Latest / Identity at the Center / #336 - IDAC Mailbag - March 2025 Edition

Transcript

#336 - IDAC Mailbag - March 2025 Edition · Identity at the Center

0:00
Eventually though, you cannot have a strategy of heroism.
0:04
It's just security strategy that is not sustainable.
0:07
It might work in short bursts and it might be something that's
0:09
needed in the short term. But I would, I would definitely
0:12
start to think about, are your business processes secure?
0:16
Do you have a way to look at the data?
0:18
You know, how are you making sure that you're trying to
0:20
reduce the risk as most possible?
0:22
At some point, you know, someone's going to have to make
0:24
a decision. Hey, it's time to spend a little
0:27
money and catch up here or augment or whatever it may be.
0:30
What tends up happening a lot of times I see is you get so far
0:33
behind that you have to spend a lot of money to catch up.
0:36
And it becomes like this ginormous task to to just get to
0:40
where good is or maybe even adequate.
0:43
And then, you know, we, I, I talk about peaks and valleys
0:46
from a budget perspective, you spend a whole lot of money
0:49
catching up and then you don't keep up with it.
0:52
And then guess what, in three to five years, maybe a little bit
0:55
longer if you're lucky, you're spending a whole bunch more
0:58
money again to try and catch up. Good.
1:00
If you could just figure out how to make that a slow and steady,
1:03
you know, probably increase just because prices get more
1:06
expensive over time, I think you'll have a better approach,
1:09
But it takes a lot of financial discipline to do that.
1:12
And not if your organization is in that mode of, Hey, this is
1:16
going to be a sustained investment identity is forever.
1:18
And so I think you need to think about identity as a long term
1:22
commitment for the organization. This is identity at the center
1:32
if it has anything to do with IAM.
1:35
This is the go to podcast now your hosts Jim McDonald and Jeff
1:42
Stedman. Welcome to the Identity of the
1:49
Center podcast. I'm Jeff, and that's Jim.
1:51
Hey, Jim. Hey, Jeff, how are you?
1:54
Not so bad yourself. I'm doing good.
1:56
Hey and all transparency today is Ash Wednesday holiday and I
2:01
saw something I've never seen before.
2:04
So I'm in Phoenix, AZ in the United States and was driving up
2:10
to a corner in my Uber and they had drive up Ash Wednesday where
2:16
they put the ash on people's foreheads.
2:18
But you didn't even have to like go to church and park and do all
2:22
the other inconvenient steps. You could just like pull up.
2:25
They do the blessing, give you the ashes and on your way you
2:28
go. I didn't do it, but I think it's
2:32
very convenient for people. You know, they have a drive up
2:35
wedding Chapel in Vegas. I mean, how convenient is that?
2:39
Well. Apparently there's a drive up
2:41
for everything so I think so. I guess that's what it is and
2:45
more transparency. You're not in your normal
2:47
location. Where are you?
2:48
I'm sorry, I'm in a hotel lobby because my room was not ready.
2:53
So we decided to record at 4:00. My room's supposed to be ready
2:57
at 4:00 and 4:00 came and no room was available.
3:01
The joys of business travel, right?
3:04
Yeah, I mean, basically we spent all day in like in a tube, not
3:10
at 40,000 feet the whole time. A lot of it was like ground
3:13
level, just sitting there waiting for the take off.
3:15
That's the worst thing. We just get all.
3:16
The time off. Can't go anywhere.
3:18
You're just kind of like, all right, let's get this thing
3:20
done. I know, I know when I first got
3:23
out of college, like my dream was to travel for work and it
3:28
was a blast for the beginning. And then it's like, you know,
3:33
when you're sitting there and it's like 10:30 at night and you
3:36
just want to get home and get in your comfy clothes and get in
3:40
bed and you're like sitting and you know, you've got like a 2
3:43
hour flight ahead of you, but you just been sitting there for
3:46
hours on end. Takes a little fun out of it do.
3:49
You have the Flighty app your iPhone.
3:52
I'm guessing how? What is that?
3:54
It's it's basically like a little app that will track like
3:56
your flights for you and kind of, you know, tell you if delays
3:59
and stuff like that. And I'm a fan of it.
4:00
I've had it for a few years now, but it tracks every single
4:04
flight And so you can track like how many you've taken, you know,
4:09
I'm looking right now, hours lost from delays like your has
4:12
your passport, how many flights where you've gone miles and
4:15
stuff like that. 2024 we'll just go over this.
4:20
My, my quick stats, 101 flights in the year 2024 only 58,000,
4:26
almost 59,000 miles. So a lot of it is just kind of,
4:29
you know, regional US travel 33 hours lost from delays because
4:35
of that because from flying so a day and a half basically.
4:40
You'll never get that time back. Nope, Nope.
4:42
Just sitting there and I'm already at three hours lost from
4:45
delays this year and I am only going.
4:47
I think my point a couple times so far.
4:49
We should see we are not sponsored by the Flighty app.
4:52
We are not, but I would happily take a year subscription if
4:55
anyway from Flighty is listening.
4:57
It's a great little app if you're a frequent traveler.
4:59
Highly recommended. Unfortunately it is iOS only so
5:03
my friends with Androids unfortunately can't partake and
5:06
I did not when I I I flirt with Android every year and I
5:09
recently did it a few months actually a few weeks ago with a
5:12
new Galaxy phone and I could not find anything close to what
5:15
Flighty does. So I really hope they add an
5:18
Android version to the road map in the future.
5:20
But as you said, not sponsored by Flighty.
5:22
I'm just a fan of the app and I think it has some interesting
5:24
information. I always know when you're trying
5:26
out the Android app, they're getting green text from you.
5:29
It's like blue Boo Boo green like Jeff's on other Android.
5:34
Yep, that's that's me, man. I was trying something you got
5:37
to know. You got to know what's going on
5:38
in the world, right? I love Android phones.
5:39
They're great, but. Here's something you taught me,
5:41
so I didn't know this. You know the the green text, you
5:45
think they're SM s s, but they're not necessarily
5:48
necessarily SM s s. They could be a very we call
5:52
them, but RCS. RCS, yeah.
5:55
So Apple added support for that last year.
5:57
I think it's part of like iOS 18.
5:59
And so now there is some comparable capabilities and
6:04
features that are similar to iMessage but cross-platform
6:09
between Android and iOS users, as long as your messaging app
6:13
supports RCS so. But just, you know, educate your
6:18
family out there because there is a warning that I'm thinking
6:20
from the FBI like your texts, if they are SMS texts, they can be
6:27
seen by just assume they can be seen by anybody who is a hacker.
6:32
So, you know, I'm sure nobody who listens to podcast does
6:35
this, but taking pictures of your credit card and then like
6:38
texting them to somebody, you trust them the other end.
6:41
It doesn't matter if you trust them on the other end.
6:44
It's all the people in between that can actually see that.
6:47
So spread the word, Goodfellow. That's a that's a risk no matter
6:52
what you do, I guess. So just got to be careful.
6:56
Why don't we cover our conferences real quick?
6:57
Because I'm, I'm, I am nervous that you're going to like,
7:01
you're in the hotel lobby and someone's going to come over and
7:03
cause problems for us. They're going to ask for an
7:07
autograph. You know it.
7:08
Are you the Jim McDonald from the Identity Center podcast,
7:12
Sir? Let's, let's see, let's start
7:14
with London. We have the Gartner IM Summit
7:16
coming up March 24th and 25th. If you use the code IDAC 425,
7:22
that'll save you €425. That is definitely coming up
7:24
here in the next couple of weeks by the time this airs.
7:26
So definitely want to make sure you take advantage of that.
7:28
Show some port. We will not be there, but we'll
7:31
be in Berlin for the European Identity and Cloud Conference.
7:33
So that is May 6th through the 9th.
7:36
I still only have a flight into Berlin at this point.
7:39
I still haven't figured out what I'm doing after that.
7:41
But if you use the code IDAC 25 MKO, that'll get you 25% off.
7:47
So hopefully we'll see lots of people out there that we know
7:49
and make and meet new friends while we're out there.
7:53
So that'll be exciting. I know you've got identity as
7:55
planned, right? At this point, it's just the one
7:58
identity beer in Oslo, and then I'm sure you'll be there for
8:02
this one as well. There there's like the identity
8:05
beer, which is the first. I guess it's May.
8:12
What's the first day? The Monday before the
8:14
conference? It's like May 5th or 6th, yeah.
8:17
Yeah, so there's an identity beer in Berlin there, so we'll
8:21
definitely be there as well. It's.
8:23
Pretty cool. I'm looking forward to it.
8:25
And then I take a week off and then come back for I think maybe
8:29
a week to the US and then head into Ideniverse Las Vegas June
8:33
3rd through the 6th. If you use the code IDV 25-I D
8:37
AC25, that gets 25% off. Don't worry about trying to
8:41
remember these as I quickly ran through them.
8:43
They will be in our show notes and they're always on the
8:46
homepage of idacpodcast.com and just Scroll down and you'll see
8:50
everything that we've got active at that point.
8:52
So hopefully people are able to take advantage of that and
8:55
doesn't cost us, doesn't cost you anything.
8:57
It's saves you money and just show support for the show.
8:59
So please use those if you plan on attending events.
9:02
Yeah, and I just want to say something before we kind of dive
9:05
into our topics of the day is I've had a lot of people reach
9:08
out to me recently and connect on LinkedIn and say that they
9:12
really enjoy it. So, and I got to tell you, like
9:15
every time that happens, like it's just like fills my heart a
9:19
little bit just to know that people are out there that were
9:22
part of their their lives or as part of their, their day of
9:25
their week. And you know, we don't know
9:29
that, right? We, we put the podcast out there
9:31
and maybe people listen, maybe they don't.
9:34
But when people reach out and say I really love the podcast
9:37
and he's laughter to me and I know it's us to you as well.
9:40
Oh, for sure. I mean, the fact that we we
9:42
don't advertise at all and we are 100% word of mouth, I mean,
9:46
it's pretty amazing, you know, how big this thing has gotten.
9:48
And yeah, it's definitely not lost to me.
9:51
Definitely appreciate everyone who takes the time to reach out
9:54
and yeah, it's great. So we'll keep on doing it.
9:57
And really that's what this show is all about today.
9:59
Even I mean, today's a mailbag episode, which we get lots of
10:02
emails and, and stuff like that asking us questions and we try
10:04
to kind of save them up to we've got kind of a, a good amount
10:07
that we think we can tackle that might be interesting questions
10:09
to for everyone to hear. So why don't we just jump right
10:13
into it? Do you want me to read these
10:14
off? Do you want to take turns like
10:16
how to how to view? Why don't you go ahead and read
10:18
them off for some kind of like in the hotel?
10:20
I've got just the laptop screen, no second monitor.
10:23
So I'm going like cheap and cheerful today.
10:27
That's fine. All right, let's start with, and
10:30
this is a very global mailbag by the way, so let me read this off
10:33
here. So Ryan from Sydney, Australia,
10:36
I presume I have a new I am professional looking to grow my
10:39
career. What certifications or skills
10:42
which would you recommend focusing on in 2025?
10:46
I think this is a pretty common question.
10:47
A lot of people kind of getting into the space.
10:50
Where do you even start? Yeah.
10:52
Do you want me to go first or do you want to?
10:56
OK, so. Yeah, I feel like this is right
10:58
near wheelhouse because this is all about sharpening the saw or
11:01
maybe even building a saw and. Providing the saw yeah, yeah,
11:04
totally. And I, I, I think there's not
11:08
one answer for everybody, right? Because you may be really good
11:12
in one area like you and I are especially was running a
11:16
program, but we're not going to write application code and
11:20
things like that work that's other people like they love,
11:23
like coming up with an idea, make something happen, then be
11:26
able to make it work on the computer.
11:29
So you have to know like what what gets you excited?
11:33
What do you what are you going to put the time into for other
11:37
people? It's like, hey, the idea of
11:40
being the go to person who makes a project happen.
11:43
And by the way, project managers usually get a lot of credit.
11:48
You know, it's a whole team that that pulls steers the boat.
11:51
But a lot of people in upper management came from a project
11:54
management background. So if you're a project manager
11:56
who delivered a project and made all the parts and pieces come
12:01
together, you get a lot of the credit behind the scenes anyway.
12:05
I love a good project manager because I hate doing that work,
12:08
so it's hard. One is invaluable for sure.
12:11
So let me give a kudos out shout out to people like Krista and
12:15
Ben. If you guys are listening, like
12:18
definitely you know the stars of the team.
12:21
Yeah, yeah, for sure. Like, and, and that's kind of my
12:23
background and I think it's a great place to go and develop
12:26
your skills. I also look if if what you
12:29
really enjoy doing is detecting from the side of the house and
12:33
like that's going to get you to develop yourself and build your
12:37
career, then you don't want to be doing stuff other than
12:41
project management and stuff. Put your time into what
12:44
interests you. I do think certification is
12:48
definitely having some leverage behind your name in this market
12:52
is a great way to kind of prove that you've got some knowledge
12:56
and maybe that you're you have some ambition and aspirations to
13:00
further your career, especially if you're starting to take
13:03
certifications that are maybe a step beyond where you are at the
13:07
moment. And then I think, you know, so
13:11
that can go all the way up to like when you start thinking
13:13
about certifications like CISSP and PMP and stuff like that,
13:19
where it's like, oh, now I'm thinking like, I want to be
13:21
somebody who does large scale project management or I want to
13:25
be maybe a seeso someday. Now you start getting looked at
13:32
and offered positions and opportunities maybe within your
13:38
current company to take on bigger roles.
13:40
And that's how you build a career.
13:43
I think, you know, the question was probably more of like, how
13:45
do you start out? But it's, I think we, we, we do
13:49
wind up answering that a lot, I think.
13:50
But I think one way is to don't be afraid to do kind of some of
13:56
the entry level roles like working on the help desk.
13:58
I mean, you know, my role, my first role wasn't really helped
14:03
desk, but I did a lot of like help desk work where I would
14:05
like do end user troubleshooting stuff.
14:08
And you'd learn so much from doing that, both sides of the
14:12
house, dealing with people and also like learning how to fix
14:16
computers and work through your identity access non vintage
14:20
shoes. Yeah, I mean, I started in the
14:23
help desk, you know, didn't really have anything, any fun
14:27
stories out of that other than, you know, that's how I got into
14:30
it is like help desk. The next thing you know, I'm
14:31
doing IoT stuff before it was even called IoT back in 2001.
14:36
So definitely would echo you need to make a decision probably
14:42
earlier on, do you want to be technical or non tech?
14:47
Because there is plenty of space for both.
14:49
I feel like it might be easier for some people to do the
14:53
technical because there is a wealth of training.
14:56
You know, there's different vendor trainings for different
14:58
products. Some of them charge, some of
15:00
them are free, tons of YouTube videos, things like that.
15:03
It might be a little bit tougher to get hands on with vendor
15:07
solutions because those typically cost money and you
15:10
really only can learn what you got access to.
15:13
So that's where maybe a certification does help because
15:16
typically with a certification, especially particularly a
15:18
course, they might give you access to, you know, like a like
15:21
a sale point training environment or a Savient
15:23
training environment or ping or cyber Ark or or something like
15:26
that. If you don't want to be
15:29
technical and that's fine. I think you still need to be
15:32
technical enough to have a solid conversation, but that's where
15:34
the soft skills come in. So if you could articulate and
15:37
communicate really well, if you're well, organize plenty of
15:39
spaces, you know, for that kind of stuff, and then you just kind
15:42
of build up the experience from there.
15:43
I think you've got to be realistic too, that if you don't
15:46
have any I am experience and you're looking to get I am,
15:48
you're probably going to need to figure out, you know, how can
15:51
you how can you kind of make that work?
15:52
But I would definitely echo the same thing.
15:55
Start, start with what you like to do and then fill in the
15:58
cracks around that. ID Pro has a great body of
16:01
knowledge for people who are looking to, you know, get into
16:04
it. I think it's, it's a good
16:06
starting place. You know, there's, there's a lot
16:08
more resources now than there ever has been and new ones are
16:12
always popping up. So like our friend Andrew
16:14
Chance, the phone has, you know, YouTube channel, He does
16:17
LinkedIn learnings. Like there's a bunch of stuff
16:19
that's out there that people have access to, but you have to
16:23
be prepared to, you know, grind it out.
16:25
It's not going to happen overnight.
16:27
What do you think about for somebody who is, you know, mid
16:31
to late career, do you think that it makes sense for people
16:36
who are say, coming out of the military or I've just decided to
16:41
like, I need to change. I need I want to get into
16:46
identity. I listen to Jim and Jeff and I,
16:49
you know, I hear people like Eve and Ian talking.
16:52
It seems so exciting. What do you think for those
16:55
hoes? I mean, a lot of folks coming on
16:57
the military may already have some of these skills, especially
16:59
if they're coming from an IT background into the military
17:01
itself. You know, there's definitely
17:04
opportunities for sure to take advantage of that.
17:06
I think the other things to think about would be, you know,
17:09
again, IT, yeah, I think the military teaches discipline and
17:14
that is always helpful no matter what job you're in.
17:17
So yeah, I think that's, I think that's a good background to
17:21
start with. And look there, there are roles
17:23
out there. Some of them aren't, you know,
17:25
sexy. They're entry level.
17:27
You might have to start somewhere.
17:28
But if you are interested in IT, you know, spend the time, I
17:32
mean, I started an help desk, didn't know anything about IM.
17:36
And next thing you know, I'm being shown here's these
17:38
different things and then start to figure it out.
17:40
And then next thing you know, I'm programming Siemens lighting
17:43
controls to make them on the network and, you know,
17:46
connecting them to electrical panels and all kinds of stuff.
17:50
You know, before that I was bartending.
17:52
So really. Yeah, the, the, the line is very
17:55
thin that you need to kind of pass.
17:56
So you just need the opportunity.
17:57
And I hate to say it was sometimes luck is part of that.
18:00
And you can increase your luck by maintaining and building
18:04
relationships. There's a lot of people in this
18:06
space. And if you start to work in
18:08
those relationships, you know when things open up that'll
18:10
that'll help you get your foot in the door.
18:12
I'm sorry, I think that's, that's a great summary, right?
18:15
Because it's not like if you take this certification or get
18:20
that degree, you're guaranteed a good job anyway.
18:22
You could be stuck in a tough job market or you have none of
18:26
those things and you just get lucky and lend in a job.
18:31
So you just got lucky of it, you know, get that opportunity that
18:35
you didn't even really know where it would lead.
18:39
Yeah, for sure. And I think there's certain
18:41
sectors maybe that might be easier to get into.
18:43
You know, maybe like nonprofit, it's typically, you know,
18:46
looking for folks all the time because they may not, you know,
18:49
pay as well as others, but you get lots of great experience
18:52
there and you get to wear a lot of hats.
18:53
So, you know, maybe that's a an attitude to get in the door for
18:56
for folks. So volunteering is another way,
18:59
local organizations, you know, just offer to help and be
19:02
helpful and hopefully you know that leads and stuff.
19:05
Yeah, Yeah. That's a great, great 1.
19:07
So I think we hit that question pretty good.
19:09
Yeah, that was going from Ryan. So hopefully that helps.
19:11
If not, drop us a message on LinkedIn and tell us what how
19:16
else we can answer that question.
19:17
That's a. Good question for you, Jeff.
19:19
That's a good question. So I looked at our podcast
19:23
listener stats and I don't trust them completely, but I wanted to
19:28
ask you, US is definitely our top country for listener that
19:33
like 36%. Surprisingly low if you think
19:38
about it. Where this thing?
19:39
Started what country came in second place?
19:42
I think it's the UK, isn't it? I mean, it's gonna be English
19:45
speaking India maybe. India, OK.
19:48
So yeah, give me a guess of what percentage of our listening
19:51
population. 10:15 I haven't looked at this.
19:56
I have access to that I just haven't looked at in a long
19:58
time. So this is just over the last 30
20:01
days and it was 3.6% three. .6% That doesn't sound like a lot.
20:07
It doesn't. That's second place.
20:09
So it's really spread out over all the countries.
20:13
That's right, we are. We don't, we don't put all of
20:14
our eggs in in one American basket.
20:16
We spread them all over the world.
20:18
And eggs are really expensive right now, so that's probably a
20:20
good thing. Yeah, that's true.
20:23
All right, well, let's let's keep moving around the world
20:25
here. Let's go to Diego from Madrid in
20:29
Spain. What are some of the most common
20:32
mistakes companies make when rolling out MFA and how do you
20:36
avoid them? So first mistake is if you're
20:40
waiting till 2025 to roll at MFA, you're probably about, you
20:44
know, 10 years really too late, but really probably four or five
20:47
years too late at this point. But hey, yeah, let's, let's
20:50
assume you know, that maybe they, they, you know, just
20:53
couldn't get to it and now they're doing it.
20:54
So what are some common mistakes that you've seen, Jim, when it
20:57
comes to rolling out MFA? You know, so my, my first
21:03
reaction to this question is that the IM practitioners that
21:08
I've worked with tend to know their user populations really
21:11
well. So I don't think the, it's just
21:16
like the user experience or just forgetting things about your
21:19
user is a common mistake. But I do think that's probably
21:23
the area that, you know, we say this has got to be the front and
21:27
foremost on your mind is like our user is going to receive
21:31
this. And there's user populations
21:33
that don't have access to their device when they are at work.
21:39
So if they're in like kind of a clean room environment or maybe
21:42
working in a prison or something, they can't bring in
21:44
their phone, that's a concern. Then there are certain users
21:48
where they're like, those are my phone, I pay the bill, why
21:51
should I have to take, you know, install your software on it,
21:54
things like that. So I think different
21:58
organizations face different use cases like that.
22:01
But in my experience, like practitioners seem to know that
22:05
one. I think the biggest probably
22:10
thing that I've seen people get hung up on, it's like if they
22:12
try and push it up to too many users at once and they're helped
22:16
us yes, for us with issues for because I mean, let's face it,
22:20
you know, we go back to my my favorite person to bring up on
22:23
like who's a non-technical person, my dad.
22:25
I. Haven't heard from your dad in a
22:27
while. I know.
22:28
Well, here he is and you know, you push out MFA to him and he
22:33
might be like, what is this? They want me to, especially if
22:37
you, you do something new. And it's not like if it's the
22:40
SMS to your phone, he's trying to get to figure that out
22:43
because everybody does that. It's like you picked up us now,
22:46
but if you have to go and download an authenticator app,
22:50
it's not going to get it. It's might be the first time
22:53
he's ever had to do it. It's going to be super
22:55
confusing. Or even if he has done it, he
22:59
maybe hasn't done it twice on the same authenticator app or
23:02
no. Like the insurance and outs of
23:04
how it's going to work. It's going to be confusing to
23:07
him. So he's probably going to have
23:09
to call the help desk or open some kind of ticket or
23:11
something. Which is fine, he can handle
23:14
some tickets coming through. But if you do 10,000 users in
23:17
one weekend and your help desk gets 1000 messages, man, you're
23:22
in trouble. Yeah, I mean I I don't want to
23:24
get 10,000 calls from your dad asking me to set up an
23:28
authenticator. You know they won't be quick,
23:30
They won't be quick calls. Well, I think that, but that
23:33
highlights, I think, the importance of communication and
23:36
the user experience. Think about what you're doing
23:39
and then make it as simple as possible.
23:42
Yeah, just simplify it. So definitely, for sure, I think
23:47
simplification helps. You know, I struggle with this
23:51
because everybody at this point, no, everybody in the IM industry
23:54
and security industry probably understands the SMS is not a
23:57
great MFA option. It's very easy, it's ubiquitous,
24:01
we've all figured out how to use it, but it is better than
24:04
nothing. So if you have the choice and
24:08
you think your users can tolerate it, try to go with a,
24:12
you know, an authenticator app of some sort, either your own
24:14
company or one of the major ones like, you know, Google,
24:17
Microsoft, Authy, you know, things like that.
24:19
There's plenty of those out there.
24:22
But I would not, I would not try to force people, especially
24:25
right away into the most difficult one.
24:31
Try to have a couple options. I think mistake that I see is,
24:35
well, we're only going to use the the authenticator app from
24:38
Microsoft, for example. Just pick on that one for now.
24:40
It's a great app. It works well, but if that's the
24:43
only option you've got, what if your phone doesn't support it?
24:45
What if you forget your phone, right?
24:46
There's a whole bunch of other kind of things around that and
24:49
you, you're really setting yourself up for pain on the help
24:53
desk side. So you'll want to think about
24:55
that. I think the other thing that I
24:57
typically see is they think it's like an, like a, either an all
24:59
or nothing or well, we're just going to put it on this app.
25:02
And so you end up with these gaps and covers.
25:04
OK. Well, we have MFA, but it's only
25:06
on our Active Directory and there's a whole bunch of like
25:10
SAS apps out there that don't have MFA.
25:13
So I think trying to have, you know, the coverage to make sure
25:17
you have as many applications as possible with an MFAA lot easier
25:22
if you have a single identity provider, single sign on
25:24
provider that you're using that you can tie that to might not be
25:27
feasible for everyone. But try to have as much coverage
25:30
with as many different options and let people choose the option
25:34
that they like. And over time you can ratchet up
25:37
the security. Like I said, I don't, I don't
25:38
think you have to go immediately to, you know, retina scan and
25:41
and you know, send me your force born child.
25:43
To prove who you are, but you're definitely going to get hate
25:46
mail for that one. So direct the hate mail to Jeff
25:50
at I Back podcast, not Jim. That's fine.
25:52
Yeah, you know, you know, you've made it once you get hate mail.
25:54
So that's I'll take it. You have to have haters.
25:58
OK, so two thoughts come to mind #1 is, you know, MFA is multi
26:04
factor authentication, 2 factors.
26:06
And here I'm going to name three factors.
26:08
Then you get to pick two of them, but they have to be
26:10
different ones. Something you know, something
26:14
you have, something you are. So if you say our MFA is first,
26:20
we're going to get your password and then we're going to ask, you
26:24
know, what was your first bet like that's not MFA.
26:29
Knowledge based medication sucks, don't do it.
26:33
Probably what everybody already, everybody already knows, but you
26:37
still know it's out there and it's horrible.
26:42
So I will send you more time on that.
26:44
The other one though, is what I used to talk about a lot was the
26:49
unhappy path. So you've got to make sure that
26:52
if you're going to let people self-serve, reset their multi
26:56
factor authentication that doesn't go back to knowledge
26:58
base, like, oh, you want to reset your authenticator app?
27:02
Sure. What what was your first touch
27:05
name? Like?
27:08
No, like that's what the heck are you going to go right for?
27:11
So most people know that they're saying, I mean, like you said,
27:16
like it's should not be in 2025, the thing you're rolling out,
27:20
but if you have to, you have to. And then think about NFA
27:24
everywhere. Yeah, communicate have many
27:29
options. Make it easy.
27:31
If you, if you treat your IM program and your services like a
27:35
product, is it a product that people want to buy from you and
27:38
use? Think about from that
27:40
perspective, if it's a crappy product, no one wants to use it.
27:43
They're going to find ways around it.
27:44
So find ways to make sure that your IM product or collection of
27:49
products, right, Whatever that looks like for your own program
27:51
or, or whatever it is. But they're good.
27:53
I mean, nobody wants to use, you know, garbage.
27:55
So make sure you actually, you know, give some thought into
27:58
like, hey, is this something that I would use?
27:59
And if it's not, rethink it. You know, maybe there's an
28:03
option that that might be, you know, a little bit easier.
28:06
You know, sometimes you have to make trade-offs.
28:08
I get it. But I'm a big fan of
28:10
productizing. I am.
28:11
And if you have a good product, people will gravitate towards
28:14
it. That's how I feel, totally.
28:17
What else do we have? All right, let's continue.
28:20
I feel like we're staying in the in that same hemisphere.
28:24
We'll go with, let's see, Omar from Dubai and the UAEI like
28:30
this question. I kind of say this one for last
28:31
because I think we can probably go into this quite a bit because
28:34
OK, so he asked us how should small and mid sized businesses
28:39
approach IM when they don't have the same resources as large
28:42
enterprises? Omar, I'm going to give you the
28:45
identity at the center listener of the week stamp of approval
28:48
because I think it's such a good question.
28:51
This actually got sent maybe a few weeks ago.
28:54
So I kind of been sitting on this one because I knew we were
28:56
going to have a mailbag coming up.
28:57
So I haven't responded in person, but hopefully you're
28:59
listening a more. I love this question for a
29:02
number of reasons, but please, you start Jim.
29:06
Well I got to say for Omar, if you send us your address, we'll
29:09
mail you a sticker. International UAE like 5 bucks
29:14
to mail a. We'll leave it at the hotel in
29:16
Berlin and you can come pick it up.
29:17
How about that? Or just meet us up in the
29:20
conference. But yeah, I mean, it is a good
29:24
question because you know, where do you start saying, well, don't
29:32
spend your money on this, don't spend your money on that.
29:34
I think it's you have to think about the crown jewels of your
29:37
organization and then like kind of critical data, critical
29:43
applications. And so once you kind of focus on
29:46
what those points are, I think the first thing you have to do
29:49
is have strong authentication to all those.
29:51
So if you do have any kind of network or IDP, you've got to
29:57
protect that with strong authentication, which means
29:59
multiple factors of authentication.
30:01
Ideally it's something like biometric based authentication.
30:08
I think the second thing beyond that is like protecting your
30:12
e-mail system, protecting your ERP application, whatever are
30:16
the applications where it's like that's where our data says
30:19
that's where our our information.
30:22
Maybe it's your recipes, your your recipes system, but usually
30:27
it's like your business system and your e-mail.
30:29
And you know, a lot of times it's your Microsoft system.
30:33
So I'm not saying this is what people should do, but this is
30:36
what I see a lot is that organizations say, all right,
30:39
well, you know, we make doughnuts or we make chairs or,
30:44
you know, they're they're not a mega, you know, billion dollar
30:49
company and they want to still be secure, but they don't want
30:55
to spend all their money on security and on 19.
30:58
So we'll go out and get the Microsoft suite and they'll use
31:04
the Microsoft authenticator and they kind of like build around
31:07
that. They put all their files out on
31:09
the Microsoft shares. I'm not saying that's the only
31:11
way to do it, but that is what I probably see the most.
31:17
Well, I think that's, that goes to the strategy of
31:19
simplification, right? If you have fewer places to try
31:22
and secure, if you've settled on a platform, let's say like
31:25
Microsoft or Google Workspace or something like that, right,
31:29
you're, you're reducing the attack surface by having fewer
31:33
things. So that's good.
31:35
I like this question because nobody has unlimited funds.
31:39
I don't care who you are, there is always a theoretical cap
31:42
maybe for some people, but you have to pick and choose the
31:45
battles. This is a question you and I
31:47
have wrestled over, you know, for years over well, where do
31:49
you start? Do you invest in authentication
31:52
first? Is it privileged access
31:54
management? Is it IGA?
31:55
Is it something else? And the answer is, you know, or
31:58
consultants. Depends.
31:59
It kind of depends on where things are at.
32:02
But it's not just a technology thing.
32:05
It could be the people in the process.
32:07
What if you don't have enough people to AT at, you know,
32:09
adequately or effectively do? I am for your organization, you
32:13
go out and hire new people, that's expensive.
32:16
Do you contract it out? That can also be expensive.
32:19
Do you get maybe get like a, you know, security provider or a
32:22
managed provider of some sort to kind of augment things?
32:25
Believe it or not, that actually might be cheaper than trying to
32:28
hire somebody and, you know, and, and train them and bring
32:31
them up to speed and then keep them on the long term for, you
32:34
know, a, an employee. So I think I think you have to
32:36
look at it from a few different fronts.
32:37
I'm going to tackle it from the business side first because they
32:39
think you have to make the justification for how do I
32:42
invest in I am. Do we have enough people?
32:45
If we don't, what is our staffing strategy going to be?
32:48
Can we support hiring people? Do we want to contract it out
32:53
and maybe, you know, fill that temporarily while we're bringing
32:56
in, you know, staff? Or do we want to go the route
33:00
of, Hey, let's keep the important stuff on our side and
33:04
then maybe use like a managed provider or something like that
33:07
to baby be like our outsourced, I am operation or, you know, I
33:12
am service in a box, right? Whatever that looks like, you
33:14
know, for the different providers out there, I think
33:16
that's one thing you need to figure out first is like, OK,
33:18
from the business side, how do we want to structure this from a
33:21
staffing perspective? And then on the technology side,
33:24
where are our crown jewels? My, my current thinking and, and
33:29
has been probably for the last couple years is if you don't
33:31
have MFA, that should be your first thing that you do, no
33:34
matter what, figure out how to get MFA in place.
33:37
If you're not licensed for it, which I don't know how that
33:39
would even work for Microsoft. You know, make sure that you got
33:42
it set up, take advantage of the licensing you have and turn on
33:46
every single security feature that you possibly can that makes
33:48
sense of your organization. A lot of people for whatever
33:51
reason, just don't take full advantage of their licensing,
33:54
you know, in that perspective. But you know, get MFA in front
33:56
of places and there's plenty of options out there.
33:58
Doesn't have to be just Microsoft, right?
33:59
There's add on MFA and all kinds of things.
34:02
And then start thinking about your business processes.
34:05
Where are you going to get the most bang for the buck?
34:07
I think a lot of people wish they could afford a, you know,
34:09
top end, you know, product like a sale point or a satient.
34:13
They're very expensive. You know, that's just, that's
34:15
just the way they are. But there are a lot of good
34:17
products, especially in the IGA space that I'm finding that are
34:20
much more economical. They may not have, you know,
34:23
the, the cachet or the the tracker of success or the great
34:27
training programs, all that stuff, but you might find that
34:30
there are some other products in this space that, you know, maybe
34:34
more palatable from a budget standpoint.
34:36
But I wouldn't even bother trying to justify an IGA spend
34:41
unless you have a lot of onboarding, offboarding, you
34:46
know, critical compliance needs to run access certifications
34:50
and, and things like that. I think you can get a long way
34:53
with the appropriate business process, the appropriate
34:56
governance on a program level before you even need to spend
34:59
money on stuff. That's kind of what I'm thinking
35:02
right now. But what do you think, Jim?
35:04
Yeah, I had a couple of other thoughts that you were talking.
35:08
I think there's a big difference between a small enterprise and a
35:12
mid sized enterprise where you could be talking about you know
35:15
a 10/20/30, a $100 million company that is not the multi
35:21
billion dollar company. And so those are different
35:25
scenarios, right. I also think it's kind of what
35:29
is your starting point? Are you this your first foray
35:32
into trying to secure your enterprise Oregon?
35:35
Have you been investing in it along the way?
35:37
And it's like, OK, yeah, MFA, we did that a while ago backing up
35:41
our systems. We did that a while ago, having
35:43
some kind of endpoint detection. We've we've been doing that.
35:47
So, you know, we can handle if we get reassure have a data loss
35:52
or something like that. The other thought I had was
35:56
cyber insurance, you know, are, is that a good investment for
36:01
you? We have a couple episodes that
36:02
we have recorded and if you go back to our archives or it's had
36:06
people come on who have expertise and cyber insurance
36:09
and how to think about it and how to position yourself well so
36:13
that you get not only the right cyber insurance, but you get the
36:16
a price that you can afford. Don't want to sound like an
36:19
insurance Marshall, but you know it, it is about not in a lot of
36:24
cases. So maybe that is your safety
36:26
net. I think a lot of it comes down
36:29
to where you are, what you've been investing in over time.
36:32
You know, you might have authentication already in place,
36:37
but it's really old and rickety, You have to update it.
36:42
Same thing with IJ. You might be in a position where
36:45
you have the home boat, home built system and you've outgrown
36:48
it versus somebody that's like 50 employees and they've they've
36:51
never had to take the song before.
36:53
Maybe they can manage the nose for a future only 50 people,
36:57
especially if they're not in highly regulated industry.
37:00
The other thing is that, you know, the question might be
37:03
coming in from Omar that you know, he's coming from the
37:06
perspective of customer. I am and that's a whole
37:08
different discussion. Now it's about, OK, well, even
37:12
if you're a small to mid sized business, you obviously have
37:15
aspirations to get bigger. What do you need to put in place
37:18
to make your customer experience, you know, superior
37:22
to what else is available? So then you have to start
37:26
thinking about what is your growing market strategy and how
37:28
does identity fit into that? That's it.
37:31
That's why I love the customer side because that's such an
37:34
exciting conversation. Well, the other thing too is on
37:37
the customer side, what happens if you get breached, Are you,
37:41
are you done because you got breached and you know, all your
37:44
customer data went out the door or whatever it may be?
37:47
What's the risk tolerance that your organization has?
37:50
Look, this stuff isn't cheap. I mean, security is expensive,
37:53
especially in the aggregate. When you start thinking of all
37:55
the things you can and should be doing, I think you have to
37:58
figure out where, where is your most riskiest areas and then
38:03
what do you want to do about it? Not everything has to have a
38:07
technology control. If you have a strong business
38:10
process, you have vigilant people.
38:12
I don't know the I am heroes that you and I talk about all
38:15
the time. You can get a long way with that
38:17
and a lot of places do. Eventually, though, you cannot
38:20
have a strategy of heroism. It's just security strategy that
38:25
is not sustainable. It might work in short bursts
38:27
and it might be something that's needed in the short term.
38:30
But I would, I would definitely start to think about, are your
38:33
business processes secure? Do you have a way to look at the
38:36
data? You know, how are you making
38:38
sure that you're trying to reduce the risk as most
38:40
possible? At some point, you know,
38:43
someone's going to have to make a decision, Hey, it's time to
38:45
spend a little money and catch up here or Augment or whatever
38:48
it may be. What tends up happening a lot of
38:51
times I see is you get so far behind that you have to spend a
38:53
lot of money to catch up. And it becomes like this
38:56
ginormous task to, to just get to where good is or maybe even
39:01
adequate. And then, you know, we, I, I
39:04
talk about peaks and valleys from a budget perspective, You
39:06
spend a whole lot of money catching up and then you don't
39:09
keep up with it. And then guess what, in three to
39:12
five years, maybe a little bit longer if you're lucky, you're
39:15
spending a whole bunch more money again to try and catch up.
39:18
Good. If you could just figure out how
39:20
to make that a slow and steady, you know, probably increase just
39:23
because prices get more expensive over time, I think
39:27
you'll have a better approach. But it takes a lot of financial
39:30
discipline to do that and not if your organization is in that
39:33
mode of, hey, this is going to be a sustained investment,
39:36
identity is forever. And so I think you need to think
39:38
about identity as a long term commitment for the organization.
39:42
I did want to say one more thing on this question before we close
39:46
out. I think a lot of people are, you
39:49
know, so always feels like you're like right on the cusp of
39:53
the next big thing and that if you just wait one more year,
39:58
then like AI agents are just going to do this all for you.
40:01
Well. Blockchain and picks everything
40:03
for us up. That happened a few years ago,
40:06
right? And here we are.
40:09
But I really feel like that, you know, I even had this
40:12
conversation with Brian the other day, one of our
40:15
colleagues, and he was like, you know, it feels like someone's
40:19
just going to come out with this big AI product in two years down
40:24
the road. And like, why spend $1,000,000
40:27
right now on IGA or whatever that's like do.
40:31
You think that Amrax would be cheaper?
40:33
Yeah, right. Exactly, exactly.
40:35
That's a good point. All these companies, you know,
40:37
spending billions of dollars developing, you know, IAI, they
40:41
need to recoup that money and they can't have like a 20 year
40:44
payback plan. So it's going to be like
40:46
everything else, it's going to be expensive at first and then
40:49
it will slowly come down in price.
40:51
But you know, whoever is building the 1st 100% automatic
40:55
AI agent that will solve all of your security needs, expect to
40:59
pay a lot of money for that and expect for it to not work very
41:02
well as a first iteration. I think, you know, first
41:05
versions of anything typically are the starting point minimum
41:08
viable product. Maybe you're you're going to be
41:11
in for some growing pains and expensive growing pains too.
41:15
It's a really good point you don't think of that, but I also
41:18
don't think in two years you're just going to flip some AI
41:21
switch and send to it all for you.
41:23
So what we find, what I find tend to find is that the
41:30
organizations that don't invest steadily over time, but once you
41:35
fall way behind and have to do so much just to get to, you
41:40
know, base level that it's like a really painful process for and
41:45
everything. Why do you need multiple
41:47
millions of dollars to solve this problem?
41:49
We did something eight years ago.
41:52
It's like, yeah. And we did something eight years
41:54
ago and didn't do anything with it since.
41:56
And now it's old, rusty, it doesn't doesn't work very well.
42:01
Yeah. It's not a moving, it's not a
42:02
stationary target. This is a moving target.
42:04
What's good now is going to be not so good, you know, at some
42:08
point and you're going to have to modernize or upgrade.
42:10
Or maybe I think that's, that's my case for sustained, you know,
42:15
appropriate funding. I won't say give me all the
42:16
money in the world because, you know, if you you gave me a
42:19
billion dollars, I couldn't once spend it all at once and I
42:22
couldn't get everything done anyway.
42:24
Give me, you know, $100 million. Thank you very much over the
42:28
next 10 years, right. And and it'll have to be a
42:31
little more risk like maybe that's, you know, it's a
42:32
ridiculous number, but hopefully the the example.
42:35
You'll still have every consulting company and every
42:37
technology vendor go through your best friend.
42:40
Yeah, that's for sure. Yeah, that is, that is
42:43
definitely a good point. OK.
42:45
So I think those are kind of the the three that we want to
42:48
tackle. Anything else or should we end
42:50
this thing on a lighter note? And who knows, maybe your maybe
42:52
your room will be ready. Yeah, yeah, that would be the
42:55
the best lighter note of all for me.
42:58
All right, do you want option A or option B?
43:02
Do you want me to stay tell you that without knowing what the
43:05
question is? Yep, I'll go to option A.
43:09
Option A OK, if you had to swap lives with a historical figure
43:14
for a week, what would it be and what would you do differently in
43:19
their shoes? I was going to say something
43:22
like Hugh Hefner or something, but I don't think that, you
43:26
know, just like quote UN quote, the easy life is is living life.
43:31
You know, you can pick somebody like a Frederick Douglass who
43:35
like man, what an impact he had on the world.
43:40
So, you know, I just got done watching the Harriet Tubman
43:43
movie. Really awesome movie.
43:45
What I want to trade places with somebody had it so hard, Yeah.
43:50
So it's a really tough question. Well, this is a chance to do
43:53
something differently too, right?
43:55
So I'll give you an example, right?
43:57
For mine, the one that kind of jumps out to me right away is
43:59
Abraham Lincoln. And, you know, not to be, I
44:02
guess, flippant about it, but I would probably not go to the
44:05
theater one night. Yeah, yeah.
44:08
Now you want to go to the Ford Theater.
44:10
You know, if you do DC, you can go and see where Ford Theater
44:14
was. Are you more great by it?
44:17
You're just filled with all that kinds of fun facts.
44:20
I know you're watching history documentaries all the time.
44:23
Oh, yeah, I do. I do.
44:24
I was watching someone on the. I had plenty of time on the
44:28
airplanes today, Hours and hours to watch history documentaries.
44:35
You know, I'm good with Frederick Douglasson.
44:37
You know, he was a contemporary of Abraham Lincoln.
44:41
He, you know, bought his way out of slavery and then just fought
44:47
to end slavery. What would I have done
44:52
differently? I don't think I think he had a
44:55
hard time during his time of really building a bridge between
45:00
himself and Abraham Lincoln. You know, he more saw Lincoln
45:05
for his, you know, I, I think he just couldn't get over Lincoln's
45:09
flaws and his eyes. He saw the slaw.
45:12
He went to Lincoln to be an abolitionist.
45:15
The country was not in the polition where they were going
45:17
to put an abolitionist in to be president.
45:20
And so that wasn't what Lincoln was.
45:23
He became an abolitionist by the end of the war, by the end of
45:26
his first term. But he wasn't there and it took
45:29
time to get there. So maybe partially it was people
45:33
like Frederick Douglass pushing along, but I think I would have
45:36
tried to befriend Lincoln a little bit more and support him.
45:41
And, you know, I think that's what I would have done.
45:47
You know, our friend Chad, he has a a saying and I don't know
45:50
if he he made it up or stole it from someone, but was it
45:53
Incremental progress is better than delayed perfection.
45:57
I mean, that's how I feel about it too.
46:00
Yeah, for sure. It's it's yeah.
46:04
And the late perfection never comes.
46:06
Is that how long is that delay? Yeah, We're still working
46:10
through that. And we're still working through
46:12
that in this country when we're talking about slavery, right?
46:14
We're both big people from that time period where the country
46:18
was going from a country that has slavery to a country that
46:22
didn't have slavery. But the remnants of slavery are
46:26
still part of our society today, right?
46:30
That's the delayed perfection. Because like, do you, you don't
46:34
really ever achieve perfection probably.
46:37
And so it's like just a memory. Well, you don't look back on
46:40
like ancient Rome and like, oh, and we're still living the, the,
46:45
the things that didn't ancient Rome.
46:46
We probably are at some level, but we don't even know about it.
46:51
So 1000 years from now, I think probably most of those years
46:54
will be dealt with 100%. Well, it'll be on, hopefully
46:58
it'll be on Star Trek and, you know, exploring no worlds, all
47:00
that stuff. So.
47:01
Yeah, if, if there's a world left.
47:04
All right, well, let's leave it there before.
47:06
Either on that lighter note. Yeah, thanks, Jim.
47:09
All right, let's go ahead and wrap it up for this week.
47:12
Thank you to Omar, Diego and Ryan for sending stuff in.
47:17
If you have other questions, drop them in emails or LinkedIn
47:20
messages to Jim and myself. We try to answer as many as we
47:24
get as they come through the good ones.
47:26
We tend to save, you know, for a mailbag like this.
47:28
But definitely appreciate people taking the time to, you know,
47:32
send us our thoughts and stuff like that.
47:33
So let's see on the web, IDC, podcast.com, if you like what
47:38
you heard, like and subscribe. If you don't like it, like and
47:40
subscribe anyway. And then send it to somebody you
47:42
hate. And, you know, maybe they, they
47:44
will either hate it, watch it with you or listen to it or
47:47
maybe they'll like it. So let's see what else connect
47:50
us on LinkedIn. And yeah, we'll leave it there
47:53
for this week. Thanks everyone for watching and
47:56
or listening and we'll talk with you all in the next one.
48:00
You've been listening to Identity at the Center.
48:04
We hope you've enjoyed the show. Make sure to like, rate and
48:08
review, and we'll be back soon. But in the meantime, hit the
48:11
website at identity@thecenter.com.
48:16
See you next time on Identity at the Center.