Latest / Identity at the Center / #157 - Chris asks IDAC…

Transcript

#157 - Chris asks IDAC… · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:28
center podcast. I'm Jeff been that's Jim.
0:30
Hey Jim hey Jeff, how are you? Oh not so bad yourself.
0:34
I'm good. I'm good.
0:35
I'm not going to complain about the heat wave I live in Georgia
0:39
and it's hot for like four months straight.
0:43
So to me I know a lot of the folks I'm talking to you from
0:46
around the country are like oh my God, it's so hot but to me
0:50
it's like it's just another day of hot.
0:54
It's I'm in. Now, the mountains of Western
0:56
North Carolina, it's not quite as hot which is kind of nice
0:58
still, humid, but surviving. I think, yeah, the heat wave has
1:03
been like all over the world. Basically, you know, like
1:05
England head if shoes. I think it was last week or
1:07
maybe was earlier this week. I don't times flying at this
1:10
point. Yeah, right.
1:12
Yeah, the big thing I've been working on this week, is kind of
1:15
coming up with a conference plan for the group that I'm in.
1:20
And really, you know, No, obviously you've got the
1:26
opportunities, like Business Development opportunities that
1:30
come from conferences than top of that.
1:33
Of course there's the training aspect, you know, go there and
1:37
receive training and I think the third thing that doesn't get
1:41
enough attention is that it's really like a reward, almost
1:46
like a retention kind of aspect to conferences.
1:50
Like if you bring folks to conferences or Let folks go to
1:54
conferences, they see it. As, you know, they're being
1:57
rewarded or they're being recognized as somebody who's
2:00
worthy of being invested in. What do you think?
2:04
I think, I feel like we talked about this, a few weeks back.
2:07
Generally, I want to agree with you.
2:09
There are some people who don't like going to conferences and
2:11
might see it as a punishment. So I could see it as a two-sided
2:15
coin. I think it just depends on the
2:17
individual. And you know, why are you going
2:19
there? I think my attendance at Fences
2:23
has changed over the years, it used to be for learning now it's
2:26
less. So, it's more networking and,
2:29
you know, business development and sort of things like that.
2:32
I kind of wish it was, you know, more Focus sometimes on the
2:35
learning side. But you get so busy at these
2:36
conferences, going from one meeting to a next to another
2:40
that there's I'm always personally finding less and less
2:42
time to actually kind of sit down and actually listen and
2:45
enjoy the content live. I don't have to catch it after
2:47
the fact. So I mean during the pandemic we
2:51
were attending conferences. Virtually I I did that myself.
2:56
You know what I found was, a lot of times I couldn't stay focused
3:01
on the conference the entire day.
3:02
So you know, especially knowing that sessions would be available
3:06
for later viewing. I felt like the training and
3:10
learning side of it was enhanced because you can really focus on
3:14
it but that everything else was not nearly as good.
3:20
Yeah, that's for sure. I mean the hallway conversations
3:23
just, you know, seeing people and faces and voices that you
3:27
recognize that that whole stuff. Definitely spare time, it's
3:30
back. I was at RSA earlier this year
3:34
miss the Denver's because it was moving and then we're gonna be
3:37
at Gartner in a few weeks. So I'm looking forward to that
3:40
as well but it's back man would just sort of like this is we're
3:46
just going to move forward now unless something happens this
3:48
kind of move things backwards but I don't see that happening.
3:51
No, I don't think so. Yeah.
3:54
So as you mentioned, we're heading out to the Gartner
3:57
conference and hoping to up our podcast game, a little bit.
4:02
What are your thoughts are? I think, yes.
4:05
Upping, the game will be a challenge as usual, but we're
4:08
starting from zero. So anything is an improvement.
4:12
We are actually still looking for a place to record.
4:14
While we're out there, we actually tried to go the Gartner
4:17
route, and that was not successful in finding a spot
4:20
that we could set up camp at. So if there's any friends of the
4:23
show out there that have like a breakout room or something
4:26
that's convenient within the conference based in Las Vegas,
4:29
Reach Out. We'd love to figure out how we,
4:31
maybe we could share some of that space with you at least for
4:34
Time because we are definitely looking to do some podcasting
4:37
and get some guests. And maybe even hopefully, if we
4:40
can get enough people, you know, one, two or three, people that
4:43
want to watch how the sausage is made so to speak, that's
4:46
certainly an option as well. But as of right now, I feel like
4:48
it's going to be you and me holding these little
4:50
microphones. And a costing people in
4:52
hallways, are trying to find like little cubby holes that we
4:55
can do things in, I guess we could try to look for like a
4:58
sweet or something like that at Caesars but that's nowhere near
5:01
as convenience. That's kind of like a fallback
5:03
plan right now. So hey Hey, we'd like a show.
5:05
We want you to walk half an hour across this casino up into this
5:09
sweet and then, you know, spend an hour there or 45 minutes, or
5:12
15 minutes, whatever it is, and then walk another half hour back
5:14
to work back to the show. It's just not the same.
5:17
So, blending options and then again, we can't really record at
5:21
the roulette table or Starbucks or anything like that.
5:26
Yeah, there's some rules about recording and public spaces, and
5:29
things like that. I wasn't even thinking about
5:31
that. I just remember thinking about
5:33
your thinking, always annoys you Oh, trust me.
5:35
I was thinking about it too. But yeah, so if you're if you're
5:37
a friend of the show or not even a friend of the show but you
5:39
have a lead on some some breakout space that might be in
5:42
the conference area or even something similar, you know,
5:46
reach out to us on LinkedIn, would be happy to discuss and
5:49
figure out if there's an option here that we can do something
5:52
together to make event to take advantage of it.
5:54
Yeah, that's Gartner. I think we're also looking at
5:59
Octane coming up in the future which is a November.
6:02
So yeah, we're sort of Of getting our our conference
6:06
circuit, you know, back on the back on track, after a couple of
6:09
years here of Hiatus. Yeah, never actually been to
6:12
Octane. I think it was supposed to go to
6:15
it. The first year of the pandemic,
6:18
so, obviously that didn't happen, but it should be a
6:22
fantastic conference. And again, you know, hopefully,
6:26
we can set new records in terms of, you know, putting the
6:30
podcasts out with a great frequency, maybe five.
6:34
Six episodes in a week and I'm just putting in some crazy ideas
6:39
on my plate. It's basically work on your
6:41
plate, but hey, the scheduling side is now so easy.
6:45
Yeah, that's true. Especially I don't know if
6:47
you've seen your calendar early lately but it's a disaster.
6:52
Well, everybody knows, right. Just just because you're
6:54
traveling or you're taking time off or whatever.
6:57
It may be, the work doesn't disappear.
6:59
It just shifts from one area of your calendar to another.
7:02
So yeah, my calendar was crazy earlier this week.
7:05
It's today's been a little bit lighter.
7:07
So it would kind of be able to catch up on some things.
7:08
But yeah, availability is always a challenge in this crazy world,
7:13
but why don't we get to our topic?
7:17
Because I actually kind of interested in several of the
7:21
things we're going to talk about today.
7:22
So actually, this entire show is basically formed her on one,
7:26
tweet from an individual named Chris power who tweeted us few
7:31
days back with a bunch of topic suggestions.
7:34
We're kind of going to go through somewhat of a surgery as
7:37
you kind of put it as your kind of preparing here for the show
7:40
to kind of dissect. At least what we think some of
7:43
the questions were that he tweeted out or she I mean I
7:46
guess I'm not sure no, it's okay.
7:49
Is it okay what we think the intent is behind the question
7:55
kind of work through that. So yeah, Chris Hildebrand sweet
8:00
and Chris the defense Twitter limits us to 140 characters And
8:04
he wanted to ask like ten questions in one tweet and so,
8:10
yeah, he's just better, Twitter's money's worth for sure
8:13
on this tweet. I think we it is like six or
8:15
seven questions in here that will try to address, but why we
8:18
just dive right into it. So Chris if you're listening,
8:20
this one's for you. Hopefully others get value out
8:23
of it too. If you do have questions,
8:25
definitely tweet about us. We will try to build build an
8:28
episode around it or weed them into other episodes that were
8:30
working through but here we go. Alright, so topic suggestions
8:34
Extracts management more or less job roles, how to build admin
8:39
intelligence or IAI managing audit expectations, provisioning
8:43
outside of sale point in parentheses, third-party apps,
8:47
validating extracts, and you say she's got more if wanted.
8:50
All right. Well, let's start with the first
8:51
one. Let's talk through manual.
8:54
Extracts Management's. First of all, what do you think
8:56
he's referring to with that statement?
8:59
Well, just judging on the Tweeter overall I think.
9:04
This might be a set point user. Right?
9:07
And so guessing I'm guessing. Yeah, so I'm kind of thinking of
9:12
it from a sales Point architecture perspective,
9:15
there's multiple ways to integrate with applications, and
9:19
one way is kind of the quote-unquote, disconnected
9:22
application. And so in that disconnected
9:25
application, you could work simply with like file feeds to,
9:32
you know, or file extract. To take them into cell point and
9:37
build, you know, the data for the access catalog or for an
9:43
access recertification. So, you know, I've always
9:48
referred to this as the least common denominator integration.
9:51
So, in other words, just like there's no reason you can't
9:56
integrate into cell point from your application, even if it's
9:59
like, the legacy of the Legacy, you should be able to Sport a
10:05
flat file comment. Eliminator tabbed Eliminator or
10:09
what have you and so what I think Chris is getting at here
10:14
is like, how do you put a whole framework or process around
10:18
that? And to me it kind of starts off
10:21
with kind of trying to put some rules to the road in terms of
10:25
what the format of that file should be when it should be
10:28
uploaded, where should be uploaded things like that.
10:33
Ideally Um there's not an opportunity for humans to touch
10:37
the file so in other words the files being created on the
10:42
system. So say we're talking about a
10:44
Mainframe and as being, you know, somehow FTP or transfer to
10:49
your file share. So, a lot of times what I've
10:52
seen corporations do is they'll set up a SharePoint or OneDrive
10:57
and have files put on that one drive.
11:00
Now, typically what I've seen is that a human being like, pulls
11:03
the file, And moves it but you know the more often you're doing
11:07
that the more likely it is that you're going to create some
11:11
automation around it. So I would say just keep that in
11:15
your back pocket that if even if you're doing just quarterly at
11:19
two stations or even annual attestations try to ramp up the
11:23
frequency of that upload so that you start to drive the idea of
11:29
automation of getting those files uploaded but a lot of
11:31
times this is where you're starting to get into.
11:35
The wild west of your it environment and you're just
11:38
happy to have something. So again it's kind of like
11:40
setting up the policy for what does that track should be like
11:44
how they get uploaded things like that.
11:47
And then I think the other thing that a lot of times what you
11:51
need is like some kind of translation of the file, like,
11:54
what is it, what are these columns that are in the file?
11:57
What do they signify in the application?
12:00
Because ultimately, you're going to design a campaign around the,
12:04
the you Data that's that's in those files.
12:08
Yeah, I like that analogy of the Wild West because I feel like
12:10
it's is like the frontier. You're building an outpost,
12:13
you're not sure what's going to come in the door.
12:15
So I think your I agree with you.
12:18
I think this is probably talking about those, those disconnected
12:21
systems, so to speak that are not using like a formal
12:24
connector right to like, read the data directly.
12:27
I think part of the question that he also asked later is,
12:29
that is like, validation of extracts, you talked about, you
12:33
know what? What Asian of the file or file
12:35
type is a coming in CSV some other version.
12:40
What are the expected data attributes?
12:43
And values? Is it Boolean?
12:45
Is it a string? You know what, kind of string it
12:47
may be like those sorts of things.
12:49
I think this is where coordination with whoever is
12:52
extracting that data, you're working with them to make sure
12:55
that you're getting the data back in a, in a format, that is
12:59
parsable. I think this is also an area
13:02
where, yeah, I think his story Clearly, it would be done
13:05
manually where someone will pick up the file from a SharePoint or
13:08
OneDrive or any other file share and then run like an import
13:12
into, for example, your IJ tool, let's call sale point in this
13:15
case because I think that's what we're talking about here, I see
13:18
more RPA. Now, robotic process Opera
13:21
automation, taking up a lot of the stuff and doing some of that
13:26
work for you. So there might be some
13:28
opportunities to say, okay, well, you talked about like this
13:32
integration pattern like the the lowest Common denominators,
13:35
refer to was okay. Well, at least let's just get an
13:37
extract of data so we can make our IG a platform at least aware
13:42
of what's out there. Can't really do anything with
13:43
it, but at least it's aware of it, right?
13:46
And if you can leverage some sort of our PA to ingest that
13:50
for you automatically, if you can't do it, you know, through
13:53
the platform itself, then that might be sort of a another is
13:58
there, a lower lower lower list, common denominator, to, to
14:02
automate that. So that steps but I think that's
14:05
you're really kind of looking again at that that Wild West.
14:08
It's like you're not sure what's coming.
14:09
If you're if that's all you have left from like an integration
14:12
standpoint, you're probably doing pretty well like from a
14:14
sales point perspective which is call it or any IGA perspective
14:17
is if you're look if like you're down to just systems that there
14:21
are not connectors for that's that's a problem that I think a
14:25
lot of people would love to have because that means they probably
14:28
moved pretty far down the maturity scale and gotten a lot
14:31
of their, you know, bigger, maybe more well-known
14:33
applications, that do have connections.
14:34
Actors, you know, set up, I guess the alternative could be.
14:38
You've got some sort of like, group that just for whatever
14:41
reason, doesn't want to play ball, you know, be part of the I
14:43
am program and be part of the, the, the, the IGA platform,
14:47
whatever it looks like. It's probably more of a
14:49
political battle, but that's kind of what I'm thinking from
14:53
that perspective. Yeah.
14:55
That that last point that you brought up is something in my
14:59
experience of working with cell Point Architects, almost every
15:03
time. I was in like you know advisory
15:07
roles like we are not doing flat file Imports, there are such a
15:12
pain in the butt and I think that's getting to the part of
15:15
the question where Chris asked about validation.
15:17
Like, imagine a comma-separated value where you have the
15:21
person's name and it's comma, MD, or comma p h key or
15:25
something like that. They'll like perk the file and
15:27
now you have to figure out like what's causing the file to break
15:31
and you're trying to imply automate this process what-if.
15:34
You have 100 applications that are doing this and what if
15:37
you're getting these extracts on a regular basis?
15:39
Now I'm sure somebody sitting out there saying well then you
15:43
know, through parentheses or not parentheses, but quotes around
15:47
all the data or something like that.
15:49
And I'm I'm sure somebody's got like a best practice.
15:53
But if you can find a way to break it, somebody's out there,
15:56
breaking it. I guess what I was also thinking
16:01
is, you know, where these can be valuable Is on the big selling
16:06
point of having an IGA system is building.
16:10
Truly a Depot of one place to go to know who has access to what
16:16
and that's, you know, when you use that statements like to who
16:20
has access to what it means, everything like, what's all the
16:23
access they have? If you're in a big Enterprise,
16:25
with thousands of applications? That's a lot of applications,
16:30
right? And so if you get one place to
16:33
go to know who has Access to our top 125 applications.
16:38
That's not really as compelling as well as access to all of our
16:42
data writer. All of our data that is of some
16:45
relevance and so there's got to be some velocity in terms of you
16:51
know when you implement one of these systems getting all of
16:54
your your applications integrated and so you know flat
16:59
files while I don't like them either.
17:01
To me it's better if you could you know.
17:04
Just set up a connector to hit a relational database and pull the
17:10
data from the database. Because I think that the point
17:13
then is that you run into much fewer these errors.
17:17
But if that's not available or to the point that you're making
17:21
because this I've been seeing as long as I've been in I as
17:24
actually, as long as I've been in it, there's some people who
17:27
just don't want to play nice. They just don't want to be
17:30
bothered by what you're doing, because their job is way too
17:33
important. They can't have you screwing
17:36
around with their system, but if you just need a file dumped on
17:40
an FTP site, yeah, we can do that.
17:43
Sometimes that file is sort of like the first step you might do
17:47
that initially with the goal of eventually using a connector or
17:52
maybe that maybe that system gets deprecated or is no longer
17:54
strategic, the organization goes away but not the ideal way that
17:59
I would look at the creation I think, you know, at that point
18:03
maybe the question is, is the juice worth the squeeze?
18:06
Is it something you really want to spend time on or are there
18:08
other things that maybe provide more value?
18:10
That could be another way to look at it too.
18:11
So Let's move on to the next one.
18:15
It is more or less job roles. I certainly have an opinion on
18:20
this one. What do you think?
18:22
Jim now I think what we decided beforehand was that we're going
18:26
to go every other one. So now it's your turn to go
18:28
first. So, let's see what that opinion
18:30
that I get to. I get to leverage some of your
18:33
answer. All right.
18:35
I like to keep things simple. So I'm more of a fan of less job
18:39
roles, at least to start with, I prefer more of an attribute
18:43
based approach to and having more roles.
18:47
But more consistent roles, what I mean by that, is taking a few
18:50
attributes from like your authoritative Source.
18:52
I'm an employee in North Carolina, I'm all set.
18:56
Chicago Old Habits, will die and employee in North Carolina and I
19:00
work in information security. Those three attributes might
19:05
drive three different roles that.
19:07
Give me what I need, if I change, maybe I am an employee.
19:11
Who moves back to Chicago? But I still stayed information
19:14
security. Two of those attributes.
19:16
Stay the same and maybe that third attribute that was
19:18
controlling other axis change as well.
19:20
So I prefer less job roles themselves.
19:23
They feel like they're pretty volatile and it's a lot of work
19:26
to keep them up to date, especially the coordination that
19:30
needs to go along with what happens if you have shared job
19:33
titles between different groups and analysts.
19:36
And one group might be different than analysts and other support
19:39
support, you know, whatever it may be and the coordination.
19:43
The you To also have with whoever is the owner of the
19:46
authoritative Source. Typically, like HR or maybe
19:49
Finance, if maybe its contractors, are not employees
19:51
involved, right? Things like that.
19:53
So I'd rather keep things simple at least to start again.
19:56
I think this is another area where I go out of organizations
19:59
say they want to be you know, fully role-based, you know,
20:02
Access Control in place and it's really hard to do especially if
20:06
you don't have good data and good tools to actually make it
20:09
happen. All right, your turn.
20:12
Okay, I'm going to generally agree with you, fewers better.
20:16
I'm going to in a put a spin on it, which is that, you know,
20:21
I've been involved with kind of building an are back from the
20:26
ground up. And so to me this is my opinion.
20:31
I think that there's so many folks out there who have
20:34
experience with roles and have a different perspective.
20:36
But to me, it's you want to start out with What can we Grant
20:41
access to automatically? So when we onboard somebody, can
20:46
we create the Ada account? Can we put them in the right
20:48
groups based on attributes in their, you know, their identity
20:54
data authoritative file. So, for employees and be an HR
20:58
System or for a non-employee, it might be some other system, but
21:03
if there's data attributes are or even if you're creating them
21:06
in your IGA system, but identifying those at You see, he
21:11
off of like, they're in Chicago, so they have access to the
21:15
Chicago lunch menu. And, you know, that's our silly
21:18
example. We always point to, but the idea
21:21
being that, you know, there you can onboard somebody, give them
21:25
email accounts. Give them, you know, VPN, I'm
21:30
sorry. Were you were you wanted to say
21:32
something? Okay, now, I was just clapping
21:35
at the lunch menu, example, just We also use it all the time but
21:40
yeah, I know. I want to say for the record.
21:42
I Am pro watch. Yeah, yeah.
21:46
Everybody should have lunch so All right.
21:50
I think that's the starting point.
21:51
I think then on top of it, you know, one of my other major
21:56
rules drivers is that the business has to own the roles.
22:02
They have to get behind the roles that doesn't mean they
22:04
have to create them in a silo or create some of that it's-- help,
22:08
but they can't be so disconnected from the process
22:12
that they don't have any skin in the game and so that's where I
22:16
start to dial it back to, you know, Identifying somebody in
22:22
the business, in a business departments, a finance or say
22:25
HR, who understands enough about technology be dangerous or is
22:30
involved with the provisioning of users that they work with
22:35
your, it rolls administrator, your IGA rolls administrator to
22:39
design the roles and then I think, the area where you start
22:44
is where you have people who basically do the same thing.
22:48
So if you have something like A call center or you have
22:52
something like you know, people who do nursing now.
22:56
All nurses, don't do the same job as I've learned from working
22:59
with Healthcare clients but they have a lot of the same
23:02
responsibilities you need access to the same system.
23:04
So there may be a baseline nursing role and then based on
23:09
the type of nurse they are, it can Branch off from there.
23:12
But even if you, you know, if you take that 80/20 perspective,
23:17
that was the other thing I was going to say is I think you need
23:19
to take a detour. Any perspective like rolls isn't
23:22
going to get you to 100% automation of access assignment
23:27
at least. I've never seen anywhere come
23:28
even close to 100%. So if you kind of come to a
23:31
point where you're saying, we're trying to get to a point where
23:34
we've either automated or simplify the axis assignment,
23:39
for 80% of the access that needs to be provisioned, you win, you
23:44
win big time. And so to me, focus on people
23:48
that do the same job. Or do portions of the job.
23:52
The same don't focus on like it administrators and folks like
23:56
that. They're so hard to get a role
23:59
for that basically or and have one roll per person and then you
24:03
lose It sounds unlikely. We agree for the most part.
24:08
Keep it simple. Less is more 80/20.
24:13
All right, let's move on the next one.
24:14
I'll be honest. This one had helped me a little
24:16
bit stumped. I wasn't quite sure, but but
24:19
it's how to build admin intelligence or IAI, okay?
24:24
And then you and I were talking as I could maybe it has
24:25
something to do with like intelligence within specifically
24:28
like the IGA platform maybe sell Point.
24:31
What I guess, what are you inferring from this question?
24:34
Yeah, I mean this is like Over the past few years.
24:38
This is an area where the IGA platforms have really invested
24:43
to start to try to differentiate their products and from an
24:49
intelligence standpoint, I think a lot of the focus has been put
24:53
on trying to predictively either assign or recommend access.
25:01
Be assigned to certain people. So, in other words, hey, where
25:04
you're assigning Access to Jeff. We see there.
25:08
Everybody else who's on the security and privacy team also
25:13
has access to XYZ application? Do you want to go ahead and give
25:18
it to Jeff as well? So in other words it somehow is
25:22
analyzing the data to make these predictions.
25:25
I make things, you know, using artificial intelligence to make
25:31
sure that Jeff has the access he needs.
25:33
I think that the best way to To kind of go about building.
25:37
That is, I think from the first and point, it's this very
25:42
product-specific, there's something that products are
25:44
using to differentiate themselves.
25:46
So it's proprietary. I think you have to look at what
25:51
the vendors recommending in terms of what their product can
25:56
do and how to configure it. I think, you know, in terms of
26:00
of best practices for me, it's like dip your toe in the water
26:04
like enter into the This area slowly because what you don't
26:08
want to have happen, is artificial intelligence, which
26:12
is essentially computer program, kind of deciding who should get
26:16
what access when somebody's actually should be taken away,
26:20
because then you don't even really know.
26:23
You're getting much further away from that kind of eye.
26:25
Till ticket based methodology, and you're trusting a computer
26:31
program that you don't really know how it works behind the
26:34
scenes to decide. Guess what access and I think
26:38
that I think most audit groups wouldn't really like that and I
26:41
don't think I would feel comfortable with that either.
26:46
Yeah, I think if this is, if this is the direction you're
26:49
going down, you know, AI for example, it's only as good as
26:52
the data that you're giving it is only as good as the a model
26:56
that's built around. I think.
26:58
Generally right now, I am relatively skeptical that this
27:02
stuff actually works in the real world in the way that, you know,
27:06
vendors portray that at will. I think a lot of times it's
27:09
based on sort of this ideal state of 0, we have all of our
27:13
systems connected. All of Our data is clean, all of
27:16
our users are in our sources and I think anybody who's been an
27:20
identity for more than, you know, 10 minutes probably
27:23
realizes that that's not true. You know, the majority of the
27:26
time. I'm, I'm, I'm skeptical.
27:31
Let me just leave it that I think it's a data point to be
27:34
used by somebody, to then help decide whether that information
27:39
is valid as part of the decision-making process.
27:44
I don't think We're yet at the spot where is completely
27:47
hands-off. And you know, we're letting you
27:50
know, some agent Smith run around inside your your IGA
27:54
system making decisions on who has access to what that is
27:59
definitely not. What I've seen out there is
28:02
generally more of a tool to be able to say okay well we're
28:05
trying to build roles and we see that 80% of the people have this
28:08
access or hey Everett you know a hundred percent of the people in
28:11
your team have access to this thing.
28:13
We think it's okay like Like that, you know, maybe add some
28:16
value but again it's is only as good as the data that's coming
28:19
into it. And it's judges should just be
28:23
part of the decision-making process, not the decision making
28:26
process, if that makes sense. Yeah, the one thing that I'm
28:30
going to see here thinking about it, the one area where I think
28:36
artificial intelligence could really help is kind of that,
28:40
that key model, which is where you're analyzing, what access
28:44
to. An account has and how much
28:48
they're using that I've access. So, in other words because to me
28:51
authorizations are kind of like that next Frontier of the attack
28:57
surface. So now, if I look at Jeff's
28:59
account and he has 500 authorizations via the roles
29:04
that he's in. But over the past 12 months,
29:08
he's only used two hundred of them. well, then I have an
29:13
over-provision to count, most likely So I can see that.
29:18
Like that's, that's interesting to me.
29:19
Like, you're not, you're using really Behavior analytics,
29:23
right? To sort of enrich the
29:25
notification process. I actually have a pretty good
29:28
real life example of this is I have a Apple iPhone.
29:32
I have an Apple Watch and over the last few weeks since I've
29:36
moved from to Chicago area, which is relatively flat to,
29:40
Western North Carolina, which is the opposite, very hilly.
29:45
Apple is telling me. Hey you're A lot more
29:47
stair-climbing than you normally do.
29:50
I am, I'm walking up a lot of Hills compared to what I used to
29:54
do. And I think that sort of trend
29:56
indicator might be helpful from an analyst perspective to say,
29:59
hey, that is, that is interesting.
30:01
What do we do about that? And I think that's an area that,
30:04
you know, you and I have been talking about for years, we've
30:06
seen sort of players in the space like EXA Beam, for
30:09
example, and other sort of this, what people call like this Sim
30:13
2.0, that is taking these owls and surfacing up to platforms,
30:20
to be able to make decisions with, right?
30:22
We see this a little bit in the access management platform where
30:25
the impossible travel scenario. Well, you know, Jeff just logged
30:28
in from Chicago and then three minutes later he logs in from
30:30
North Carolina, that doesn't make any sense.
30:33
Let's do something about it. Throw up an MFA prompt or, you
30:36
know, some other challenge, whatever that looks like.
30:38
The same thing could be done from a identity governance
30:41
perspective, or a privileged access management perspective,
30:44
where you taking those sorts of Ada, and you're leveraging a eye
30:47
to spot those Trends and do something with it.
30:51
You know, if it's just surfacing it up in a ticket, that's better
30:54
than it being lost in some sort of log somewhere.
30:56
That, you know, no one looks at for six months and then by then,
30:59
it's too late. Yeah, you know, part of what my
31:02
concern is with, this AI is like the teams that I think would be
31:07
we get the most benefit from. It are the ones who are the most
31:11
vulnerable to what if it goes Haywire.
31:14
So you know My concern is a lot of the companies that have
31:20
scaled back the size of 13 teams.
31:24
It's like, oh yeah, that's where using AI to get more efficient
31:28
would be really helpful but they get further and further away
31:31
from you actually knowing how the system works.
31:34
And so to me it's a little bit of a scary combination.
31:38
But you know, also counterbalance that with the
31:42
fact that more and more these things are moving to the cloud.
31:46
And you have even less until it's just about what's going on
31:50
behind the curtain truly as the software as a service, like
31:54
these are proprietary systems are not open source, you don't
31:58
always know how they're working behind the scenes and your urine
32:03
kind of a trust model that you know that system is going to
32:08
stay secure. And it's secure until it's not,
32:11
I guess. Yeah, I think I might humans
32:15
going to have flaws in it. So I want to bridge that part of
32:20
the AI and being able to explain it with the managing audit
32:24
expectations. Because one of the things that I
32:25
think about is like, okay, well hey, we're leveraging a auditor,
32:28
we're leveraging AI to do these things for us and then the next
32:33
question, I would have it. An honor is okay, tell me how
32:35
your AI works. Can you can you actually explain
32:39
it, right? The algorithms is it documented
32:42
things like that? Are you going to be able to
32:43
produce the evidence that your AI is actually effective in
32:48
making that decision? So I think that goes along with
32:50
sort of the question next on the list was managing audit
32:54
expectations which is definitely near and dear to my heart from a
32:59
former operation side of things. I will go first as we kind of go
33:03
back and forth here, I think this is let's start with a.
33:06
Let's start with Our expectations.
33:08
The first one I think is you have to have a relationship with
33:11
your Auditors. You cannot just treat them at
33:14
arm's length as like the cops and they come in and check you
33:18
and your the bad guys. More generally speaking, most
33:23
Auditors, especially the internal Auditors are the check
33:26
before the external Auditors come in is much better to have
33:30
things found from an internal audit perspective than from an
33:33
external audit perspective. So if you've got the
33:35
relationships there that is helpful.
33:37
I think the other thing too is at least in my experience is
33:40
that audit doesn't actually tell you what to do.
33:44
They are there to check on what you say you are going to do or
33:48
what are you've documented from a process procedure, whatever it
33:52
might be to validate that what you're doing.
33:55
From a process perspective, is actually what's taking place in
33:58
real life. Now, you could argue, they might
34:00
find that a process is ineffective and then you have to
34:02
update the process or whatever it may be, but in the Is that
34:08
I've been a part of and worked with generally, speaking audit
34:11
is merely an advisor, they advise on risk.
34:15
And they say, okay, here is what we think should be taking place,
34:19
but it's still up to the business to make a decision on
34:22
what they want to do about that risk.
34:24
And a lot of times what you'll see is, you know, an audit
34:27
findings document that has the auditor the audit, you know,
34:30
whatever are finding that they say they have.
34:32
And then there's like this Blank Spot called management response.
34:35
I've written enough of these in the past.
34:37
A stores like okay, they're just telling me what the problem is
34:40
or what they, what they see as the problem now.
34:43
It's up to me as the person who's going to write that
34:45
management response to say here's what we're going to do to
34:49
fix it. Or here's why I don't think that
34:52
it is a risk and we will focus on other things instead.
34:57
So I think understanding those expectations and making sure
35:01
that the Auditors understand what they're you know what it is
35:05
that they're looking at because sometimes you have to help them,
35:06
they may not be as you 100 percent Identity or 100% tool
35:10
base, or whatever. That maybe is making sure that
35:13
they understand how the platform works, whatever you're doing
35:16
from any perspective and how the processes work and bringing them
35:20
into the fold. I like to include them as part
35:22
of program management as part of rolling things out.
35:25
I think they're a key stakeholder.
35:26
When it comes to, you know, designing, huh?
35:29
Services work. You want to make it audit
35:31
friendly and audit compliance as much as possible at front rather
35:34
than try to do that stuff later. So, sometimes that makes Sense
35:37
to invite them to a steering meeting or invite them into a
35:42
you know and I vendor demonstration of a tool that
35:44
might be considering, right? Let them ask their questions as
35:47
well and help provide some of their input.
35:50
I think that's, I think it's an easy way to help sort of get
35:53
them into the fold and help manage those expectations.
35:57
Yeah, what do you think? Well, I think that the way
35:59
you're talking about that, the way you're addressing, you're
36:01
talking about internal external audit.
36:03
Some work is a job bigger, more complex structures, like that.
36:07
T risk? That those are your teammates,
36:10
right? They're the ones who are to
36:12
advise you in terms of how to pass the audit, I'm going to
36:17
throw out another perspective, which is that, I think the audit
36:21
process that I see the most of the time is very reactive.
36:25
In other words, it's assessing how things are done and then,
36:30
you know, inspecting the data looking for, you know, controls
36:36
that are broken. And identifying those think
36:39
going out for so, in other words, if a control, if they
36:43
don't find bad data or they don't find an exception to it,
36:48
then the control works fine. So to me that's kind of like
36:52
that's not necessarily the spirit of what you're trying to
36:55
achieve with the these regulations are trying to
36:59
achieve is that you've got a more secure environment, not
37:04
just that you pass the audit and So here's an example where I see
37:09
that. So around user experience and
37:12
what we talk a lot about with user experience, when it comes
37:14
to the detective control of reviewing access is that
37:20
sometimes people get overwhelmed as like here's your 50 users
37:24
that report to you and therefore hundred entitlements do you
37:27
should they have and they're named XYZ 1, 2 3.
37:32
And The managers like, you know, I'm afraid to take away access
37:38
for this person because what if they can't do their job?
37:41
Last time I tried to get somebody access, it took 10
37:44
days. There's no way I'm going to take
37:46
access away, unless the person has left the organization.
37:49
So I'm just going to approve. Everything is what we call a
37:53
rubber stamp. And I mean, how many clients do
37:55
we go into? Are like yeah, reverse a
37:57
problem. You get audited?
37:59
Yeah, we get audited you pasteurize.
38:01
Yeah. We pass our audits.
38:02
So, in other words, even though you have a Can process you pass
38:05
your audit. So that's part of my
38:08
perspective. I wanted to bring up one other
38:10
thing which is I see some you know some identity governance
38:16
tools that are kind of early in their maturity, which I think
38:21
our focus more on organizations that maybe don't have as steep
38:28
of a compliance curve to overcome as a where I'm getting
38:32
at by that, like few, Think back to very early in variety
38:36
careers, the way that audit evidence would take places that
38:41
the administrator would take screenshots of the user list or
38:47
they print it out on, you know, the the dot matrix printer and
38:51
like that wood and then they scan it in.
38:53
That would be the evidence that would end up in somebody's email
38:56
box to say yes there's the right people or they'd actually
39:00
physically write notes. I mean, I know this make it
39:02
sound like a dinosaur. That is so essentially what that
39:06
was coming from is that what we're auditing is not what your
39:10
single sign-on system says that if you have access to or your
39:14
IGA system says people have access to we're talking about
39:17
that, what the source system has.
39:19
Now if you can prove to me that nobody can access that system,
39:24
unless they go through your single sign-on system or that
39:27
the data in your IGA system is airtight that nobody could have
39:31
like deleted a few accounts. Then okay, maybe I can go with
39:35
that but for the most part we're trying to get to the system of
39:39
record which is the end point system.
39:42
And if there's a counts there that aren't on your system, you
39:47
know, like service accounts for example, the audit has to be
39:51
done a fact data of the data on the system, not on your central,
39:56
I am system. So I don't know that every audit
40:02
Department looks at it like, you know, that Black and white like
40:07
I'm talking about. But to me, that's really what
40:10
you're auditing it, what you should be auditing is the system
40:13
where the data exists. Yeah, I'm I'm talking to myself
40:18
because I'm a very long time ago setting with an auditor and they
40:22
were asking me to prove a negative show me that this
40:26
account does not exist. Okay, I run a search in a duck.
40:32
Not found will do you have any proof that that's not found.
40:35
Like it's not found it's not their me to wait and I had to
40:40
take screenshots of you know it was like a sample of like
40:43
onboarding rock whirring since I got samples 50 people take
40:47
screenshots of 50 searches showing that the account is not
40:50
there. I always got a chuckle out of
40:52
that. That's one of the really laughs.
40:53
I were talking to be or not to be.
40:56
That is the question. Exactly.
41:01
All right, let's get to the last one on his tweet and that is
41:05
provisioning outside of sale Point, third-party apps.
41:09
Your turn to go first. Alright, so what I think he's
41:13
getting at here is like what is the best practice for handling
41:17
provisioning when you can't automate the provisioning.
41:22
So there are is a scenario where a lot of aij systems have kind
41:27
of a ticketing management system within themselves for the
41:33
purposes of creating a ticket to it administrators to go create
41:37
that access or than they're supposed to close that.
41:39
It when they are done, you know, maybe there are, you know,
41:44
posting some evidence that they did the work.
41:46
Usually not from what I've seen to me.
41:50
The best practice is sending creating a ticket in the itsm
41:56
system. In the reason I say that is
41:59
usually when let's say we're onboarding somebody, right?
42:03
And they hit six axis is and five of them are systems that we
42:07
ought to meet the 61 Is a system where it's some Linux
42:12
application and an account needs to be manually provision.
42:17
And so, ultimately, the Linux administrator is the person that
42:23
is going to have to go and create that account and assign
42:26
the entitlements and everything. They don't only do, you know,
42:30
they're not waiting around for these tickets to come through.
42:33
They're doing all kinds of work and they manage their work and
42:37
itsm system usually. And so when you create a ticket
42:41
for them in their itsm system, it gets in there Q with all the
42:46
other work that they have to do now in terms of priority and
42:49
might come to the top or go to the bottom whatever.
42:52
But to me, that's why you want to put it there.
42:55
As like you don't want there to be one other place.
42:58
They have to check to see if they have work order.
43:01
You know, stack all the work that they have to do it.
43:04
Be preferable that they clock, all their work in the itsm
43:08
system. And that there, I am tests are
43:11
in there as well. So I think that's what Chris is
43:13
asking about there. Yeah, and I have one spot to go.
43:19
I think to have that provisioning track makes sense.
43:22
I'm not a fan of using the built-in ticketing.
43:25
You know, that there were process that might be built an
43:28
IG perform unless that's the only thing you have.
43:31
I think you're better off strategically, who averaging
43:33
whatever your it standard is servicenow share.
43:36
Well, freshdesk, you know, whatever.
43:38
It might be like that sort of approach.
43:41
I think the other thing that I will add on to this is it could
43:44
be a scenario where you've got the Third-party apps.
43:46
They might be like ass a space app and you don't have a
43:48
connection for example, from sale point.
43:51
But you could do, is, if you have a relatively modern access
43:55
management tool something like an OCTA or an Azure is, you
43:58
could leverage them to do the provisioning for that third
44:01
party app, maybe it's controlled the in Active Directory Group,
44:04
or maybe it is a entitlement within the octave Universal
44:07
directory or something like that.
44:09
You basically stage the account into one of those directories
44:12
via sale point and then you let the access management tool that
44:16
has probably the appropriate SAS connector to that app to then
44:21
facilitate the provisioning of that through the same process.
44:24
So you're kind of like, chaining your lifecycle management from
44:28
IGA to the access management platform to do that as well.
44:31
So that could be an option as well.
44:33
Hopefully were inferring some content.
44:34
Some of the appropriate context out of this from a tweet which
44:37
is always dangerous but we're giving it our best.
44:40
Yeah I'm sure Crystal follow-up after here's the episode and let
44:43
us know how much how much we I mean, hey, if we 80/20, if we
44:48
got 4 out of 5, I'm happy, yeah, I'm happy.
44:52
We got half of them, right. So I'll set the bar a little bit
44:55
lower for us. Okay, so I think that really
44:58
kind of covered everything from his tweet, which is really cool.
45:00
I love to get like stuff like this because Jim and I can
45:03
ramble on about anything, but we'd rather talk about stuff
45:05
that people actually have questions about.
45:07
So thanks Chris for sending that tweet out.
45:10
If you got questions and you're listening, drop them in a tweet.
45:13
Sent them to us via LinkedIn. We're happy to kind of like I
45:15
said build a show around it. Anything you want to bring up
45:19
around anything that we talked about so far before we start to
45:22
close things out. No, I'm kind of excited to get
45:25
into this lighter note, question, I actually I had a
45:30
because I'm new with my company. I had an introduction and I was
45:35
supposed to come up with a legendary question for everybody
45:39
else. And yeah, instead what up?
45:42
I messed it up. I thought that there should be a
45:44
lighter note. Question presented to me and I
45:47
was going to answer it. So the question I asked the
45:50
group that I came up with on the Fly, was, what's your favorite
45:53
podcast and you got some really good answers.
45:59
Yeah, so for those who missed it, Jim and I are working
46:01
together again, both part of our SMS identity practice.
46:04
So, come seek us out if you need help with something but yeah, we
46:08
have like a think we do. When we have people who start,
46:10
they have liked to give like a little intrude for themselves.
46:13
And I remember looking at that That's line you're working with
46:16
with Ben and it was completely blank and he's like, no, you
46:19
were supposed to come up with the questions and they're like,
46:22
okay I got it now. Fortunately wasn't like a real
46:27
Mindbender kind of, if right. All right, let's get to the
46:32
lighter note. So here's the scenario.
46:34
They're making a movie about your life.
46:37
Jim What actor would you want to play you in that movie?
46:42
No, so Jeff, you know, me for a little while and you know, that
46:46
one of the things that's happened to me since I was a
46:49
very young person was, people would always say, do you know,
46:53
do you have a twin brother? Because you look exactly like
46:56
dot dot dot. And based on my different looks
47:00
that I've had throughout my life.
47:02
It would change for a while. There it was a few different
47:05
looks to, I've only known you for seven or eight years at this
47:07
point. And I know two of those looks I
47:10
changed my look like every I have changed my look like every
47:14
two years when I was younger, you know, go from long hair or
47:18
short hair, facial hair, no facial, hair, different
47:21
hairstyles, things like that. Anyway, used to be Kid Rock and
47:28
then it was Bradley Cooper from A Star is Born.
47:35
And I've gotten he look like Aquaman You know, Jason, Momoa
47:40
Samoa. Yeah, I don't like that one.
47:43
That what? I don't see at all?
47:44
I'm sorry. Well, I do.
47:45
I like, I feel like, I feel like even embarrassed saying that
47:49
one, right? I like, I'm like, I don't look
47:51
anything like him, but I had at least three people say it and I
47:55
think what it is like, you know, I have longer hair, facial hair
47:59
and I work out and so people are like, oh yeah, your long haired
48:05
guy, who works out, you look like Jason Momoa, that's He's
48:08
like, that's how he looks. But the most recent one, I got
48:13
was Goldberg and I want I was just like, no, I don't, I don't
48:16
see if I, you know, I mean, everybody sees what they see
48:21
and, so, anyway, I could see the Goldberg maybe if you like,
48:24
shaved your head and your beard, but then I think that kind of
48:28
like defeats some of the purpose.
48:31
I'm gonna go Jason Momoa though, even though I don't look like,
48:33
I'm the question was like, who would you have play you?
48:36
And I mean, I like that one. I'm going with that, I feel like
48:41
it's going to be with those movies where it's like, why did
48:43
they cast this person? Like that person doesn't look
48:46
anything like them. And maybe, you know, that's a
48:48
that Jason knows on, a great actor.
48:49
I enjoy his work, Bubba, blah. But I'm just, I'm just not
48:53
seeing it, man. I'm sorry.
48:54
Yeah, that's okay. Sorry.
48:58
I think as far as myself I don't look like any I don't get
49:01
anything like that. Like I don't like anybody else.
49:02
I guess we're better for something that's good or bad,
49:05
but no one's ever said, hey you look like so and so, and I've
49:09
had relatively consistent look now for like 30 years.
49:13
I used a long here when I was younger, but it's been pretty
49:15
short since my, I guess, early early 20s or late teens.
49:21
So, I don't know who would play me.
49:23
I would say back in the day, maybe somebody like a Tom Cruise
49:26
or something like that. Just like the the short hair
49:29
from what was it Mission Impossible?
49:32
I think would probably have been like, the probably the closest
49:34
match, but you know, who would I want to play me?
49:37
I would love to have like Paul Rudd or somebody like that or
49:42
Ryan Reynolds I think. Both of those guys would be
49:44
amazing in my role but in the story that is Jeff and his in
49:48
his life. But I don't I don't, I have not
49:51
been either fortunate or cursed to have somebody say, Hey you
49:55
look like so and so so I'm going to be positive and say that's a
50:00
good thing but that's just how I'm going to read into it.
50:03
Yeah, well, I mean, he's, you know, when it changes every
50:09
couple of years you're like okay.
50:10
Well I guess I can look like whoever I want to look like
50:13
then. It's true.
50:16
Occasionally, I'll grow the facial hair, a little bit out
50:19
for maybe a week or two. I'm fortunate, enough to be able
50:21
to grow a nice beard if I wanted to, but about two weeks is my
50:25
limit before. It starts to bother me and it's
50:27
ready to go. Yeah, you are.
50:28
I've always said you've got like a full beard of 5:00, but so get
50:34
this one. So, my brother, and I were on
50:36
the cab in New York City, a few years back.
50:39
And we told the cab driver, Were brothers.
50:44
And No, I don't see it. And it's like, really, why is
50:50
that? Well, you have facial hair and
50:52
he doesn't like and you look like Jason Momoa and he doesn't
50:59
look like Jason Momoa. He looks like Kid Rock.
51:02
Now, I think that's just a magic.
51:04
It's genetics. I mean I have four younger
51:05
brothers and I don't feel like I look like any of them.
51:08
I think my middle brother. Alex is probably the closest
51:10
one, but if you put like, the four of us are five of us into a
51:13
room, I think one person would be like oh yeah I can kind of
51:18
see the resemblance but the rest of us all.
51:19
Look different. Yeah.
51:20
Well what I was going to say is like your one brother.
51:23
Looks like you with glasses on then I was thinking, I thought I
51:27
think the only time I ever see him is like a LinkedIn picture
51:31
which is about the size of a penny, you know.
51:35
So I don't really know what he looks like.
51:36
I just know he looks. It looks like you kind of.
51:40
Yeah I think you know Alex I have very similar, you know,
51:44
personalities. Tris things like that.
51:46
We're definitely probably the most similar looking as well.
51:49
Although he has shaved his head, and I have not yet been that
51:51
that brave to do it. So, when he had hair, we
51:55
definitely look a lot closer. Well, you have plenty of her,
51:58
I'm doing so far so good. So we'll ride that wagon as long
52:03
as we can. Yeah, that's right.
52:04
Absolutely. Alright, let's go ahead and wrap
52:07
it up for this week. Chris.
52:09
Hopefully hopefully we covered what you're looking for, if not
52:13
I'm sure you'll tweet at us. If Got other topics out there.
52:16
You're listening, feel free to drop them into a tweet at IDC
52:20
podcast or send us a message on LinkedIn.
52:23
You will be at Gartner again the week of August 22nd.
52:27
If you've got a spot that we can podcast from, so we're not
52:30
homeless podcasters and the halls of Gartner, that would be
52:33
great, sync up with us. We'd love to try to figure out a
52:35
way. We can maybe share some space
52:37
with somebody and I think that'll do it for us.
52:41
I got one more time centered, I got one more thing.
52:45
Good news is next week, we're going back to having gas now, we
52:50
don't know. Yes, lined up for, like the
52:51
next, you know, few months or whatever.
52:53
So it could just, you know, works way back to Jim and Geoff,
52:57
but there's so much interest in being on the show and I don't
53:01
think it's going to be that hard to fill.
53:02
But next week we're going to have our friend Robert Snodgrass
53:05
on talk about State and Municipal I am and citizen I am
53:13
so pretty excited about that. I'm he's super knowledgeable in
53:17
that area. Yeah, for sure.
53:19
That'll be a good one. I always hate to put next week
53:22
because we never know what the schedule will put out there.
53:24
But if it's not next week, it'll be an upcoming.
53:27
I'm so so that's how that's how I will copy out that.
53:29
How about that? I'm good with that.
53:31
That's your ass trick. Yeah, it's coming.
53:33
It's coming up. We're just working on
53:35
calendaring and scheduling. All the good stuff.
53:37
All right. We're going to leave it there.
53:39
We're on the web identity at the center.com.
53:41
We're on Twitter at idac podcasts.
53:43
If you'll be at Gartner ping us. We'd love to do a fist bump or
53:46
something. And with that, Go ahead and
53:49
leave it for this week. Thanks all for listening and
53:51
we'll talk with you all in the next one.
53:56
Thanks for listening to the identity at the center podcast.
53:59
If you like what you heard, don't forget to subscribe and
54:02
visit us on the web and identity at the center.com.