Latest / Identity at the Center / #158 - IAM for State & Local Government with Robert Snodgrass

Transcript

#158 - IAM for State & Local Government with Robert Snodgrass · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:27
sender podcast I'm Jeff and that's Jim.
0:28
Hey Jim hey, Jeff, how are you? That's a bad yourself good?
0:32
Yeah I see whatever we start the podcast just for people who are
0:37
listening on audio which I guess is everybody.
0:39
We have video going. What, what else would you be
0:42
listening to us? Not audio.
0:43
That's true screens. That's true.
0:45
And we but we can see each other.
0:48
Yeah. And I always crack a smile.
0:50
And then you crack a smile because, you know, I'm going to
0:53
get into some Thing and you just don't know what it's going to
0:56
be. But pretty sure this is the
0:58
Jeffrey act section where I have no idea what Jim is going to
1:00
say. So for you, for those listening,
1:03
you know, answer to the show and then I say, hi.
1:05
Jim. And then Jim comes at me with
1:06
something that I have no preparation whatsoever.
1:09
So, this is all thinking on my feet.
1:11
Yeah. Well this is this was easy
1:13
because I'm going to base it on real life.
1:16
Experience of I want to talk about the Gartner, I am Summit
1:20
that were scheduled to go to. What is that?
1:24
The 22nd through the 24th, fourth day for website and so
1:31
we've got a recording spot. We're going to set up some
1:36
podcast recording. So starting to invite people.
1:39
And I'm letting people know that they need to schedule time to
1:44
get from wherever they are to the time of the recording
1:48
because Caesars might be the biggest maze on the planet.
1:54
Me getting that point. A to point B is pretty difficult
1:58
at times. Usually you figure it out by
2:00
Wednesday and is just in time to leave.
2:04
Yeah yeah. It's a big spot.
2:05
I mean I think you if Gartner is where it usually is and I don't
2:09
know name of the spot but it's kind of like it's got a view
2:11
overlooking like the the pools or whatever it may be, the rooms
2:15
could be half an hour away and you and I and courtesy of our
2:19
friends at RSM, have a suite that we have booked that will be
2:22
sort of like our recording home base.
2:25
I have put in a request to make it as convenient as possible.
2:28
I know there's a bank of elevators, I got to go kind of
2:29
go up and down from where the gardener areas, but I have no
2:32
idea if that request will be honored or if it's even
2:35
available, so we'll see. But yes, if you are planning on
2:38
being on the show or even just want to watch a show, get
2:41
recorded and you know, reach out to Jim and I and Linkedin and
2:45
just kind of account for time. I know we're kind of booking
2:47
things out right now and working through schedule but it'd be
2:50
kind of cool it'll be the first time Jim and I are actually at a
2:52
conference together since As I'll never let him live it down.
2:56
He ditched me for aesthetic 8 last year with the phyto
2:59
conference but be get an opportunity to fist bump, you
3:03
know, shake hands. Whatever the greeting du jour is
3:05
for the day and then if you want to watch or be part of a show,
3:09
you know let us know. Be happy to try and figure out
3:11
how we can accommodate that Jeff have a pro tip for getting an
3:15
upgrade of room or whatever your request is pictures of benzene
3:19
dollar bill on palming it to the second trailer goes you know to
3:23
talk about That's not going to get you quite as far as Benjamin
3:29
Franklin will, and it gets an extra towel if you want to.
3:34
If you want to feather free room, I think you're in luck
3:38
with the Choi dollar bill. Yeah.
3:40
Do you have a, do you have an actual tip or you going with the
3:42
palm the cash Tibbits? It's money.
3:45
Yeah, I saw your phony talks and the other stuff.
3:48
Better be doing the walking. Yeah, everyone will be doing the
3:52
walking. That's what Vegas is as Well,
3:56
anything else or should we get into our topic?
3:59
Let's get into it, man. We've got a lot of a lot of
4:01
ground to cover here. And no kidding.
4:03
We're going to talk about identity and access management,
4:06
really focusing on the state and local government sector and to
4:09
help with that conversation. We've got our new friend, Robert
4:11
Snodgrass. He's a director in the security
4:13
practice here with us at our SM, welcome to the show Robert.
4:17
Yep. Happy to be here.
4:19
Longtime listener. First-time caller.
4:22
So thanks for having me on if I was Brave.
4:24
Use my soundboard to do some kind of wacky sound effect, but
4:27
just imagine in your head if you're listening to right now,
4:30
it is very cool, it's been great to kind of get to know your last
4:32
couple of months since we've kind of both been on boarded and
4:35
working through a lot of projects.
4:37
You've got a ton of experience in this space.
4:40
One of the things that we like to do when we have a new guest
4:43
on the show though is kind of learn about their origin story
4:45
and really kind of find out, you know, how did you get into
4:48
either Identity or sort of infosec?
4:49
Is it something that you chose to or did it choose?
4:52
You can kind of walk us through. How you got to where you are
4:56
right now? Sure.
4:57
So I've spent my entire career in cyber security Consulting and
5:02
my path to Identity, probably like a lot of people was a bit
5:05
of a zigzag. I actually initially started my
5:07
career working in a big for focused on actually your p
5:10
implementations and as part of that gained a bit of notoriety,
5:15
I call it some good and some bad as it related to dealing with
5:19
distressed projects and helping to bring those projects back on
5:22
track. So my focus.
5:24
Is really around cybersecurity solution delivery.
5:29
And as part of that path, it led me into both state government as
5:33
well as specifically the identity sector and through
5:36
that. I've had a great opportunity to
5:38
take my experience, which initially started in financial
5:41
services and particularly Fortune, 100 Banking.
5:44
And I've had an opportunity to work with.
5:45
Now, seven different state governments on various Cyber
5:49
Solutions, including digital identity over the last 10 years.
5:54
Different government. That's pretty good in 10 years.
5:56
That's a that's a that's an excellent track record.
5:58
I guess. You know, I will I'm going to
6:01
shamelessly, plug your organizational skills because
6:04
you are one of the most organized people.
6:06
I think that I've ever met Sol most people call that OCD almost
6:11
frighteningly. So I think that's that's quite a
6:15
compliment coming from you job because I was going to say,
6:17
you're one of the most organized people that I've ever met.
6:20
That's now we're getting in the tearing structure which means
6:23
Jim you're not organized at all. I'm not organized at all but I
6:28
and yeah but I'm doing all the organization for our podcast for
6:33
Gartner. So enjoy the outcome.
6:37
Hopefully we have the nine or ten sessions recorded that were
6:41
hoping for, but I think we'll be, we'll be fine.
6:44
So, Robert today. We're going to discuss state and
6:47
local government approaches to digital Identity or identity,
6:51
and access management, and how they different from Private
6:54
sector. And I guess, you know, if
6:56
there's any differences between state and local government, I
6:59
mean, do they take a different approach then one another?
7:03
And also we found a recent article that talked about how
7:08
states have been investing heavily over the past decade
7:12
into kind of getting their Workforce.
7:15
I am house in order and now they're kind of shifting their
7:19
focus for investment into the citizen.
7:23
I am space. So, just wondering if you could
7:25
maybe talk about that and you know, explain a little bit about
7:31
that Trend that's happening. Is that something is happening
7:34
across the board? Or is it something that's just
7:37
In Pockets? I think to really understand the
7:40
trend of identity, as it relates to state government, we really
7:43
need to understand the origin of Technology as it relates to
7:47
state government, because it's really very different than what
7:49
you might see in a traditional private organization.
7:52
So 20 years, Go agency is essentially operated
7:57
independently within the state government landscape.
8:01
So they had their own directors, they had their own budgets, they
8:04
had their own IT staff, and for the most part operated
8:08
independently as it related to delivery of those Solutions.
8:12
So then in the early 2000s the legislative body got tired of
8:18
essentially paying for 100 different, it shops and began to
8:22
form Departments of it. Within States and that's been
8:26
going on now for the last probably decade or so, is these
8:29
these kind of centralized, it departments were generated,
8:32
initially started with things like data centers.
8:35
Obviously there's a huge capital investment makes a ton of sense
8:37
for agencies to consolidate that investment into a single
8:40
location. But with identity, it created a
8:43
really unique challenge because you have agencies that are
8:47
typically potentially very large, think Departments of
8:50
Transportation Departments of Health that have 10:15.
8:54
Thousand employees. They have their own domain
8:57
structure, and then, how do you collapse that together into
9:02
unified naming conventions? How do you take this, you know,
9:05
Forest of various active directory, domains, and unify
9:09
them. And that's really been the focus
9:10
over the last you 10. 12 years is building.
9:14
That integrated view of what is your Workforce identity, as it
9:18
relates to an individual state I'd say, for the most part
9:23
states have really gotten over that hurdle with in their
9:25
Workforce and that's really why they're starting to look a
9:28
little bit down the road and focusing on that, that citizen
9:34
personas as you started to touch on.
9:37
This is, some Persona is is a bit of a unique concept and it
9:42
also isn't a unique concept. So the closest parallel I would
9:45
put to this is you really think about a consumer Persona where
9:49
the start of this was very Similar where it was really
9:52
meant to be a way as you dealt with education, with
9:56
transportation and so forth. How can we build a unified
10:01
mechanism for individuals to access those Services?
10:05
Basically, how do we reduce the barriers of entry for
10:08
individuals to come in? To a digitized government beyond
10:12
that though? I think there's some really
10:14
unique things that states are starting to think about as it
10:17
relates to the citizen Persona and why?
10:21
I think state may start to see really interesting impacts in
10:25
the private space. So one is the joining of both
10:29
digital and physical identities. So if we think about your
10:33
physical identity, as it relates to state government, driver's
10:36
license, right? Or a really simple example of
10:39
how you would go to various state agencies and prove who you
10:42
are, there's a lot of interesting use cases that are
10:45
being considered now about how do I join that with a digital
10:49
identity in some Samples that I saw of recently, read things.
10:53
Like, if you have your covid-19 vaccination card, can you put a
10:57
QR code on that? As a way to sort of validate
11:00
that record and have the most up-to-date information or on the
11:05
flip side, how do I take my physical driver's license and
11:09
digitize that and make that available to me, within my phone
11:13
in some way shape before? Real interesting, there you
11:15
wouldn't into the driver's license.
11:18
I'd like to follow up on that, but just had a thought.
11:21
As you were talking about kind of the transition that state
11:25
governments have made from, you know, having decentralized it to
11:29
centralize their tea and kind of the all the challenges to doing
11:35
that. I just had to think there's a
11:36
lot of big companies that have kind of found themselves.
11:41
Go through the same Journey, right?
11:42
If they were, you know, didn't have a push to centralize it.
11:47
Departments within that company early on well, they Build a
11:51
bunch of infrastructure, maybe they have some shared
11:55
infrastructure, like the network layer and but, you know,
12:03
normally I've seen a lot of companies where, you know,
12:07
active directories, where separate at one point, and
12:10
they've had to kind of go through the process of merging
12:13
it and really, that also kind of sets the stage for other
12:17
identity and access management challenges.
12:20
So, I mean, I don't think that's completely unique to States.
12:24
It sounds to me like that's where almost every state has
12:28
kind of found themselves. But, I mean, we see this a lot
12:31
in like, University context and see it.
12:33
A lot in big multinational companies especially if they've
12:37
grown by acquisition. Is that kind of your experience
12:40
as well. Yeah, absolutely.
12:42
So I worked for a fortune 10 bank for four years at the start
12:46
of my career and a big element that we had to work through is
12:49
that they grew very rapidly. Through acquisition.
12:52
They had organizations almost of equivalent size that they were
12:55
trying to bring under single identity umbrella.
12:58
And I think the challenges that we Face, there are almost
13:01
identical to the challenges that we faced within state
13:03
government. I think the difference is you're
13:05
facing them 10 12, 15 years later.
13:08
So, in some ways you have the advantage in that you can take
13:12
those proven use cases from the private sector and really apply
13:15
them into the public one. I think that lag is helpful
13:19
right? Sometimes sometimes it might be
13:21
a little of a hindrance or they go.
13:22
Why isn't this? Why isn't this service easy to
13:24
use? Like what do you mean I have to
13:25
like fill out a piece of paper, right?
13:27
Look it's only 22 are doing that sort of thing.
13:29
I want to touch back a month because I might get to privacy
13:31
for a second. But before I get to that, you
13:32
mentioned earlier on that a lot of legislators have gotten
13:36
together to essentially kind of form these centralized
13:40
Departments of it or services or whatever might look like.
13:44
Is that something that you've seen across the board
13:46
essentially for like all 50 states or is that you know, half
13:49
the state's, you know, like what What's been the adoption of sort
13:52
of that sort of mindset of a central shared infrastructure,
13:56
group of some sort at this stage and I can't speak for all 50
14:00
states because I've interacted with all 50 states.
14:02
But at this stage, you know, beyond serving directly with
14:05
seven states, I probably interacted with another 20 to
14:07
25, every single one of them has some level of centralized it the
14:14
way in which they're funded and the level of service that they
14:18
provide to both state. And Or local governments will
14:21
vary dramatically between States but all of them will have a
14:25
central it department and in every single one of those
14:29
circumstances. That is the department that is
14:31
driving the identity discussion. It seems to me like it's a great
14:34
opportunity to have more interoperability between the
14:37
different states for those types of scenarios like vaccine or
14:41
driver's licenses or other forms of being able to check things
14:45
which you know, if I put my tinfoil hat on now I'm starting
14:48
to talk about privacy and there's this natural.
14:51
Enough, what is the government doing with my data on?
14:55
You know, we've seen some some recent things at least at the
14:57
federal level with things like the IRS and ID me, I guess from
15:01
a, from a privacy standpoint, you know, what is the sort of
15:06
data that state or local governments want?
15:09
What are the constraints that go around how they might utilize
15:12
it? Or, you know, those types of
15:13
scenarios? Like, what are some of the
15:14
things that that those operations are thinking about to
15:18
try and protect the citizenry? You know, and their data so you
15:22
mention ID me but I think probably the better parallel
15:25
from a state identity identity to Federal identity perspective
15:28
is login dot-gov. So log in.gov if you've
15:32
registered for things like TSA PreCheck or Global Entry is the
15:35
mechanism in which you log in and so what login dot gov did
15:40
and what states are doing is really trying to build a shared
15:44
set of piping in order to facilitate authentication that's
15:49
primarily what they're driving towards.
15:51
The Privacy question is a good one.
15:53
Because in some ways, not to the same extent that the federal
15:56
government does, but state government has more information
16:00
about the individual than just about any other industry,
16:04
vertical that's out there. And there is no unifying law,
16:08
around collection, and usage of that information.
16:12
Now, I would say in the last five years, five to ten years,
16:16
there's been a definite trend of States, hiring permanent data,
16:21
Data privacy officers and or data governance officers to
16:25
better understand the data they have and how it's being
16:28
utilized. But laws that people often
16:31
associate with State privacy, like the California consumer,
16:35
protection act are focused on consumers not government
16:40
services. So there isn't, you know, that
16:43
one place to look at to really understand those questions.
16:46
And a lot of cases, you're seeing very agency.
16:51
Laws and regulations driving that so Center, for Medicaid,
16:55
and Medicare services. For example, has a view on this,
16:59
the Social Security Administration has a view on
17:01
this. The driver's license privacy
17:03
protection act has a view on this.
17:05
And so, it's a really hard question to answer sometimes,
17:10
when you're trying to go through this view of, how do I balance
17:14
building out a very robust process to identify and proof an
17:18
individual, but not create A honey pot of data that both
17:25
exposes the can the individual constituent as well as violates
17:31
their understanding of how the data was going to be utilized.
17:34
Yeah, I think that's that's the main concern, right?
17:35
Is we're in the age of breeches. So, of course, the more data you
17:39
consolidate in the one spot. The more a concern there is that
17:42
all that stuff gets out there and now we start thinking about
17:45
things like biometric, you know, you can change your password,
17:47
can't change your fingerprint at least not legally or maybe even
17:51
Only so things like that become a lot more sensitive from a
17:55
sharing perspective and where is it being stored?
17:58
I think of you know you mentioned login dot gov and you
18:00
know I have PreCheck and I have a passport and I use that to log
18:03
in those types of services, a service like that essentially
18:06
already exists. Why would another agency?
18:09
Even think about using something else from a medication
18:13
standpoint and there probably are certain scenarios like
18:16
identity proofing. You know, prevent financial
18:18
fraud, maybe that's why IRS didn't look at it.
18:20
Or maybe didn't meet their needs, but it seems to me like,
18:23
if we, they're still this, as a as a Outsider looking in, like,
18:27
I see what seemed to be suitable services, but then it seems like
18:32
because of all the different use cases or requirements, or laws
18:36
or regulations, whatever they be.
18:38
We still haven't come up with a scalable or modular.
18:42
Enough way where it's kind of like a no-brainer de facto
18:45
standard for government services.
18:48
Yes, I log in, with my login, Dot, Than the u.s. maybe it's
18:51
something else in a different country.
18:53
I think I can't remember the country in the Europe but
18:56
they're like totally is a martini or something like that
18:58
where they're like 100% digital and they've kind of figured out.
19:02
It seems they've been that way for a while.
19:05
Like why haven't we caught up to that from a central?
19:09
I think that I think Estonia actually Tony only ones I was
19:13
thinking of where they have a pki enabled infrastructure for
19:16
their for their digital identity, it really interesting.
19:19
So I think obviously any individual State probably has
19:23
more complexity to it than Estonia does.
19:26
But you know there's a number of kind of deployment related
19:30
challenges that as you think about what's the model we even
19:33
went to apply here and depending who you ask they take a very
19:36
different approach. There's really only three views
19:39
to this. At the end of the day, there's a
19:41
centralized model, there's a Federated model and then there's
19:44
just a completely decentralized model.
19:46
It's a decentralized model is basically what you just talked
19:48
about the Stony. Oh, and this is the direction
19:50
that the States have gone like with Ohio and in the Innovative
19:53
Ohio solution where the department of IIT, essentially
19:57
builds a singular infrastructure for identity.
20:01
So it has the identity store, it manages the authentication, and
20:05
you essentially plug into that. It is, it is the IDP for State
20:08
Services. Then you have a more Federated
20:11
system where you can have multiple identity providers that
20:15
you're utilizing. I think I read an article where
20:18
it's Canada actually. Rates with certain banking
20:22
systems, in order to drive identity and then you can have a
20:26
totally decentralized but based on standard integration pattern
20:30
view which is really interesting.
20:33
I think from a data privacy perspective because no one
20:37
controls the full View and that certainly in and of itself
20:40
strives drives kind of a bit more of a container around the
20:43
data they have, but the complexity of what that really
20:46
means in the management of it. Also, generates a lot of
20:50
question marks, To my mind. So until we can really come to a
20:54
conclusion on that. I think that each state is
20:57
really trying to make that determination on their own
21:00
wasn't black chain, supposed to solve that for us, and we've
21:02
been hearing blockchain and block identity.
21:04
Things were going to be like the decentralized way to everybody,
21:08
manages their own data and it's going to be a perfect world.
21:11
And I feel like here we are, I think I first heard about this,
21:14
probably at Gartner, like four or five years ago and I still
21:18
haven't, it's it hasn't gotten anywhere.
21:20
When identity present Active, even though on the face values,
21:23
like oh, that seems like a pretty applicable use case,
21:25
Civic Health Care education. I can see it making a lot of
21:30
sense there. But we're I don't know anybody
21:33
who's like really doing it really in the real world at any
21:37
scale that matters? I'm not aware of anyone that's
21:41
looking at that it, you know, the idea of a transparent
21:46
citizen own identity. That is portable like you would
21:49
see as part of your Apple, wallet is exciting.
21:54
And I think very interesting position that states and or the
21:59
federal government could play to really drive forward, not just
22:03
state and local government, but the market of identity as a
22:06
whole, but there really hasn't been Been that singular
22:09
leaderships, whether that's Department of Homeland Security
22:13
or directly within sisa that that has not really been a
22:17
direct strategy for them at this point in time.
22:20
There are some really interesting Investments that are
22:22
coming out of the federal space. The infrastructure act that was
22:26
signed under the Biden Administration.
22:27
Last year has about think about 1 billion dollars Associated to
22:32
it. And grant money related to State
22:35
and local government Partnerships related to
22:38
cybersecurity Purity, no guidance specifically on how
22:41
they anticipate awarding that and what is going to be used
22:45
for. But, I mean, it creates
22:47
interesting questions that can you unify some of that money in
22:52
a way that drives forward, not just for a singular state, but
22:55
for a region or even the country, you know, I feel like
22:58
when we have this privacy discussion, you can't have the
23:02
discussion holistically without talking about, like, arcs, Odin
23:06
and Wikileaks. And Kind of what impact that
23:09
had. I'm wondering when it comes
23:12
because I think most of the Privacy regulations that we
23:17
talked about in our industry things like CCPA, you know, they
23:21
don't really apply to government agencies.
23:24
So I guess the formal question would be what draw what is
23:28
driving or what framework do policy or I'm sorry yeah privacy
23:33
practitioners use from a government side too.
23:38
Determine hey, what day does should we collect and things
23:41
like that? I'm kind of wondering if the
23:44
whole Wikileaks peas kind of like looms over is that kind of
23:49
influencing that in other words. Hey, if we collect it at some
23:55
point, it may become publicly known that we collected errors
23:59
that just something. I mean you know I noticed a tank
24:02
state governments probably aren't collecting the kind of
24:05
data that say the NSA is collecting.
24:08
Getting caught, I'm wondering like if we hope right.
24:12
But what's kind of driving privacy practitioners Within
24:18
These government agencies to determine what data to collect?
24:22
So I can't speak to data privacy as a whole, but in the context
24:26
of identity and I'll talk about it in two ways, identity,
24:30
proofing, and identity affirmation.
24:33
It is something we talk about every single day.
24:37
In the reason we talk about it, every single day is we want to
24:39
avoid those data Marts, honey pots Wikileaks, whatever view
24:45
you want to apply to it around the collection of data, that
24:49
potentially creates an attack surface, that we're just not
24:54
interested in taking the risk associated with.
24:56
So when we talk about identity proofing, so when I initially
25:00
come into a digital service and identifying you are who you say
25:06
that you are, we have a lot of mechanisms available to us
25:09
within the state government to facilitate that, but we want to
25:12
right-size the risk of both collecting that information, as
25:16
well as validating it with the service that you're attempting
25:20
to access. So, for example, if you're
25:23
coming in to pay your taxes, not get a refund, but to pay for
25:29
yourself or for your business to degree, if you're willing to cut
25:33
that check probably, Willing to accept that and we aren't going
25:36
to go through additional proofing.
25:38
If you are, for example, getting grant money or in the case of
25:41
the federal government getting a tax refund with the issues that
25:44
happen there, the bar would be significantly higher.
25:47
And so part of it is limiting again when we are actually
25:51
attempting to even access that information such that it is risk
25:56
Justified the second element that is well how are we
26:00
accessing the information? So driver's license is a really
26:04
A popular mechanism and state government.
26:06
Why? Because we have it and it's
26:08
relatively easy for us to reach out and grab it.
26:11
But as I mentioned earlier, there is a law.
26:14
The driver's license privacy protection act that we do have
26:16
to evaluate these calls against in.
26:19
So, the approach that we've generally taken is API in the
26:22
API isn't send me all the information about Jim McDonald.
26:26
The API is Jim McDonald. Said these things about himself.
26:31
Can you confirm yes or no and so that limits The information that
26:35
were receiving and have to be responsible for the other
26:39
element and getting to the biometric piece is the sort of
26:43
the view and I'm sure that other spaces have this as well.
26:46
The view we play in the public sector is assumed all
26:49
knowledge-based proofing is compromised.
26:52
So we would take any information, you provide plus a
26:56
picture of your driver's license, plus a picture of you
27:00
and do a comparison but we would never store that we Blow it all
27:04
away. It's real time, it never gets
27:06
collected. So the footprint is meant to be
27:09
very small and very transactional as best as
27:12
possible and then at that point all we do is store that you have
27:16
in fact been proofed and to what level you've been proved the
27:20
other element. We look at is the identity
27:23
affirmation piece so find your in the system great.
27:27
But now you're coming in and you're attempting to perform a
27:31
certain transaction that is as of a higher level.
27:33
So your Trying to pull information from retirement
27:37
benefits or cut a check out of your pension or 401K in that
27:42
case. We would also look at more like
27:44
an Adaptive or risk based view of that transaction and say,
27:48
alright. So you typically login with one
27:51
of these two devices and that device is geographically located
27:56
here. And this is the type of login
27:59
pattern that you follow in terms of the language of your browser.
28:04
And we would flag that for a typical Behavior.
28:09
And then that would require, again sort of additional
28:13
confirmation before that transaction would take place.
28:16
Yeah, the the latter scenario that you were discussing.
28:19
I think the buzz term is verified credentials.
28:24
I kind of went through that process with the ID.
28:26
Dot me, process to get to IRS services just recently, right?
28:32
As you're going through the process of obtaining, a
28:35
mortgage, you have to kind of go and IRS transcripts and things
28:40
like that. So, recently went through that
28:43
process and to your point it made a big point of saying,
28:47
look, if you do this automated process, we blow a of the data.
28:51
Your your other option is wait and do a video chat with a human
28:55
being but the wait time is an hour.
29:00
But hey, you do have the option. Anyway, I wanted to switch
29:04
topics a little bit. You know, we had three our
29:07
preparation for this session. And you mentioned, an
29:10
organization called, I think Ignacio.
29:14
It was the way you can see, I'm not a CEO.
29:16
And yeah, so that's a public sector CIO organization and what
29:25
are you, what are they talking about?
29:27
And relative to digital identity so nacio, the National
29:32
Association of State cios in my mind, is the organization to
29:38
really And what are the it priorities across the state
29:43
sector. So typically this is a group
29:46
that meets twice a year. These are decision makers within
29:49
the individual states. Typically, they are leading the
29:53
shared Departments of it for that state and they come
29:56
together to really talk about. Where are you investing?
30:00
Where do you plan to invest? What are you seeing as a
30:03
successful way in which you've invested?
30:06
So that could be vendors. That could be just Particular
30:09
topics, and things of that nature.
30:11
So, every year, they release a nacio top 10 priorities.
30:15
It typically comes out in the late fall or early winter of the
30:18
preceding year that says, okay. These are the 10 priorities that
30:22
we anticipate, we will take into, in this case, 20 22.
30:26
And then, these are the supporting technology projects
30:29
that we believe are going to enable those.
30:31
So if I look at 2022, is nacio top 10 priorities.
30:34
Number one is cyber security. Number two is Digital Services.
30:39
I think number six is Identity. The idea is that with not just
30:45
covid, but I think with the understanding that the
30:47
digitization of government services drives faster Revenue
30:53
return better engagement with services and frankly just better
30:58
experience from the user perspective, which ultimately
31:00
leads them to come back again. There's been a significant
31:04
investment in that kind of it modernization to enable that
31:07
obviously, then PSI. Cyber security exposure and the
31:10
need for a unified citizen identity, in this case, are
31:14
going to be critical to that underpinning that if you look at
31:18
the Technology Solutions, if they're really most focused on
31:22
particularly from the citizen perspective, there pretty early
31:25
in the life cycle. So they're just focused on how
31:28
do I prove out the citizens that are logging in are?
31:32
In fact who they say, they are such that I can move Beyond
31:36
those General Services where I really Not having to prove with
31:40
any real any real detail evaluation.
31:43
So now exposing more sensitive services like retirement
31:47
benefits and health information through these digital portals.
31:52
That these are things like access Indiana history to go
31:55
down this path and if you do, hi, oh, I know it started to go
31:58
down this path, but many states are really just starting to
32:02
frankly, dip, a toe in to how Digital Services supported by a
32:07
digital citizen identity can believe, Start to be rolled out
32:10
to their constituencies. So we focused a lot you know
32:13
talking about the United States, right?
32:16
And I mean a lot of our listeners are based at least a
32:20
third of our listeners are based outside of the United States.
32:23
How much collaboration would is going on, you know, beyond the
32:28
borders of the United States because a lot of the what you're
32:31
talking about seems like these are best practices not only for
32:37
United States, right? But for government.
32:39
It's all over the world. The short answer from a state
32:42
and local government perspective is none that I'm aware of even
32:48
with in state and local government outside of groups
32:50
like nacio the information. Sharing tends to be a bit more
32:54
Regional and Partnerships. So if you think about Washington
32:59
and Oregon or Maryland and Virginia, where the Carolinas
33:02
lick, these are groups that share clothes, Geographic
33:05
territory. They have a lot of overlap in
33:08
business. Isis and citizens, and things of
33:11
that nature. So they tend to work pretty
33:12
closely together in terms of international Partnerships.
33:15
Like I said, none, I would say that if you look at it from the
33:19
federal level and thinking about things, like the National
33:22
Institute of Standards and Technology, you know, those are
33:25
organizations that are often setting standards that state
33:28
governments or are utilizing their our office.
33:32
Also, obviously looking at things like standard
33:34
authentication patterns and way to DC and sam'l which have an
33:39
Flavor to them as well, but I guess the short answer I would
33:43
say is indirectly when you think about industry standards,
33:47
certainly state and local uses them, like anyone else would.
33:49
But as far as you does, Ohio directly talk with members of
33:55
the EU to Define what they're doing from a identity strategy
33:59
perspective, absolutely not. But wouldn't be a conversation
34:03
about state and local government without talking politics before
34:06
I get to that. I'm curious for nacio.
34:08
So, you know, they're certainly politics play a role large role
34:11
in a lot of different things. But as far as participation at
34:14
that sort of like, CIO level, do you see any is it, you know, Red
34:20
vs. Blue.
34:20
And some of those things do everyone.
34:22
Pretty much just get along and they're kind of like operating
34:24
outside of the political Spectrum.
34:26
What's the sort of like I guess feel of the room so to speak?
34:31
Yeah, it's a great question and I would personally say that
34:36
those sessions are not political.
34:39
But state cios are appointed by the governor's office.
34:44
So there are potentials where they will be cios who leaned
34:49
more political one way or the other based on their affiliation
34:54
with the particular governor's office.
34:55
I would say typically if you look across the board the vast
34:59
majority of those individuals would say that they are it first
35:03
and it in cyber is a bipartisan issue that really doesn't play.
35:08
And either side of the aisle. So there are always concerns
35:14
your particularly in Battleground states where if a
35:16
party affiliation changes over the these individuals may also
35:20
change over. But for the most part these are
35:23
very specialized roles people with a lot of experience in that
35:27
space working with the state agencies.
35:29
And so because of that they tend to be seen as longer term
35:33
positions. Do you find any Trends where,
35:37
you know, I'm thinking like, you know, Blue States tend to be
35:39
more digital force, or red States might be more something
35:42
else first or, is it pretty Universal.
35:44
Everyone kind of gets it, that it's just more about getting,
35:48
you know, secure access to the state's resources, and making
35:51
sure the services are usable. Do you see any like Trends as
35:54
far as Democrat versus Republican or Independence?
35:59
You can also pass to if you want to preserve.
36:02
The trains would be more digital service oriented than I would
36:06
say cyber oriented which is to say that a Blue state would
36:09
typically provide were government services than a red
36:13
State. A blue state would typically
36:15
have a larger budget in comparison to Red states of a
36:20
similar size. And so, because of that certain
36:24
blue states have perhaps identified the need for digital
36:28
identity for their citizens earlier, just because more
36:31
things are being offered from a digital perspective that being
36:35
said, I worked on innovate Ohio, which is Is the citizen portal
36:40
for Ohio, for 43 years. That was under Governor, Mike,
36:44
dewine, and tenant Governor husted.
36:45
That's, that's a red state. So I don't think it's
36:48
necessarily a red or blue issue. I think anymore people see.
36:52
Cyber is as a bipartisan issue that really deals with National
36:57
Security. You talk about a little about
36:59
kind of like the funding cycles and changing over of the
37:01
administration's and how that might impact some of the
37:05
appointments at the it level and maybe Downstream.
37:08
Sort of strategies, I guess, what can you tell us about that
37:12
sort of political cycle. How does that?
37:14
How does that impact things? Like funding and strategies?
37:17
And things like that, because I'd imagine every two to four
37:20
years, there's probably some major shake-up and that's to me
37:23
as I think about it. Like, from a, how we're going to
37:25
actually get things done. That seems like a pretty big
37:29
concern that would have in a road map, somewhere as a risk.
37:34
It isn't it isn't it? Isn't that really probably more?
37:39
So the four-year Governor cycle than the two-year legislative
37:43
cycle is more impactful and I'd say it's impactful from a
37:47
people, and from a funding perspective, the people piece we
37:49
touched on, which is that many of the agency, directors and
37:52
secretaries are directly appointed by the governor.
37:55
So, in the event, that, that Governor is not re-elected or
37:58
term-limited or even more. So, if the party changes over it
38:03
is possible. But that individual will no
38:06
longer be there when the administration transitions, it's
38:10
not guaranteed, but it is probably more likely than not.
38:14
That is the case and so from an execution standpoint that can
38:18
potentially slow things down whereas people transition and
38:21
want to understand what the projects are in the Investments
38:24
that they're making is that projects may not go live in
38:27
those windows or may drag on six, seven months after
38:31
anticipated, Windows to bring new leadership.
38:34
Up to speed funding is perhaps less impactful and there's
38:39
really two ways in which the centralized it.
38:42
Departments are funded. One is direct Appropriations and
38:46
the second is chargebacks, direct Appropriations would
38:49
typically be driven by let's say?
38:53
Marilyn doesn't example is doing it as an IT modernization.
38:56
Cyber monetization fund where they basically pushed Bonds in
39:02
order to put multiple Millions. Dollars together to drive,
39:05
various IT projects that funding once approved is earmarked with
39:11
the help. Basically, significant effort is
39:13
not going to change. Charge backs are chargebacks
39:17
from Individual agencies. So we're essentially where
39:20
you're operating, a must, as an out out sourced, it service
39:23
provider for those agencies and then they pay into Central it
39:28
for that time. Those, those can be much more
39:32
impactful because those are really kind of annual Oh, based
39:34
decisions, and if there's leaders change over, they may
39:37
not be inclined, to spend their money.
39:39
In that way, you talk about this thing called the three.
39:41
P's when we were talking before the show, what does that mean?
39:45
So, that's, that's a, that's a Robert ISM that I came up with
39:49
to really describe the funding cycle and delivery cycle for
39:53
these projects at the state. And so the three p's are piping
39:57
pilot and pattern. The first two are typically
40:01
activities that we would be driving out of the centralized
40:04
it. These would be projects with
40:06
direct Appropriations with definitive timelines, and really
40:09
being driven by various leaders, but then those Departments of i
40:12
t. So, the idea is what whether
40:16
it's access manage better, IGA or Pam that we would stand up
40:20
the infrastructure, the base configuration, the core testing
40:25
of use cases. That would be used for the
40:27
Enterprise. So lights on documentation,
40:30
done, core functionality available, we would then
40:34
Coordinate with agencies for the launch of an individual pilot to
40:38
essentially validate our understanding.
40:40
So it's like, everything sounds great and Academia and then once
40:44
you apply it in the real world, you obviously have a number of
40:46
lessons learned that come through that process.
40:49
That at the end of it, we would incorporate those Lessons
40:52
Learned and that essentially finalized we call a pattern.
40:56
And so the pattern then is agencies choose to onboard from
40:59
that point going forward. The agencies would pay for that
41:03
the agencies Would be responsible for bringing
41:05
individuals to the to the table and they would utilize generally
41:09
documentation generated during that that that piping and pilot
41:13
phase to drive the majority of that implementation activity.
41:18
So it's a way to take kind of a centralized solution and a
41:22
centralized delivery model and then start to decentralize it
41:26
across the Enterprise in the state or local perspective,
41:28
Robert I'm wondering are our state and local governments like
41:34
most Corporate organizations that I've worked with coming up
41:37
with kind of a cloud first strategy.
41:40
So they trying to move to cloud services men, that got me
41:44
thinking about. Do they have any fedramp
41:46
requirements that they're either governed by or that they are
41:51
choosing if available? So there's been a lot of
41:54
conversation over the course of the last two years for a state
41:58
ramp set of requirements, very similar in nature to what you'd
42:02
see from a federal perspective that Still very much taking
42:05
shape going back to NASA. Yo, if you look at their top 10
42:09
priorities and the technology that supports it, number one is
42:12
cloud services. So cloud is, I would say from an
42:17
Enterprise strategy perspective, relatively immature across the
42:21
state landscape, there are still a valid evaluating how to
42:26
strategically apply this for benefits across the state.
42:29
What type of data are we going to put in there?
42:31
How does this apply for infrastructure versus software?
42:34
Where, what kind of changes are we going to make to our overall
42:38
cyber security services and audit mechanisms that we use?
42:42
A lot of that? Frankly hasn't been defined,
42:45
this is a space and and and I pick on vendor sometimes because
42:48
think vendors drive a lot of the conversation.
42:51
But I think vendors that are pushing cloud services right now
42:56
will help to maybe drive some maturity around that discussion
42:59
at the state level to the cloud to the cloud.
43:02
Here we go. Want to start to wrap up the
43:06
conversation because you don't you know, generous with your
43:07
time this Sparks though. Something I want to bring up
43:12
that listener out there. Andrew also been on the show and
43:16
you the chance of phone sent me a LinkedIn message.
43:20
And I think this is a great option to bring up this question
43:22
as in its around the balance of security versus a user
43:27
experience, because I feel like this is exactly.
43:29
The conversation is probably taking place as part of that and
43:33
I think of it. He gave me an example of, you
43:35
know, moving away from SMS in favor of more secure MFA
43:40
methods, and I'll paraphrase things like app app, based, push
43:44
authentication or maybe even, you know, if you're, if you're
43:47
really cool going down, like a password list, router something
43:49
like that. What are your thoughts on?
43:52
You know, how does an organization and let's keep it.
43:55
The state and local kind of flair for this one, you know,
43:58
help kind of dry that stuff, stuff that that sort of maturity
44:01
or that maturation away from What we consider a legacy MFA or
44:06
others type, some Legacy Technologies like on Prem maybe
44:10
moving to a cloud based approach.
44:13
How does that Balancing Act take place?
44:15
Maybe this is maybe this conversation that takes place in
44:17
a CO and I'm sure in conference rooms all across different
44:20
governments. But what are your thoughts on
44:21
that? A question that has been brought
44:24
up more times than I can count in my career and a big element
44:28
of your why I've talked a lot about not just identity, but
44:32
Digital Services is, we found That that joining to be
44:35
extremely successful every time you layer on security, no matter
44:39
how great the ux is always creates friction with the user
44:44
base. So by looking for opportunities,
44:47
where we weren't just rolling up security, but but tagging that
44:51
to perhaps web application modernization and releasing
44:56
that. And sort of one joint package
44:59
created a bit of a balance, right?
45:01
So I'm getting better services and experience.
45:03
And while Is a security layer. That's may be new to me.
45:07
I'm okay with accepting that because I'm getting a better
45:09
overall experience. So it's sort of big picture
45:12
drilling down into something like MFA.
45:15
What we often would talk about is, okay, fine, SMS isn't as
45:19
secure as an application push. But what are they trying to
45:22
access, right? How critical is it that we push
45:26
that experience. And if we didn't have a really
45:30
good risk, story around that, then we would typically show Shy
45:34
away from that change. So I think as with most things
45:38
from a cyber perspective, understanding the risk context
45:41
that's there is important to drive those decisions.
45:44
Not just looking at it from a cyber lens.
45:47
I think the other thing I think about too is that it doesn't
45:49
have to be a one-size-fits-all. There's probably multiple right
45:52
answers. Just depends on the use case,
45:53
context, risk, whatever it is. You're trying to address Gym in
45:59
30 seconds. Tell me how you balance security
46:01
with the user experience. Yeah.
46:04
Rapper touch on it. Sees about it's all about level
46:07
of insurance. If you need a high level of
46:09
assurance, then you have to have appropriate controls that
46:13
achieve that level of assurance via high level of assurance as
46:17
well as you need to reach a broad audience.
46:20
That's the toughest scenario. But I mean can you name One
46:25
banking service where you're able to login with your Facebook
46:28
ID or your Google ID it just doesn't happen, right?
46:34
I was doing something the other day where it was again, going
46:38
through the process of getting a mortgage.
46:40
You're constantly DocuSign doing things.
46:43
This is not DocuSign, but it was some other application to signed
46:46
document. They said, do you want to sign
46:48
up for multi-factor authentication?
46:50
Which has become ubiquitous enough?
46:52
Now that like I am, probably a lot of people say, yes, I do
46:57
want that level of protection, but that when I got to it, they
47:00
would not offer SMS or emails and option.
47:03
You had to download. Not them akator app and at that
47:06
point I said that sounds very inconvenient, right?
47:09
I have Google Authenticator but don't want to go through this
47:12
whole process to link through for DocuSign except for just
47:17
become like the clean next term, right?
47:19
To sign a document electronically.
47:22
Ultimately, I went up saying way after I started seeing what the
47:27
documents were I was like okay I will register my Google
47:30
Authenticator but I bet you most people would say forget about
47:33
it. Which is too high.
47:35
It's just felt like to too high of a bar before I knew what I
47:39
was going to get after. I saw was in there, I was
47:42
willing to go over that bar, but it was still probably a bar,
47:45
especially if you give people the option to opt out.
47:49
It may become too high up in a bar, but that level of assurance
47:53
we were talking about your employees.
47:55
You're talking about your privileged access to high level
47:59
of assurance and now you can set up those digital hurdles where
48:03
you need to use. Solve token or maybe even a hard
48:06
token. I got a Chromecast with Google
48:10
TV, yesterday to add to my collection and I went through
48:14
the process last night of setting up all my video services
48:17
on it, Netflix Hulu HBO Apple blah blah blah blah.
48:21
All the things that we said would be cheaper independently
48:25
from a cable subscription. I'm now paying more but that's a
48:26
separate conversation and I must have experienced five or six
48:32
different ways to Senna, Kate and connect those services to my
48:37
media device and it ranged from having to use a remote control.
48:42
You know that doesn't have letters and keyboards on it and
48:45
navigating and typing in an email address and you know, a
48:49
very long and complicated password for each of these
48:51
services to going to the web and doing like an oauth flow where
48:56
it's, you know, simpler and easier to Apple, which I logged
49:00
in and then it used actually my on device credentials and Facial
49:04
recognition and I never had to type anything which was awesome.
49:08
I think that's that, that balance of the usability and
49:10
security kind of comes back to this as like, okay, we're
49:13
talking about, you know, media streaming.
49:15
What are we really concerned about?
49:17
And how do we make that, you know, easier for people to
49:20
actually consume the services? I get Netflix is down there
49:22
looking for ways to, you know, to increase subscribers or drive
49:26
Revenue. But in the end the day, you know
49:28
what's make it easy for folks? All right, let's start to wrap
49:32
things up, Robert we like to end on a lighter.
49:34
Or note. And I know that you are a
49:37
connoisseur of various beverages, you've got a very
49:41
impressive kind of home bar set up, so I'm going to go with an
49:45
alcohol theme Here. For our lighter note, what is
49:48
your favorite alcohol spirits and then, what is your least
49:52
favorite? Yeah, I think we're saying that.
49:54
There's a, there's a definite spin-off podcast here, strong
49:58
opinions on strong Spirits because I have very strong
50:02
opinions on this. So, from up, from a Everett
50:04
perspective of you kind of changes over the course of the
50:07
year, I would say, you know, given that it's a beautiful
50:09
weather here in Charlotte, North Carolina, I would say, tequila
50:13
right now, is in my number one spot.
50:15
I think, you know, a lot of times people have their, their
50:18
Cuervo Scar from at some point in their life, but a huge fan of
50:23
really great Tequila's out there.
50:25
And I think it's been really fun over the last couple of years,
50:28
that Tequila's kind of caught on in the market on the other end
50:32
of the spectrum. I know this is a really
50:34
unpleasant Popular opinion. Vodka only because I just don't
50:37
feel like vodka brings anything to the party.
50:40
I like I like to make cocktails pocket to me is just a blank
50:45
slate. That's my vodka stories for a
50:49
different reason that's because I had way too many one night.
50:52
Very long time ago, I have not gone back to the well and I'm
50:54
not gonna do that anymore. Yeah, and I promise that cyber
50:57
projects. Don't don't drive me to drink.
51:00
That's, that's definitely not the case at all.
51:03
That is plenty of other things I do.
51:04
Yeah exactly. Jim.
51:06
What about you? What's your favorite and least
51:08
favorite Spirit? Well I feel like I need to trust
51:10
the the Vodka piece because I think it being a blank slate and
51:14
the more blank the Slate is. In other words the more time the
51:18
more refinement it has that fewer impurities exists and when
51:23
you drink it you don't have the problems the next day of feeling
51:26
hungover. So I appreciate that about a
51:28
good vodka I think probably the Alcohol that I enjoy the most
51:35
but I have to make sure I don't drink too much of is bourbon and
51:39
then I'm going to pick one that maybe nobody saw it of for least
51:43
favorite which is an aperitivo called ouzo if you had to
51:48
choose? There's no my thunder.
51:49
No did I maybe see her too? Yeah, exactly.
51:52
I'm not a fan of ouzo. My wife had a drink last night
51:56
at dinner, and I think was an old-fashioned or something and
51:59
for whatever was they had some sort of ouzo spirit in there.
52:01
And it was just, Yeah, exactly. The face are seen.
52:05
As you can see, I put his definitely like not the right
52:07
thing. Yeah, I was.
52:09
I'm impressed that well, impress, shocked and I guess not
52:13
Shock the same time that we don't like the same Spirit.
52:16
My is Malibu Rum. That's pretty much my go-to.
52:19
I don't really drink that much to begin with, but I will enjoy
52:23
a nice. Sweet coconut rum of some sort
52:27
other than a, pretty basic man. I'm like I'm not much of a
52:29
drinker, I'll drink port, but not talking, we're not talking.
52:33
Fine Wines at this point where you're in the land of breweries
52:36
where you are now. So, does she need a venture out?
52:39
That way? I am, we've got whistle hop,
52:42
like, literally like a hop for me.
52:44
So, tons of breweries here in Western North Carolina, and the
52:47
Asheville area is a good food and drink in town.
52:49
So yeah, we are. We are certainly enjoying making
52:53
the rounds and discovering all that the area has to offer my
52:56
wife and I. All right, let's go ahead and
52:58
wrap it up for this week. We're getting a little bit long
53:00
in the tooth here, from a show perspective.
53:03
Any final thoughts, Robert, what should people be taking away
53:05
from this conversation? As it relates to Identity and
53:09
the state and local or the fact that ouzo is garbage?
53:13
You know, what do you want to go with?
53:15
First of all, do not get any tequila that has added Agave to
53:19
it. You want to go 100% natural?
53:22
That is the most important takeaway.
53:24
So for those custom Migos fans out there shots fired, but that
53:28
is definitely not the best. Tequila brand on the market from
53:33
Probably what people actually came here to talk about which is
53:35
identity. I think the big thing that I
53:37
like to tell folks is that way as it relates to your state and
53:41
local governments is that there is significant time and
53:43
investment is being put into understanding.
53:46
What are those services that really make sense to digitize?
53:49
No one likes to go to the DMV no one likes to go and wait in long
53:54
lines. And with that I see that states
53:58
are making a more significant significant investment than many
54:02
even private. Solutions are in establishing
54:05
citizen identity and I think there is a hope in a vision that
54:09
over the course of the next five to 10 years, that state identity
54:13
really can become a really unique source of Federated
54:16
identity across public and private sector.
54:20
So be really interesting to see how that plays out here.
54:23
Here, I just have to get a new drivers license in North
54:25
Carolina here soon and it's like a three-month.
54:28
Wait to get like an appointment as a DMV to get it done.
54:30
So hopefully things like that. Get As we move things, forward
54:34
from a identity maturity at the state and local level Jim.
54:38
How about yourself final thoughts for this week?
54:40
Yeah. Final thoughts are thank you to
54:42
Andrew to for sending us the question.
54:44
Thank you to Chris for sending us the Tweet.
54:47
Last time I encourage all of our listeners, you know, take part
54:51
in the show by submitting some things like that and if anyone's
54:55
going to be out at the Gartner, I am Summit.
54:58
We'd love to meet this. Pump is Chef likes to say, but
55:02
yeah. Yeah, and if this is your first
55:04
time listening, please reach out to us connect to us on LinkedIn
55:08
And subscribe. It helps us out a lot.
55:10
We've seen a tremendous growth with the show over the last few
55:13
years. Considering this is all Word of
55:15
Mouth. We don't do any advertising or
55:16
anything. So we certainly appreciate every
55:19
thumbs up. Like, subscribe, share,
55:22
whatever. The, you know the thing is that
55:24
that helps get the word out as I was appreciated and definitely
55:26
going to be a gardener hit us up.
55:28
We'd love to just bump, do whatever it takes, two to make
55:31
sure that we meet up with folks. All Without we're going to go
55:33
ahead and leave it for this week.
55:36
We are on the web. I'd any of the center.com, we're
55:39
on Twitter. At idac podcasts.
55:42
You can connect with us on LinkedIn robbery, cool.
55:44
If we put your LinkedIn profile was part of our show notes.
55:46
If people want to reach out and have kind of questions or
55:49
thoughts concerns or the the Agave police want to come in
55:53
arrest. You absolutely any.
55:55
And all the above. Very good.
55:58
Alright. So we'll include that in the
55:59
show. Notes with that.
56:00
We'll go ahead and leave it for this week.
56:01
Thanks everyone for listening. Ting and we'll talk with
56:03
everyone in the next one. Thanks for listening to the
56:09
identity at the center podcast. If you like what you heard,
56:12
don't forget to subscribe and visit us on the web and identity
56:15
at the center.com.