Never let me live it down covid or not you know you you had an
7:26
episode per day and I'd love to match that if possible.
7:31
Yeah, it's a lot of work but I think we could kind of cool.
7:33
I'm I'm still trying to work out where we will do the podcasting.
7:37
We've got a lead on a spot that's like one level up.
7:40
But there's conversations between like Gartner and Caesars
7:44
and approvals and also their stuff.
7:45
So hopefully we get that kind of sorted out sooner rather than
7:48
later. But, you know, my thought was
7:50
like, yeah, let's let's talk to folks, we're going to be out
7:51
there and if you want to be on the show, great, we can work it
7:54
out. Even if you just kind of want to
7:55
watch the magic happen as boring as it might be, you know, maybe
8:01
even being in the room while we record with others.
8:02
You know, I think that's certainly an opportunity as well
8:04
but at the very least you know, give us the opportunity to kind
8:06
of give a fist bump of thanks, that people are going to be out
8:09
there, listening or who are listening We're going to be at
8:11
Gartner. We're always happy to meet up
8:14
and kind of have conversations and stuff like that.
8:17
I think that would be really cool and this is the first time,
8:20
you know, Jim and I will be at the same conference and multiple
8:23
years and I have been on the road pretty much all week this
8:26
week. Saw each other for the first
8:28
time on Monday last Monday in over two years which was, you
8:33
know, a little bit surreal. But yeah, here we are, you know,
8:37
we video like every week we visited every week for the The
8:40
last two years so it wasn't like oh that's a big surprise what
8:45
you look like now. But yeah it was it was
8:49
definitely weird. It was my first business trip in
8:51
over two years. Well, that's back baby.
8:54
We're all over the place now. So I guess good times we were
8:59
having some conversations this week to that about some some
9:02
cool stuff that we're working on that.
9:04
Not ready to announce yet but stay tuned for latest year.
9:07
We'll keep some mystery around it but the calm Two things like
9:11
that. One of the conversations was,
9:12
we're kind of talking about the podcasts folks and well,
9:16
Clinton. If you're listening I'm going to
9:18
steal this because like, you know, how you guys come up with
9:20
ideas and we kind of explained our process, which sometimes
9:23
it's plans, sometimes, it's not, here we are.
9:26
We've been on the road all week, I've had chances chance to sit
9:28
down, and it's Saturday, July 23rd, and we're recording this.
9:33
And I'm going to have to get it, edited and ready to go and
9:35
publish for early Monday morning.
9:37
So that's sort of like the process of the magic comes.
9:40
Behind it. But you know, a lot of the times
9:43
we pull topics from, is what happens to us, sort of in the
9:46
real world. As we're having conversations,
9:49
you know, with either colleagues or clients or analysts, whoever
9:53
it may be. And the conversation that we
9:56
were having earlier, this week was really kind of around like
9:58
this. This idea of a hub-and-spoke
10:01
model and I got think Jim thinking about mergers and
10:05
Acquisitions. I think that's we're going to
10:07
take the conversation today is talk about sort of I am in the
10:12
MMA space, mergers, and acquisition space.
10:14
But yeah, before you go any further, this would be a good
10:17
point to insert the an audio clip from the Seinfeld show
10:23
where George is saying it's a show about nothing.
10:27
You see this is going to be a topic right here.
10:30
It's about nothing rocket about nothing.
10:32
For you talk about mergers and Acquisitions and thing and
10:35
challenges and opportunities in the identity space, that those
10:40
might present. Aunt.
10:41
But yes. Yeah I think in the spirit of
10:45
Seinfeld, I don't want to get a copyright strike but just
10:47
imagine you know the show about nothing but instead were about
10:52
identity, nothing. I don't know if that makes sense
10:53
or not. Yeah, I get it.
10:56
Everyone gets it. All right, let's talk about
10:59
mergers and Acquisitions. I guess the way that you and I
11:02
were kind of thinking about this was sort of like talk about
11:04
maybe some of the challenges that first and maybe some of the
11:06
opportunities and I know what divestitures is a thing out
11:10
there as well. We'll probably kind of weave
11:12
that towards the end, but maybe from just, let's just talk ma
11:15
for right now. I guess, what are some of the
11:18
things that you think about formica challenge perspective,
11:20
that folks who were in the identity space living in the
11:24
trenches, in the real world should probably start to think
11:28
about or at least consider if they're about to go through some
11:32
sort of m&a activity? Yeah, I mean, while I think that
11:37
the Mna activity kind of needs further Mission.
11:41
Right? Because there could be the M
11:43
which is mergers and it could be kind of a merger of equals re.
11:47
So a big bank is joining with another big bank or whatever
11:51
industry, but you've kind of got to organizations that are
11:57
roughly the same size or have roughly the same Sway.
12:01
And you've got to kind of like Stitch those two together,
12:05
whereas on the Acquisitions, that I think of a bigger fish,
12:08
consuming of smaller fish, In other words, a big company
12:13
buying out a smaller company. In this smaller company is going
12:15
to plug into, you know, how things are done at the bigger
12:20
company. I also kind of feel like
12:25
especially in that second scenario is if your company's
12:29
done a lot of pre-planning or requires companies all the time,
12:34
you prop, you really should kind of start to have a strategy for
12:39
how you fit. It in an acquired company,
12:42
right? So there's the policies and
12:44
standards and all the things that you're going to adopt and
12:46
that we have a strategy for how we handle, you know, active
12:51
directory or single sign on things like that.
12:55
So I think that that definition really is a good starting point,
13:00
merger, I think, is it definitely has its challenges.
13:05
It also has presents a lot of opportunities as well, because
13:08
potentially the company, Merging with brings as much good stuff
13:15
to the table as your organization, or maybe more.
13:18
Yeah, I guess, from a. So, let's the mergers and
13:21
acquisition definition is flexible, because you could be
13:26
on either side and of those in any capacity, right?
13:29
If you're doing a merger, Chances are you know
13:33
organization probably the same size.
13:35
There might not be a bigger fish or maybe there is a bigger fish,
13:37
right? Who's going to be in charge, is
13:38
one of the things that I think about is, okay, to organizations
13:41
of equal stature and capability, right?
13:45
Who becomes the dominant personality from an identity
13:49
perspective, when it comes through that merger in the case
13:53
of an acquisition, if you are acquiring someone else, chances
13:57
are, you're probably going to, you know, impose your Any
14:01
practice that processes and Technologies onto whoever it is
14:06
that you're requiring. Conversely if you are being
14:09
acquired you might have the opposite, right?
14:13
The acquiring organization May impose certain things upon your
14:17
your identity stack, whether it's process or technology that
14:21
need to be accounted for now. Doesn't always hold true, right?
14:25
It may be that your company's acquiring technology or
14:30
acquiring another knee because of the success of that
14:34
technology or processes and you might be able to impose some of
14:38
the better processes and things that come along.
14:40
So I think it's important to not just look at this and like in a
14:43
black-and-white way and say okay we are buying you so therefore
14:48
you are going to do it the way that we tell you to do it that
14:51
certainly can be the case but does not always the case.
14:54
So I think if you've got a good identity program of whether
14:58
you're the acquiree or the acquirer Um, there is the
15:02
opportunity to kind of extend that maturity into the
15:06
organization either up or down from there.
15:08
I think some of the other challenges I think about too is
15:10
like, you know, you've got different it systems that are
15:14
going to be out there. So you think about it, okay.
15:17
You know, the the the competition of single sign-on of
15:22
MFA of the different directories, you know, who's
15:26
going to, how we're going to handle those things, are they
15:27
going to be Consolidated or they get a kept separate?
15:30
You know, I think the idea Allstate is a lot of folks like
15:32
okay well you know, we're going to be one big happy family with
15:35
one giant SSO, 11 MFA solution and one directory and then the
15:40
real world hits and you realize oh you know here we are five
15:44
years later and we have 48 active directory domains because
15:47
we never Winters observe you know consolidation or you may
15:50
know Jim you and I we could have seen that you know multiple
15:53
times over the years and there was never like any steps to sort
15:56
of like think about this strategically.
15:58
It was we've just gotta make it work.
16:00
So okay. Slap the domain in there, we'll
16:03
just create a forest and set up the trust and we're done.
16:06
We wash. You kind of like move on to the
16:08
next thing. So those are some of the things
16:10
I think about as well. Any thoughts on what?
16:12
I just touched on? Yeah, yeah, I actually was
16:15
thinking about, you know, what we're really talking about is
16:18
like the full on integration of the acquired company.
16:24
And I think one thing that kind of has to be laid out is that
16:28
it's not going to happen overnight.
16:29
There's not going to be a flipping of the switch and the
16:32
company's fully integrated. So there probably are steps
16:35
along the way. Usually it starts with things
16:38
like the email system. Let's get the email system, it
16:42
see everybody under one email system.
16:45
Federation is usually an I am solution that has put into place
16:50
so that people can, you know, authenticate and and reach
16:55
corporate applications of the acquiring company.
16:58
Sometimes people are just moved over at the A swollen of you can
17:03
just migrate the users over into, you know, a new active
17:06
directory, or new single sign-on system and, you know, get rid of
17:10
some of the old it systems. But that in my experience is
17:15
usually the scenario where a much bigger company requires a
17:18
much smaller company and it's like resources are thrown Outta
17:21
to make all the old it systems of the acquired company, just go
17:26
away. But in a scenario where that
17:29
acquired company has it Systems that are going to come over and
17:34
continue to be used. Now, you've got a different set
17:38
of. I am challenges in other words,
17:40
how did, what's the transition state then once the final State
17:43
and into something that you were talking about, is what we've
17:46
seen so many times with clients that we've worked with where
17:50
they get so far with the integration and then they move
17:53
on to other things. It's like somebody just kind of
17:56
gave up on it or there wasn't the executive push and I That's
18:02
that's kind of one of the things I've learned through the ma and
18:06
divestiture activity that I've been involved with is that
18:10
trying to drive integration of it and infosec.
18:17
And I am from a Grassroots level, is, is almost assure
18:21
loser, especially when it gets to Major Integrations, like,
18:25
hey, we the acquired company has their own active directory.
18:28
So, let's say that the acquired A company is like a third of the
18:32
size of the acquirer so it's not a small company.
18:35
It's you know, say hundreds or thousands of users and there's
18:39
an active directory and applications integrated into act
18:42
active directory. You're going to have a hard time
18:45
if you are the active directory, team of the acquirer to convince
18:51
the active directory, team of the acquiree, to give up their
18:56
control and move everything into a central active directory.
18:59
However, if from like a sea, Yo level, you've got the support to
19:05
miss support the direction and and the mandate to get down to
19:09
one active directory, you got to make it happen.
19:12
Everybody's had a March of that tune or, you know, they might
19:16
not be happy here anymore, but ultimately, I think that, you
19:20
know, if the mindset is, we're going to build a better
19:23
mousetrap in my experience. That's a loser.
19:27
You know, you've got to do more than build a better mousetrap,
19:30
you've got to have The Mandate? Yeah degree.
19:33
I think you know, we talked about sort of like treating, a
19:39
technology implementation is like an opportunity to do
19:43
process re-engineering, and I kind of see the same thing
19:46
around mergers and Acquisitions is sometimes it's the right
19:52
time. I do it.
19:52
Sometimes it's not, if you have a modern mature identity
19:58
program, You know, the the inclusion of just another Target
20:02
or another system, to manage, generally should fall in line
20:06
with whatever the program is already established for like a
20:09
standard integration pattern perspective.
20:12
For example, it's it's more complicated but it should fall
20:17
into that same thing. What I think typically happens
20:20
though is most I am programs are not that mature and so they're
20:24
left scrambling and trying to figure out.
20:26
Okay well how are we going to get you know this new population
20:28
in? So our system are they going to
20:30
go into the EHR platform? If they are, is there any
20:34
automation that is going to be used to sort of create new
20:37
accounts, for those individuals coming in?
20:41
You know, how is, how are people going to get access to the
20:44
ticketing system to submit requests, right?
20:46
How are we going to get them? Their IDs and passwords.
20:49
My experience is has been, it's a pretty manual process where
20:53
there are spreadsheets of IDs and passwords that get kind of
20:56
passed around and sent to some coordinator.
20:59
Of the of the activity, right to get off to managers and things
21:02
like that. But it's not great and trying to
21:07
design it at the same time, you're doing the acquisition.
21:10
I feel is a losing proposition as well.
21:12
Yeah, you know, one other thought as you were talking it
21:15
got me got me thinking about was the reason why companies go out
21:23
and acquire other companies and perform mergers is that They
21:29
think that the money that's being made by the acquired
21:32
company, we can make more money. They were to leverage what we
21:36
have. So it's leverage our, it
21:39
systems, leverage all of our back-office, maybe leverage our
21:42
manufacturing capabilities, leverage, our sales force,
21:46
things like that. And so the idea is that, you
21:50
know, we want to acquire this, the company what they're good
21:54
at, but we want to leverage what we have because we think it's
21:58
can make it Much better company when I think about that mindset
22:05
and I think about running a back office.
22:07
Not just the back office. But hey, let's say we start
22:10
manufacturing these goods and different facilities and things
22:13
like that. The idea of identity management,
22:16
it kind of like goes all the way back to identity management.
22:19
Like if you can't even log in and get from system to system,
22:23
or you keep running into access denied because their systems
22:26
aren't fully integrated Or else not even use the term
22:30
integrated. But like, the vision should be
22:32
that we're kind of getting to just one set of systems for the
22:36
company. If you, if you can't get the, I
22:39
am stuff straightened out. Everything else is going to
22:43
suffer. And so I kind of feel like, you
22:46
know, from a technology leader perspective, getting that, I am
22:51
P straightened out as just of the utmost importance and it
22:54
again, if you kind of leave that to a Grassroots effort, to say,
22:59
alright, well, we don't want to rock the boat and force and make
23:04
people who are over here, feel like, oh no, big brother's
23:07
coming in and forcing me. So I'm just going to go from a
23:10
Grassroots perspective. My active directory.
23:13
Ministers work out. I'm telling you from what I've
23:16
seen, it'll never happen. Yeah.
23:18
I think the intention is that you know, in every go through
23:20
sort of this process of a merger acquisition it's to make the
23:23
experience is good for everybody involved.
23:27
I don't know anybody who likes to try to have a process where
23:30
it just doesn't work, but that's just the way it is.
23:32
The process of merging identities is always a challenge
23:39
too, because sometimes you'll come across these situations.
23:41
Where, you know, people might have an account in one
23:44
organization and the organization is acquiring them.
23:49
They may have an account there as well.
23:50
So trying to kind of pull those together is a challenge.
23:54
I've seen it before to where people are not necessarily
23:59
loaded into directory systems, it might be kind of treated as
24:02
like one-offs and they live sort of like in this transitive State
24:07
between directories or between HR platforms, whatever it may
24:10
be. So I think that's another thing.
24:11
And people kind of consider is as you're going through this
24:14
process, right? You might have like, on your
24:16
side and identity and access management platform that is used
24:19
to receiving identity data from an HR platform, like a work day
24:25
or an oracle. Sure there's tons of them out
24:29
there, right? How is your system going to
24:32
respond when that data is not available or can't be used for
24:37
whatever reason? How are you going to provision?
24:39
Those accounts is always a question and the same.
24:41
Thing is, if there is a termination, how are you going
24:44
to make sure, you know this kind of touching on the divestiture
24:47
topic that we'll talk about as well.
24:48
But how do you make sure that acts as unwind into has been a
24:51
challenge? This is where I typically see
24:53
those spreadsheets get passed around which stinks and nobody
24:57
likes that. So I think if the system is
25:00
designed in a way that again from a program perspective is
25:04
okay, it's just another Target. Another population to manage
25:07
insert them here and you've got sort of like this manual hook
25:11
up. For when that RV, you know,
25:14
comes along to the campground, kind of them, be more Transit.
25:17
I think it makes more sense. So, when you're designing your I
25:20
am platform, especially when it comes to things like identity,
25:24
governance, and the axis engine side of things is making sure
25:28
that you've got not only a happy path, right?
25:30
Here's your identity source of truth, but here's the manual, /
25:35
may be unhappy path. Of how are we going to handle
25:37
folks? Who don't fit into that?
25:39
Into that bucket? What your thoughts?
25:41
Yeah. Yeah.
25:42
I mean I'm sitting here thinking, probably the first
25:44
time you do, this is going to be the hardest sale on the
25:47
acquisition track. And I was thinking about the
25:50
merger track where a merger of equals and you know, I was
25:55
thinking about. Okay, so we have say to
25:57
companies with 10,000 employees each?
26:01
You know we talked about kind of it happens, iteration.
26:04
So in other words you put together enough Plumbing so that
26:08
you can kind of work together but that's not the vision of You
26:12
know, how you achieve the, The Leverage you get from take going
26:19
from two companies to one company.
26:20
It's by a full-on, you know, melding of all this back office.
26:25
And I think about things like, you know what, if you're using
26:29
the same SAS applications like Salesforce or even something, as
26:34
simple as concur. Now I go to concurred it's
26:38
asking me to login, like which one do I use?
26:41
So you can imagine in like the cloud brings on all these new
26:44
directories and how you get to those and how you authenticate
26:49
to them and how you're being provision to them.
26:52
All those things need to be taken into account.
26:55
As I think if we just think about it from the traditional
26:59
directory perspective of an active directory, that's
27:03
complicated enough. When you started thinking about
27:05
organizational units and and policies, and You know, all the
27:12
things that go with ad and merging those together over
27:15
them, when you take all of these Cloud applications that have
27:19
their own directories, and the fact that organizations could be
27:23
the merged organizations could be using the same application.
27:27
So it requires a extensive planning of requires that the
27:31
merge companies work together to kind of, you know, come up with
27:37
the strategy for this, this merger, so that end users don't.
27:41
Don't get stuck in the land of total confusion.
27:45
But, you know, the other thing I was thinking about is like,
27:47
imagine a scenario where two companies merge, they're both
27:50
using Office 365, they both are using in tune and they're
27:55
managing those end devices on in tune with be it, you know,
28:01
laptops are more likely mobile phones.
28:05
Imagine that they also have, you know, non-employee users in
28:10
their core directories Like Partners which to your point,
28:14
you could be leveraging the same partner, so they might not be an
28:18
employee user. Normally a person wouldn't be an
28:20
employee of both organizations but certainly a third party
28:24
could have accounts on both sides and that could actually
28:28
absolutely be confusing but I think you know you have to with
28:34
all that complexity at all that you have to kind of dial it back
28:37
into parts that you can control and try to isolate.
28:41
Eight the areas where you can merge where it makes sense and
28:45
try to minimize the impact Downstream.
28:48
And then, you know, you go after some of these more complex Parts
28:51
as late in the process as you can, I think it's probably a
28:56
good spot where we can pivot and stop talking about all the
28:58
problems and maybe stuck start talking about.
29:02
So I things that are actually benefits right?
29:05
Or potential benefits, or opportunities, whatever way we
29:08
want to kind of spin it around. Okay, so we know we've got all
29:11
these issues. What are some of the positive
29:14
things that could come out of a merger?
29:16
Organs action acquisition from an identity for Sperry, right?
29:19
Yeah, I mean, that's that's great because I am an optimist,
29:22
believe it or not are like to think Of myself as an optimist.
29:26
You know what I think of you know say were the acquiring
29:31
company or the more senior organization in the merger
29:35
however you want to put that or even if your equals the idea
29:39
that the other company could have a better process, a better
29:46
mousetrap for some Mass effective.
29:49
I am so you've been on you know, adfs for Forever.
29:55
Right? And you haven't been able to get
29:57
the investment to move to a cloud base and say the company
30:01
that you're merging with has OCTA, that's not perfect
30:06
opportunity to you know, upgrade your technical footprint and
30:11
hopefully you're all so you know going to be bringing you on a
30:15
team of people who are expert in that technology.
30:17
So that's a great opportunity right there.
30:20
What are your thoughts? Yeah, I think anytime that you
30:23
can grow from Expertise standpoint is great.
30:27
I think that's certainly in, on a win.
30:30
If you if you are able to get additional technologies, that
30:33
may be either you couldn't afford or just didn't get
30:36
approved or whatever, maybe from from an acquisition.
30:38
I think that's great too. I think a lot of times companies
30:42
who are doing acquiring tend to be more mature anyway, from a
30:46
information security and from add any perspective.
30:48
So there may be an opportunity to solve some Legacy challenges
30:52
that you might have had. If or being acquired, for
30:55
example and say, hey, okay well this company has you know, X
30:58
technology. We we didn't have that.
31:00
But now we do, how were we going to take advantage of that sort
31:04
of thing to be able to, you know, deliver, better services
31:07
to the organization? You know, for my identity
31:09
standpoint, probably an opportunity to take advantage
31:12
of, you know, if there are, if there are better processes, it
31:16
can also be used as an excuse to make it to make changes to the
31:20
environment. Say, okay, hey, you know what?
31:22
Well, we're going to those Acquisitions.
31:23
So because of that, That we're going to have to do X and
31:26
sometimes, you know, that that sort of kick in the pants is is
31:30
all you need to change mindsets or at least get the the momentum
31:34
or the drive to maybe make things more standard or more
31:37
consistent through processes. So I think you can kind of get
31:41
creative sometimes around. You know how you want to kind of
31:43
Leverage that change from at any perspective and a merger or
31:47
exact acquisition or Eve or a divestiture is a seismic event
31:52
in the organization and it can certainly cover, you know, a lot
31:56
of things that need to take place either from a people, a
32:00
process, or a technology standpoint.
32:01
The seismic event often comes with a special budget.
32:05
So there might be an opportunity to invest in an area where you
32:10
have an invested before you even take it to that very fundamental
32:13
level. A lot of organizations, even
32:16
mature organizations, don't have a mature.
32:21
I am program or I am strategy. so it might be an opportunity to
32:26
reset around that, especially if you've gone through an
32:29
acquisition and you can say, alright now let's do a
32:32
post-mortem on it and you start to say boy we could have
32:35
probably done this better had we had a shot at she around how to
32:40
handle an acquisition or merger so movie we bring in some help
32:45
to help us plan around that and then to your point, you know,
32:49
usually even very mature organizations, have some areas
32:54
that Could be improved whether it's, you know, they can have a
32:57
better process or better technology for access management
33:01
or something on the provisioning and you know, role management
33:06
side or privileged access management side.
33:08
So the scope is large enough that you know, you can take take
33:14
advantage of the opportunity to have an acquisition budget.
33:18
Potentially get some things done.
33:19
Yeah, for sure. I mean, don't overlook that
33:21
budget. I think we've seen it.
33:23
Yeah, the last few years is like This thing called digital
33:25
transformation. And we've seen a lot of identity
33:27
programs, sort of, get better, and sort of use.
33:31
Some of the funding, that might be available that to transform
33:34
the organization, whether it's like, internal Workforce or
33:36
maybe some sort of customer-facing thing.
33:38
But I think this is another another cover to get some, some
33:41
money into the. I am program that may be of use
33:45
and be able to kind of move things forward with that.
33:48
We've been hinting on sort of divestitures the whole time in.
33:52
I think probably now is a good time to kind of Think about that
33:55
as well is what are some of the things from a divestiture
33:57
standpoint? Because for every, you know, I
34:00
feel like merger and acquisition that's out there.
34:03
There is also the opposite that takes place where some part of
34:06
the organization or company is being spun out or wound down, or
34:10
whatever it might look like. And there are certainly
34:13
challenges around that because those are not typically like a
34:15
normal run-of-the-mill separation or termination,
34:19
right. Those sort of thing.
34:20
What are some of the things that you think about from a
34:22
divestiture standpoint before we move on to Investors.
34:25
Can I bring up one other area? I guess around these challenges
34:29
and opportunities because they think these two are the two
34:33
things we're going to bring up our both potential challenges
34:37
and opportunities. So, the opportunities arise
34:40
around people. Potentially, you're acquiring a
34:43
company with talent and you can add that talent to your team.
34:49
The challenge is potentially those folks.
34:52
Don't realize that they're, you know, you're thinking about them
34:55
in that way of, hey, there's there's going to be a new home
34:58
for me and I'm going to be happier than I was before.
35:02
So the challenge becomes You need to get in front of those
35:05
people and let them know that there's a place for them and
35:08
that you picture them in your future.
35:11
So people's one, the other I was thinking of there's like so many
35:14
more of our of clients that I interact with are moving to this
35:21
manage operations, or MSP or mssp model where they've
35:27
outsourced. The day-to-day run activities of
35:30
their info SEC and I am groups, maybe all of Mighty.
35:34
So, you're potentially in a merger scenario or acquisition
35:39
scenario, you've got two different msps.
35:44
Obviously, that could be a challenge like, you know, do you
35:47
move forward with both of them in place?
35:50
Do you move forward and kick one of them out?
35:53
You know, but it's also an opportunity right if one
35:56
organization has been unhappy with their managed service
35:59
provider. I mean, that's how I see that
36:02
you know, quite frankly Quite a lot.
36:05
So if one organization is very happy, the other organization is
36:10
unhappy, I mean, there's a potential opportunity where
36:14
potentially lower your costs overall, for managing it and you
36:18
could improve your service on at least one of the one end of it.
36:22
You know, either the acquirer the acquiree, you know, going
36:26
back to real quick before you get back to dusters around
36:28
people and making sure people are under, you know, Part of the
36:34
plan and understood but communicating that to the
36:37
employee is a very important part because it's certainly, you
36:41
know, if you're thinking about is like, okay, well shoot, we're
36:43
getting bought or we're selling something off, like what does it
36:46
have to do with me? Right?
36:48
What am I going to? What does this mean for me, from
36:50
a employment, standpoint this good or bad?
36:54
And the sooner you can share, you know?
36:56
News, hopefully it's good news. The better you will be off
36:59
because then, you know, people are aware of Of what's going on
37:04
where they're going to fit into the new organization or how
37:05
that's going to work, etc. You know, one of my mantras is
37:09
never wait to share good news with people because I've seen a
37:12
lot of times where, you know, that uncertainty, you know,
37:15
leads to something that you wish hadn't hadn't happened, all
37:20
because you decided to wait, because you were trying to
37:22
coordinate something else or maybe share, good news, you know
37:26
as soon as you can. I think that's a good mantra for
37:28
me, at least. Yeah.
37:29
You and I were both recently involved with being in that.
37:33
Position, right? And I don't think when you say
37:36
people think we'll, how does this affect me?
37:38
There's nothing wrong with the person for thinking that, right?
37:42
I mean that's, you know, any normalize what you should be
37:46
doing, it's normal. And so I think going into a
37:50
situation like that, if you're in management, you should be
37:52
thinking before going to be thinking that and get out ahead
37:56
of it. Yeah.
37:57
For the people that you really value their, you'd be really
38:00
disappointed. If you found out, they were
38:02
leaving You know, right around the time of the, you know,
38:06
acquisition taking place. Yeah, it's difficult time for
38:09
sure. So try to make sure if it's the
38:11
same page and again bring people to especially the folks that are
38:15
considered strategically organization is make sure
38:18
they're aware of what's going on.
38:19
Make sure they understand what their role will be and try to
38:21
share as much as you can. So, alright, let's get back to
38:25
divestitures. What are things to think about?
38:29
Because I think about this idea of like a carve-out, For
38:33
example, a lot of organizations are good at putting things
38:36
together, not necessarily good at breaking them apart and
38:39
that's one of things immediately jumps to mind but I'm sure
38:41
you've got other thoughts on that.
38:42
You know, I think that you're right on.
38:44
So I've been a part of divestitures in the past and you
38:48
know, typically what I saw was that when you divested company
38:54
included in that sale is some set of it systems and the folks
38:59
required to support those, it system.
39:02
So You know, it could be one of your networking people.
39:06
It could be you know one of your I am people, but essentially
39:10
you're going to have to, you know, give that acquiring
39:13
company, the it systems to run the business, right?
39:16
They're not just buying the factory and none of the
39:19
computers and it systems that go with it.
39:21
So the accounting system all that.
39:24
So you, you know, as much if you're in the business of,
39:28
you're going to divest a few companies.
39:31
Obviously, if you have that strategy and And as you're
39:34
developing systems, you can develop them in that way.
39:37
Each business maybe does have its own active directory domain.
39:40
So then you just kind of break the trust and give them their
39:44
active directory and all goes well rather than having
39:48
everybody merged into, you know, one OCTA instance, maybe you're
39:53
in a hub-and-spoke model and they get their spoke or the data
39:56
is kind of already segmented. That is ideal.
40:00
One of the other things that came to mind.
40:02
There is just That you know, well, typically you're going to
40:05
have to divest some of your team as well.
40:08
So, you know, if you're not completely decentralized, which
40:14
would be great, but usually not the case.
40:15
You're going to have to, you know, take some of your folks
40:18
from your corporate it and info SEC staff and give them over to
40:23
the new company. Those people may know shared
40:27
passwords and they may know, you know, things that.
40:31
Well, at least let's just stick to Passwords for a second.
40:34
If somebody who shared passwords service accounts or shared
40:38
passwords for routers and things like that, those passwords need
40:43
to be changed. So I think, you know, step one
40:46
is trying to figure out anybody that your divest thing.
40:49
What are the passwords that they know that you need to change?
40:54
It doesn't really sound that much different in that context
40:57
of like a normal separation, right?
40:58
Shouldn't you always be removing access for people who have left
41:02
the organization or Road into a new, you know, position that
41:05
doesn't need access to things. I know we see the struggle of
41:08
time with a privileged access management especially shared
41:11
accounts rotating passwords. You know not everyone is
41:14
fortunate to have you know a tool that will automate automate
41:17
that rotation of the secrets password Vault something of like
41:21
privileged access agent tools like you know psychotic or the
41:24
Linea. Now Beyond trust cyber-ark,
41:27
those sorts of things and they're left sort of like in
41:30
this manual state where it's like okay well shoot Jim knew
41:33
all these Counts. I'm gonna have to go off and
41:35
change all these and hopefully we get them all.
41:39
It seems to be, you know, one of the, one of the strategies I
41:42
know that you and I don't like building strategies based on
41:44
hope. So how do we, you know, validate
41:47
that that stuff is taking place. But you know even now with like
41:51
Cloud security, and the obfuscation sometimes of some of
41:55
the identity permissions that go with things like AWS gcp Azure
42:00
to lesser degrees of the measures a little little more
42:03
straightforward. For the adgroups.
42:04
But, you know, how are people getting access to some of these
42:09
Cloud infrastructure as a service or platforms, as a
42:11
service, whatever it may be understanding how the
42:14
permissions are working, how to counter for is a big part of it,
42:17
too. Because we've certainly seen in
42:19
the mood, in the news. The last few few years of people
42:22
having access to, for example, S3 buckets, that probably
42:26
shouldn't have had access to Beyond, you know, they're,
42:30
they're, they're stay with the organization.
42:32
It's no different for me. Least from a divestiture
42:34
standpoint was like, okay, it is a termination and the goal is to
42:39
make sure that the axis is removed in a timely manner to
42:44
whatever systems will not Remain the challenge.
42:47
Is there, sometimes this transitive state where a person
42:50
might be in both roles, how do you make sure that access is
42:54
appropriate? And if there are things, we've
42:56
been carved out or separated. How do you make sure that the
42:59
right permissions, remove wrong, permissions, go away.
43:02
You know, those sorts of Things. So I think it's a complicated
43:05
scenario for sure, but if I try to keep it for my feeble brain,
43:10
as simple as I can, that makes it easier for me.
43:12
Yeah, well, takes a lot of planning.
43:14
It takes also having detective controls so that you can keep a
43:19
watch on what's Happening. I think what you mentioned there
43:24
in terms of like all the the cloud reach Beyond kind of just
43:31
what's happening on your network makes It harder to control,
43:35
makes it more complex, and I think that's why organizations
43:39
constantly find themselves falling behind is that the, the
43:43
world of it is changing so fast. It's, you know, new services are
43:47
coming online and it makes it harder to manage, then you throw
43:51
a divestiture on top of it. So, yeah, again kind of the
43:57
divestiture and MMA stuff, really just has a You know,
44:04
Major Impact in terms of complexity challenges, but I
44:07
think on the on the flip side, it's opportunities as well.
44:10
And if you you know if you get it right potentially you can
44:15
grow your business exponentially and that the acquisition like
44:18
we're talking about why the business is to the Acquisitions.
44:21
It's because they believe that take this company, that's making
44:25
a million dollars, a year, put it on our system and maybe it
44:28
can make ten million dollars a year because of the kindness of
44:31
their heart. The idea Is this?
44:34
Yeah, they don't want to make that examinees is to make more
44:36
money so it's just it's just the way business is.
44:39
I think for my dining perspective is kind of start to
44:41
wrap things up, is try to keep it simple as much as you can.
44:45
These are complex situations, but if you try to break it down
44:50
from an identity perspective, we're still talking the same
44:53
Concepts who has access to what and is that appropriate.
44:58
So boarding off-boarding the changes, those are still the
45:02
same type of life cycle. Well, events that are probably
45:05
taking place, you know, throughout the challenge here is
45:08
that it's a new organization, they may or may not have a easy
45:12
path in and there may be some options that need to be
45:16
triggered to be able to support sort of that that move over or
45:20
move out whatever that looks like.
45:21
So again I try to keep things as simple as possible and try to,
45:25
you know, the life and the world was already complex.
45:28
We don't try to make it complex, even more complex.
45:31
Just just for know, A reason doesn't make any sense to me.
45:34
So, again, try to keep it simple as kind of a things and,
45:37
hopefully, that that makes makes things go smoother As you move
45:40
through this process. Yeah, that's great advice.
45:43
All right, so we should start to wrap things up, but you and I
45:46
have been on the road. I've been on the road for two
45:48
straight weeks, which is great times.
45:51
And you've been on the road I think for the first time in a
45:53
while for all week with, you know with me I got me and you
45:58
thinking about some of the trips that we've taken in the past and
46:02
you had a good one that I thought would We'd bring to cut
46:04
kind of white here. Is what was your first
46:06
international business trip and you could stories around it.
46:10
Yeah, good sir. And and the reason we picked
46:12
International talk about is that I did have a first domestic trip
46:17
but it was pretty uneventful. My first international trip was
46:21
to Frankfurt, Germany. And on, during the landing,
46:27
there is a little kid sitting in the row behind me, and he
46:31
started crying and Not sure why I was crying but then I found
46:35
out pretty quickly because he vomited over the seat on the guy
46:40
next to me and there's splashed on me.
46:43
So, I mean gross before I was pretty fortunate that I wasn't
46:48
like I didn't bear the brunt of it but the guy next to me got
46:52
God blasted. And I mean even if you get one
46:55
drop of vomit on you, it's really bad.
47:00
Now I heard the appropriate number of drops is 0.
47:03
In case you're wondering. Yes.
47:06
Yeah if you're doing if you're playing at home but yeah it was
47:11
pretty bad. Someone had mentioned to me
47:13
early in my travel days like try to be as empathetic to the
47:20
people around you as possible and traveling because nobody's
47:23
having your time and you know like I didn't take this as an
47:26
opportunity to blow up. Now, the guy next to me was
47:29
furious and I think probably if I get blessed with Like you did.
47:34
I probably would have been Furious too but I tried to take
47:37
it in stride as much as possible.
47:38
The mother whose with the kid was almost in tears.
47:42
I mean, she felt horrible about it.
47:45
But I mean that was my very first trip.
47:47
So lend in Germany got vomited on, went directly to the
47:51
bathroom. Took off my shirt wash, it
47:54
didn't put it back on and put something else on.
47:58
But yeah, I'll never forget that one.
48:01
How about you? Yeah, I'll bet that's it.
48:03
That's It's a not a great way to start.
48:05
I guess, I guess that's one way to stamp a passport.
48:08
I would just rather ink instead. Yeah, yeah.
48:11
And you know, it wasn't, it wasn't a bad trip but I had not
48:16
dealt with that kind of jet lag before.
48:20
So, six hours difference and I'd be laying there at night, after
48:24
working all day, and being exhausted and just staring at
48:28
the ceiling because I my body wouldn't adjust.
48:31
And then when I got home and there's only six hours, But you
48:34
know is my first first time experiencing that it was the
48:38
same way. I think my first trip was to
48:41
India going from Chicago to India, which was a nineteen and
48:45
a half hour. I think total travel time
48:48
between airports to get there. I had a good trip.
48:53
I mean, as far as, you know, experiences go is my first
48:57
international business trip, you know, it was a long trip, that's
49:03
for sure. Sure.
49:03
But the actual experience was great and you know was there on
49:06
business with the partner that we were working with and going
49:10
through a scenario that we had just talked about and, you know,
49:14
the, the experience was great. I got a chance to sort of open
49:17
my eyes to other cultures and kind of see how other folks
49:22
around the world lived. And I think that was, you know,
49:25
a sign of an Awakening moment, you know, having lived in my
49:28
bubble in the Chicago area for a number of years.
49:31
At that point, not really having that exposure You know, shout
49:35
out to the folks that I was with making sure that spicy food was
49:39
kept to a minimum protecting me from hopefully making any too
49:43
many stupid American mistakes in a foreign country but just being
49:48
able to kite, go meet the other folks you know, I got to see
49:51
mahabalipuram and the shore Temple and a bunch of stuff in
49:55
the Chennai area of India. It was very hot which as you
49:59
know is My Kryptonite hot and humid not A great combination
50:04
for me but the actual trip itself was so positive.
50:08
It was, it was a good experience for me, certainly long from a
50:10
travel perspective but I'm glad I went and certainly was a good
50:16
experience. Like I said and you get vomited
50:18
on. No, I def, I did not.
50:20
It was a, it was a, it was a good trip.
50:22
No, no vomit vomit. Free trip.
50:25
Wow. This is so weird.
50:27
So unusual, right? Yeah, I hopefully that's a no.
50:31
I mean, hopefully that's the uh, normal.
50:33
Strictest, you're not gonna say it.
50:36
Only happened to me once it just happens to be my first trip.
50:38
It was a scarring incident. What can you say?
50:41
You can. All right, let's go ahead and
50:42
wrap up because we were starting to ramble a little bit.
50:45
It is definitely a Saturday. I got to turn this around to a
50:47
show for Monday, so we'll go ahead and leave it there, you
50:51
know, I think, you know, as we kind of think about this Ma and
50:54
identity perspective and we talked, I feel like we spent
50:57
more time on sort of like the challenges.
51:00
But as I'm sitting here thinking about the conversation, a lot of
51:03
the challenges are things that you're probably already dealing
51:06
with already. It's just not in the context,
51:09
maybe of a merger or an acquisition or a divestiture,
51:13
but it's still again that same concept of onboarding
51:15
off-boarding changes right to Identity, the system's being
51:19
available, right? How are they going to be
51:21
utilized with any memorization? So, hopefully, hopefully this
51:24
conversation made sense and if you've got comments around it,
51:27
you know, certainly paying us on LinkedIn.
51:28
We're happy to Tell it tell us, we're crazy.
51:31
Tell us like, yeah, you know War stories about it.
51:33
We're always happy about that maybe even better maybe.
51:35
Come on the show and kind of talk through some of the
51:38
challenges. Maybe you face in the real world
51:39
wrong with HEPA to have folks in the real world come on.
51:42
But any final thoughts before we close it up for this week?
51:45
Jim. Yeah.
51:46
Just thinking exactly what you said about the, you know, adding
51:50
your comment to LinkedIn. Every Monday noon eastern time
51:53
in the u.s. Jeff post a post on LinkedIn to
51:57
let everyone knows that the episodes out.
52:00
Out adding a comment there would certainly be welcome and then of
52:05
course feel free to direct message us on LinkedIn
52:08
especially if you're going to Gartner and we have that
52:11
opportunity to to meet. We'd love to interact in person.
52:16
Yeah, definitely. If you're going to Gartner, we
52:18
will be there. We hope to see folks there as
52:19
well. We put on our golden podcast
52:23
pants just like everyone else. We'd be happy to do fist bumps,
52:26
you know, if you want to watch a show getting recorded, you know,
52:28
that's, that's certainly an option or beyond the No, hit us
52:31
up on LinkedIn. We're happy to accommodate that
52:33
as best as we can. So all right with that, we'll go
52:36
ahead and leave it there for this week.
52:38
We're on the web. I'd any at the center.com we're
52:40
on Twitter at idac podcast and we've enjoyed this conversation
52:45
and hopefully you did as well and we'll talk with everyone in
52:49
the next. Thanks for listening to the
52:55
identity at the center podcast. If you like what you heard,
52:57
don't forget to subscribe and visit us on the web and identity
53:01
at the center.com.