Latest / Identity at the Center / #411 - Making IAM a Best Buy with Greg Handrick

Transcript

#411 - Making IAM a Best Buy with Greg Handrick · Identity at the Center

0:04
This is Identity at the Center. Welcome to the Identity at the
0:11
Center podcast. I'm Jim McDonald.
0:14
Unfortunately, Jeff Stedman wasn't able to make this
0:17
episode. He is braving the elements in
0:20
North Carolina, driving to Charlotte today, and today is
0:25
March 16th, and there's all kinds of wacky weather that he's
0:28
dealing with. So we'll wish him the best and
0:31
wish him safety on his travels. I'm going to be joined today by
0:35
a special guest. But before I get to all that, I
0:38
wanted to go over some kind of key updates and key dates and
0:42
reminders. We've got Identity Management
0:45
Day, which Jeff and I have been a part of in terms of bringing
0:49
on the director for I think pretty much since Identity
0:54
Management Day started. Anyway, it's April 14th of 2026
0:58
this year, and Jeff and I will actually be a part of it.
1:02
We're going to do a live podcast as part of Identity Management
1:07
Day, so make sure you tune in for that.
1:09
You can watch the live podcast. We're also hoping to to have a
1:13
recording so folks who can't see us live can experience that
1:18
podcast later. We're going to be at a couple of
1:21
conferences upcoming. So the European Identity and
1:25
Cloud conference put on by Cooper or Cole is in Berlin.
1:29
That's May 19th through the 22nd.
1:32
ID AC-25 MKO is the code that will get you 25% off.
1:40
All you have to do is go to our website, idacpodcast.com anytime
1:46
you can get all of our discount codes, all the information about
1:49
different conferences that either both of us or one of us
1:52
are going to be at and get those discount codes and direct links
1:56
to go and register. That's going to be a fantastic
1:58
time for anybody who's there. We also are going to attend all
2:03
the identity events that we can. I know there's going to be 1
2:07
prior to EIC. There's also going to be 1 prior
2:11
to Identiverse that's in Las Vegas, June 15th through the
2:15
18th. To get 25% off of that one, it's
2:19
IDV 26 DASH, IDAC two, 5% percent sign.
2:27
So again, go to our website and you get all the latest podcast
2:32
discount codes, sorry, conference discount codes.
2:35
Our guest today is like I said, is a very special guest, is
2:39
somebody that we've been talking to you for a long time about
2:42
coming on the podcast. His name is Greg Hendrick.
2:46
He's the director of IDAM or I am at Best Buy.
2:50
Welcome to the show, Greg. Thank you very much, Jim.
2:53
Pleasure to be here. Well, it's a pleasure to have
2:55
you been. Listening to you for a long
2:57
time. So exciting to finally be on.
2:59
Yeah, well, I'm really glad to have you on the podcast today.
3:03
And you know, I, I mentioned to you before the show this, this
3:07
podcast has really grown internationally and only 33%
3:13
roughly of our listener base is based in the United States.
3:18
So we have a large global presence.
3:20
And I don't know how much of A global presence Best Buy has,
3:24
but I'm assuming there's some listeners who aren't familiar
3:27
with Best Buy. So maybe you can give us a
3:29
little bit of background on what Best Buy is?
3:33
All right, sounds good. Yeah, we are domestic US only.
3:36
So we are the about the last standing consumer electronics
3:39
retailer. So everything from computers,
3:43
TV's, audio equipment, high end home audio, car stereos,
3:47
washers, dryers, all the appliances you need for your
3:50
home and all the accessories that go with those things and
3:53
then a ton of services to service those things.
3:56
So for it in the US we are well known but outside of this, no
4:03
probably people don't know us. Yeah, and, and I think, you
4:07
know, Jeff shops and spends like half of his paycheck at Best
4:11
Buy. I'm sure he would love his own
4:13
little discount code for Best Buy.
4:15
So if you work that out for him, that would be fantastic.
4:18
But we would not be under such pressure actually.
4:21
So I this your first time on the podcast, Greg got to ask you,
4:27
how did you get into identity? Did you choose it or did it
4:31
choose you? I've been around a long time and
4:35
I definitely chose identity. I used to say that I've been in
4:39
identity since before the word identity, but I actually started
4:42
back early in my career as an Oracle DBA and database
4:46
developer, but then in the office got into helping people
4:52
get access to the network file shows.
4:54
And so it was Novell network at the time, and I ended up
4:57
becoming learning about Novell Network and then learning we're
5:00
switching over from token ring to this new thing called 10 base
5:04
T networking. So I actually got in the wearing
5:06
closet, learned how that worked and, and it was just starting to
5:12
connect people to stuff. And so it was always about the
5:16
users and what they needed to do to do their jobs.
5:21
So I'll give a, a brief history of, of, of my long colorful
5:24
career. But I translated that to a
5:29
consulting gig with Nobel and then from there landed at a
5:34
manufacturing firm which was nationally located.
5:37
We had a bunch of sites, but as the network services manager,
5:42
which meant I got to learn not only the local area, network
5:45
wide area network stuff, but router switches, firewalls, all
5:49
those things, data center operations.
5:52
So I have this big infrastructure background
5:54
between, you know, power, space, cooling, all those, all those
5:58
things, racking servers, racking, storage, telephone
6:01
equipment, all the things learning about help desk and,
6:07
and again, getting people access to the things they needed.
6:11
And then from there, working for a large international
6:15
manufacturer and doing a lot of project management for them, a
6:20
lot of projects that were cross divisional, international, super
6:24
hard or things that have failed before.
6:25
And we got to step in and rescue from there.
6:29
I so there I got to be exposed to quality control, IT, service
6:35
management, and a bunch of different ways of looking at SA
6:38
at, at access, at technology. I got to become actually in one
6:44
part of that role, SAP security administrator, which is my first
6:47
exposure to true security. From there went to a couple
6:53
other different companies where I got to be exposed to a whole
6:55
lot more PCI, HIPAA, high Trust capability, maturity models,
7:00
whole bunch of different IT frameworks, COBIT, different
7:04
things, different ways of looking at the world, different
7:06
lenses. And, and again, it's always
7:09
about the business and about getting people around the
7:14
business, the things they need to do their job.
7:16
Had my first role where I actually had the title identity
7:22
and access management at Best Buy actually in 2011.
7:26
And from there, we were very operationally focused.
7:31
It was just about getting the user set up, getting their their
7:34
access into apps and then and making making sure that that was
7:40
done quickly and accurately. But security didn't matter so
7:45
much. So then following the retail
7:49
Armageddon that Amazon introduced to retail, I left
7:53
Best Buy in 2014, got to do a whole bunch of consulting, but
7:59
used all those, those different frameworks and, and security
8:04
systems and things that I picked up all that different
8:06
terminology from working across all kinds of different parts of
8:08
the business and was always drawn back to those situations
8:14
where it was getting people access to the systems they
8:17
needed. So identity was always there.
8:18
But now layering in, are we doing it in a Sox compliant way?
8:23
Are we doing it in a PCI compliant way?
8:25
Are we doing it with what, with whatever the the regulatory
8:31
framework of the moment was And then after a couple more
8:36
identity rolls, actually got to boomerang back into Best Buy and
8:41
step back into the team that I had left seven years prior.
8:46
And there's some some stories there because all the got to see
8:48
all the things that we had started back in the day when we
8:51
were actually trying to make it a real formal identity and
8:55
access management program. And then see how the promise
8:59
that we had had and the hope for all those systems that we're
9:02
putting in the 2014, how that changed over the course of seven
9:06
years, and then get to see what it became.
9:08
I can tell from that story, there's no way in the beginning
9:11
you could have drawn the line from here to there, but somehow
9:15
you made it all the way to the director role over the IM
9:20
program at Best Buy. And I'm sure there are a lot of
9:22
people who are in the beginning of their career who are very
9:26
interested to know, like, well, kind of just follow the path
9:30
that you follow, that you followed to get here.
9:32
And it's like, there's no way you could repeat that, right?
9:37
Absolutely not. And again, identity didn't exist
9:42
when I started, but it is now. What I love about identity and
9:48
as it grew on me over the years is that we have this unique
9:52
perspective in the organization. We touch every single person in
9:55
the company from security guard at the front desk all the way to
9:58
the CEO with very personal access to what they need to do
10:03
their jobs. It is it is now called identity
10:06
security and it is about security, but it's also about
10:09
compliance. It's about some human resources
10:12
and day one. How does that how's that person
10:15
get into their role? Do they have all the things they
10:17
need to do to be productive early on?
10:22
It's about that user's experience.
10:24
How does that look? And it's about the the
10:26
compliance pieces and it's the operational accuracy, efficiency
10:31
and can we audit the the current set of permissions across the
10:36
entire environment at any date of time?
10:38
Well, I think it's like the range of experiences you had
10:42
over time kind of talked about different frameworks you worked
10:46
with. And all the time you were like
10:48
serving this internal customer and trying to make it so that
10:54
identity security didn't become a hurdle for them, or at least
10:59
not something that held them back from doing their job.
11:02
And so to me, it's there's no one path for what makes a good
11:08
identity program leader. And I've been a program leader.
11:12
My path looks different. Jeff has been a program leader.
11:16
His path is different and your path is different.
11:20
One thing I found interesting is like now that you are the
11:23
identity program leader, as we talked, I wanted to make this
11:27
kind of like one of the top things that we talked about in
11:30
the show, which was the organization.
11:34
And so one thing you mentioned to me that totally different is
11:38
that or I shouldn't say it's totally different, but totally
11:41
different from my background, just background is that your
11:45
role reports into the CIO and the CIS.
11:50
So is more of a like a stakeholder to your program.
11:55
And I wanted to get like from you like how that works and what
11:59
the pros and cons are in your mind in terms of that approach?
12:04
Sure. For Best Buy, it's always been
12:07
that way. The identity program started off
12:10
just it was called credentialing and privileging.
12:17
And so they would actually they were focused just on setting up
12:20
an account and getting the person into the application.
12:22
So it was always that operational aspect when you're
12:25
talking we're about 100,000 person organization.
12:28
And so a lot of people coming in and need access fast and they
12:32
just wanted that efficient. And so adding on the security
12:37
piece of it was sort of an afterthought.
12:39
Adding on the compliance piece of it was an afterthought.
12:42
But now that we're here and now that we are more mature in this
12:46
space, I, I think it's all pro to be reporting up through the
12:52
CIO side of of the work because security compliance, they are
12:58
our stakeholders. They provide the framework, they
13:01
provide the, the rules and the standards that we have to abide
13:04
by. And so I'm free to, to actually
13:09
use them as a hammer when it, when we want to drive some new
13:12
thing in, we could say, oh, security needs us to do that.
13:14
So just don't blame me for, for this thing.
13:17
It's security's fault. But also I get to feedback to
13:21
security and say, wait and totally understand where you're
13:24
coming from and why we need to do whatever it is you're asking
13:28
to do. But here's the impact.
13:29
And so can we, can we change this role?
13:32
Or can we steer this? Can we guide it to make it just
13:34
a little easier for the organization to accept?
13:38
And so that's been a benefit. You have to be aware that that's
13:43
the role you're playing and that you do have these stakeholders.
13:46
And, and I think if because you're trying to manage all of
13:51
the things, if you let any one of those stakeholders get too
13:56
out of balance, things are, are not going to go well.
13:58
So if I, if I just said, oh, no, operationally that security
14:03
thing you're trying to do is too hard, we're not going to do it.
14:06
That's I'm giving too much wait to the operation side or vice
14:11
versa. If I if we let security drive
14:13
all of our program responses, then it's going to get out of
14:17
balance and and the customer experience is going to suffer or
14:20
something else is going to give way.
14:22
Jeff and I debated this on a recent episode of Mailbag
14:25
episode right? Someone asked about
14:28
organizationally is it better to report to CIO or CISO And I did
14:34
bring up that I think when I am falls under the CISO, which is
14:40
the most common case is that there's a little bit of
14:46
separation of duties issues kind of baked into that is like
14:50
where's the check and balance is.
14:52
CISO has to set up a lot of rules in terms of these are the
14:56
security gates that thou shall pass your application or your
15:02
enhancement through before you can go live.
15:05
The application team is often making guarantees or promises up
15:11
the chain that you know they'll go live on a certain date,
15:16
things like that. And you know the CISO can put a
15:20
stop to going live if you haven't gone through closing all
15:25
your critical issues, things like that.
15:28
Now the CISO is the one who made the promises and now it's like,
15:33
Oh well, there's this critical issue, but you know, it's not
15:35
really that critical. Like now they're in a position
15:39
where they have to either disappoint their boss or they
15:43
have to play, you know, they have to kind of let that
15:48
critical bug go past. And I'm not saying they won't
15:52
make the right decision, but they shouldn't be in that
15:56
position in the 1st. Place exactly who watches the
15:59
watchers, and you don't. You don't want to put people in
16:03
that position where they have to make a choice that's going to
16:06
make them look bad because everybody means well and they
16:09
want to do the right thing. But it could be really tough.
16:11
In your role as I am program leader, do you have a steering
16:16
committee and then what is the role of that steering committee?
16:19
Are they a sounding board? Are they decision makers?
16:24
What kind of? Where do they fit into the pre C
16:28
view if you will? They are both of those things
16:33
sounding board and and decision makers, but it's not always been
16:40
that way and it it took a while to get them to embrace that.
16:46
At some point in the history, somebody got a recommendation
16:51
that an identity best practices to have a steering committee.
16:54
And so the C so and, and my manager who's the CTO actually
17:00
came together and initial steering committee meetings
17:06
were, were sort of more like project status updates and they
17:09
were very much looking back. Here's here's what we did here.
17:12
Here's you know what, what it cost and, and you know the
17:17
problems that we had the findings that we had took a
17:20
while to, to get our program stable enough, get, get things
17:28
running smoothly enough that we could actually start looking
17:32
ahead and getting, getting them, getting the questions that we're
17:37
asking them to be difficult enough to actually engage to
17:40
BPS. You know that executive level
17:42
brain isn't, doesn't really care about provisioning accounts or
17:45
doing an access certification. But when you start discussing,
17:49
well, wait a minute, what's our road map to password list?
17:51
What's our, you know, compliance coverage name an issue they want
17:57
to be more of strategic. What business value are we
17:59
actually adding? Can we show it or are we just a
18:02
just a cost center? And so when we started talking
18:05
about taking friction out of the environment, driving better
18:08
compliance, reducing the tax surface and how we're going to
18:12
get there, all of a sudden the steering committee really became
18:16
critical for us because we needed both the security side to
18:20
get be giving a standards that we could drive to operationally.
18:23
But then the operational feedback about how, how, how do
18:27
you do zero trust? Well, you, you can say it, but
18:31
but we see where all the gaps are and where implementation
18:35
challenges are. So it's been fabulous to see
18:38
that shift in the, in those meetings and simple, it's a,
18:43
it's a one hour meeting every six weeks.
18:44
So if you don't have a steering committee, put one together and
18:47
just put a little little burden on their plate because the
18:51
feedback you get is phenomenal. The guidance that we've gotten
18:55
towards implementation has made us successful.
18:58
But the other thing is we've now got a partner in the executive
19:01
suite and so they can have conversations about us in the
19:05
rooms where we aren't. And so when you've got senior
19:09
VPS talking across the organization and somebody else
19:12
saying, hey, no identity is important and here's why you
19:14
have to account for it, it makes all the difference in the world
19:19
to to your ability to be successful.
19:21
Yeah, identity really touches like every part of the business.
19:25
So, you know, most parts of the business ought to have some kind
19:29
of input in terms of house touching them.
19:32
I've always felt like one of the biggest benefits you can get
19:35
from a steering committee is building evangelists who go out
19:39
and say, hey, this thing that the identity group is doing is
19:43
pretty big, but guess what? It doesn't work without our
19:46
cooperation. So we are going to cooperate.
19:51
You know, whether your stakeholder is HR or an
19:55
executive who manages business, part of the business or they're
19:58
IT stakeholders who are, you know, operations.
20:01
For example, if they're on board with your program, you don't
20:06
have to twist their arm as much to.
20:09
Get them to, you know, hey, we want to push out this new
20:13
standard and especially if you, if you frame or couch these
20:17
issues, as you know, hey, this is what we want to do.
20:20
This is why we want to do it. The problem is going to solve.
20:25
What say you? Do you have a concern about
20:27
this? Wow, now it's like you're open
20:30
minded to hear their feedback. Exactly.
20:33
And so having those evangelists is great.
20:36
And then the other thing is they actually will help us sell the
20:40
wins. So when we've removed password
20:43
entry from, you know, 3 or 4 applications, they can step in
20:49
front of that other executive leader and say, hey, we did that
20:52
for you. We took some friction out of
20:54
your daily life because those are the kinds of things that
20:56
people see and they don't always know why it happened.
21:01
And so when we can say no, that was an intentional step and we
21:04
chose to make our your life easier, people do appreciate it.
21:08
So Greg, before people start sending you emails saying like,
21:13
hey, having problems with my password on bestbuy.com, I
21:16
wanted to clarify you do the internal work for a side of
21:21
identity. You have a a peer who does the
21:25
external side. But that leads me to another
21:28
question because I think the other big party that a large
21:33
retailer especially would deal with his third parties suppliers
21:38
essentially, is that in your scope and do you think that is
21:43
easier than your internal workforce or is that just a
21:47
totally hard thing to do? Such a great question.
21:51
Yes, I have enterprise all, all humans and and non humans and
21:57
everything but customer. So third party suppliers, Best
22:02
Buy has thousands. We have merchandise vendors, we
22:05
have services vendors. We also have a retail meeting
22:11
network who will be sell ads in the spaces in bestbuy.com.
22:15
And so there's ads, buyers are another category for us.
22:19
And then we also have a marketplace and so on
22:22
bestbuy.com you might see products that are fulfilled by
22:25
Best Buy or fulfilled by a third party.
22:28
And so those sellers are also among those those vendor and
22:33
partner identities that we track and and take care of.
22:37
Is it easier? In some respects it is easier
22:42
because the, the number is smaller than the number of
22:44
humans we have inside and the the things that they have access
22:49
to is simpler. The the number of entitlements
22:51
is much smaller and number of applications is smaller.
22:55
Where it gets really interesting and has been been challenging
22:58
for us is the number of stakeholders across that single
23:02
partner experience is challenging because we do have
23:06
the marketplace and then the the merchandise vendors and the
23:10
other internal vendors. And then the ad side of it makes
23:14
for a whole bunch of people who will come to the table and one
23:17
person will say, I got to have it this way and four others they
23:21
know you don't and they don't want it.
23:23
And so we end up with a doing a lot of a lot of listening and a
23:27
lot of compromising just on what that partner experience is going
23:30
to be. So Greg, I was really happy to
23:32
hear that you're a regular listener to the podcast because
23:36
really the way we thought about the podcast from the very
23:40
beginning is this is the podcast for the IEM practitioner.
23:44
And Jeff and I both have the background of we've run IEM
23:48
programs. So we think there are a lot of
23:52
people who are either I am program managers or who aspire
23:56
to be, I am program managers. And I love that idea that you
24:01
put out there about the, you know, going beyond the identity
24:06
security piece, because what you're talking about is like
24:10
enabling the business and that's great.
24:14
But somehow you have to get recognize for that, right?
24:18
I mean, like, you maybe don't have to get recognized for it,
24:22
but it sure is nice if you get recognized for it and it will
24:26
help your program in the future to get, if you get that
24:30
visibility and you get that recognition that, you know, this
24:35
is a team that creates business value.
24:38
And I'm wondering from your perspective, like, how do you
24:41
keep that going? How do you keep your program
24:44
visible and relevant to the business?
24:48
You raised such a great point about the identity space and let
24:53
me go back to when I started listening to the Identity at the
24:56
Center podcast. I was intimidated by every guest
24:59
you have on because everybody brings such depth of experience
25:02
and I am is so big. I think it is easy to get to, to
25:08
get a little bit of imposter syndrome because like there you
25:12
could be a super technical person in access management and
25:15
be able to speak about, you know, SAML and OIDC and Oauth
25:19
and, or, or maybe you're on the IGA and ILM side of it.
25:23
And if you can't bridge all of it, it then maybe you feel like
25:29
you're failing a little bit. And so that to me was, was
25:32
always a, a challenge. But identity is, is truly A-Team
25:35
sport. And so I don't know anybody that
25:39
can do all of it alone. And so how do I stay relevant It
25:43
it's that because not only do within the identity space, we
25:48
have to cover a whole range of solutions, but we've got
25:52
business groups that are trying to do a whole range of things.
25:55
And and to succeed, we have to bring the right team to the to
25:59
the problem. So I think one of the things
26:02
that you know, I really key in on is communicating the value of
26:08
identity. And 1st off, it's probably a
26:11
matter of people not always knowing what identity is, much
26:16
less of value that it brings to the organization.
26:19
So you probably experience the same thing, right?
26:22
Everybody other than our groups don't wake up thinking about
26:27
identity, but we do. And we need people to understand
26:32
what's the importance list of value, right?
26:35
Right, exactly. And I think that's the way to
26:37
think about it. We stay relevant by having those
26:40
conversations and being actually the expert who has a role to
26:45
play at the in business. So I think one of the things
26:49
that is challenging for a lot of identity, a lot of technologists
26:53
is just to to speak in simple enough terms for your audience
26:57
to understand. But I think the the corollary
27:02
there is if I go talk to the doctor and the doctor starts
27:06
throwing all the medical jargon at me, I'm not going to
27:08
understand, I'm not an expert in his face.
27:11
Same when I'm talking to marketing or the finance folks
27:14
or the HR folks. I'm not an expert in their
27:16
space. They're not an expert in mine.
27:18
I wouldn't expect them to be. So we have to find ways to
27:21
simplify what we do and be able to communicate it clearly so
27:25
that we can exchange that business value.
27:28
And I think there's a lot to be said for just spending a lot of
27:31
time listening to the problems of the person on the other side
27:34
of the table, getting their perspective.
27:36
And then when you hear what they're facing, we can think
27:39
about solutions that we can we can bring to them.
27:42
And then that's immediately where we find value and where we
27:44
add relevance. I want to pick up on that
27:47
analogy just through which is like going to the doctor,
27:50
because my next question is around making the value pitch
27:54
and getting investment in. I am.
27:57
And one thing that I found that doesn't work is fun factor,
28:01
right? So it's kind of like you to the
28:03
doctors like, well, you keep eating BBQ, you're going to get
28:06
cancer and if you keep drinking, you know, pop, you're going to
28:10
end up with diabetes. The first thing you're doing
28:13
after that is going to work. It's just like, I just can't
28:17
take this anymore. But so the question I have for
28:21
you is like, how do you make the case for getting investment?
28:25
Do you talk about the enablement side ROI?
28:30
Do you talk about risk mitigation?
28:32
Or do you find that maybe it's contrary to what they said?
28:35
Maybe flood works for you? Absolutely no, never flood it
28:40
because it it does not work. In my experience.
28:45
We, when I came back to Best Buy in 2021, we actually ended up
28:51
doing an RFP because that system that I mentioned that had grown
28:55
for seven years when I left was not serving the business and it
29:00
was too expensive to maintain, took too long.
29:04
It wasn't hitting all the business seeds.
29:06
We had business compliance findings.
29:09
And so we actually ended up ripping, well, we ended up doing
29:16
an RFP, selecting a new identity life cycle management, identity
29:20
governance tool. I don't know if I'm allowed to
29:24
say brands here and A and a single access management tool.
29:28
So anyway, we want sale point ping identity and Microsoft AD
29:32
Active Directory as the sole directory.
29:33
So we took this big portfolio of apps and we just shrunk it all
29:38
down into three single things. Through that we actually got
29:43
engaged with with every app team because they had to standardize
29:47
that. We forced a whole bunch of
29:49
security standard standards into this thing.
29:51
If you're coming out of the old directory, your service account
29:54
is now going to be in AD, It's going to have the same standard.
29:57
We're going to give it an owner and an alternate owner, and the
30:01
password will be vaulted in the privileged access management
30:04
system. So we actually were able to
30:07
suddenly standardize and drive a whole bunch of efficiency
30:10
improvements just by making everything repeatable.
30:15
And all of a sudden it was it was easier for app teams to deal
30:18
with because if they if an app developer moved between teams,
30:23
all the standards still were the same as far as access
30:25
management, single sign on directory and provisioning.
30:31
Since then we haven't really had to make any investments in
30:34
identity. And so we're now coming up on,
30:38
on some with the rise of I Gentic and we've, we've got to
30:41
expand our tool set to get a little better visibility in that
30:44
space. But now with the activity of the
30:46
steering committee, we've already been having these
30:49
conversations now for over a year.
30:51
How does this look? How's this going to look where
30:53
this the knowledge gaps? So we put in put together some
30:57
working groups and we figured out things.
30:58
And we're now, we've gone through an RFI, we're now about
31:01
to RFP, but at the point where we have to make a tool with CSO
31:06
and the CTO are in alignment, they're already know that this
31:10
is the way we have to go. Aren't this entire steering
31:14
committee has brought together the right people to look at the
31:17
problem and all the concerns that they would have had had
31:21
only one side done it are now kind of alleviated.
31:25
And so there you go. That's how we make investment
31:28
now. Well, congratulations to you
31:30
because I know what that takes to pull together leadership to
31:36
all get on the same page. I think one of the other big
31:39
challenges that we as program leaders and your program leader
31:45
today is probably the hardest time in history to be an
31:50
identity program leader because the, the merging of traditional
31:56
cyber and traditional identity is like they're just merging.
32:00
And the name identity at the center is more relevant now than
32:04
when we started the podcast because it's like identity is
32:08
getting integrated to all the cyber cyber tools, you know,
32:13
identifying, detecting anomalies and account takeovers and things
32:19
like that. And then identity being the, the
32:23
number one, you know, methodology that the attackers
32:30
are using to take over networks. I guess all that is a
32:34
background, you know, how do you work with your peers who do
32:40
traditional cyber to make sure that identity is being included
32:45
in that and that you're taking from them?
32:47
Like how do I harden my identity environment so that you know I'm
32:53
not causing problems for them? I need a piece of wood to knock
32:56
on to make sure that we are we are doing that that having that
33:01
conversation and staying secure. Best Buy does have several
33:07
advantages over other companies and one of them is that we are
33:12
very, very centralized. We're based in Minnesota and a
33:17
lot of the team is here so we can have conversations.
33:19
Cyber is here. We were talking to each other
33:22
all the time. One of the other advantages
33:25
we've had is that we haven't grown a lot by acquisition and
33:27
we don't have these far-flung business units.
33:30
So everybody is kind of right here.
33:32
When we make decisions for the enterprise, it's done.
33:36
You know, basically there's there's not not a lot of shadow
33:38
IT or other other divisions that we have to worry about
33:41
implementing. Those are absolute blessings in
33:46
my program and I have lived in an environment that didn't have
33:50
those those blessings and my sympathies to the people that
33:55
are trying to do this with, you know, an an argumentative
34:00
security group or business units that just want to go their own
34:03
way. And so you can only secure about
34:05
half the org or something. It's a challenge it, but it
34:11
comes down to we don't think of the identity team and the
34:17
operations team and the cyber team.
34:19
We think of the Best Buy team. So one of the other good things
34:23
about Best Buy is that our culture is, is focused on the
34:28
the external threat rather than somebody having the internal
34:32
threat of Oh my, my turf is getting stepped on or somebody,
34:36
you know, didn't show me the proper respect for my role.
34:38
We don't have that. Our culture is is pretty healthy
34:41
in that regard and makes those conversations with the cyber
34:45
team easy because we're always looking at what's best for the
34:47
company. You know, I said one of the
34:49
things I I learned since I met you, Greg, is that you are
34:53
pretty technical. And as you went through the
34:55
background today, I was like, oh, he's had some pretty
34:58
technical roles. I mean, you started all the way
35:00
back as ADBA, new Oracle environment and kind of a novel
35:07
administrator. So you have a bit of a technical
35:10
background. But one of the other things that
35:13
I learned about you, because you're so sharp with your
35:16
business acumen, thought this guy can't be technical.
35:20
You've got the right balance, right?
35:22
But you weren't born with the right balance.
35:24
I'm sure you didn't come out of college with the right balance.
35:28
What have you done over time to kind of build the skills so that
35:34
you can target this answer toward the person who is up and
35:39
coming and wants to be in a role like yours?
35:42
Like you need to have both things right?
35:46
Be be curious. One thing I've always like to do
35:52
is is when I, when I encounter something I don't know, I, I
35:57
say, I don't know, teach me or you know, I, I can learn this
36:01
thing and learn enough about it. As I've moved out kind of away
36:06
from the, the day-to-day technical where I was the hands
36:09
on the keyboard, configuring the system, I make sure to, to talk
36:14
to my engineers. I always want to understand what
36:15
they have to do. And so it is that they, it takes
36:20
people a while to get used to me coming in and going show me.
36:24
I, no, no, I, I know the, the work, that ticket that's right
36:27
in front of you. I want to sit and shoulder surf
36:29
while you do it. So I understand the effort, how
36:32
much swivel chair maybe you have to do between systems, the
36:36
burden we put on when we say, no, you got to use a jump host
36:39
and then pull the password from the vault and, and just watching
36:42
those things. And then it just asked the
36:46
question, where's, where's this running?
36:48
Oh, it's running on containers. Well, tell me, teach me about
36:50
containers. Where's that, you know, Oh, who
36:52
runs that? You go talk to that team.
36:53
You go tell me a little bit about your world.
36:56
People love to, to tell you about their world.
36:59
And it's, it's just a great way to learn, a great way to be able
37:06
to make connections between what we do and what other people do
37:09
and what, what are the foundations for the systems that
37:12
we're running. And you end up building a
37:17
network of connections that you may not understand how it will
37:23
serve you today, but at some point you're going to need that
37:25
connection. And so be curious, go out, just
37:30
talk to people, get to know people.
37:32
It will serve you in all aspects of your career.
37:35
How are you using AI in your day-to-day?
37:38
Are you the kind of person that you're actually writing agents?
37:42
Are you asking how do you use it?
37:45
I have a little bit of FOMO when it comes to writing agents.
37:48
I am probably behind where I want to be, which explains the
37:53
three open things out of training sessions I've got on my
37:57
browser right now. But we are using it in our code,
38:03
in our coding and Best Buy as a whole is using.
38:09
We're creating aid and agentic structure and we do have
38:13
experiments going on with several different models.
38:16
It's been we're trying to keep those people a little bit
38:20
throttled and not get too far ahead of the identity space.
38:23
So, yeah, no, I mean, we all, I think are we know this tidal
38:29
wave is coming and we're trying to balance getting good use out
38:34
of it for today, but also be ready for tomorrow.
38:36
I think it's changing so fast that it's hard to see where this
38:40
thing's going to be in two years.
38:42
But we know it's not going to be where it's at now.
38:45
Right. One of the other questions I
38:48
wanted to ask you, Greg, was, you know, now shifting gears.
38:53
I loved your answer about being curious.
38:55
It was advice to the practitioner who's like the up
38:59
and Comer wants to lead a program.
39:02
Now, I want you to answer this question mostly with the person
39:05
who's already leading a program of mine.
39:08
And I want to know what is your philosophy as a leader of
39:11
people? Because I think that's probably
39:14
the biggest transition when you're no longer producing the
39:18
output, you have a team of people who produce the output.
39:22
And in some ways, I remember making this transition myself
39:26
and kind of feeling vulnerable, right?
39:29
At first you feel vulnerable because like I spent my whole
39:32
career producing output and now I don't produce output.
39:36
All these other people are doing the work, but that's my job is
39:39
to make sure that they're producing the right output.
39:42
What's your philosophy on leading people?
39:45
So I'm also a former Army officer.
39:47
So I've learned a number of different ways of leading and to
39:52
me, the the best is to set up conditions where people just can
39:59
work freely and have set a psychological safety.
40:02
Basically, they people have to be not just a hands on the
40:07
keyboard, but we need the brain that's attached to those hands.
40:11
So my philosophy is I know that I'm intelligent and I've got a
40:17
lot of experience and I know a lot, but I don't want to be the
40:20
smartest person in the room. So if I am the smartest person
40:23
in the room, I try to invite more people into the room or I
40:26
go find a different. And what I try to do with with
40:31
my team at Best Buy is let them exercise their skills, grow
40:37
their own skills, and feel trusted enough to tell me when
40:39
things are going wrong and to tell me what they need to grow.
40:46
Richard Branson, I think, was the one who had a quote of
40:49
somebody had asked him, well, what if we would train all our
40:52
people in the elite? And Branson's response was, what
40:56
if we don't train them and they stay?
40:58
And so I try to set up the environment where people want to
41:03
be there because their skills are being used, because they're
41:06
growing, they've got challenging problems to work on.
41:09
And they're trusted like, like everybody's an adult and a
41:12
professional. Let's treat them like
41:14
professional adults. So the more you can do that, the
41:18
more you can kind of trust beyond reason and let people
41:24
bring their best selves to work. The more fun you're going to
41:30
have at work, the less stress you're going to have and you can
41:34
help people grow. And again, it's, it's always
41:37
worth it. Even if somebody ends up leaving
41:40
your team, there's there's always going to be turnover.
41:43
But if you've helped them achieve everything they can
41:47
where they are with you, and they're now ready to fly the
41:50
nest and move on, I think that's a win.
41:52
And then it's announced an opportunity.
41:55
Opportunity for us to bring in somebody with a new perspective,
41:57
new energy, new experience to to change our dynamic challenges to
42:01
keep us moving forward. Hey, you're a boomerang, so it's
42:04
definitely something that can happen, right?
42:07
Absolutely. So I think he answered kind of
42:13
one of my next questions, which was how do you keep people
42:16
growing but keeping them motivated and wanting to stay.
42:22
I also my next question though, is I think people have real
42:27
anxiety, especially younger folks that they're, you know,
42:31
just as they're starting their career, they're going to be
42:34
replaced by AI agents that are going to do all the white collar
42:39
jobs. And I guess in a lot of ways
42:42
we're lucky, right, because we're, we've been in our career
42:45
and we're, you know, in the, the, the last decade of our
42:49
career, let's just call it that. That is like, I'm kind of like,
42:55
well, AIA just replaced my job. I don't, you know, that's not
42:59
the end of the world for me, But for someone who's starting out
43:02
or mid career, it's a big deal. I guess one, do you think that's
43:06
something people have to worry about?
43:08
And do people ever bring that concern to you?
43:12
Or if they did, what would you say to them?
43:15
If they brought me the question, am I going to be replaced by AII
43:19
think that the better question is what can I do to be enhanced
43:25
by AI? And that's the way I'm trying to
43:27
think of it. Because yeah, there's a little
43:28
bit of nervousness always, I think, I think the the basic
43:34
triangle in IT is, is people, process and technology.
43:38
And I think even if you add AI and agents into the mix, well,
43:45
what are they? They're they're definitely
43:46
technology. They but they react kind of
43:49
peopleish. So the proportion changes a
43:52
little bit, but I think the people working with AI to to
44:00
number 1, I think what we're going to do is use it to do what
44:03
we do today faster than maybe to automate things and the
44:10
processes are still going to be important.
44:12
I just heard an interesting thing just this week on a
44:16
podcast and person said that it's not, it's not when we
44:24
change an existing process and speed it up that people lose
44:28
their jobs and get replaced. It's when the entire paradigm
44:32
shifts that all of a sudden people will be displaced.
44:36
So I think near term and and probably mid term, it's going to
44:41
be a long time until the fundamental need for people
44:46
process technology shifts to the point where we get replaced by
44:49
AI. And that's the hope I have for
44:51
the next 20 years, so that. That's great and that's a great
44:55
way an optimistic view to round this out.
45:00
You know, if you're a regular listener, you already know we
45:03
like to end every episode with Ledger note where we kind of
45:07
step away from the identity subject matter.
45:09
And as we got to know each other, you mentioned that one of
45:13
your big hobbies is doing run the house projects.
45:17
And I wondered, are you just naturally handy?
45:22
In other words, do you kind of know what to do?
45:25
You learn from, you know, your father or something like that?
45:29
Or are you like me and you go to, And I hope my dad doesn't
45:34
hear that because he's taught me a lot of things that I've
45:37
forgotten most of them or I haven't really used them because
45:40
I've been in this identity world.
45:42
So I haven't had to do like electrical or work on my car and
45:47
you know, for most of the time over the last 30 years.
45:50
But are you kind of naturally handy or do you have those
45:56
skills in the past? Or do you use YouTube as a
45:59
crotch like I do? So I guess I'm naturally handy
46:03
because I I had shop class in grade school.
46:07
Been doing woodworking for a long time, some metalworking,
46:13
word word welding and that kind of thing.
46:15
But my father-in-law is a builder and so he's the guy with
46:22
all the tools and always so, oh hey, I got to do this thing and
46:25
he'd say, well, I'll lend you the tools and tell you how to do
46:27
it. I was looking for him to, to
46:30
actually do the thing for him, but I ended up doing the thing.
46:33
So I have picked up a whole bunch of skills over the years,
46:35
but YouTube is the greatest. Absolutely.
46:39
I tell my wife I am 3 videos away from knowing how to do
46:43
anything. And so, you know, one of the
46:48
other things that I picked up was making gear to support my
46:51
son's Boy Scout troop. And we'd had, you know, some
46:55
tarps to repair and things. And I ended up learning how to
46:57
make, I learned how to sew because of YouTube.
47:00
So making hammocks and tarps and tents and backpacks and, and
47:03
climbing bags and all kinds of things, final wraps for my
47:07
daughter's car. YouTube, you know, spend endless
47:12
hours watching, figuring out how to do trim on my deck.
47:15
Embarrassing. But also YouTube.
47:18
And of course, the most valuable thing on YouTube, and my
47:22
favorite thing to watch on YouTube is Identity at the
47:26
Center podcast. Well, I think with that, we'll
47:29
get invited back, but we do our best to make sure that we have a
47:34
lot of content on YouTube. I mean, you know, one thing I'd
47:38
love it is if folks who are listening to the episode could
47:42
go out, find one of the shorts or find this video, just give it
47:46
a like or give it a comment because they're trying to grow
47:49
the YouTube channel. We put out video content every
47:54
week, tons of shorts and things like that.
47:57
And so it's kind of a labor of love.
47:59
I mean, we do like doing it, but it is a labor.
48:03
We put a lot of effort into it. And getting that feedback is
48:07
important to, you know, Jeff and I in terms of knowing that what
48:11
we're doing is is valuable and it makes sense to keep doing it.
48:15
So if you get a chance to go out there, but definitely appreciate
48:19
that Greg. And I do know what you mean
48:21
about the the three videos away from learning how to do
48:24
anything. I mean, I got open clawed up and
48:27
running on my laptop in the VM. And I believe me, I had to like
48:33
fight my way through some old, you know, prompts that were like
48:38
Linux commands that I hadn't used in quite a while.
48:42
And like it was, it was quite an adventure, but I could not have
48:46
done it without the contributions of people putting
48:49
things on YouTube. So.
48:51
So they know what you mean. So then one question back for
48:54
you. What is your agent doing?
48:56
What are you doing with Open Club?
48:58
How are you using AI, Jim? How am I using AI?
49:02
So I I pretty much wind up being lol Ms. like all the time.
49:07
Couple things. One I tried to build agents at
49:11
my work. The the problem was is like I
49:15
could build agents that worked kind of within themselves but
49:18
when they had to integrate to data sources that the
49:22
integrations weren't pre created, that's where it broke.
49:28
My experience with open Claw was it was a lot harder to install
49:33
then a lot of people were talking about online.
49:38
And when I got it up and running, I tried to give it a
49:42
few projects to do and how do I put this nicely?
49:47
The thing was stupid. I told it like do this thing and
49:52
then create me a report and e-mail it to me and then it it
49:56
ran it and then it's it failed. But why did it fail?
50:01
Because me is not an e-mail address.
50:05
And I was like, OK, I didn't mean type the letter ME as my,
50:10
you know, an e-mail to that. I meant be smart enough and use
50:14
my e-mail address. So then I had an argument with
50:17
it about like, who's going to fix the code to get the thing to
50:21
work? And then the thing I asked it to
50:24
do. It was another one of those
50:25
scenarios where maybe I didn't give it enough information, but
50:29
if I had like gone into gory details, like I, I basically
50:33
tell it to go into my sent mail, look for anything where my
50:37
attachments were nothing but receipts and move those emails
50:43
to the trash. So I was trying to free up some
50:45
space. And what it wound up doing was
50:49
like putting all of my emails that had attachments in the
50:53
trash. I'm like, that's not what I
50:55
wanted. And so I kind of gave up on it.
51:00
The conceptually it's amazing, right?
51:03
And obviously like I think over the AI bought the, the software,
51:08
that's where things are heading. Just I don't have a lot of time
51:11
to invest in something where I'm not going to see a payback.
51:15
And that's what I kind of came to conclusions like cut my
51:18
losses. I learned a lot getting to this
51:21
point, but this thing is not productive enough.
51:24
Now what I'm excited about trying here in the next couple
51:28
of weeks is clawed Co work because I know with that you can
51:33
set up a lot of recurring processes and things like that.
51:38
One thing I will give clawbot was or open claw, they're
51:43
calling it now, was that it connected to my WhatsApp.
51:49
So I was able to message with it.
51:51
I was able to tell to do things when I was not in front of the
51:55
computer, which I thought that was very cool.
51:57
But by the way folks, one thing you have to realize is like for
52:01
it to be effective, you have to connect it to all the systems.
52:05
So one of the connections has to be to an LLM.
52:10
If you connect it to open AI as your LLM, it connects via API.
52:19
Well, every time you hit the API you get charged real world
52:23
money. So I know a lot of people are
52:25
connecting Open Claw to Chinese LLM to try to save money.
52:31
And I think that's, you know, that is what it is.
52:35
But, you know, don't go into it thinking, oh, this is just a
52:38
free project and it's not going to cost me anything.
52:41
So that's not the case. No, I think there's a lot of
52:44
power out there and there's promise of getting that harness,
52:49
but we're we're still safe from being replaced by AI for a
52:52
while. Yeah, well, I think even look,
52:56
this is my my thing that makes me feel safe is that building a
53:02
a setting up a product to making it like exist is that's not the
53:08
hard part, Never been the hard part in IT.
53:10
It was all the integrations and not just the technical side of
53:14
the integrations, but getting the OK to do the integration and
53:19
testing the integration and someone looking at this test
53:22
results and saying, yes, we can continue to move forward.
53:25
When you're talking about identity, I mean, it is the
53:29
ultimate middleware. You don't just you know, install
53:33
like I think you said sell point and paying like you don't just
53:36
install those things and then you know, all the integrations
53:39
just happened like this things take years and it's not just the
53:44
technical side. It's, you know, getting the
53:46
organization and people to be OK with you, like OK, you're going
53:51
to take over the logins for this system that I care for.
53:55
And if it doesn't work, where are you going to be?
54:00
And if like I need to get access to the system, if that doesn't
54:05
work, where are you going to be? You know, So you know, rolling
54:12
out like ERP systems, rolling out identity systems, AIS got a
54:18
little while till it can do that.
54:20
If it can, if it can do all the technical side like, you know,
54:24
for people to be comfortable with it plugging in enterprise
54:28
wide, we're looking at many years down the road I think.
54:32
No doubt it'll help with the technology, but getting the
54:35
people and the process aligned with all of it is where the
54:38
magic for humans. Yeah, I put something like that
54:43
on LinkedIn and not everyone agrees and that's cool.
54:47
But I I mean, you know, I'm formally in my opinion, because
54:51
I go back and forth because, you know, heck were AI wasn't
54:55
beating me at 2025 to the end of 2025.
54:59
I mean it was like, you know, went from like sci-fi to Oh my
55:03
gosh, is this really happening? So where's it going to be at the
55:06
end of 26? Somebody mind blowing.
55:10
But again, you know, what does that mean?
55:13
People are going to just say, yeah, we're going to take the
55:16
the handbrake off. We'll see.
55:19
More to come. More to come.
55:21
Well, thanks for being on the show, Greg, and wrap it up for
55:25
all the listeners. Thanks for listening.
55:27
If you're still on with us, check us out on the web at
55:30
idacpodcast.com. We're on YouTube,
55:33
idacpodcast.tv, and of course, in your favorite podcast player.
55:39
Greg, thanks for being on with us.
55:41
Thank you so much for having me, it's been a pleasure.
55:44
All right, everyone, we'll talk to you all on the next one.
55:49
You've been listening to Identity at the Center.
55:53
We hope you've enjoyed the show. Make sure to like rate and
55:57
review, and we'll be back soon. But in the meantime, hit the
56:00
website at identity@thecenter.com.
56:04
See you next time on Identity at the Center.