Latest / Identity at the Center / #361 - Identiverse 2025 - Sean O'Dell on Harnessing CAEP Abilities with Event-Driven Identity

Transcript

#361 - Identiverse 2025 - Sean O'Dell on Harnessing CAEP Abilities with Event-Driven Identity · Identity at the Center

• 0:05
  This is identity at the center. Welcome to the Identity at the
• 0:10
  Center podcast. I'm Jeff, and that's Jim.
• 0:12
  Hey, Jim. Hey, Jeff, how are you?
• 0:14
  How bad yourself? Doing great.
• 0:16
  Here are 2025. Feels like there's so many
• 0:19
  people to thank. There is there's a lot of people
• 0:21
  definitely give a shout out to Shirley.
• 0:22
  She's behind the scenes MVP. So Shirley, if you're listening,
• 0:25
  this is it's all possible because a lot of the work that
• 0:28
  she put in to help us get this going.
• 0:30
  Yeah. And RSM sums here, yeah.
• 0:32
  RSM. So we got some banners for that.
• 0:33
  We have a nice little banner for like identity at the center
• 0:36
  that's behind our guests. And yeah, it's been a very cool.
• 0:39
  I think we're slowly but surely starting to figure this out a
• 0:43
  little bit. Have you gotten any negative
• 0:45
  comments that we have AQR code? No, I don't think anybody
• 0:48
  actually scans it. I have no idea if they do or
• 0:51
  not. So it just seems like an
• 0:53
  interesting idea to put up there and maybe maybe help somebody, I
• 0:56
  don't know. Yeah, it's been really cool.
• 0:59
  A lot of our listeners have been here this week and just stopped
• 1:01
  by the booth, said hi, told us to listen to the podcast and
• 1:06
  that they find just to be a big service.
• 1:08
  And it's just like, wow. Which is the best part of doing
• 1:10
  this. So they tell some people to
• 1:11
  listen. So it definitely means a lot any
• 1:13
  time someone comes up and just takes the time to say, hey, you
• 1:16
  know, thanks for listening. And I'm always curious to like
• 1:18
  where they find us because we don't advertise.
• 1:20
  So it's like, hey, well, someone told me about it or whatever
• 1:22
  maybe. So super cool.
• 1:24
  I think the other thing that makes the conference seem so
• 1:27
  great was all the people who volunteer to speak and be on
• 1:32
  panels and kind of like pay it forward.
• 1:35
  And one of our past guests, our guest today is one of those
• 1:39
  people who paid it forward. And why don't you introduce, I
• 1:42
  don't want to steal your, your role on the podcast.
• 1:45
  Now you're doing so well. Yeah, Let's get to our guest.
• 1:47
  His name is Sean Odell and he is here of his own free will.
• 1:51
  His opinions are his own, right? All that legal stuff.
• 1:54
  Like we're just talking to Sean at the moment, right, Sean?
• 1:57
  Yes, Sir, you got it. OK, so Sean, tell us a little
• 1:59
  bit about like you were with us before, a couple times actually,
• 2:02
  but for a brief kind of intro like what is it your your day
• 2:05
  and job is? Do a lot of stuff with identity
• 2:07
  security both in consumer and and workforce at at the Walt
• 2:10
  Disney Company specifically focusing on continuous identity
• 2:14
  management at at at Disney and a plethora of other
• 2:18
  responsibilities is all the way over on the consumer side.
• 2:21
  And every other domain you can think of is workforce.
• 2:24
  So SSOIGA, Pam, make stuff happen.
• 2:27
  Figure out figure out tough problems and the plethora of
• 2:30
  integrations a company that size gives you on a daily basis.
• 2:32
  It is so much fun. So much fun.
• 2:34
  Excellent use of the word plethora.
• 2:35
  For example, we actually had a panel today.
• 2:38
  So I moderate the panel that you were part of as a, you know, the
• 2:41
  main kind of driving force behind us.
• 2:43
  Let's be honest, why don't we start there?
• 2:45
  Let's recap the panel and it was called bringing it all together,
• 2:49
  harnessing the capabilities with event driven IAM.
• 2:53
  Pun intended. Pun intended.
• 2:55
  Yeah, for sure. So tell us what was the panel
• 2:58
  about? Sort of give us kind of a
• 3:00
  synopsis of it for people who weren't able to be there.
• 3:02
  So we we started off First off, the panel was absolutely great.
• 3:04
  I think the the way you handle it was absolutely fantastic.
• 3:07
  The layout was great. So you are when you go in the
• 3:09
  right way, because flatter will get you everywhere with me.
• 3:11
  So I. Appreciate that more stickers,
• 3:13
  more stickers my pocket. We set it up pretty nicely.
• 3:17
  The first part was giving background and contacts like
• 3:19
  what, what is Cape, what this use case is, what's a real,
• 3:22
  what's a real, what's a real example?
• 3:24
  Which then flowed nicely into asking all the panels to Ansel
• 3:28
  Toshi Begwali. We got Mike Kaiser, Beta, Andrew
• 3:30
  Cameron from GM and myself and we all played off each other
• 3:33
  very well. And we had very disparate
• 3:35
  examples that all resonated. And we, we kind of covered like
• 3:38
  what we wanted to cover like in the 1st 15 minutes.
• 3:40
  And then the audience just took off the questions.
• 3:44
  It was like we threw away all the agenda.
• 3:46
  It's like, well, we had an idea and they're like, well, they hit
• 3:48
  all the topics and we wanted to hit on the agenda just by asking
• 3:50
  questions. So that tells me a lot that
• 3:53
  people are starting to really embrace the event driven
• 3:57
  approaches here. And the, the the conference here
• 4:02
  is coming really full circle with embracing like 5 key
• 4:07
  disciplines like the consumer identity, sorry to say it, AI.
• 4:14
  We almost made it the entire time.
• 4:15
  Too about 6. Seconds left. 6 seconds left.
• 4:18
  Was that 50 minute panel? Yep.
• 4:20
  And Andrew Cameron. Andrew Cameron.
• 4:22
  Yeah, Andrew Cameron. Ian said, I don't want to say
• 4:24
  it, but I said we did AI. So they had kids, kids identity
• 4:27
  meant non human. They had AI think it was citizen
• 4:30
  identity. And there was one more and but
• 4:33
  it, it said it was a nice non Venn diagram, Venn diagram from
• 4:36
  Andy. But it just highlighted the
• 4:38
  importance that the, the main 2 buzzwords here are NHI and AI.
• 4:44
  They really are. But the foundational pieces to
• 4:46
  making that safe, secure reality and realizable is you need event
• 4:50
  driven. You need to have a continuous
• 4:53
  identity paradigm to get to the realization and the controls of
• 4:56
  what AI can give you and the security you can have with all
• 5:00
  of your what I like to call as workload.
• 5:02
  I am not NHI because I just the way I am is they're all
• 5:05
  workloads. I follow Martin Copinger and
• 5:08
  what Eric Wallstrom's doing over in Gardner.
• 5:09
  Like I like workload. I am as a as a generic term
• 5:12
  because almost everything's a workload, a machine, your
• 5:16
  device, your laptop. So we're viewing off topics and
• 5:18
  continuous, but I want to want to pull it back to where the
• 5:21
  foundation for a lot of things is data and that's continuous.
• 5:25
  That's event driven. So I think I think the panel was
• 5:27
  fantastic. Some of the questions that I, I,
• 5:29
  I heard from the audience was, and I was really shocked, Jeff,
• 5:32
  it was more, how do I implement this?
• 5:35
  What do I do? If they were very, it was very,
• 5:37
  it was, it was technical. It wasn't like, oh, give me the
• 5:40
  boxes and arrows. It was more like, like a great
• 5:43
  question was about rate limiting and thresholds and throughput.
• 5:48
  And I was like, wow, like then they all looked to me and I'm
• 5:51
  like, well, I guess I'm answering this question and then
• 5:54
  you. Were you were the only one who
• 5:56
  sort of raised your microphone they.
• 5:57
  All were like, I'm like, OK, got it.
• 6:00
  But the answer and I gave her the answer and she just was
• 6:03
  like, yeah, but, and she kept pressing on it and I'm like, so
• 6:05
  you really want to. Then Otle took, took a stab and
• 6:08
  then Andrew took a stab. But then it what it came back
• 6:10
  down to was the data that you're going to be using in these
• 6:15
  security event tokens with continuous identity gives you
• 6:18
  the ability to to be less chatty with tokens for an example.
• 6:21
  And I thought it was very, it was a very good distinction that
• 6:24
  by, by by harnessing and utilizing this paradigm
• 6:28
  continuous identity, you have less tokens flying around the
• 6:31
  wild because you're, you're being more precise.
• 6:32
  Like I can give you all a token for 24 hours and not worry about
• 6:35
  it. Because if I have all these
• 6:36
  detective controls happening in the background and integrations
• 6:39
  that if you look suspect or malicious, I can just say, oh,
• 6:44
  Jim's cool, Jeff, you look suspect.
• 6:46
  I'm just, I'm just going to revoke your session.
• 6:48
  But that's one token versus having to always do token
• 6:51
  refresh, token refresh, token refresh.
• 6:52
  So I thought that was a really good example.
• 6:54
  And she understood this spot on, which is I'm, I was, I was so
• 6:57
  happy, so happy because the maturation levels raising more
• 7:00
  and more like when we first talked about Cape.
• 7:03
  Yeah. I want to ask you if there was a
• 7:04
  difference in mindset or what did you notice from the one we
• 7:07
  did last year, which I think was more presenting this idea and
• 7:11
  sort of getting people up to speed versus this year where a
• 7:14
  year has goals. Now it's like, OK, how how much
• 7:17
  more real is SSF and can we? Can we go back one more year to
• 7:20
  23? So when I first presented it, I
• 7:22
  had to give them the breakdown like here's what a JWT looks
• 7:25
  like, here's the data in it, here's why you use it.
• 7:29
  In 2024, we did that awesome panel and it got better.
• 7:32
  But then even this year, but it was more yeah, the background,
• 7:34
  we understand it, the use case. Cool.
• 7:37
  But now they're like, how do it tell me how to use this?
• 7:41
  Like I, it's almost like you, you want this more.
• 7:44
  How do I get it? They were looking for, for
• 7:46
  prescriptive guidance on it. And it, it made me very, it made
• 7:51
  me very happy because we put a, we put a lot of hard work into
• 7:55
  this in the, in the standards bodies and even with working
• 7:58
  externally with, with companies like like Octa and Apple, that
• 8:02
  it's becoming a reality. And even at the last Gardner
• 8:04
  interop, I mean, 30 plus people came, came to interop and test
• 8:08
  it out. That's huge.
• 8:10
  I think, I think MM Kaiser was saying on on stage that he's
• 8:14
  never seen adoption that quipped that fast.
• 8:15
  And I was just, I was floor. So I mean, I know Otto's excited
• 8:18
  about it. I am Shane, our other working
• 8:21
  group Co chair is excited about it.
• 8:23
  Everyone is. We bring it up a lot with like
• 8:25
  vendors and asking them what is their plan to support SSF.
• 8:29
  And and I always ask. And I think that's, that's
• 8:32
  probably one of the more important things you can do is
• 8:33
  like customers of of these products that say, what are you,
• 8:37
  what are your plans to support shared signals framework?
• 8:41
  Because are you going to? Correct, because it is my
• 8:43
  requirement as your customer exactly.
• 8:45
  I want to communicate that way more.
• 8:46
  Customers who do that, the faster it gets out to road map
• 8:49
  adoption, which then drives interoperability and then hey,
• 8:53
  guess what, we're sharing signals.
• 8:56
  Sharing is scaring right? Exactly 1 of the other fun
• 8:58
  takeaways from it. Was it it naturally?
• 9:01
  I mean, if I'm off base here, but it naturally progressed from
• 9:05
  capabilities into Cape into like data.
• 9:10
  It's a natural progression. Like to do this you need data
• 9:13
  foundations and it just it was interesting and someone asked a
• 9:16
  question. I forgot who it was, but it was
• 9:18
  more of who owns this. And I know you were like, I'm
• 9:22
  sorry, what? That was Blot.
• 9:23
  Yeah, yeah, that's right. It was.
• 9:24
  Yeah, I know you. You hopped on.
• 9:26
  You're like I got, I want, I want it on this one and it and.
• 9:29
  It's such a loaded term though, I know.
• 9:30
  What do you mean by ownership? So we all said it depends.
• 9:33
  And Otto said it depends. And I'm like, yes.
• 9:36
  And what it came down to is I think I think you called that
• 9:38
  out like it's it's politics, one reason.
• 9:41
  And then Otto said everyone. And then I think Andrew, Andrew
• 9:44
  Cameron was like whispered stakeholder.
• 9:47
  And then he's like, yeah, it makes sense.
• 9:49
  But I think that was like, that was the question that sparked
• 9:53
  like 15 hands. So it was, it was awesome to
• 9:56
  say. It really was.
• 9:57
  I was flattered. I was flattered to actually be
• 9:59
  there. It was a really good question.
• 10:00
  And I think this is something that gets overlooked a lot is,
• 10:03
  you know, you go off and buy tools and you build programs and
• 10:06
  all kinds of stuff and it's like, OK, well, what are the
• 10:09
  rules and responsibilities within your IEM program?
• 10:11
  And a lot of the stuff is not technical, it is agreement and
• 10:16
  whatever political structure your organization runs in to
• 10:19
  say, OK, here's how we're going to collectively operate tending
• 10:22
  things forward. Was there anything that
• 10:24
  surprised? You for the.
• 10:26
  Conversation today like was there something that's like oh,
• 10:28
  I didn't think about that or was it kind of was it kind of what
• 10:31
  you were expecting the questions because I felt like it made my
• 10:34
  job way easier so thank you to everyone.
• 10:36
  Audience to ask a question was we spent 30 minutes I think
• 10:40
  straight on questions for the audience after a quick like,
• 10:44
  hey, we're gonna level set real quick for like 10-15 minutes and
• 10:46
  then it was just Bang, Bang, bang questions.
• 10:48
  No, I think it, I think earlier I covered it.
• 10:49
  The only thing that surprised you was that they were they were
• 10:52
  above a baseline. I was talking about that and
• 10:55
  they were really above water, which is good.
• 10:57
  Nothing, no question. Really, really shocked us at
• 10:59
  all. Pretty much.
• 11:01
  There was an interesting 1 towards the end about relevancy,
• 11:06
  context and efficacy of signals. That was a I'm sorry, yeah,
• 11:09
  Signals. It was a very, that's also a
• 11:12
  very loaded question. And the, the TLDR bit was can
• 11:16
  you trust external signals in your, in your platform to emit
• 11:19
  more? And the answer is no.
• 11:21
  If there, there are points of data and it's all relative to
• 11:24
  where if that's your only source, that's all you have the
• 11:27
  answer to your own question. But if, if it's one out of many,
• 11:30
  do you have five sources? And that one is like, is it a
• 11:33
  20% weight? Is it a 5% weight?
• 11:35
  And it, it's subjective. I can't give you the answer.
• 11:37
  You can't give him the answer. Only his data could give him the
• 11:40
  answer. So I think that was, that didn't
• 11:42
  shock me, but it was very much like, oh, they're thinking that
• 11:44
  way now, which is good. Yeah, that ownership question I
• 11:48
  thought was very bad and I think you heard it super well because
• 11:51
  I think it's a loaded term most what you called.
• 11:54
  It I don't think it was a gotcha question.
• 11:56
  I think it was a general. It was.
• 11:57
  It was a genuine. It was a genuine.
• 11:59
  We have to address this side of the software it.
• 12:01
  Was like a help me understand this exactly.
• 12:02
  Yeah. You got into a discussion about
• 12:04
  policies and Mike talked about federation.
• 12:07
  So I, I was trying to picture exactly what he meant.
• 12:10
  Was it that each end system will, you know, take the event
• 12:18
  signals and apply policies to them and they will have a
• 12:21
  framework for policy decision making, policy enforcement?
• 12:26
  Or will there be some kind of middle tier layer that does that
• 12:30
  for the applications? I think you can have both, but I
• 12:34
  think what Mike was talking about was if if I integrate with
• 12:37
  your system, for example, I send you a prescriptive action that
• 12:41
  says we have an agreement that you're going to action on this.
• 12:44
  The policy in your system says when I receive a session revoked
• 12:47
  token, I take this action. That's a policy because you're
• 12:51
  saying intake maps to this thing.
• 12:53
  You're actually building what Otso and I joke about, which is
• 12:56
  that capability matrix, that's policy.
• 12:59
  So if if say, for example, let's say Jeff sends you a signal and
• 13:03
  you're like, that's just information because I may not
• 13:06
  trust Jeff stuff, but our agreement is I am your IDP.
• 13:09
  I'm telling you revoke this session, your policy and your
• 13:13
  app, which is a very loaded turn to say it's more like a rule.
• 13:16
  Whenever I get a token from Sean, my job is to revoke this
• 13:21
  session. That's where you're talking
• 13:23
  about Federated policy. Because then from a transmitter
• 13:26
  perspective, when I send you something, I have my own policy
• 13:28
  that says if I get these signals coming in from disparate sources
• 13:31
  and and their risk scores over a tolerance.
• 13:33
  My policy says if signal of this type session revoke is malicious
• 13:39
  and the scores over 90, I have to embed a token to these
• 13:42
  systems and you're one of them. That's my policy.
• 13:44
  That's your policy. That's what I think Mike was
• 13:46
  talking about with Federation's are there.
• 13:49
  So where do you where do you see the decision being made on which
• 13:53
  signals which events to send to which applications?
• 13:57
  So for example, we've talked about, you know, Mike Lazar
• 14:00
  presenting South Point, we're talking about South Point A
• 14:03
  we've integrated into this framework.
• 14:07
  I mean do you send him every signal or send self on every
• 14:10
  signal that you have in the database?
• 14:12
  It's a great question and I think the way you the way you
• 14:15
  would have it as a as a transmitter, so it actually goes
• 14:18
  back to the question Blatt asked is who owns this?
• 14:22
  So take him into a context like if you have one company that has
• 14:28
  a, an Uber transmitter that is going to be for all the
• 14:32
  workforce, right? Their policy would be that
• 14:34
  anything to do with provisioning, life cycle
• 14:38
  management or even access management.
• 14:41
  You could send that to an IGA platform where the platform
• 14:44
  could start doing embedded already example workflows where
• 14:47
  they act as an appliance. So we actually covered that too
• 14:51
  in the panel, which is like, thank you.
• 14:53
  Great, great, great setup right where this fabric of signals
• 14:58
  that you ingest from all these things you have these things
• 15:00
  popping off them as appliances like IGA platforms being one of
• 15:04
  them Pam platforms being one of them ID PS being one of them.
• 15:07
  The way you target events and event types is intrinsic to the
• 15:11
  domain. So a lot of words great.
• 15:14
  So breaking it down very easy if it's a provisioning events or a
• 15:18
  life cycle events or even a data change events IGA.
• 15:23
  So if my if my attributes change about me, maybe I send a skim
• 15:31
  event to my IDP and my IGA platform.
• 15:34
  However, if my IGA platform informs my IDP of the change, I
• 15:39
  send it to one spot and it federates out to the other ones
• 15:43
  federation. So it's very it's very dependent
• 15:46
  upon the given integration. So it's a long answer to say it
• 15:52
  depends. But like Cape Ones applications
• 15:56
  on 100% IGA ones, you could even like, let's be honest here, if
• 16:01
  it's a hard enough event where you're prescriptive and you say
• 16:04
  a session revolt because it's really bad.
• 16:07
  Like if, if Jeff has access to like the world, not only do you
• 16:12
  want to revoke his sessions, I want to remove all his access.
• 16:15
  And you can do that in many ways.
• 16:16
  But let's say you have an IGA platform and you're all in on
• 16:18
  it. I send the same token to your
• 16:22
  IDP to your IGA platform. Your IDP says I'll kill your
• 16:26
  real time sessions and your IGA platform does admin things that
• 16:29
  it says, oh all your roles you have all your gone that way.
• 16:33
  You are essentially marked as an adversary, not in a bad way, but
• 16:38
  someone's acting as you so they're impersonating you.
• 16:41
  So you were considered an adversary at that point.
• 16:43
  Great question. Great question.
• 16:45
  Thank you. It seems like most of the
• 16:48
  conversation I'm hearing is like the signals would come from
• 16:52
  within your enterprise. But is there a thought that
• 16:56
  signals would come from maybe partners you federate with
• 17:00
  signals come from big tank, Yes, OK.
• 17:04
  So it's actually. I think this could actually be a
• 17:07
  product that's out there, right where somebody's going to say
• 17:10
  I'm going to create the biggest, baddest database of signals.
• 17:14
  And just like you have a, you know, have I have I that owns
• 17:17
  breach password list or any of these other data services, this
• 17:21
  could end up being another. Product am I on notice?
• 17:25
  Exactly, right. Exactly.
• 17:26
  Yeah. Something like that could could
• 17:27
  take place. Absolutely.
• 17:28
  Yeah, it's, it's a great question.
• 17:30
  And the best way to phrase it is you're creating, you're
• 17:37
  ingesting a lot of data points, right?
• 17:39
  So you have your internal because it's your data, but you
• 17:42
  can integrate with external systems that do endpoint
• 17:45
  detection to be vendor agnostic. Those could be perfect, they
• 17:51
  could be bad. But like the other guy was
• 17:54
  saying, and they'll also one of the last questions in the panel,
• 17:56
  it was do you trust them? How?
• 17:58
  How? How?
• 17:58
  Efficient are they are they, are they legitimate?
• 18:01
  So you should definitely get external sources of trust.
• 18:05
  So like EDR platforms 100% should you go after social
• 18:08
  providers in the workforce? Probably not.
• 18:11
  But it is very much a mixture of internal and external because
• 18:15
  not not only that, like, I mean, this is just public knowledge.
• 18:17
  Like Octa has this in their platform right now.
• 18:20
  They they support Kate, they support it both ways.
• 18:23
  You can send to them, they send back to you.
• 18:26
  Like that's, that's what everyone should aspire to be is
• 18:30
  you're both a transmitter and a receiver.
• 18:32
  Because say it again, sharing is caring, right?
• 18:36
  How do you get around privacy concerns, that kind of thing?
• 18:39
  That's that as it does a tough question.
• 18:41
  And I and I think the way you have to do that is if you share
• 18:44
  with your SAS providers, it's essentially your data.
• 18:48
  So it's a little bit easier in the workforce.
• 18:50
  Same thing goes for ER platforms.
• 18:52
  But if I ever wanted to share with like an external company,
• 18:54
  yeah, there's, there's standards out there for that.
• 18:56
  Like in like in an open ID, there's, there's a thing called,
• 18:59
  is it AP pit, pairwise student anonymous identifier.
• 19:02
  That's where it's just a mapping table that says this is, this
• 19:06
  is, this is Jim. Let's say your ID is 1 and 2,
• 19:09
  but to them, you're gonna be 456789.
• 19:12
  That way you only ever share that identifier.
• 19:14
  That way if they see something anomalous about you, they send
• 19:17
  over your 789789, which I know is 2.
• 19:22
  That's the way you can do privacy sharing.
• 19:23
  That's one example. There are plenty of use cases
• 19:26
  for those of you listening or watching that you'll be like,
• 19:28
  yeah, but what about, of course, they're all there.
• 19:30
  But in the lot of time that we have, that's an easy example to
• 19:32
  say that's how you could interoperate and be privacy
• 19:36
  aware because I'm really like like Mike is, I'm really big on
• 19:40
  privacy, really big. It's outside of our panel.
• 19:44
  What are those have you seen here that had a verse that has
• 19:46
  been, you know, sort of in support of shared signals
• 19:50
  framework shave. Are you seeing the love outside
• 19:54
  of our little bubble of our panel or are there other things
• 19:57
  that are taking place? We're saying, OK, we help.
• 19:59
  We still have some work to do to either educate or inform or.
• 20:03
  But, you know, drive that adoption and get more vendors on
• 20:05
  board. So the vendor adoption is always
• 20:08
  there, like you should always tell your vendors, this is what
• 20:10
  I want, this is what I want. And the only way they're going
• 20:11
  to do it is by listening to you, right?
• 20:15
  You the users, not you, Jess. Vendors get on board.
• 20:20
  It was the the keynotes were pretty interesting.
• 20:24
  Andy had a good one. Laughter Andy was really good
• 20:27
  too. And they, they're calling out
• 20:30
  that continuous identity is needed.
• 20:32
  And what even is more surprising now is the you need an event
• 20:36
  driven architecture that that was like when I sat back in my
• 20:40
  chair, filled my hands off my head and I had a possible legs
• 20:42
  and I was like, OK, this is good.
• 20:44
  This is good. When you when you see more than
• 20:46
  one person say it who isn't in your direct circle of everyday
• 20:50
  talk, it's both reassuring, ratifying and relieving.
• 20:53
  It's very much relieving because when more people say it like
• 20:57
  it's when one person has an idea, it's an idea.
• 20:59
  Once you have it, it's a collective when 345, it expands
• 21:02
  out, then it gets, it gets exponential.
• 21:04
  That's called adoption, right? And I, I think it, it was very,
• 21:07
  very evident that I still think continuous identity is
• 21:11
  foundational to a lot of things like workload and AI and stuff.
• 21:15
  But if you look at the pace AI is going and the pace that
• 21:19
  we're, we're, we're allowing automation to, to do our jobs,
• 21:22
  the amount of data that needs to be correct is insane.
• 21:26
  And I, I said this in my, in my talk, in my workshop, and I'm
• 21:32
  going to say it again tomorrow in my, in my session where AI is
• 21:36
  not ready for our data because our data is not ready for AI.
• 21:40
  It's just not. What do you mean?
• 21:44
  A lot of data that companies have are either stale, outdated,
• 21:47
  or they're 12 hours old or a day old.
• 21:49
  AI doesn't wait for an hour or 12 days to make a decision.
• 21:52
  It's like, oh, look, I can go solve this problem over here
• 21:54
  with this data set. That's it's as accurate, right?
• 21:57
  Go Then you're then some viewers are this is going to be like,
• 21:59
  well, there's hallucinations. I know that.
• 22:01
  But if you're taking action on hallucinations, caveat emptor,
• 22:05
  right? Yep.
• 22:07
  So you've mentioned about workload identities.
• 22:12
  I remember when we bring he brought it up, I said non human
• 22:15
  identities which raises your ire.
• 22:20
  There you go. That's another good word we got
• 22:22
  higher. Higher plethora brought to you
• 22:25
  by the dictionary. Brought to you by the
• 22:28
  Encyclopedia Britannica. There you go.
• 22:31
  No one. Is it about that non human
• 22:33
  identity terminology that you don't like?
• 22:36
  It's too broad, that's all. The classification is too broad.
• 22:40
  You can get you can get into into devices, you can get into
• 22:43
  workload, you know, to machines. I, I like a classification
• 22:48
  that's that's much, much simplistic.
• 22:49
  So Eric Wahlstrom and and Martin from company during coal,
• 22:54
  they've coined the term workload.
• 22:55
  I am and I haven't seen much pushback on it.
• 22:57
  And I, I had the same thought, not talking to either of them a
• 23:02
  year and a half ago. And it just like were I do my
• 23:05
  work, we call it that. And it's just NHI is just more
• 23:08
  like it's a, it's a buzzword, but it's like, oh, NHIS, what
• 23:12
  does that mean? Is it your phone?
• 23:14
  Is it your device? Is your laptop?
• 23:15
  Is it a Lambda? Is it a workload?
• 23:17
  Yes, the answer is yes. Exactly.
• 23:19
  So that's why I think everything could be a workload.
• 23:22
  You use your laptop to do something, which is a workload,
• 23:24
  right. A machine does something which
• 23:27
  is a workload, right. It's just the generalization
• 23:30
  works. But NHI is like, I just, I
• 23:33
  personally don't I like workload versus that cause Eric's a
• 23:39
  pretty smart guy, Martin's a pretty smart guy and they, they
• 23:43
  tend to get it right. And if two birds say something
• 23:47
  and I'm like, it makes sense, the same way tends to work out
• 23:49
  that way that you have a triangle of like a triangle of
• 23:51
  trust because we're not in that movie, but like circle of trust,
• 23:54
  right? Could.
• 23:55
  Join. Triangles of success exactly
• 23:57
  could join triangles of success. I just.
• 23:59
  It makes worse sense honestly. It just does so I disagree.
• 24:02
  Not in theory, in just the semantics of this.
• 24:06
  And I feel like non human identity is fine.
• 24:09
  It's not any, it's, it's not new.
• 24:12
  I think that's the most important thing.
• 24:13
  It's like, it's not like not human identity started last
• 24:16
  week. Like it's years old we had.
• 24:19
  Punch cards, you know, all these things have been operating
• 24:21
  machines, identities. What I think of it is more is,
• 24:24
  yeah, I think it's a little bit marking term and I think that's
• 24:26
  probably OK because we need to help people understand because
• 24:30
  they don't understand the word workload, a normal person,
• 24:34
  right? And we are not normal.
• 24:35
  People. So I'm asked you a question,
• 24:36
  then you don't. You don't.
• 24:37
  You don't agree. Love opinions.
• 24:40
  What's a giraffe? What's a what?
• 24:42
  A giraffe. A giraffe.
• 24:43
  It's an animal. Is that a non human identity?
• 24:46
  Yes, we've already made a decision that a human is a
• 24:49
  human, and if you're not a human, it's something else.
• 24:52
  Now again, semantics. Could we say there's another
• 24:56
  subclassification of exactly, you know, carbon based life
• 24:59
  form? And I was.
• 25:00
  Waiting for you to go there, right?
• 25:01
  Versus non carbon based life form.
• 25:02
  It's NCBH. It's kind of a.
• 25:05
  Potential term right now, and it's a hot 1 to the moment.
• 25:09
  Yeah. I mean, think about ITDR.
• 25:11
  It's like all of you predicted to talk about last year.
• 25:13
  It's definitely toned down this year.
• 25:16
  Why is that? I'm not sure.
• 25:17
  Maybe it's just that you have a tendency to say this is the hot
• 25:21
  thing and get on it. By the way, I don't think
• 25:24
  giraffe is an identity if what you're talking about is they put
• 25:28
  a chip in under a skin and it's a.
• 25:32
  That's a machine editing a device identity of some sort of.
• 25:34
  Tracing chip, then every piece of inventory is an identity and
• 25:37
  then it's like. Well, see we're getting into
• 25:39
  semantics again of can a non human have an identity versus
• 25:45
  not. And we've had this discussion
• 25:47
  before about between the difference between an identity
• 25:49
  versus an account and I don't know if we.
• 25:52
  This is great to watch. This is great to watch.
• 25:54
  I love it. Yeah.
• 25:55
  Yeah. But I feel like in my defense
• 25:58
  it's it's NHI, not human identities literally into things
• 26:01
  so. Here's the one that I think is
• 26:03
  about to like really become a hot topic is continuous
• 26:08
  authentication. Because we're starting to talk
• 26:10
  to organizations that are coming up with different form factors,
• 26:15
  seeing keep you authenticating rather than just logging in, you
• 26:20
  have to be wearing some kind of proximity device.
• 26:23
  You're emanating. That authentication, you know
• 26:25
  what that is? That's continuous identity.
• 26:27
  That's Cape, Absolutely. Yeah.
• 26:29
  So before Cake was Cape, it was continuous off indication,
• 26:32
  sorry, since authentication. But then Cave came around to
• 26:35
  where continuous authentication is too chatty.
• 26:38
  It's always check, always check, always check.
• 26:40
  Whereas even if you were a device for proximity, as long as
• 26:46
  your device is on and emitting A emitting a signal, pun intended,
• 26:50
  that's a way to check relevancy, right?
• 26:52
  But continuous authentication, which I think you're right, Cape
• 26:57
  and continuous identity is going to be pivotal and foundational.
• 27:00
  So what we want to do in to your NHI, to my workload, I am to AI,
• 27:04
  but it is a hot topic and I, I, I think a lot of companies are
• 27:07
  so struggling to get it right because they're, they're looking
• 27:10
  at things like I got to get more factors.
• 27:12
  I got to get this, I got to get stronger factors.
• 27:14
  You do crawl, walk, run, but in in the the walk and run phase,
• 27:18
  you, you got to get your data. Your data is what matters.
• 27:21
  Because if you don't understand your, your data population, what
• 27:24
  they're doing, how they're using it, you're going to build that
• 27:26
  policy and make probably make more investments in things that
• 27:30
  may not accomplish what your business got, what your business
• 27:32
  task is. I used the word may not, is or
• 27:35
  are or will so. What?
• 27:37
  Also creates a a brand new threat factor to protect
• 27:40
  against. OK, We've put a lot of our data
• 27:43
  into this thing. What are we doing to protect it?
• 27:46
  Correct. It's going to be really
• 27:47
  attractive for people to want to get.
• 27:48
  We're going to protect it with AI.
• 27:50
  That was a joke. I solved it 100.
• 27:52
  Percent more AI. So I've been, you know, thinking
• 27:57
  about this shared signal framework.
• 27:59
  It feels like it fits within this concept of identity fabric.
• 28:07
  It feels to me like you need to have your arms around the
• 28:11
  identity of a, say, human, but also the device.
• 28:17
  So when you talk about kind of like what is necessary from a
• 28:22
  device identity or device management perspective, what is
• 28:26
  it that? Where is kind of the baseline to
• 28:29
  be to be successful with the shared signals framework?
• 28:32
  Do you have to be somewhere in that journey or is it wherever
• 28:35
  you are it can help you? Start small, pick the smallest
• 28:39
  use case, the small, the smallest implementation with the
• 28:42
  smallest blast radius and just try it out.
• 28:45
  So I we actually in the workshop, we left our
• 28:52
  participants with your homework is to go try this, whiteboard it
• 28:57
  out and start at the smallest scale.
• 29:00
  Just try it one time, get it all together and do 1 revocation.
• 29:06
  When you see it work one time, it is so intoxicating.
• 29:11
  You're just like, wow, I want more of that 'cause I know, I
• 29:14
  know when I see other, I see, I see others do it and it's you
• 29:18
  just see like the the giddiness. They're like, oh, that can that
• 29:22
  can happen. It's good, but you have to start
• 29:24
  small. You have to you really do.
• 29:26
  And from a from a device perspective, you don't need to
• 29:29
  have like, oh, the INEMI number, the device Idi mean heck, your
• 29:32
  laptop. I mean, if it, if it's your
• 29:34
  laptop with an user agent and an ID and you, it's good enough.
• 29:38
  I mean, the odds of you being able to do things with your
• 29:40
  laptop, that's your personal one and not managed.
• 29:42
  Slim to none. There are companies working on
• 29:46
  that to support SSF, but it has to be a managed device or you
• 29:52
  have to be logged into your browser of choice for them to
• 29:54
  actually do that because they can't just be public like, oh, I
• 29:56
  know, just laptop or Vulcan. That doesn't work that way, not
• 29:59
  yet. What is the smallest peripheral
• 30:01
  concept you could do? Can I do this in a spreadsheet?
• 30:04
  Is Access database still a thing or would you recommend like
• 30:09
  something a little more modern? Graph database Neptune,
• 30:11
  Something like that. Like do you mean?
• 30:13
  How quickly could I establish this central source of data?
• 30:17
  Because I know people. Out there like well.
• 30:20
  We can use it in their spreadsheet.
• 30:22
  Could that be a source? I it if it is, you have to be
• 30:25
  able to action on the source, which means you have to have.
• 30:27
  You could hook it up to Visual Basic and do some API calls.
• 30:33
  Bubble gum and chicken wire and duct tape.
• 30:36
  I mean that you you don't really need data to test this out.
• 30:40
  There's a great open source 9 owned by any company website
• 30:43
  called cave dot dev, CAEP dot dev DEV and I think I think
• 30:50
  Kaiser has shared signals dot guide GUIDE in there.
• 30:56
  You can put in everything you need in a, in a fake target
• 30:59
  system that you can see what, what would happen.
• 31:02
  I mean, it, it, it sounds crazy, spin up a, a brand new tenant of
• 31:06
  your choice fake and go try it out for efficacy.
• 31:11
  And it is. It is super, super easy to do.
• 31:15
  Super easy. So we're a vendor agnostic
• 31:17
  podcast, so I'm not asking you to endorse anybody that you hear
• 31:21
  you've walked the episode for. Did anybody jump out like whoa
• 31:25
  that's cool solution? I mean you did specific area.
• 31:29
  Oh. Like there's a whole NHI
• 31:34
  Pavilion, is it Pam, is it IGA? Is it some sort of
• 31:38
  authentication? Or you pull out a company name.
• 31:40
  I mean, what time? I walked a floor and it's
• 31:45
  there's a lot of AI and HI here the the soup du jour is I can
• 31:50
  secure your MCP server with a proxy and a gateway and
• 31:53
  authorize it. That is like everybody has that
• 31:55
  now here it's like great, stop talking to me about that, right.
• 31:59
  But from from what I've seen, what's what has stood out here
• 32:01
  is there's not a lot of people Avengers wise that are looking
• 32:08
  at the bigger picture of continuous and they're chasing
• 32:10
  they're chase they're chasing AI and NHI, they're chasing it.
• 32:14
  And what's gonna really be unfortunate is that year and a
• 32:19
  half purchased these tools, these things that these things
• 32:21
  to secure your platforms without the backing of the data.
• 32:26
  It's it's not gonna work the way you want it to.
• 32:30
  But that's your point though. What I have seen is there's,
• 32:36
  there's a lot of focus on identity verification here.
• 32:43
  I kinda like that now. Like there's some companies here
• 32:45
  to remain agnostic, but identity verification is becoming a thing
• 32:49
  now finally. That should have been a thing
• 32:51
  three years ago. That probably was a thing three
• 32:53
  years ago. But people are starting to
• 32:54
  realize that this North Korea thing is a problem, right?
• 32:58
  Not the country, just the, the whole you've all right, we've
• 33:00
  all, we've all read the articles, but it's, it's that to
• 33:04
  me set out there's, there's more than more than one vendor doing
• 33:07
  that here now. And I'm like when?
• 33:08
  That's a real interesting area because it started off really as
• 33:10
  government kind of vendors and focus, right, of trying to
• 33:14
  prevent fraud and how do you make sure the right services are
• 33:16
  getting to the right people and things like that.
• 33:18
  But then it was like, OK, finance usually is a leading
• 33:22
  indicator of people adopting that.
• 33:24
  And now it's starting to get further down.
• 33:25
  I mean, you can see it now. It's like, OK, well, I'm calling
• 33:27
  a help desk. How do I know that Sean calling
• 33:30
  me and not AI Sean or someone tripped fishing me?
• 33:34
  Because chances are, fishing is going to be the way you're going
• 33:37
  to get breached because that's what's going to.
• 33:39
  Happen statistically and with what Google.
• 33:41
  Google's VO3 just released. Which is crazy scary.
• 33:45
  Like if you had not played with that yet, Oh my, you just so
• 33:48
  it's it's super. Cool and super terrifying.
• 33:50
  And it just. And it's just that glimpse.
• 33:53
  Is that what we say? This is the worst it will ever
• 33:55
  be. It's gonna be better tomorrow.
• 33:56
  Better and better and better. All right, great, great
• 34:01
  question. I mean, that's I saw identity
• 34:03
  verification is like, wow, I'm like good 'cause that keeps me
• 34:07
  up at night. I mean, I think it's going to be
• 34:09
  helpful. I think what I think you have to
• 34:11
  think about is the credential management self and then who do
• 34:13
  you, where do you get them from and how do you make sure that
• 34:15
  everyone has access to it. That's all stuff I think that
• 34:18
  will eventually get figured out. But I think there is there is
• 34:21
  that authenticity that needs to be established of OK, who am I
• 34:24
  talking to and. It's like do this good way
• 34:28
  right? Proving me you're you.
• 34:29
  Blink if you're. Blink 3 times if you're you, but
• 34:32
  then on one foot exactly right, yeah.
• 34:35
  I feel like we could go on and on and on, but we do want to
• 34:38
  wrap this up. Sean, it's always great having
• 34:41
  you here on the show and I really enjoyed your panel.
• 34:44
  Thank you again for inviting me to be part of it.
• 34:46
  I'm just trying. To keep up.
• 34:47
  I'll say it out loud. You did a great job with it.
• 34:50
  I always look to you for like help and you always you take
• 34:54
  thoughts very well and you're like I got you.
• 34:56
  So thank you so much Otto. Same thing loved it.
• 34:59
  Mike and Andrew's like Jeff did a great job.
• 35:02
  So I'm thank you so much. I appreciate.
• 35:04
  It I think it's like I said, I think moderating is the easiest
• 35:06
  thing. I had a conversation with Grace
• 35:08
  Kluke, who is a Diev org winner for us.
• 35:11
  I caught her in the hallway and she did a panel and we we had a
• 35:13
  little bit of a discussion of us is moderating harder or easier?
• 35:18
  He says being on the pedal itself.
• 35:19
  And I said, well, for me in moderating is easy because.
• 35:22
  So I just. Turned the questions over to
• 35:23
  smart people and said OK, you guys answered these questions
• 35:25
  and in our session today was awesome because literally 30
• 35:29
  minutes of like straight audience questions like yeah, go
• 35:31
  to this person over here, go to that person over there and.
• 35:33
  You should ask also about this because he moderated the FC
• 35:36
  panel and I it's like ask him what you thought about it was
• 35:39
  harder to moderate or be on a panel because I think it's
• 35:41
  harder to moderate personally. Well, here we.
• 35:42
  Go. That's our call to action, you
• 35:44
  know, Put in the comments below whether you think moderating or
• 35:47
  being on the panel is better or not.
• 35:48
  So what I think is funny, though, is like, go to the
• 35:52
  different panels of sessions and I'm like, that person has been
• 35:56
  on the podcast that everyone on the stage today in your panel
• 35:59
  has been on the podcast. No surprise, but it's.
• 36:03
  Pretty cool, yeah, you're. Andrew Cameron, session with
• 36:07
  you. I thought you guys were going to
• 36:08
  geek out on EVs. I was like, man, is this, I
• 36:12
  think the center is, is it like EV now?
• 36:14
  What is it? It was, it was, it was, it was a
• 36:16
  great one. It was good.
• 36:17
  It was good. Well, all right, let's get out
• 36:19
  of here because I think we've got a bunch of stuff to do
• 36:20
  tonight. It's kind of another long day of
• 36:22
  Vegas, but I definitely appreciate you being on the show
• 36:24
  again for. Us, John.
• 36:25
  Well, what's that for having me? Thank you very much.
• 36:26
  You guys are great. I'll have your show, your
• 36:28
  LinkedIn in our show notes as well as
• 36:30
  kate.devcaep.devandthenyeahieacpodcast.com. Like subscribe that stuff.
• 36:35
  Again, thanks to RSM, thanks to Identiverse for helping us out
• 36:39
  with getting us off the ground. And yeah, we'll talk with
• 36:42
  everyone in the next one. You've been listening to
• 36:46
  Identity at the Center. We hope you've enjoyed the show.
• 36:50
  Make sure to like, rate and review, and we'll be back soon.
• 36:55
  But in the meantime, hit the website at
• 36:57
  identity@thecenter.com. See you next time on Identity at
• 37:03
  the Center.