Latest / Identity at the Center / #169 - IDAC Mailbag - Labor Day 2022 Edition

Transcript

#169 - IDAC Mailbag - Labor Day 2022 Edition · Identity at the Center

0:09
You're listening to the identity of the sender podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity of the
0:25
center podcast, I'm Jeff. And that's Jim.
0:27
Hey, gem. Hey Jeff, how are you?
0:29
Oh, not so bad yourself. Hey, I'm living the dream right
0:34
now. It's kind of a nightmare.
0:36
No, I shouldn't say that. It's really not but I think
0:40
everybody's experience those. So, last week we were at the
0:43
conference and then this week came home took some time off
0:47
because I was moving so it wasn't really a vacation and
0:51
then you come back to work and it's like they always say A, the
0:54
work will be waiting for you. Yes, it will be waiting for you
0:57
plus all the new work that's coming up.
0:59
So, yes, like I was on the computer, literally, till 11:30
1:04
last night working and I haven't done that in a while.
1:09
I mean, it's just was like, a tidal wave came in from like
1:12
8:00 a.m. to 11:30 at night. I consider that payback for all
1:16
the work you gave me and editing.
1:19
All the podcasts that we did for our from Gartner, we put out, I
1:22
think nine, Roads in two weeks, which is like a new record for
1:26
us which is very cool. It's very cool experience but
1:29
yeah so welcome. Welcome to the world of Jeff for
1:32
the last two weeks. Yeah, no, I was thinking like,
1:35
you know, hey that putting out all those episodes that wasn't
1:38
too much work. Was it for me?
1:41
It wasn't. But for you, I know it was a
1:43
lot. That's a lot of work but it's
1:45
fun. We do it as a hobby, right?
1:46
We don't really do anything. This is, we don't really, like,
1:50
monetize the show in anyway, right?
1:52
So we don't do commercials or anything like that.
1:54
Your ability to advertise ourselves know, maybe that'll
1:56
change at some point in future to kind of figure things out,
1:58
but We Do It For the Love of the Game.
2:00
And certainly, it's fun. Well, we don't, we don't
2:02
advertise for ourselves, but if anybody wants to hire us to do
2:07
more than free to do so yeah, definitely come.
2:10
Visit us at our SM.com? Yeah, so I mean there's a couple
2:15
things actually working out so like we put all the episodes 94
2:18
Gartner so you haven't check those out.
2:20
You basically did a preview episode of like the day before
2:23
of what We thought we would be getting into and then we did
2:27
like a daily recap from the three days of the conference.
2:31
And then while we were there, we also recorded specific
2:35
conversations that we had with five different guests.
2:38
So we have Louis Almeida, Jamie Lewis gross, we had head covet
2:42
sand, we had Vittorio Bertolucci and bread to me from various
2:47
companies. I got them all off memory.
2:50
That's how fresh it is, having different conversations and we
2:53
rolled that out base. They all this week and for
2:56
kicking down and forth. While we're recording this on
2:58
Friday, the S as this will become our new our Labor Day.
3:02
Episode that goes out on Monday. The down a few nice comments
3:06
about people whose lives. We have really good coverage of
3:10
the of the conference. I feel like that was kind of
3:13
part of the goal was, you know, for people who couldn't be
3:16
there, just kind of giving you some kind of inside picture.
3:20
Obviously, we're not, you know, news media covering it.
3:24
You know, this session did this or the session at that, but more
3:28
getting their perspective of us and some of our friends of the
3:32
show who work who happened to be there and we're willing to jump
3:36
on the jump on the podcast for a little bit.
3:39
Yeah, it was pretty cool. I think even some folks and
3:41
Garner took notice and re K. Thanks thanked us for our
3:46
journalism. I told him, I think journalism
3:48
is stretchable is a little bit of a stretch for what we do, but
3:52
it's very cool to get some get some nods from that.
3:54
Yeah, it was fun again. Think so you know to Gartner
3:58
really for putting on a great show but also are some for
4:00
hooking us up with that sweet. Sweet as you like to say
4:03
anything. Have a great, you break top one
4:05
now. I mean, yeah, that was getting
4:07
old. Keep them guessing.
4:08
That's, that's the way that's the way to roll, but yeah,
4:10
having a spot to record was definitely ideal.
4:12
And we're actually looking at doing this again.
4:14
I think we're looking at being at the authenticate 2022
4:17
Conference in October, will be in Seattle.
4:21
So we'll be meeting with our friends from the Fido.
4:23
I am It's looking forward to maybe getting and Iran and
4:26
Russia are the executive director over there.
4:28
And if you're going to be at the conference, we'd love to sit
4:31
down and have a conversation either on or off the Record
4:34
depending on the know how it works.
4:35
But that'll be exciting to that. For those who haven't been
4:39
following along. That's the one that Jim ditched
4:41
me last year and made me present on my own 48.
4:45
A talk that was all his idea. I would have been more than
4:48
happy to call fall over you but I was sick as a dog at the
4:52
middle of a pandemic. Turned out at least a test said
4:56
that it did not have covered by it.
4:58
I feel like I had covid like 10 times.
5:01
Yeah. I was sick a lot during the
5:03
pandemic but I'm yeah fight Alliance is definitely one of my
5:07
favorite organizations. You know, it's kind of like as
5:12
well as idsa in as well as Ida Pro.
5:15
And I wanted to mention, I put a message on the ID Pro slack
5:20
Channel, but just to mention here as well.
5:22
We've got a A special episode plan for Halloween, so Halloween
5:27
falls on Monday this year. And so the idea that I came up
5:33
with was, what is your? I am Horror Story, So to
5:37
participate. So I kind of figured the episode
5:41
format with look, like what we did with.
5:43
What's the difference between ID and access management and
5:47
digital identity. And it's kind of like, you know,
5:49
individuals kind of recorded their 3 to 4 minutes or And then
5:54
email it to us. So if anybody's down, I am
5:57
Horror Story like I've got one that comes to mind my own life
6:01
but if any of our listeners have one that they'd want to share,
6:05
basically, just sit down record, it send it to us, reach out to
6:09
me ahead of time, right? We can't have 20 of them, just
6:11
to break it up into. So it's going to be more or less
6:14
of a first come first, serve kind of thing you that or send
6:17
them in. We'll just try to figure out the
6:19
best ones that are podcast friendly or we can, you know, if
6:23
there is one Is that maybe aren't safe for work?
6:26
Hey, we can maybe talk around it.
6:27
I love hearing the stories because I think it's
6:29
interesting. So for my perspective, send them
6:32
all in and we'll we'll try to pick the best ones.
6:34
Maybe I'm thinking of one in my own personal life.
6:36
I shared a too long ago, but it could be interesting for sure.
6:41
Yeah, definitely. And then, you know, also just
6:44
speaking of authenticate coming up.
6:47
That's a, you know, the The conference that you went to last
6:51
year, we'll have the executive director of The phyto Alliance
6:56
and Russia are, hopefully, come on and do a preview.
7:00
He's always a good sport about coming on the show so I think
7:03
it's more a matter of just finding a mutually available
7:06
time isn't agreed to come on yet but I'm just getting it out to
7:09
hit each other. Yeah.
7:11
Right. If he did come on I'd be
7:13
surprised. Is it good?
7:15
Good sport? Yeah.
7:16
Anders cool. What else we got?
7:19
Octane? Going up.
7:20
I think we're planning on doing something out there so octane is
7:22
acht has customer conference partner and customer conference
7:26
in San Francisco in November. So I think we're tossing around
7:29
ideas of how maybe we do something around that.
7:32
So yeah, we're kind of like been hitting like, the conference
7:35
circuit here pretty, pretty hard over the last couple of months.
7:39
Yeah. What I love about the cover,
7:40
like, just take the photo coppers.
7:42
For example, if you onto the photo Alliance of the
7:46
authenticate conduct calm, and look at the Agenda and you just
7:51
look at the sessions as like, so many good topics and so many
7:56
good speakers. So what does that mean?
7:58
For the podcast means we can have all these people in one
8:01
place. Is a, hey, can you carve an hour
8:03
out of your schedule or you're already going to be there in
8:05
Seattle and just join us in the in the podcasting sweet and, you
8:11
know, lay down the track? Well, I don't know if we'll have
8:13
a sweet but some area, hopefully the table and chairs that makes
8:18
it. This will be convenient.
8:20
So yeah, like a broom closet. Yeah, I mean that, you know,
8:24
that's funny you say that but a lot of people when they first
8:26
start podcast, they start in their closet because it has all
8:29
of their clothes in it. And the clothes do a really good
8:31
job of like minimizing Echoes and things like that.
8:33
So yeah, there's a pro tip for you.
8:35
If you're looking to start a podcast, you know maybe take a
8:38
look at your closet and that might help.
8:41
Yeah. Because, you know, that'll be
8:43
the cheapest moment in your podcasting history.
8:46
At some point, you'll by mixers and And some microphones and
8:51
sound treatments for your walls. All kinds of Av services for
8:54
editing and noise, clean up, and nothing beats having good clean
9:00
audio to begin with, like that's where you should make the
9:03
investment. So, if you're doing a podcast,
9:05
that's where that's where I would spend the money.
9:07
Yeah, I mean, people don't want to look, we started early on, we
9:11
did not use this cool software. We use zoom and, you know,
9:16
people had poor internet connections.
9:19
It sounded horrible or if they had, you know, as you know, just
9:24
like behind the curtain. The reason is like, with zoom,
9:27
it's recording it at this happening.
9:30
Whereas, with the software that we use, now is called Riverside,
9:33
it does the local recording, and then you mergers look recordings
9:37
together. But if your internet is spotty,
9:41
you're going to get the local recording and it'll sound good.
9:45
Yeah, it's we've definitely upped our game for sure.
9:47
I'm satisfied with Mr. Rat for what about Auntie website?
9:52
Yeah. I mean some updates and so we're
9:53
going to get to listener questions here in a minute.
9:55
But yeah, I made some updates to the website, put out a brand
9:58
new, listen page, that has all of our episodes that used to be,
10:03
just our most recent one. But now, all of our episodes are
10:06
listed there in chronological order.
10:08
Most recent first, as all of our show notes on each individual
10:11
page. So when we say like, check out
10:13
the show notes or they'll be a link in the show notes, now,
10:16
there's actually a place to go instead of trying to do it on
10:17
your phone to your podcast app or you know, ever might be a
10:21
little more convenient if you want to link directly to a show.
10:23
There's now a permanent web link for each episode and most
10:27
importantly we have joined 1999 and added a search to the to the
10:33
podcast list and page. So you can now actually type in,
10:36
you know, a couple key words and I'll pull back episodes that
10:39
where it's either in the title or in the show notes, so kind of
10:42
a simple approach, but it works. I was really impressed for the
10:45
search feature and it's because even though it's like, we joined
10:48
1999, How many apps do you use? Including I am.
10:53
Platforms, where the search feature stinks?
10:56
Like, you have to get us failed. Just write something guns, like
11:00
this works. Really good.
11:01
Yeah, I'm looking at you Microsoft Dynamics.
11:05
Yes, exactly. The one that that I was thinking
11:08
of. Yeah, exactly.
11:09
So yeah, check it out. Idac podcast.com.
11:12
There is a listen Banner right on the front page or link on the
11:14
top and yeah, it's I'm proud of the work that wasn't into it so
11:19
hopefully people enjoy it. All right, should we get to
11:22
actually, Talking some identity. We spent 10 minutes like talking
11:25
about everything except it. Yeah well we needed that mental
11:29
break. Yes.
11:31
Let's do it. Let's go for it.
11:33
All right. So how did this come about?
11:34
Basically this is a LinkedIn post that you put out there to
11:38
ask questions from folks around you know what is what I'd any
11:42
questions they have was kind of loosey-goosey.
11:44
We got a bunch of different things, from a few different
11:46
folks will go through these kind of one by one.
11:50
We pick sort of the best ones that we or ones.
11:53
We think we can answer the best at least, or at least have an
11:55
opinion on and just kind of go back and forth.
11:57
I'll go ahead and give a give you the first one here.
11:59
This is from Eric Woodruff and he writes since it's a long
12:03
weekend and one could bet the threat, actors will hope all the
12:06
admins are out on a boat somewhere drinking, perhaps
12:09
credential theft and fishing resistant.
12:11
MFA may be diving into how traditional MFA like OTP
12:15
one-time. Password is no match for things
12:18
like evil Jinx to or modish car, which are basically open.
12:23
Apps that people can use to run like a reverse proxy or a
12:26
man-in-the-middle sort of attack that would intercept those
12:28
codes. So, I think the question here
12:30
really is, you know, what do we think about fishing resistant
12:34
MFA and things like that, that might help people enjoy their
12:37
time on a boat drinking. Yeah, for sure.
12:40
And I think it's, you know, the consultant in me wants to take a
12:44
people process and Technology approach of this, because I
12:47
think that the first part of his question was geared towards it's
12:51
a holiday weekend. And the hackers.
12:54
Like we think the hackers like to try to exploit the fact that
13:00
admins are not going to be around, I mean, that's always
13:02
been something we've said, I don't know if the data actually
13:06
supports that that more hacks happened before a three-day
13:11
weekend or something, but let's assume that that's correct.
13:14
I think it is that, you know, the first thing is you have ever
13:20
if everybody goes out on a boat and Shrinking and nobody's going
13:25
to be able to take the call and jump on it and that's a problem,
13:28
right? So that people standpoint has to
13:31
be that somebody's ready to jump in, if you know, the world goes
13:36
to hell in a handbasket, you know?
13:40
Then I think that the process, I'd really what we're getting at
13:43
here with the fishing campaigns is people keep falling for
13:49
fishing campaigns. They're clicking links in emails
13:53
to go to what it looks like Instagram or there.
13:57
You know. And look, I understand some of
13:59
these things are getting really sophisticated.
14:02
You know, they send you an email looks legit, you click the link
14:06
and the login page looks legit. However, if you were smart
14:12
enough or I should leave smart enough, let's say educated
14:15
enough for you. Have this built-in And you go
14:18
and look at the URL bar, you can see you're not on the real
14:23
instagram.com or whatever the pages that they're trying to
14:27
fool you when you look at this. But even that's assuming that
14:30
you've got your browser configure to actually show the
14:32
full URL I guess I'm gonna bug me about Safari is by default it
14:36
hides, the full You full URL. It just shows the first part of
14:39
it or maybe just the base of the domain.
14:41
You know. I think these are things that
14:43
yes, you know, we hope that we wouldn't fall for fishing but
14:47
there is a reason it is So popular because it works.
14:50
Yeah, I kind of feel like I have to built this little fish.
14:54
I'm in this industry and everything, but I've also worked
14:58
for a few companies now that I've really had, you know,
15:01
awareness campaigns and I feel like I'm more aware because of
15:05
this awareness campaigns, I'm more suspicious when I see
15:08
something less likely to click on the link.
15:11
So that's kind of the process. I'd and I think what what Eric
15:17
is also Up in terms of technology is there's some
15:24
there's some multi-factor authentication methods that are
15:28
stronger than others. Obviously leveraging a one-time
15:32
password through SMS or email that's like the that's the low
15:37
end of the spectrum versus doing some kind of certificate based
15:43
or you know, biometric or something.
15:47
That That can't be captured with a man in the middle attack.
15:52
We don't have the monkey like how one-time passwords are.
15:56
Look any MFA is still better than no one will say, right.
16:00
But things like SMS for example has been specifically called out
16:04
as like the Bottom Rung of the MFA tree.
16:08
It is probably the most easily intercepted breached you know
16:12
cracked whatever you know whatever term you want to use.
16:14
The basically say yeah, the MFA went to the wrong person or was
16:16
intercepted. When do you think SMS as a
16:21
one-time one-time password approach, or MFA approach
16:26
becomes no longer prevalent, because I feel like it's still
16:30
the number one method like every single app seems like, yeah,
16:32
that's like it defaults to is, like, the minimum viable
16:35
product. When people are rolling out MFA,
16:38
when do you think it will be that?
16:40
That is no longer the case. Are we talking two years?
16:43
Five years, ten years, never, oh, no, Kind of feels like that
16:49
never because I don't think it's in the foreseeable future but I
16:52
think what could get it there as kind of the that 52 approach
16:57
where if the device makers make it so easy to use the biometric?
17:04
I mean it's kind of gotten there, but I I think so.
17:07
Look in terms of MFA to me, there's different levels,
17:12
there's the low rung, like we talked about the one-time
17:15
password all the way up to something like You became, but
17:21
you can't expect people to use a UV key to go shopping on Amazon
17:26
or, you know, something like that.
17:28
So, you know, per carry one around and plug it into their
17:31
phone. Like that's not normal.
17:33
People don't do that, right, but could you?
17:35
Yeah, exactly. But could you do that for
17:39
high-stake transactions, connecting to a VPN or doing
17:45
some kind of online banking for it.
17:48
In certain scenarios, I think it is reasonable, but I think
17:51
there's always going to be those lower risks use cases.
17:54
And I mean, heck, we know, there are still sites out there that
17:58
aren't even at that level of using it as mess.
18:01
So I think it's really the level of assurance that's required.
18:07
And there's always gonna be there's low level Assurance use
18:09
cases, where SMS will be good enough I guess as that's kind of
18:16
a pessimistic View. I think that's the the
18:19
technology side is that you got to go up the ladder in terms of
18:23
level of assurance, if they use cases higher and I think they
18:27
need to think about a critically.
18:28
Like if getting into the VPN is low level Assurance then
18:33
somebody could escalate to a higher level account.
18:36
So if only requiring like a higher level account for our
18:40
higher level of assurance for an admin account, what if somebody
18:44
gets into the vpm as a low-level account and then Then somehow is
18:48
able to elevate their privileges or Elevate to another account.
18:53
Yeah. I mean, you were talking.
18:55
You know what? Take a risk-based approach.
18:56
I think to it again. MFA still better than nothing.
18:59
Yes, traditional MFA. Which is really the question,
19:03
right? Is that as good as stronger,
19:06
what versions know. Is it more fishing resistant?
19:10
MFA, yes, but I don't know if we're there yet.
19:12
So like, you talk about my certificates and really, I think
19:14
now, we're starting again to like pass keys on devices, which
19:17
is sort of a new kind of Fido standard.
19:19
I don't remember the exact technical term Vittorio.
19:22
Helped us out. Yeah, Last week when recording,
19:24
but there are certainly a lot, it's a mouthful.
19:26
So I prefer passkeys as a name, it's still better than nothing
19:31
it. But the end the day, you know,
19:34
how do these man-in-the-middle attacks work?
19:36
Is they trick you into going to a nefarious website.
19:39
So security awareness training for sure.
19:41
Right, making where that doing random fishing camp, simulated
19:45
fishing campaigns. Right?
19:46
Kind of checking up on your, on your employees and things like
19:49
that dry. If you are a customer
19:50
environment, making them aware of where they Can and can't get
19:54
help from what they should be looking for, you know, giving
19:57
tips on looking at the, you know, the full URL watching for
20:00
misspelled or, you know, domain squatters right.
20:03
Things like that. I think is always a concern, but
20:07
that, I think, I think it's my two cents about.
20:09
I think we, I think we've beaten that one up.
20:10
Pretty good. Okay, so let's move on to the
20:14
next question. I was submitted by Ian saying,
20:17
and it goes like this. Why does modernization always
20:21
seem to stop at today's Standards preparing for what's
20:26
next. Seems to be punted to the next
20:29
round of quote-unquote modernization.
20:33
I think it's because we are still playing catch-up for the
20:36
most part. Like, if you're doing
20:38
modernization, I think that is a thinly veiled, excuse to bring
20:42
your whatever you're trying to modernize technology process.
20:46
Whatever might be into something that you probably should have
20:49
done like five years ago, maybe even 10 years ago, say feel like
20:53
organizations are for the most part, not on The Cutting Edge of
20:57
the technology. They are doing, just enough to
21:00
get by to either make the business run at the most cost
21:04
efficient way possible because bleeding edge is usually
21:06
expensive usually introduces more risk you know it would be
21:11
nice to be you know more modern I think as a as an organization
21:16
when it comes to the technology and services you're putting out
21:18
there but I think of things like password list that we're seeing
21:21
such rapid iteration. Roo not only the use cases of
21:25
how it actually works and keep things secure, but also the
21:28
methods of delivery, you know, things like that, where you
21:32
could call it modern. Yeah.
21:33
We were modern two years ago when we first started.
21:35
Look at password list. And now, what are we looking at
21:38
now? We're get past keys.
21:40
So, okay, so what's your definition of modern because it
21:44
keeps changing and how often do you continually upgrade the
21:48
technology that you've got to stay modern.
21:51
It's too expensive to do that. So I feel like you know, the
21:55
reason it doesn't happen is money.
21:57
Most organizations don't have budgets to install.
22:00
A brand new ID P, MF a conditional adaptive password
22:06
lists identity governance privileged access management,
22:09
Cloud infrastructure and title that management, like all this
22:12
stuff. They can't do this every year so
22:14
you go in Cycles. It's basically okay, you're
22:16
buying a product. Let's hope to get five years out
22:18
of it before we even think about trying to do a replacement or to
22:21
do a major upgrade or something like that.
22:23
Unless there is a very clear, reason I clear and present
22:26
danger or some sort of unmitigated evil risk or audit
22:31
finding where it forces you to do it it comes down to money.
22:35
What do you think? Yeah, I think I think
22:39
improvements and standards the way I took those was, you know,
22:44
I think it's very reliant on upgrades to Hardware.
22:50
So for talking about like, you know, Omer Technologies like
22:54
iPhones and things like that. Think about how fast they move
22:58
from version to version, but then there are still people who
23:01
are on older iPhones back. There are some people, like I
23:05
had a painter, come and paint my house.
23:08
I asked him if we could use like cash app or then know, I was
23:13
pretty much open to whatever your I don't have any of that.
23:16
And he had a flip phone and he's taking pictures of the place of
23:19
the flip phone. I'm thinking, oh my goodness,
23:21
this guy. So out of date, the Is like, you
23:24
know the bank that I go to wants to do business with him just as
23:28
much as they want to do business with me even those Technologies
23:32
out of date. So they, you know, the standards
23:35
have to take into account all the folks who have the old
23:40
technology and then I think the I think the other thing is that,
23:45
you know, the responsibility to be secure.
23:50
Generally does not fall on the end-user.
23:53
Al's on the company, providing the service.
23:55
So you know if you say whose responsibility is it to keep my
23:59
account at Wells Fargo secure is it my responsibility or Wells
24:04
Fargo? Most people say it's Wells,
24:05
Fargo's responsibility, my password needs to be as long as
24:09
what they say, it needs to be. And my multi-factor has got to
24:12
be whatever they say, it needs to be and I'm going to, I have
24:16
to follow those rules if I went access but they try to keep my
24:21
data secure, it's not my responsibility.
24:23
Now you and I may see it differently because we're in
24:26
this industry. I think, you know, the
24:29
quote-unquote man on the street and it feels like the
24:32
responsibility lies on the company, that's providing it
24:37
now. So they've got the
24:39
responsibility for security and they don't want to alienate
24:42
customers that don't have the technology.
24:44
So if Wells Fargo, all of a sudden said, the only people who
24:47
can access their account are people who have, you know, this
24:50
biometric support from this version.
24:53
So basically if you have an iPhone 7, you can't be a
24:56
customer here anymore. You need to withdraw your
24:58
millions of dollars from our bank because we don't want you
25:01
here. That's not going to happen.
25:03
So that's good. That's that's that.
25:04
That is not going to fly. That's not going to happen.
25:06
So that's my feeling is, like, that's the holding back
25:09
modernization is old Hardware. Old Hardware.
25:15
I can see that. I mean, I still think money is
25:16
the answer. Well, yeah, I mean it always
25:20
ties back to mommy's home. All right.
25:22
Sure, do the next one. Yeah, let's do the next one.
25:25
Okay, so this is from our guy. Chris power, who we actually
25:28
we're able to meet out at Gartner.
25:30
Chris is a big Sox fan meeting like actually on your feet
25:34
socks. So kudos to him for that and
25:37
collecting socks off by Gartner. He actually came up with a
25:40
bunch. So I'm going to try to
25:41
paraphrase some of these can Jumping on the socks thing
25:44
before you go any further, I got.
25:45
So I kind of felt like after that conversation with him was
25:48
like this is the first time that I've ever heard somebody going
25:52
to the vendor Hall. I kind of like scoping the place
25:54
out to find something wear socks.
25:57
So if you're listening and you do a booth at a conference, you
26:01
know Sox, might be a good giveaway.
26:04
Yeah, I think it's interesting because I know he is, it sounds
26:07
like he's into it. I think Ian Glaser from
26:10
Salesforce has also into it and then Someone else I read his.
26:14
I was all unlike my LinkedIn or Twitter feeds and stuff like
26:16
that. Where I saw people comparing
26:19
security-related socks. So there is definitely a market
26:22
out there for socks now. Didn't we?
26:25
Look at like the possibility of socks that they're, you know,
26:28
getting custom Sox's not a trivial matter right there,
26:31
expensive. Any type of merchandise is
26:34
expensive weave. We are looking at it.
26:36
I think trying to figure out how that would work, but at least of
26:40
decent quality. Can you get some paper thin
26:42
socks from Some low quality type thing probably, but it's going
26:47
to do it. Do it right man.
26:48
Spend the money. That's right.
26:50
Anyway, so shout-out to Chris. So his question is really
26:54
looking at the best ways to manage layered access.
26:59
So, by layered access, what he means and he gives an example is
27:02
application. A is managed by the I am team to
27:06
get into it. Initially let's say something
27:08
your single sign. Alright.
27:08
So basically like the authentication is controlled by
27:12
one team. But once you're inside the
27:14
application, the application and once you're inside that
27:17
application, there are other entitlements or access controls,
27:21
maybe your administrator or powers or something like that,
27:23
where you can gain additional access within that application.
27:28
So, you know, the perspective he's taking here is we've taken
27:31
the position that business owners and vendors who have this
27:34
ability to take on the responsibility.
27:38
Meaning the ability to escalate within a specific application,
27:42
take on the responsibility. And the audit findings that come
27:44
from adding access, when they surpass or go around the I am
27:48
team, this release is me and this case Chris from the
27:52
response from that responsibility on paper, but not
27:55
from the threat and the risk that these business and vendors
27:59
these businesses and vendors making changes on their own, if
28:03
something would happen to occur the call to resolve, it would
28:06
start with the IM team, of course rights like, hey, why
28:09
does someone have incorrect access to your application?
28:11
Well, let's start with the top of the chain.
28:13
Jane and then you start doing this, you know, root cause
28:16
analysis and said, oh well we only control one part of the
28:19
authentication. Someone else is controlling it.
28:21
What are your thoughts on the management of that layering of
28:25
access? So my thoughts on managing I am
28:31
managing access period. Is that the business makes the
28:35
decision on who gets access to what and I am team provides the
28:41
tools to do that in a Controlled fashion.
28:44
So even the example he gave is saying, okay well I am team
28:49
manages the single sign-on so ultimately you know to get
28:53
single sign-on to an app. They don't give everybody a
28:55
single sign-on to every app, right?
28:57
Ellie Give the apps that you need.
29:00
Well, who's going to decide who would apps?
29:03
Jeff Steadman needs access to what groups he goes into an
29:07
active directory. That enable him to see that icon
29:11
in his single sign-on. That's Would be the business.
29:16
What I also think is like when you gets to entitlements, it's
29:21
really then finer grain. Either groups in active
29:24
directory or maybe is provision into the application with
29:29
certain entitlements. Whether it's groups or some
29:32
other attributes that drive access typically use a tool like
29:37
identity governance and administration like a South
29:40
points, avian omata, you know, along those lines, I'll Amos or
29:45
clear sky. I that can narrow name every
29:48
single idea by somebody else, right?
29:51
But the idea being that it goes to the business and the business
29:58
I person in the business decide? Yes, you get access or no, you
30:02
don't get access and then the system ideally if it's fully,
30:07
automated, would provision that backs us.
30:09
It doesn't, it's going to issue a ticket, but then ultimately,
30:13
if there's a breakdown, like, somebody gets a ticket.
30:15
It and doesn't follow the ticket or they provide access.
30:19
That shouldn't be given, if you have the right Tools in place
30:22
from, I am perspective that have that automation or issue a
30:26
ticket. And someone breaks process, you
30:29
have to be able to identify who broke process, but it sounds to
30:33
me, like what Chris is saying is that they've got a single
30:38
sign-on tool, but they don't have an IGA system in place.
30:42
While could be that but I think what happens in the real world,
30:45
too. You might have the single
30:46
sign-on tool but you don't actually control the permissions
30:49
within the application itself. Like sap might be a good example
30:53
where there's like an sap team who is responsible for
30:57
maintaining access within sap but the front door might be
31:01
controlled through an active directory authentication.
31:03
For example. So I think that's the risk.
31:06
Right? Is okay.
31:07
Well the I am team is doing the right thing.
31:08
They have like defined processes but somewhere along the way the
31:12
business decided that they did not want to hand over.
31:15
The provisioning of the actual entitlements within the specific
31:19
application to a centralized team that does that work, or
31:23
that centralized team doesn't have policies or standards or
31:27
things like that, that align with sort of the organizational.
31:30
I am policies. So I see Chris's Point here is
31:33
like, okay, well, we can only control so far because we're
31:36
only doing this part. We're only really doing the
31:39
authentication part of it. The authorizations are being
31:41
managed by someone else in their own application that we do not.
31:45
Have connectivity to into or integration, for example.
31:49
So I can have an IGA tool, but I might not have a connector that
31:53
is provisioning, the actual permissions within the account,
31:57
they happens quite a bit. Right.
31:58
So I think you know, from a risk perspective the risk doesn't go
32:01
away, it becomes a business decision to say.
32:04
Okay well how do we want to manage the risk to your point?
32:06
I think the business owns the risk.
32:08
They have made the decision not to integrate with the Enterprise
32:12
standard identity and access management.
32:15
Meant system to the, to the degree, that absolves the
32:19
business from complying with their audit requirements.
32:22
Like, that's something about was take back to say, okay, well,
32:25
you know, if you want an easy button, put it in active,
32:27
directory, or Azure active directory.
32:29
And because my IJ platform is fully managing active directory,
32:33
or Azure active directory, I will control both the
32:35
authentication and the authorization.
32:38
But if you've got an application that sits outside of that, out
32:41
of sight of that management chain, I'm not going to be
32:44
responsible for it because I can't control.
32:45
What? And I would never agree to say,
32:47
I will own the audit responsibility for an
32:49
application that I cannot control the authorizations in.
32:53
So I think that's where the business comes in.
32:55
And is I think it's part of the, I am program.
32:57
I think this is, you know, an agreement that gets made
32:59
somewhere. Maybe, you know, executive
33:01
levels or some other management levels to, basically say, okay,
33:04
here's what we're responsible for, but by the way, because
33:07
you're not using the, I am easy button that we've created, you
33:11
are going to take on these responsibilities.
33:13
You need to show your audit Trail for Who requested access
33:16
was, it approved keep that for, you know, X number of months
33:21
years, whatever you know regulation you need to comply
33:24
with things. For example, if you ever decide
33:27
that you do want to hop on the I am trained and become fully
33:30
managed. Great, let's talk about that.
33:32
But until that happens, I will not accept ownership of your
33:35
audit findings. Have a good day application
33:37
owner team. That that's the way that I would
33:39
look at it. No, I mean you made a lot of
33:42
great points certain when you fart at escp example we Seen
33:46
that over and over again. I think what It ultimately comes
33:49
down to is if an application or platformer how we want to look
33:54
at is going to do their own identity and access management.
33:57
They still need to be in compliance with the information
34:02
security policies. Essentially, they have to do
34:04
what the I am platforms are doing with the same level of
34:09
adherence, to controls and being tested and, But ultimately comes
34:15
back. 24. The decision-maker standpoint to
34:18
decision makers, should be the business and the IM system,
34:23
whether Central or its sap GRC, they need to be able to show the
34:28
audit Trail and who approve the access and collecting all the
34:32
same information that's required of the IGA system.
34:38
I think it's kind of feeds also to hit the second question.
34:40
He sent us, which is around work audit balance, which is a pun
34:44
off, work life balance very In a regulated Industries, it's hard
34:48
to balance the work I have because I don't want an audit
34:51
finding against the work. I have to assure our identities
34:55
are safe. So, now, basically, what we're
34:57
saying is balancing water what, you know, the stuff I have to do
35:00
that is going to be an audit finding or maybe was not in
35:03
funding versus the thing that I know I should be doing from a
35:06
general identity and access management hygiene perspective.
35:09
There are certainly some overlap.
35:11
But what ends up happening is this prioritization that?
35:14
If every, if Every time an audit finding comes out, that becomes
35:17
like the fire and it wins, when you're trying to, you know,
35:21
versus all the things we should be doing and this is almost like
35:25
the modernization question earlier.
35:26
It's like, there's a bunch of things that you should be doing,
35:28
but if you're constantly playing catch up on stuff, you know,
35:31
what is that balance? Look like where.
35:33
I have a list of a lot of things I need to correct.
35:35
Every year, hopefully, you're making progress and it's not the
35:38
same audit findings. Otherwise you've got problems
35:40
but I think it goes along with that as well.
35:42
Which is, you know, what is that mindset?
35:44
That that If that needs to take place from basically walkable
35:49
and say, okay, well we're just going to dress these Auto
35:50
findings and not really solve the bigger picture versus trying
35:53
to be more strategic for my New Perspective.
35:55
That would solve potentially audit findings in the future.
35:59
That would arise from not having a strategy or a program in
36:03
place. What do you think?
36:05
Well, I think the thing that comes to mind to such act to
36:07
know what is the source of the audit findings and is a
36:11
predictable because if the source of the audit findings is,
36:15
Is hey, we've got an ancient access management system or an
36:19
ancient, you know, provisioning tool.
36:21
That's not really doing what a modern IGA does.
36:25
Or we don't have a good privileged access management
36:28
tool or we're shifting to the cloud and we don't have her
36:31
framework for managing access there or maybe it's all the
36:34
above were completely under invested that.
36:37
Maybe you can attack it by saying we need to make these
36:41
shows. You can vestments as an
36:43
organization. Now, you also have to That some
36:46
were, his ations it's almost like their strategy is to stay
36:50
under invested and on this very unfortunate because we from the
36:54
clients in the past that they call us after they paid a major
36:59
Ransom, you know, to rent somewhere gangs because they
37:03
were under invested and very vulnerable to being attacked, or
37:08
they have some kind of major incident or major audit finding
37:12
and, you know, it's like, okay now the house is on fire.
37:15
Now we're going to call in the big guns and usually the
37:19
situation is they've gone, 10 years and under invested.
37:23
Now I think a big reason is of fish.
37:26
Strategic decision was made like we're going to Outsource.
37:30
I am as just a function we don't want to run and then it gets
37:34
into this mode of just maintenance just maintain what
37:37
we have. I mean five years in the I am
37:39
industry is an eternity. I'd say five years ago.
37:42
It wasn't even Baseline standard that you need that.
37:45
Mme everywhere. I would say anybody would argue
37:48
that you don't need them. If they everywhere now is crazy
37:53
right? You have to look at your
37:54
environment from a zero trust perspective.
37:57
So I guess that's you know to Chris's.
38:01
If you can kind of like predict what those audit was going to
38:05
cost us on a findings and is due to, you know, things that can be
38:10
addressed with investment. I think you have to push to make
38:12
that investment and If your organization is cotton,
38:17
critically underinvested in molten vest, I think your
38:21
options are one. You've got to figure out how to
38:24
convince people that is worth, carry about and worth investing
38:28
in or, you know, potentially just think like this
38:32
organization never going to invest, and we're just going to
38:34
continue on this cycle. And, you know, you question
38:38
whether or not, that's what the place you want to be.
38:41
Yeah. If you're not investing, you're
38:42
accepting the risk. That's the bottom line.
38:44
Like that's that's pretty much Even when you are investing,
38:46
your you're accepting certain levels of risk, but you should
38:49
be investing to reduce risk, but anytime you don't spend money to
38:53
fix something that's risk and you know, that's just no way
38:58
around it. Let's shift a little bit because
39:00
he he came up another one tools and Technology.
39:03
He's looking for a tool. That will tell him at the
39:05
entitlement layer when the last time it was used in order to
39:10
reduce aging access his requirements, at least in a base
39:14
level is it has to An active directory and third-party
39:17
applications. I think a tool like that sounds
39:21
really nice. I don't know if something like
39:23
that exists because I feel like this is extremely dependent on
39:27
logging and what logs are kept by the entitlements applicator
39:34
the application that has the entitlements in it.
39:36
So active directory, obviously has logs.
39:38
I would feel probably okay with that the third party
39:40
applications though, you just don't know what you're going to
39:43
get from a log in perspective. Hey was this do they even track
39:47
1? Entitlement is used beyond the
39:50
initial authentication or authorization chain?
39:54
Yeah I mean you're right on like you know there are some well I
39:59
don't think there's going to be one tool that that kind of you
40:04
know pulls all this together without logs and I think the
40:07
ultimate answer is having a Sim tool like a Splunk or elastic
40:13
stack that can pull this data. It in and you create reports
40:17
that can make sense of it. I think there are some access
40:22
management tools that you know can filter at a coarse-grained
40:28
authentication level and but ultimately it still comes back
40:32
to spitting out, there's logs and when you throw active
40:35
directory into the scope I think there's so many different ways
40:39
to authenticate to active directory.
40:41
Ultimately, you're pulling the active directory security logs.
40:45
I think, you know, to me, the logging to make sure you're
40:48
capturing the data that you want, centralizing, the logs,
40:52
and then building reports to, you know, make sense of the of
40:57
the log data to help filter it, to just what's important and
41:02
potentially setting up alerts so that you know anything that's
41:07
like really bad, you're getting alerted on, this sounds like a
41:11
lot of custom work to me to try them, get all All the logs and
41:16
then, you know, basically, you're looking through all the
41:20
authentications that take place that's almost like this needs to
41:23
be at the authentication level for each application.
41:26
Suck up, all those authentication transactions.
41:28
So to speak into that log and then try to come up with some
41:32
sort of logic or tree that says, hey, look for this specific
41:35
authorization chain. And if you see this specific
41:37
word, which should map back to an entitlement name somewhere,
41:41
or maybe it's even a word, it could be some sort of primary
41:44
key that if, you know, Slate's from one thing to another you
41:48
know, maybe this is an untapped space, maybe there's already
41:50
products out there that exist. So if you know of something, you
41:52
know, hit us up here, you know, ahead and send a message just on
41:55
LinkedIn. We'd love to like talk and
41:57
figure it out. Maybe it helps Chris out as
41:59
well, but I feel like this is a very custom a custom thing that
42:03
needs to be built, which to me, sounds like it's going to be
42:06
pretty expensive. Yeah, yeah.
42:08
Sounds like something. Maybe the FBI has just something
42:11
but it sounds to me, like, premise question.
42:13
He's talking about the The entire winter and entitlement is
42:17
actually used, then you not only have to say, okay, Jeff logged
42:23
in as an administrator but here actually use the administrator
42:26
access. So I, you know what, I kind of
42:30
think we're one place that we do, see that is with Kim
42:34
software. So it's going in to Amazon, for
42:39
example, and finding out when a role was actually used, and if
42:43
that rolls not being, Stanley says you Jeff is now using that
42:48
role but that's you know basically that's leveraging data
42:52
that Amazon has and brawl the cloud providers have.
42:55
So it's almost doing like log analysis from this Cloud vendor
43:00
so it kind of goes back to our answer but it's also very
43:03
specific to Cloud infrastructure.
43:05
I don't think a similar tool set exists for you know non Cloud
43:12
platforms. Yeah, that's a good point.
43:15
You know, the Kim space might offer some solution.
43:17
There are they think about too is just because it entitlement
43:21
isn't being used, doesn't mean it should go away.
43:24
I think of things like fire call or other sets of like emergency
43:27
break glass type accesses where you hope that the you never have
43:31
to use them or they use very sparingly, you know, if that if
43:35
you have, you know, I'm, I would imagine go to some sort of
43:38
portal say, oh, yeah, that's you know, that's the emergency
43:40
access. Don't worry about that.
43:41
That's fine to leave where it is, or whatever.
43:43
B versus taking more like an automated process.
43:47
I know there's there's one one client that we're kind of
43:51
talking with in our professional life where like things like
43:55
out-of-band access. For example, like how do you
43:57
detect accesses and entitlements that are being granted?
44:01
And you know we're looking at a combination of our PA robotic
44:04
process automation, you know logging things like that to try
44:08
to come up with some ways to kind of address that that unique
44:11
use case, which is emitted. Ooh, pretty advancement.
44:14
A lot of, I think a lot of organizations still trickling
44:15
the basics but it is something that, you know, that that we're
44:20
working on in our professional life.
44:23
Let's get to the next one, which is a culture question.
44:25
I like this one because it's gets more to the people side of
44:29
identity. Chris works with a wonderful
44:31
team. Now mostly virtual and spend a
44:34
lot of time grinding provision requests.
44:36
I feel your pain. Chris, how do you remind them of
44:40
the importance of the work they do.
44:42
How do you reward them? Away.
44:44
So I think the idea here is that, you know, I'll go back to
44:47
my old id admin days and kind of how I got into identity was.
44:51
You're basically processing requests tickets emails,
44:54
walk-ups maybe not so many walk-ups recently you know, Iams
44:59
where there's you know you have to create accounts for some
45:01
reason or add permissions are entitlements and it's, You Know,
45:05
It's a Grind, e work, sometimes, especially if you're in a big
45:08
organization, or you have a lot of tickets or requests coming
45:11
in. You know, how do you You how do
45:14
you a stress, the importance of what they do?
45:16
I mean, really, you're talking about the first line of defense
45:19
for an organization. It all starts with identity, but
45:22
when you working on, you know, 100 tickets a day, or maybe 10
45:26
tickets today is really matter. Right.
45:28
How do you keep the focus for a team that that's sort of their
45:31
primary primary role is to just do that permissioning for
45:34
people? I think it's also comes back to
45:39
kind of people management what I want, which is make sure that
45:42
you are In touch with their people, you're having the water
45:45
once, they have an opportunity new, you care about them.
45:48
They know that the work that they're doing is important to
45:53
the organization and they know that if they have a concern or
45:59
something, coming up in their life that you're going to listen
46:02
to them and do what you can to help them.
46:05
I mean, so to me, it's kind of like, if you talk about the work
46:09
culture and how do you keep people from going crazy, it's
46:12
know that they're not. Alone, even though there may be
46:15
physically alone at home and but that they're part of something
46:19
bigger and they're valued and that you're going to be there
46:23
for them. If they have, if they need a
46:25
mirror, I think I feel like the last couple years because of the
46:29
pandemic organizations, have gotten better at this of helping
46:34
people understand their role with the organization.
46:37
Why they're important because such a such a focus was paid on
46:40
the mental health side of things, you know, for folks.
46:43
I think is a good thing. I think it starts a lot of it as
46:46
that messaging from the top you know and making sure that you
46:49
know as a manager of a team like that for example promoting the
46:52
success of my team to other managers and people that might
46:57
be above me and the organization.
46:59
Here's what we do. Here's why it's important and
47:02
getting that message to them and having those folks help Cascade
47:06
that message back down to folks, this is a lesson I took from a
47:10
few of the Cecil's that I've worked for in the past.
47:13
And Burt where that thank you of what we're doing, you know is a
47:19
powerful motivator, you know. Not everyone is motivated by
47:23
money or tokens of thing. Whatever that might look like
47:26
gifts. Sometimes I love will tokens.
47:29
I do yeah, I do have tokens of money.
47:30
Don't get me wrong, but yeah, a sincere.
47:34
Thank you and acknowledgement of the work that was done, is
47:37
certainly helpful. And I think that's, you know,
47:40
it's not always the end, all be all but At least recognizing,
47:45
maybe even seasonal spikes. Okay, we know we're going into a
47:48
busy time, you know, maybe it's open enrollment for example or
47:52
it's the first day back after holidays and everyone seems to
47:56
have forgotten their password. So, you know, you're gonna get a
47:58
lot of password calls because they just don't feel like they
48:01
want to take advantage of, self-service, password,
48:02
whatever, reason, not saying that.
48:04
These things haven't happened to me in the past.
48:06
I'm just, you know, throwing examples out there, right?
48:08
But I think, you know, I think part of it is making sure that I
48:12
think the biggest parts were just being aware.
48:13
Are of the value making sure that the team understands it,
48:16
but also promoting your team, especially for managers and
48:20
other folks who are leading people in these types of roles
48:23
is, make sure that people know what it is, that your team does
48:26
and why it's important and enlist their aid.
48:29
And making sure that that message is getting around and
48:31
have a Cascade down, is a big thing.
48:35
You know, I as you're going through that, I thought of a
48:38
session at the five-day conference that I saw listed
48:42
that I'm definitely going to sit in this called The Forgotten how
48:47
we all started with the contact center then forgot to secure it
48:50
properly. You know, it's like we all like
48:54
started out in that kind of position and then when we go
48:57
through security it's it's not are you no mountain high enough
49:02
of a priority for us to get it right?
49:05
That's the global security engineer from CVS Health John
49:09
Poirier. So reach out to him and see if
49:12
maybe we can we can meet up with them while we're at the
49:15
conference. Yeah that would be cool.
49:17
I didn't say I think it's a really good question.
49:19
I'm I think that's probably where we'll go ahead and leave
49:21
it for this week. We've it's Labor Day.
49:23
We've labored through a bunch of questions.
49:25
I feel like our work here is done.
49:28
We'll end on a lighter note which was also submitted by
49:31
somebody out there. I don't think they knew they
49:32
were submitting a letter or note but we're going to treat it as
49:35
As such, let's go with it. And it's from Kurt Greening,
49:38
what tool program policy or settings that if implemented
49:43
would help reduce the chance that you would be called into
49:46
work because of an IM emergency on Labor Day.
49:50
So what is it that you're going to implement?
49:52
That's going to make it. Make sure that you can be on
49:53
that boat drinking somewhere or at least, you know, not, not
49:57
have to do some work on Labor Day.
49:59
Well, I guess the serious answer would be what a talked about
50:02
earlier is like, you're going to have to take your turn.
50:05
In our recent uptick for turn, but if everybody taking their
50:08
turn then it shouldn't be anybody's turn.
50:11
Every time of holiday shows up, my funny answer was my
50:17
technology would be an airplane and get on that airplane and go
50:20
somewhere. If that doesn't have Wi-Fi, like
50:23
Belize or Bora Bora, that was my five response to Kurt, he's a
50:28
good egg. I met with him out in the
50:31
Gartner as well. Uncle how about you Mike Let's
50:35
see, I think self-service, you know, reset your own password,
50:41
you know, make a wit, make people aware that you know what
50:44
they think it is emergency may not be truly an emergency,
50:47
right? Don't I remember back to my
50:48
pager days of Walgreens, you know, don't page me at 3 a.m.
50:52
because you can't get access to the corporate menu you know for
50:55
the cafeteria tomorrow because you're trying to plan your
50:56
meals, I will not be very happy about that.
51:00
You know, I think taking a risk based approach to escalation I
51:03
think my fun answer would be Setting an out of office and
51:07
making it very clear that you're not checking email.
51:09
Good luck, godspeed. And you know notify the next of
51:13
kin so to speak is the way that I would look at it.
51:16
Yeah. Don't put your cell phone in
51:17
your email signature. Yeah, I have mine.
51:22
I do. That's the only number that I
51:25
use, but yeah, I think that's I, you know, you have to draw
51:29
boundaries. Fortunately, I think a lot of
51:31
people especially the, it space are aware that they sometimes
51:34
get you have. They're in a support position.
51:35
You might get called in on days off or weekends or holidays.
51:40
I can certainly remember having to create a whole bunch of
51:42
accounts because of a mismanaged onboarding, New Years Eve, for
51:47
example. So it just I think if you can
51:51
plan ahead and try to head off as much of things, you know,
51:53
people can enjoy it but and first cats culture question.
51:56
So if you have those people who don't respect the boundaries and
52:01
they go ahead and like violate the work lifetime, Your
52:05
employees just, you know, recognize your employees and to
52:09
whatever extent you can kind of stand up for them.
52:12
Let people know like, hey, you know, calling them at home just
52:15
because you have their phone number.
52:17
Yeah. It doesn't make it right.
52:19
Yeah. I remember back in the day would
52:21
be like okay well just you know work from home today or hey
52:24
leave early you know on Friday or whatever it's kind of makeup.
52:27
Make it try to make it Equitable I think for both sides right
52:29
ever. We all have a part to play in it
52:31
so be a good human being is my motto.
52:33
That's pretty much it. All right, what do you think?
52:36
Should we go ahead and leave it there?
52:38
I think so. Okay, hopefully everyone is
52:41
enjoying their Labor Day. The end of summer officially
52:44
here. At least in the US we'll go
52:46
ahead and wrap it up. Check out our website, idac
52:49
podcast.com, check us out on Twitter at IDC podcast.
52:54
Follow us, always love to engage with folks.
52:56
If you got show topics questions, concerns grievances,
53:01
you know accolades you can set them all, send us send So us on
53:05
LinkedIn after you connect there and we'll be happy to chat.
53:08
So hopefully we get to meet some more Folks at some of these
53:10
conferences that are coming up. So, authentic 8 2022 in Seattle
53:13
by the final group or final lines of should say and then
53:16
potentially octane, which is put on by OCTA in San Francisco in
53:20
November. And who knows what next year
53:23
from it perspective. So with that, we'll go ahead and
53:25
leave it for this week. Thanks everyone for listening,
53:28
and we'll talk with you all in the next one.
53:34
Thanks for listening. Turning to the identity at the
53:36
center podcast, if you like what you heard, don't forget to
53:38
subscribe and visit us on the web and identity at the
53:41
center.com.