Latest / Identity at the Center / #256 - IDAC of NIST with Ryan Galluzzo of NIST

Transcript

#256 - IDAC of NIST with Ryan Galluzzo of NIST · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now.
0:15
Your hosts Jim McDonald and Jeff Stedman, welcome.
0:22
To the Identity at the Center podcast, I'm Jeff and that's
0:24
Jim. Hey, Jim.
0:25
Hey, Jeff, how are you? Oh, not so bad yourself.
0:29
I'm doing great. You know what I realized was we
0:31
never did a 2024 prediction show.
0:35
So I'm not, I'm not going to try to revisit that now we're going
0:39
to we've got a whole plan for the show that has nothing to do
0:42
with that. But I predict I'm going to spend
0:44
a lot of time learning about ITDR this year.
0:48
I just think it's like I think it's the technology that is the
0:52
true game changer. The more you know, videos I
0:55
watch and products that I mess around with and read
1:00
documentation, I mean it's where it's at.
1:02
And then as you know, working with a client in my day job
1:08
where we're working on like having a privileged access
1:11
management strategy. And I mean, it's a big
1:16
organization. I wouldn't call it
1:18
decentralized, but there's a lot of different groups that are
1:21
doing privileged access management.
1:23
So what can you do centrally? I don't think you can stick a
1:27
monolithic Pam solution right in the center and expect that
1:30
that's going to manage all of your privilege access.
1:34
But what I do think you can do is have a centralized vision,
1:39
commanding control, or at least an alerting platform that kind
1:43
of shows you, here's what's going on in the environment that
1:48
looks fishy. And you can predefine responses
1:52
to some of those events. I know we talk about this all
1:55
the time. It's like, oh, Jim, you just
1:56
woke up to this? No.
1:58
But I'm getting really excited about it.
2:00
OK. I mean I think like a lot of
2:02
this is logging, right. I think and I've said it before,
2:04
I think ITDR is sort of the evolution of what we called user
2:08
behavior analytics or analysis or user an entity behavior
2:11
analytics or analysis from like a decade ago.
2:14
That's great. I think, you know, I think the
2:15
assumption at this point is, is that most organizations now have
2:20
the appropriate logging in place to be able to take that data and
2:23
do stuff with it. Hint, hint, if your organization
2:26
does not have that yet, probably should get on, get on the on the
2:29
bandwagon and start to figure out how you're going to click
2:31
that data. Yeah, I I think ITDRS have a
2:35
little bit of a moment in the sun feel like the last year or
2:37
so has definitely gotten some play.
2:39
Certainly Gartner shining a light on it a couple years ago
2:41
has kind of opened the eyes for it and we've seen some pretty
2:43
cool products. So that'd be interesting.
2:45
I was going to say if you know about the prediction show, I was
2:48
going to say, well, I predict that we're not going to do 2024
2:50
predictions and that would automatically be right.
2:53
Yeah, well, I think we're, I think we're at that stage now.
2:56
So I mean one thing I can tell, I another thing I can predict is
3:00
that we're going to do a voicemail QA show here.
3:05
We're going to record it this the world really push the
3:08
limits, right. We're going to record it on
3:10
February 3rd. So this episode drops January
3:13
29th. We're going to record it the
3:16
following the next Saturday from that, and then we're going to
3:20
drop that episode on February 5th.
3:22
So there's still time to leave that killer voicemail.
3:26
Just go to idacpodcast.com, click on leave a question,
3:31
recorded A short voicemail question, and if we choose your
3:36
question as one of the five that we're going to air, we've got a
3:40
free digital copy of Phil Windley's Learning Digital
3:45
Identity book and it's a fantastic book.
3:48
So I think it'd be a really nice win if you're able to get that
3:52
book. Yeah.
3:53
So you've got till basically February 2nd, let's call it,
3:58
maybe to get the voicemail in. And I think we're only doing
4:01
this for voicemails, right? So you got to go to
4:03
idacpodcast.com, click the Talk to US banner on the screen.
4:07
If you're on the normal, like desktop website, it'll slide in
4:10
from the right. If you're on mobile, it's on the
4:12
bottom. Or you can just find it on our
4:14
contact page. But the idea here, Jim, right,
4:16
is it's a voicemail, not someone just writing an e-mail in or
4:20
something like that. Right.
4:21
Actually, someone did send me a question via LinkedIn and I
4:24
direct them to the voicemail box and that was over a week ago.
4:27
They never did it, so I'm assuming they weren't
4:29
comfortable with it. But I mean, look, this is just
4:32
voice. The text I mean, just like, you
4:34
know, drop it into some AI thing.
4:36
Oh yeah, you could do that. That would sound really weird,
4:39
but. Or you could send me the
4:41
question. You could do that.
4:42
I can run it through my filters and make it sound like you or I
4:45
are asking the question using our voice, 'cause you know,
4:48
we're all deep fake now at this point, yes?
4:50
So I guess the next thing to talk about really is
4:53
conferences. I mean I'm getting excited for
4:56
conference season to come. What's the the news on Identity
5:01
Week America? Yeah.
5:03
So we are going to be at Identity Week America later this
5:05
year. We have secured through our fine
5:08
friends over at the Identity Week folks, conference,
5:11
producers, Terrapin, stuff like that, a discount for all of our
5:15
listeners. If you use the code IDAC 30, IDC
5:19
30, you get 3% off your registration, which is pretty
5:23
cool. So definitely looking forward to
5:25
that. Again, I was there last year by
5:27
myself doing some recordings. This year you're going to be
5:29
there as well and looking forward to kind of taking the
5:33
next step and trying to figure out, you know, how these
5:35
conferences, we can bring the podcast to it, but that'll be
5:38
exciting. The cool thing about this, Jim,
5:40
since I know you're wondering is that IDAC 30 Code is good for
5:45
all of the identity work, conference, Identity Week
5:47
conferences taking place around the world.
5:49
So the one in Europe in Amsterdam June 11th and 12th,
5:54
the one in America and Washington DC on September 11th
5:56
and 12th and then the one in Asia in Singapore October 22nd
6:00
and 23rd, the same code IDAC 30, you can use it for any of those
6:04
or all of those. You know, maybe you click
6:06
stamps, you know passport stamps and you want to hit all three of
6:09
them. I'd love to figure out someday
6:11
how we get out to like Europe or you know Asia for some of these
6:13
conferences. But we're we're definitely going
6:16
to be at the at the United States one in Washington DC, So
6:20
you could just. Keep setting up our conference
6:21
game. I think the the first conference
6:23
we're in like a broom closet. No, no, no.
6:26
We actually had to get a. The sweet suite the.
6:30
Hotel room, right. The sweet suite.
6:32
That's right. Man, what a.
6:34
Thanks to our assumption by the way.
6:35
That is, yeah, it was a great time though, I mean but now each
6:40
conference I think what you know the the next step was we had a
6:44
room on the conference you know area and now it's we're becoming
6:50
an active part of the conferences.
6:51
So exciting stuff. We have to get like ridiculous
6:55
riders, like only Yellow M and Ms. just to make sure that
6:58
people are reading, you know, contracts, things like that.
7:01
You know, because we're such high maintenance when it comes
7:03
to things like that. Yeah, exactly.
7:05
Exactly. Only Yellow M and Ms. I love it.
7:08
Jim, you had a question that I thought was interesting and
7:12
we're going to pose it to our guest today is Identity at the
7:16
Center for NIST, which obviously for us we should think it should
7:20
be because that's what we're called Identity Center.
7:23
So we're going to ask that question today and more.
7:25
We've got Ryan Gluzzo, he's the identity management program lead
7:28
at NIST. Welcome to the show, Ryan.
7:31
It's a. Pleasure to be here, Jeff and
7:32
Jim and and and I'll throw a prediction out because I I
7:35
didn't realize we were doing predictions.
7:37
We were going to talk predictions, but a new version,
7:40
a new draft of our digital identity guidelines will be out
7:43
in in 2024. So I've got that to look forward
7:46
to. I'm sure we'll talk about that
7:47
more later, but I had to throw at least one prediction in.
7:51
I will also see you all at that Identity Week in in Washington
7:54
DC where I will definitely be attending.
7:56
Oh, very good. So we can give fist bumps of
7:58
gratitude and all that good stuff.
8:01
I think you can. Share in our yellow M and Ms.,
8:03
that's. Right, make sure make sure
8:05
there's no red. My son's favorite color is red
8:07
and yellow right now, so we can give him the yellow ones too,
8:10
OK? I believe, Ryan, this is not
8:14
believe, but this is the first time I've been on the show.
8:16
And like, one of the things we try to do is really kind of
8:18
understand the backgrounds of people who come on the show.
8:20
Since identity has such a varied history of different people and
8:24
backgrounds, how did you get into the world of identity and
8:29
access management? Is it something that you chose
8:32
or did it choose you? It chose me completely by
8:36
accident. So I when I about 2011, I was, I
8:41
was coming out of the United States Army, where I had
8:43
previously been an artillery officer, which has absolutely
8:46
nothing to do with identity at all.
8:49
Trying to figure out what I wanted to do with myself.
8:52
You know, having a a an early midlife crisis, figuring out who
8:55
I was. Thinking on the spectrum of, you
8:58
know, maybe I'll go back to school, get a PhD in like,
9:00
history or something like that. Or, you know, maybe I'll move to
9:03
Washington and join the national security establishment because I
9:06
had no idea what I wanted to do. But my father, who who was at
9:09
the national security establishment, was actually down
9:11
in the Washington, DC area. And he happened to run into a
9:16
colleague of his who had a nonprofit organization known as
9:19
the Intelligence National Security Alliance that does kind
9:23
of research and coordination, collaboration between the
9:25
private sector and the public sector in the national security
9:29
sphere. She happened to see him walking
9:31
around with his bright Red Red Sox hat in a Starbucks.
9:34
One day they started talking and she mentioned that they had a an
9:38
internship program for folks coming out of the military to
9:41
help get them kind of up to speed and and integrated to
9:44
potentially get jobs within the the the public sector or in the
9:47
commercial sector. And as a result I came down,
9:51
interviewed, got that internship and I ended up working on a
9:54
paper focused on HSPD 12. So Homelands Homeland Security,
9:58
Presidential Directive 12, which essentially kind of pushed the
10:01
PIV card originally the personal identity verification cards of
10:05
using government and and reciprocity of of background
10:09
investigation. So I ended up kind of deep into
10:11
this initial world of how do we share information, how do we
10:14
establish identities, how we establish suitability within the
10:17
government and then how do we make sure that we don't have to
10:19
do that 52 times for every single contract that you work on
10:22
over the course of your life as a a contractor of the
10:24
government. From there, that kind of got the
10:27
intention of some folks at at Deloitte, a large consulting
10:29
firm, and I ended up interviewing there and joining
10:32
is a very junior research the National Strategy for Trusted
10:35
Identities in Cyberspace in Stick program management office
10:39
at NIST. Those of you who are familiar or
10:43
aren't familiar with with in stick, it was a very large
10:45
presidential initiative in 2011 launched by the Obama
10:48
administration focused on advancing new ways to deal with
10:52
digital identity. Sounds fairly familiar to a lot
10:55
of the stuff we're still doing right now.
10:57
But it introduced me to, you know, Jeremy Grant who is The
11:00
Who is the PMO director at the time, Mike Garcia, Paul Grazi as
11:05
a very young consultant, very green consultant, I got kind of
11:09
dragged into a world where I got to meet some of the biggest
11:12
players in the space and engage with some of the biggest names
11:14
in the space and learn a lot very, very rapidly.
11:16
And it's been it's been pretty much all identity from there.
11:19
So so you could say my my dad's Red Red Sox hat resulted in me
11:24
being an identity. That's a pretty cool world.
11:26
Works in mysterious ways. So let's talk a little bit about
11:30
your role at NIST. What does I guess a identity
11:34
management program lead at NIST do?
11:37
And I guess for people who might be listening around the world,
11:39
who aren't familiar with NIST, he kind of explained what the
11:42
organization is as far as, you know, how it how it represents
11:45
the US in these kind of regards. Yeah, absolutely.
11:48
So NIST stands for the National Institute of Standards and
11:51
Technology. Very, I guess the best way to
11:54
describe would be eponymous. We do, we do standards for
11:57
technology. We also do measurement science
12:00
and the research to kind of support all those things.
12:02
Within NIST, we have what's called the Information
12:04
Technology Lab, which focuses really on IT, systems, networks,
12:08
stuff like that. We've also got a physical
12:11
measurements lab. We've got folks who do like
12:13
standard reference material. I'm not sure if you've ever
12:16
heard the story about our peanut butter, but we actually have the
12:19
world's most expensive jar of peanut butter, which is used as
12:22
a standard reference material for all the caloric studies that
12:26
people do. But that's on the kind of
12:27
physical and measurement side of the house.
12:29
We're on the IT side of the house.
12:32
So we got the Information technology lab, which has a
12:35
bunch of divisions. I'm in the Applied Cybersecurity
12:37
division where we focus on taking guidance, standards,
12:41
stuff like that, transitioning those into the easiest ways to
12:44
execute and practice. We've got the Computer Security
12:47
division, which is the kind of traditional home of a lot of our
12:50
800 series documents, 863. Our digital identity guidelines,
12:55
which I work on kind of straddle between the Applied
12:58
Cybersecurity division and the Computer Security division that
13:01
we've got our information and Access division and a few
13:04
others. But the bottom line is that each
13:05
one of those divisions has needs to execute projects relative to
13:10
identity. So again, our Applied
13:12
Cybersecurity division, we're doing applied work.
13:14
We're doing work within our labs at the National Cybersecurity
13:16
Center of Excellence around identity and identity projects.
13:19
Within the computer Security division, we've got, you know
13:22
853, which is the kind of core privacy and security control
13:26
catalog that has identity components.
13:28
We've got our personal identity verification work that we do
13:32
Phipps 2O1-3, so federal information processing standard
13:35
2O1-3 which is our our personal identity cards for government
13:39
employees. That's all identity related.
13:41
Our information and access division is where we have our
13:43
authorization teams who work on things like attribute based
13:46
access control. We have our entire team that
13:49
works on biometrics. We've got a very robust
13:51
biometric measurement team. You may be familiar with facial
13:54
recognition verification vendor testing program, which is now
13:57
the face recognition test and evaluation program, had a little
14:01
name change and rebranding there.
14:03
But the focus there is to help evaluate and measure these
14:05
technologies. And my role is to try and help
14:09
tie those things into an overarching identity program,
14:12
make sure we've got a consolidated view and set of
14:15
strategic outcomes and goals that we're building towards.
14:17
And just kind of make sure that there's there's good connections
14:20
because of the fact that because identity is at the center, it's
14:24
at the center of each one of those different programs, it's
14:26
at the center of each one of those different project areas.
14:29
And so we needed someone to kind of help coordinate and stitch
14:32
those things together. And that's, that's what I'm
14:34
doing right now, is at NIST as my primary role.
14:37
So I've always wondered this, who comes up with the idea that
14:42
says, oh, we need to create some sort of NIST standard?
14:45
Like who's who said like, oh, we need to create NIST 863 Digital
14:50
Identity Guidelines? Like is there a process that
14:53
says hey we need to create something like this or how does
14:56
that process start? So there's a there's a few
14:58
different ways it could happen. One, it could be that we
15:00
identify it through research and say hey there's a gap within the
15:05
US set of guidance for federal agency.
15:07
And I think it's helpful to be clear that one, this is non
15:10
regulatory, So what we create does not impact commercial
15:15
entities. We can't, we don't force it on
15:17
them. We create the standard if they
15:18
want to adopt, if they can. Within federal government, what
15:21
we create is standards or guidance and it is enforced as
15:24
mandatory by policy and legislation.
15:27
But it's it's not considered to be regulation, it's considered
15:29
to be guidance or standards or guidelines.
15:33
And so the work we do for special publications can either
15:36
be, hey look, we've identified that there's a gap or you know,
15:40
policy might dictate, hey, we've identified a gap where we think
15:43
there's a new one. So the White House or 1B kind of
15:46
the policy authorities might say there's a gap in our standards
15:49
portfolio or there's new and emerging techniques we will like
15:52
this to create a standard for. So we can either kind of be
15:55
directed or we can identify and and and and create something
16:00
from a gap that we are able to identify through our own
16:02
research and process. So there's there's kind of a
16:05
mixture of authorities and capabilities there to to decide
16:09
how we do these things. And a lot of times it'll be a
16:11
progression to right we'll, we'll do some market research,
16:15
we'll do some analysis, we'll do some standards analysis to
16:17
identify where there might be gaps or things might become
16:21
super obvious that there's no gap, there's no standards there
16:23
whatsoever. And as a technology emerges or a
16:26
technology gets adopted, we realize we need to kind of take
16:29
some action on that. So Ryan, the, you know, NIST has
16:33
so much respect within the industry and you know things
16:37
like the NIST, CSF and some of the standards like Jeff was
16:40
referring to are, you know, the basis for how a lot of people
16:46
approach cybersecurity and digital identity specifically.
16:52
And so this is your chance to kind of make it or break it For
16:55
our podcast, I'm going to ask you the the central question
16:59
here is identity at the Center for NIST.
17:03
Yeah, absolutely. And again, I think one of the
17:05
things to emphasize is that if you look at each one of those
17:09
components, right, if you look at the the Cybersecurity
17:12
framework, there are sections in there that point to identity and
17:15
access management outcomes and objectives that need to be
17:18
achieved. If you look at 853, which is the
17:21
baseline for a lot of controls that are being used not just in
17:25
government but in industry as well too.
17:27
There's the identification and authentication category, There's
17:30
the access control category. There's an entire set of or or
17:34
or or families rather of controls that exist in there
17:38
that need one to kind of initial control identification.
17:41
But also hey, we've got to have additional standards, we've got
17:43
to have additional guidance to go around these things.
17:45
And then I think most importantly, particularly as we
17:48
start talking about the adoption of things like zero trust within
17:51
the federal government, zero trust really kind of revolves
17:54
around in many cases identity, whether it's identity of the
17:57
individual or identity of a device and the attributes that
18:00
support associated with that individual or that device.
18:03
It becomes really at the center and core of those things.
18:05
And so all of the projects that we kind of work on because of
18:08
the fact they're spread throughout everything, it's it's
18:10
really kind of indicative of the fact that it it is crucial
18:13
identity in some way form or function is absolutely crucial
18:17
to all of our different work streams, all the areas we have a
18:19
responsibility and and it continues to just emerge as well
18:22
too. I mean, there's a lot of
18:24
conversation going on around AI and you know, AI and the
18:29
application of. Of of.
18:31
Artificial Intelligence and Machine learning, a lot of the
18:34
uses that we're starting to see are applied to things like
18:37
identity. So how do we improve the use of
18:39
biometric algorithms? A lot of times those are
18:42
actually using AI and machine learning.
18:43
And the the only uses of AI and machine learning are not just
18:46
generative AI. It's also, you know, being able
18:48
to look at things like algorithms, how do we improve
18:51
them with this large volumes of data?
18:53
You know how do we actually leverage things like IDTR
18:57
coupled with AI and machine learning to be able to improve
19:00
the way we detect potential anomalies and the behavior of
19:02
identities and and actually be able to take action on those.
19:04
So it it really runs through, I mean whether you want to call it
19:08
the center or something that just runs through and and kind
19:11
of ties a lot of these different security concepts together it
19:15
it's, it is absolutely critical to all those things.
19:18
Well, it feels like security. When I when I first got into IT,
19:21
you know, 25 years ago, identity was definitely not the center of
19:26
security, of information and security.
19:28
It was the network. It was IP addresses and ports
19:33
and perimeter. And now it's the zero trust
19:38
model which I don't think is overrated and it's building from
19:44
OK, you have attacks from the outside but assume that maybe
19:50
they got through the perimeter. You also have attacks, attacks
19:53
from the inside and when attacks are launched, I mean they can be
19:57
anywhere from you know just the the curious over the overly
20:03
aggressive person that works there to somebody who gets an
20:07
account and kind of lives off the land and you know just is
20:11
poking around your network and trying to move laterally with
20:13
their account, things like that. So my perspective is that you
20:19
know, we we've. Made this great shift from
20:23
identity was definitely not the center 25 years ago to, you
20:26
know, that's where it is today. So I'm not trying to argue with
20:30
you or anything because I took it on the same page, right?
20:32
I'm kind of like backing up what you're saying.
20:34
Yeah. And I would, I would, I would
20:35
take it kind of one step further.
20:37
I think part of that evolution is an acknowledgement of that
20:40
most attacks, the most successful attacks, there is
20:43
some degree of identity compromise that typically goes
20:45
along with it because you know, entitlements, access actions are
20:49
typically taken either by, you know, an individual human
20:52
identity operating within the system or an account or service
20:55
account that's being compromised and and used to to conduct
20:59
malicious activities. So if you start to kind of
21:01
narrow down on some of those common factors that exist across
21:03
some of those attacks, you start to see that focusing on solving
21:06
some of those problems, identity really helps extend the
21:10
different ways you can you can defend your organization.
21:13
And I'll take it one step further as well too.
21:15
It's not just a security thing, right?
21:16
What we do here is a lot of focus on how you can bring human
21:20
experience and usability into the conversation as well too.
21:23
And particularly if you start to take a look at not just your
21:25
enterprise use cases, but your public facing use cases,
21:29
identity becomes the center of your interactions with the
21:32
government in a digital perspective.
21:33
Like how am I able to, you know, sign in and and take care of
21:36
things related to my benefits? How am I able to access my, you
21:40
know, my Social Security records or my tax records, whatever it
21:43
might be at at the starting point of that?
21:45
That first interaction is an enrollment in a registration
21:48
process and a proofing and authentication process that are
21:51
all part of identity. And and being able to do so in a
21:54
way that is both secure but also manages to provide some kind of
21:58
a consistent user experience is really crucial to being able to
22:01
have a good trustworthy relationship with government and
22:03
and the the public that we serve.
22:06
Yeah, and you brought up ITDRI didn't bring it up, you brought
22:10
it up. Well, if you brought it up while
22:13
I was waiting to join, so. Exactly so.
22:15
Mention it I guess. So I guess my question for you
22:18
is overrated or underrated and you know, evolutionary or
22:25
revolutionary. I don't know that I can say what
22:28
one way or the other, whether it's kind of overrated or
22:30
underrated at this point. I think Jeff you kind of brought
22:33
up the point that this is an evolution of, you know the
22:36
logging and auditing and collection of of kind of event
22:39
information to be able to actually take some action on it.
22:42
I think you know regardless of whether you refer to that as as
22:46
you know the kind of IDTR or whether you kind of talk about
22:49
it as a the continuous evolution and continuous monitoring
22:52
process that you would apply in a zero trust architecture.
22:55
I'm not sure how you want to slice and dice and and kind of
22:58
carve those things up. But I mean I think at the end of
23:00
the day being able to at least within the enterprise be able to
23:04
have really fine grained view into what's happening, what
23:09
might be indications of compromise, what might be able
23:12
to get you ahead of the curve on you know, to to your point those
23:16
those threats that may have gained A foothold before they
23:18
move laterally, whatever it might be, I think it becomes, it
23:21
becomes really critical to your overall threat posture.
23:24
It becomes a little bit tricky if you're talking about applying
23:26
that to more like a commercial public facing viewpoint because
23:29
of the data collection aspects of the privacy impacts and how
23:32
some of those technologies get deployed.
23:34
But there's still value there, particularly from a fraud
23:36
prevention perspective. So you know, as a as a kind of
23:40
like term, I don't, I don't know how you know whether it's
23:44
overrated or underrated. But as a concept as it fits into
23:47
overall security posture and zero trust models, I think it,
23:49
you know, it clearly has a lot of value.
23:52
OK, great. So we talked Jeff, actually
23:56
throughout the the standard NIST 800-63 which is an R3.
24:02
I think I became familiar with it in R1 talking about levels of
24:07
assurance framework, right. The idea that based on the the
24:11
risk of the access, you'd implement certain levels of
24:17
control around what hurdles someone would have to go through
24:22
to provide a level of assurance based on the types of
24:26
authentication they were doing. But I think it's much more than
24:29
that. So maybe you could give us an
24:31
explanation OF800-63 and then talk a little bit about why it's
24:37
going through R1R 2R3? Yeah, so I mean I think you
24:42
pretty decent summary actually of the goal of the of the
24:45
overall documents. I mean revision one as you kind
24:49
of pointed out, I don't remember exactly what was published, but
24:53
we've we've kind of reached a point here where evolution with
24:59
revision 3 which which came out in 2017, you know we started to
25:03
be able to see that you know the goal was to be able to provide
25:06
controls that were kind of adaptable and flexible so that
25:09
organizations specifically government agencies but
25:11
commercial entities that might want adopted can help better
25:14
mitigate risks associated with different aspects of identity.
25:17
So we had one volume in revision one and what we what ended up
25:22
doing with that, that single revision was taking it and
25:25
splitting it out into three different volumes.
25:28
So, so revision 3 at 4 volumes, actually revision 3 covers 4
25:33
different volumes. It contains all of the kind of
25:36
technical and functional controls that you would need to
25:38
execute identity starting from your enrollment and identity
25:41
proofing going on to your authentication and then going on
25:44
to federation as well too. So being able to be confident in
25:48
your enrollment proofing process.
25:49
So how do I prove that you are, Ryan, your authenticator and
25:55
authentication confidence. So how do I make sure that when
25:58
Ryan returns, it's the same Ryan that I registered and I'm I'm
26:01
confident that he hasn't been compromised in the meantime?
26:04
And then how do we remain confident in identity
26:07
information that might be conveyed from one organization
26:10
to another or even within an organization through something
26:12
like SSO and SSO protocols? And underpinning all those is
26:16
our base volume which which covers your kind of risk
26:20
management process as well as the identity model.
26:22
So how do we speak the same language when it comes to
26:24
digital identity? But then also how do we make the
26:27
decision about what assurance levels we want to select within
26:31
identity? So Identity Assurance,
26:34
Authentication, Authentication Assurance and Federation
26:37
Federation insurance. So I'm wondering, so the list
26:40
level of risk, right? And maybe I'll start with this
26:43
question. Is there a level of assurance or
26:46
or a level of authentication required where MFA is not like
26:51
the bare minimum? And the reason I ask is like,
26:54
let's say it's a really low risk asset.
26:57
In other words, it's registration for T-ball and I
27:00
have to go in and create an account and I go in and I create
27:03
an account and set a password. And then a month later their
27:08
database gets hacked. They push that out onto the
27:11
Internet. Now someone has my password,
27:13
they go and try to conduct some sort of MFA fatigue or you know,
27:20
SIM swapping attack, but they have my password.
27:24
So I guess the angle I'm taking on that is like if there is a
27:28
level where MFA is not required, then it seems like the level of
27:32
assurance is like the level of assurance I need to protect my
27:35
asset, not to protect the person who is authenticating to my
27:40
asset. They if if I lose, if I if I
27:44
fumble their credentials because my asset was low risk and I
27:50
didn't put MFA on it, Now I just put their password out on the
27:53
Internet. What do you think of?
27:55
That so I mean I would start with we provide a suite of
28:00
guidance that allows organizations to make their own
28:04
risk based decisions, right. So we we are going to go in and
28:07
assess someone's applications for them and say you should
28:10
really be at this insurance level because that's not our
28:12
job. Our job is to provide the
28:13
guidance and allow the agencies to make their organizations
28:17
using it to make their own decisions about what risk level
28:19
they're at. As far as the federal government
28:22
goes, we I mean we do allow at our authentication assurance
28:25
level 1 the use of single factor authentication.
28:29
Now if there is PII that's protected or Phi or basically
28:33
any personal information, by policy the federal government
28:36
should be using multi factor authentication.
28:39
And so within the context of the federal government, if you're
28:43
protecting some kind of sensitive information, if you're
28:45
protecting some kind of personal information, then you should
28:48
probably be moving using multi factor authentication.
28:50
And I would say even more so you should probably be thinking
28:53
about using phishing resistant authentication which we can talk
28:57
about a little bit more later, but essentially something that
28:59
is more robust than just something like a A1 time
29:02
password sent to your phone or a push authentication device that
29:06
can be compromised through MFA exhaustion.
29:09
But, but I think I want to stress and maybe I wasn't kind
29:11
of clear enough on on the kind of delineation, but we we do
29:15
have different kinds of assurance levels now.
29:17
So it's not just the big one LOA 1-2 and three and four that I
29:20
think most people are used used to.
29:22
We actually have the ability for you to say look I want an
29:25
authentication assurance level of 1-2 or three, right.
29:28
I want single factor authentication on multi factor
29:30
authentication or I need you know cryptographic
29:33
authentication in order to protect my application and at
29:35
the same time you can decide well you know based upon the
29:38
potential compromise of the core identity.
29:41
I might want no identity proofing or light touch identity
29:44
proofing at IO one. I want you know stronger
29:47
identity proofing at IO2. I want to make someone come in
29:49
person and collect a biometric at IO3 and then for federation.
29:53
Again you don't. You might not be doing
29:55
federation, but if you want to make sure you've got the most
29:57
robust confidence in all of that authentication and identity
30:00
information being provided by an external provider or to your
30:03
other entities, you can select your kind of federation
30:05
assurance levels one through 3. So you could even be in a
30:08
situation for example where you want multi factor authentication
30:12
because you're potentially protecting something like self
30:15
attested PII, right? Like of I've got like a you know
30:20
a personal health tracker or something online that I'm
30:22
uploading my workouts to and my diet to and you know where I'm
30:25
working at. But you don't really care if I'm
30:28
really Ryan. But you do want to make sure
30:30
that someone who's not Ryan doesn't get into that data.
30:33
And we now give the opportunity and through that flexibility and
30:36
breaking those things up to allow you to be able to deploy
30:39
multi factor authentication and strong multi factor
30:41
authentication. In fact, to protect that data
30:44
without having to also identity prove me unnecessarily.
30:47
Yeah, that's a great point. Really what you're providing is
30:49
a framework and then folks have to kind of decide within their
30:54
organization how they apply that framework and what their
30:57
different levels are and then apply that to their assets.
31:02
So great points there. So we talked about this being in
31:07
R3 is I think you said 2017, it's been out since, but R4,
31:13
what I understand is R4 is in the works.
31:15
He can tell us. Can you give us a little?
31:17
If you want to drop any news here on the Identity Center
31:20
podcast, feel free. But can you tell us kind of like
31:22
what to expect? Yeah.
31:24
I mean, I don't know that it is the, you know, a complete
31:28
breaking story. But so revision 4, we published
31:31
a draft of last year in December.
31:35
We had a public comment period that extended through April.
31:39
We got over 4000 comments and for reference on revision 3, we
31:45
only got I think about 2000 comments or issues that we
31:48
needed to take care of. So we nearly doubled them and
31:52
we're in the process right now of adjudicating all those
31:55
comments, working through you know some major updates.
31:58
And so one of the things we announced that maybe a couple
32:01
weeks ago is that we are going to do a full round of.
32:04
So when we do our special publications, we always do at
32:07
least one draft for public comment because it's very
32:11
critical to make sure that we get feedback and input and that
32:14
if we make updates, we've got the ability to point back to
32:17
that kind of community input as why we made some of those
32:21
changes. Sometimes if we've got something
32:24
this substantial. And this is really four special
32:27
publications not just one. You know we have the ability to
32:30
go ahead and do a second draft or even a third draft if we so
32:33
choose to. I I hopefully we won't have to
32:35
get to a third draft. But you know the so the second
32:37
draft will be hopefully published in the kind of April,
32:40
May time frame of the coming year for a second round of of
32:43
public comments. And part of the reason that
32:45
we're doing that is even from the draft that we put out in in
32:49
December of last year where we we made some pretty substantial
32:52
changes into grading things like mobile driver's license as
32:55
potential options for forms of identity evidence and verifiable
32:59
credentials as well adding context for efficient resistant
33:02
authentication. And then adding a couple
33:05
different forms of of of of Federation to meet Federation
33:09
insurance Level 3 that includes this concept of of bound
33:12
authenticators. That's far probably way too
33:14
complicated to get to on the on the show, but if you ever want
33:17
to follow up we can have a conversation about it.
33:19
So we made some pretty massive changes from revision 3 to
33:23
revision 4. And then even since revision 4
33:26
has come out, you know some of the feedback we got was like the
33:29
change you need to go a little bit further.
33:31
We need to get a little bit more than we need, a little bit more
33:33
detail. So a little bit more detail on
33:35
how to use mobile driver's license and verifiable
33:37
credentials. Not just that I can, but what
33:40
are some additional protocols and steps that need to be put in
33:42
place for us to actually be able to use those things like
33:45
phishing resistant authentication.
33:47
We've got the definition, we've got the, the approach.
33:50
But since we published, task keys have become a much bigger
33:55
thing, right? And so how are we going to deal
33:57
with this new concept, this new paradigm of not just a
34:00
cryptographic authenticator, but a cryptographic authenticator
34:03
that can move. And while we had opened the door
34:05
to that and the idea that you could potentially replicate a
34:08
key to multiple different devices to make it a little bit
34:10
easier for the user to sign in from different parts of their
34:12
account, We didn't go so far as to kind of figure out how is
34:17
that syncing fabric, how are the back end components, how is, how
34:20
do we deal with it as a as a paradigm changer.
34:24
And the reason we couldn't go much further is because they
34:26
weren't really done with the the underlying protocols.
34:28
We hadn't seen a lot of adoption, things like sharing of
34:30
those credentials was something that was just emerging right as
34:33
we started to put this together. So we have some more content
34:36
that we've got to deal with around things like whether and
34:39
how and to what degree pass keys can be used.
34:42
For those of you who have been paying attention to us, we are
34:45
at the the kind of phase of we do think these are consistent
34:48
with AL2 multi factor authentication when certain
34:50
conditions are met. But there's other things that we
34:52
want to apply to that conversation.
34:54
So even though we have made a lot of changes, there's still
34:57
more changes that we're going to be making.
34:58
So I guess the kind of core take away there is April, May keep
35:03
your eyes on the NIST website. We should be publishing an
35:06
updated draft then and then we'll probably have about a 3045
35:09
day public comment period after that and hopefully proceed to
35:13
final sometime, sometime next year.
35:16
Exciting stuff. And yeah, pesky, super exciting.
35:19
You mentioned digital driver's licenses.
35:21
Super exciting. I want to get back to that in a
35:23
minute. But before that, I want to talk
35:25
about something that's not super exciting or ask you about.
35:29
So is it 863 that includes guidelines for passwords?
35:35
Are those going to be changed in revision for at all?
35:38
They were so, so they were updated and so we we had in
35:42
revision 3, we kind of made the first toe in the water type
35:47
steps towards changing some of the things around passwords.
35:51
So we had there's two different ways we reflect language within
35:55
63 there are should which is a recommendation and there are
35:58
shall statements which are mandatory.
36:01
We've also got may statements, but that's just more like you
36:03
can do it if you want. So we put a a bunch of
36:06
recommendations around things like not arbitrarily requiring
36:11
users to change their passwords, not mandating things like
36:15
complexity requirements. You know, and we found that you
36:20
know through research for the most part, when you apply things
36:23
like random rotation, especially short period random rotation
36:26
like 30, sixty, 90 days, and when you apply arbitrary
36:31
complexity requirements, you ultimately end up with users
36:34
creating that they can create in order to meet those policy
36:36
requirements. And it's not typically the most
36:38
secure, right. You know, it's the 12345 and now
36:41
I need to add something out, all right, exclamation point.
36:43
And then the next time you do, you add another exclamation
36:46
point, you know. So you end up with these kind of
36:49
efforts to to meet with those requirements and what you end up
36:52
with is something that is that that the user one probably is.
36:57
Creating. As as less secure and also
37:00
typically creating patterns that are easy for for bad bad actors
37:03
to guess. So we made those recommendations
37:06
to remove your kind of random rotation remove password
37:11
complexity requirements. We kept those as recommendations
37:15
initially what we put out Rev 4 or or we were going to keep them
37:19
as recommendations and then we kind of got a lot of feedback
37:21
that was like no, we actually really like this and this should
37:23
be mandated. This requires.
37:24
So we did in the December version that we published last
37:28
year put out, I mean I guess two years ago we did in fact update
37:34
the requirements. So that is now mandatory that
37:36
you do not have have complexity requirements that you do not
37:40
have random or arbitrary updates of passwords.
37:45
So those have uploaded that. Thank you.
37:49
I would. Love to take credit for it but
37:50
it's it's this happened long before me.
37:52
So really and smart people. Actually.
37:54
Started. You know, wholesale doing it.
37:56
But I think some people think, Oh yeah, we'll follow all the
37:59
others, but we're going to make people change their password
38:01
every 90 days just because, you know, I mean, we've been doing
38:07
it forever. It was the status quo, it was
38:10
the status quo and I think people just they're, I will say
38:14
the gut reaction from a lot of the security community was we
38:19
can't change that. You know, complexity makes it
38:21
harder. And you know and and rotation,
38:24
make sure that if you've got a compromise, it'll be taken care
38:27
of. And all those things are kind of
38:29
understood. But at the end of the day, you
38:30
know, we really wanted people to focus on, you know, length over
38:34
complexity and memorability over random kind of rotation.
38:39
Absolutely, absolutely. OK, so enough of that boring
38:42
topic. Mobile driver's licenses, What
38:46
is NIST up to in this area? Are you creating a standard
38:51
around mobile driver's licenses? Does that mean states are going
38:54
to start doing it the same way? We don't have authority over the
38:59
states. I will say we have been actively
39:01
involved in the international standard here.
39:04
So the One 8013-5 is the kind of core standard around mobile
39:10
driver's license and Dash 7 is the online version.
39:15
Bottom line is those are the kind of international standards
39:18
that have been put together. They're the starting point for a
39:21
lot of this. And and what really needs to
39:24
happen is kind of that transition into, one, how do we
39:28
make this work within the US context because it's an
39:30
international standard, 2, how do we make it as easy as
39:34
possible for organizations to actually adopt and leverage
39:37
these things? And then three, how do we plug
39:39
some of the gaps that that like an international standard still
39:42
has to make sure it fits our our own context for privacy and
39:46
security purposes? Because again they wrote this,
39:48
you know, there's a lot of focus on like the data model and the
39:50
elements that go into it and and the components and and core, you
39:55
know, necessary functional things.
39:56
But there's going to be additional layers that need to
39:58
be layered on top of this to make sure when it's ultimately
40:00
implemented, it's done in a way that's consistent with how we
40:03
want it to be done in the United States, so.
40:05
Some of the things we're doing, one, we're integrating it into
40:08
863. So these ideas of mobile
40:11
driver's license can't be used as essentially a piece of
40:13
identity evidence and really we're not restricting it to
40:15
mobile driver's license. That is a a form of these kinds
40:19
of credentials. We're also looking at things
40:21
like verifiable credentials, both the W3C model as well as
40:26
you know just kind of generally referring to cryptographically
40:29
verifiable things about me or things about you.
40:33
So mobile driver's license are one way of doing that.
40:35
And and again they can represent a whole identity like a driver's
40:38
license or it can represent individual attributes that have
40:41
been selectively disclosed, so date of birth address or just
40:45
over 21. So looking to how can we fit
40:48
those into the identity proofing process, it's in 863 AR Digital
40:51
Identity guidelines. How can we build the right
40:54
requirements around conveying that information?
40:57
So we're kind of putting that within the bucket of 863 C
41:01
looking at it from the concept of federation because it is kind
41:03
of an identity assertion, not exactly, but close enough as far
41:07
as our guidance goes. And then looking at how we can
41:10
also work within the international community to
41:12
continue to improve the underlying protocols that need
41:14
to support it. So we're actively working within
41:16
the Open ID Foundation to monitor where they're doing the
41:20
Open ID Connect for verify presentation and for credential
41:23
issuance work. Lots of acronyms, but they're
41:26
the ones doing kind of some of the underlying protocols for how
41:29
you exchange the information and we're kind of keeping an eye out
41:32
of the work that they're doing there.
41:33
We're also working within W3C where they're still kind of
41:37
trying to figure out what might be next as far as like the
41:39
browser APIs that might need to be developed in order to support
41:42
things like mobile driver license and verifiable
41:44
credentials in a more consistent manner across different
41:48
different browsers. And then we're working very
41:51
closely with our security and privacy folks to start thinking
41:53
about how do we make sure when these get implemented in
41:56
particular they're done in a way or at least states have the
42:00
guidance to, to do it in a way that will preserve the privacy
42:04
of individuals because it's got a lot of a lot of potential
42:06
value. Mobile driver's license for
42:09
privacy protective approaches. I mean selective disclosure,
42:11
which is essentially being able to only share what you want to
42:14
share is a kind of key concept. However, on the other end of the
42:18
spectrum, a lot of times this is issuing source information, so
42:21
coming from DMV, coming from the States and a lot of times the
42:24
verification you know might require some kind of a call back
42:26
to the state. So making sure that you
42:28
eliminate the unnecessary kind of phone home aspect of things
42:32
and kind of enhance the the kind of the privacy side of things to
42:36
make sure that the when these are deployed, they're done in a
42:38
way that doesn't infringe upon people's privacy.
42:42
And yet again, we we don't have authority over the state.
42:44
So our goal is to help create the guidance that can be pointed
42:47
to by states to to figure out you know how do we make sure
42:52
that we are, we're doing things in a way that is that is going
42:56
to protect our, you know, the residents of our state.
42:59
But again, all we can kind of do is create those those pathways
43:02
to doing it right and the states will ultimately have to deploy
43:05
it on their own based upon their own laws and regulations.
43:10
And that's one of the things that I think makes MDL in
43:12
particular so complicated is it's not just a technology
43:15
solution and it's not just a single technology solution.
43:18
It's a layering of various different standards and
43:20
protocols to support an outcome. And then on top of that, there's
43:24
the kind of policy and governance side that's going to
43:28
vary potentially by 50 plus States and and territories in
43:34
the US Well, I live in North Carolina, so I'm.
43:36
Hopeful that at least some somewhere we'll catch up and try
43:42
to catch all the mobile driver's license.
43:44
He answered the question that I was going to ask around really
43:47
kind of the the state's role in this with versus the federal
43:50
government. And I guess I see a lot of
43:54
organizations not just government or state governments,
43:56
I'm sorry, but a lot of just you know for profit businesses for
44:00
example rely on NIST standards or seek out those standards
44:03
before doing things. So I feel like there are some
44:07
states that are ahead of the curve, smaller number of states.
44:11
At this point, NIST comes out with a standard or raises a
44:15
publication and then it seems like the floodgates start to
44:19
open a little bit more because those pathways have been
44:21
created. Is that a fair perception that I
44:24
have or do you see it differently?
44:25
So I mean, I think the. It's states are going to kind of
44:29
move at their own pace no matter what and and I think from time
44:33
to time they will point to NIST guidelines.
44:35
I know 53 has actually been pretty popular with the states.
44:39
I think in this particular case, I think it's such a unique
44:43
situation with with what mobile driver's license are that even
44:48
if we were to come out with guidance to support the
44:51
international standard, because the international standard, you
44:53
know, the Dash 5 has been out for I think a couple years now.
44:57
So some states have really jumped on board really fast to
44:59
to help implement it. Others are kind of waiting to
45:01
see. But a lot of that has to do with
45:03
the speed of their own legislation, their own internal
45:05
government processes, politics, it's very complicated.
45:08
So you know, I think we, I'd like to say that as we come out
45:12
with guidance on this kind of topic, it will help aid
45:16
adoption. But I think this is such a
45:19
challenging kind of political conversation that I don't know
45:21
that, I don't know that that necessarily changes the speed at
45:25
which the the states will adopt. And I will say another thing
45:30
that we're looking at is is you know because Dash Five really
45:33
focuses on kind of the, the, the data model and the physical
45:36
interaction. So like if you're to use your
45:38
mobile driver's license at the airport, which is the primary
45:41
use case now there's kind of a lag in how we can use this
45:45
online while we wait for Dash 7, which is the the other the
45:49
online standard that's still in in finalization.
45:52
And so we wanted to be prepared with is particularly for federal
45:56
agencies that want to consume what's already there and what's
45:58
already available is being able to provide, we call kind of
46:00
relying party guidance. So how do I take this, integrate
46:04
it into my work flows and actually use it.
46:07
And so we're going to do some of that in 63 C, but we're also
46:09
looking at trying to do some work within our NCCAA, National
46:13
Cybersecurity Center of Excellence to actually get some
46:15
practical how do I consume a mobile driver's license type
46:18
guidance together and if we move past this.
46:21
Being a technology problem and more of a policy and sort of
46:25
configuration issue at this point and making sure that
46:28
everyone's kind of the same page on that?
46:29
Or are there still technical deficiencies that you're seeing
46:33
that throw wrinkles into this somehow?
46:36
I mean, I wouldn't necessarily say that.
46:37
It it's deficiencies, I would say there's still gaps, right?
46:41
And again, they're still trying to figure out and finalize the
46:45
version of the standard that says this is how you do it
46:47
online. And that's a, it's a pretty
46:49
major gap and that's cobbled together multiple different
46:53
pathways through things like the Open ID Foundations, Open ID
46:55
Connect for verifiable presentations.
46:57
It also leverages, you know, some additional sitting APIs
47:00
within W3C. So I mean there's a lot of
47:02
pieces and parts that need to be put together and I think we've
47:05
got a good understanding of what it looks like in a physical use
47:08
case because we have seen a pretty decent number of of
47:11
transactions. TSA has been piloting a lot of
47:12
the stuff. So we've got a good
47:14
understanding of what still needs to be fixed and updated
47:17
and improved there from a physical perspective.
47:19
We just don't know what we don't know yet from a a, an online
47:22
perspective. And so I think what we'll find
47:24
is that you know the standard is going to work, it's it's going
47:27
to be interoperable at least to start.
47:29
The challenge is what is it going to look like an
47:31
implementation, what implementation challenges are we
47:33
going to run into. I mean one of the major ones is
47:35
discoverability of of like the wallet that stores your your
47:39
mobile driver's license, How do we present that to the user?
47:43
How do we let the, you know, like an online application
47:45
actually select or allow the user to select the wallet that
47:49
they want to use? Because again, we we might find
47:51
ourselves in the future where I've got 5 wallets, 10 wallets,
47:53
12 wallets. I I don't want us to get there.
47:55
I prefer we don't replace 100 passwords with 100 wallets.
47:59
But you know, there are going to be scenarios where there's still
48:03
some kinks to work out that we need to figure out as we
48:05
actually move into implementation.
48:07
Again, some of that interaction with the browsers and wallet
48:09
selections stuff, something that's still being worked in in
48:12
particular within W3C, but also within the ISO context.
48:15
I totally agree with you on the wallet.
48:16
Side I feel like we're headed towards multiple wallets and I
48:20
don't know if that's any better multiple passwords, but
48:23
hopefully we'll get it figured out.
48:24
I think you know it's you know which is the wallet that you use
48:28
for what is probably the question they ask because I
48:30
think people will probably gravitate towards well this is
48:32
my finance wallet or this is my social media wallet or this is
48:36
my government wallet or whatever right.
48:39
Things like that. My.
48:41
I mean, I don't know if this. Is officially like in this
48:42
stance. My personal view is like at the
48:45
end of the day, we want to give the end user as many options as
48:48
possible. What we don't want to say is in
48:51
order to do 20 transactions, you have to have 20 wallets.
48:55
If I choose to use 20 wallets, that's perfectly fine.
48:58
But I think you're you're exactly right.
48:59
Like if I want to have one wallet that is my, you know, my
49:04
core identity wallet or my core transaction wallet that's got my
49:07
government stuff, my official stuff, my mobile driver's
49:10
license, sure, I can, I can do that.
49:12
But if I want to have my, you know, my my wallet full of you
49:16
know, Costco cards and and and and wholesale cards and and you
49:22
know my baking club, you know card that I can go get, you
49:26
know, a free scone because I have, I've made 12 purchases.
49:29
But you know I should be able to do that too and not necessarily
49:32
have to intermingle those things.
49:33
So our our goal is to really make sure that we can help build
49:36
out the standards so they're interoperable, so that any
49:39
wallet can do anything it needs to as long as it meets a certain
49:42
set of standards and expectations.
49:44
And then also be able to make sure that those credential types
49:47
are interoperable across potential use cases to give the
49:49
user as many options as possible.
49:52
I see as kind of a. Parallel with where social
49:54
logins kind of started where everyone kind of has picked
49:58
their favorite social login to start with and they've also
50:01
picked ones which ones they'll never use.
50:04
So I know people who are very much like, yes, if it's Google,
50:07
that's what I'm using or I am never going to use Facebook as
50:11
my login, right. There's kind of things that have
50:13
come up along that way and I feel like we're kind of headed,
50:15
sore that direction. Maybe with wallets?
50:18
It seems kind of similar to me a little bit, but hopefully.
50:21
Even more choice because I think you know, as much as we do see
50:23
like a lot of options for, you know, the core users, the core
50:28
or the core kind of identity providers there, the core social
50:32
sign on. You know, sometimes you'll go to
50:34
a website and it'll your Facebook will be the only option
50:37
or they're kind of local sign in things.
50:39
So hopefully we see a bit, a bit more optionality as it comes to
50:43
wallets in the future. But I mean you know there's
50:44
going to be a lot of business drivers beyond just the the
50:48
technical context that we support.
50:49
So this has been a great conversation.
50:52
And I want to ask you one final question before we start to wrap
50:55
things up. We did an episode, it feels like
51:00
a couple years ago at this point.
51:01
It was like episode 150 something.
51:02
Jim might be able to look it up while I'm kind of stalling for
51:05
time, but we asked this question of what is the difference
51:09
between identity and access management and digital identity,
51:13
and we sent this kind of call out to everybody that we could
51:16
think of and we got a lot of responses.
51:18
I think we got like 10 responses and everybody had a different
51:22
answer. So now I'm curious from your
51:25
perspective, Ryan, no pressure, but what is the difference
51:29
between identity and access management and digital identity
51:34
so and we? Actually had this debate.
51:36
So we also published, I think about this time last or two
51:40
years ago, we published our our the first version of our digital
51:43
identity or identity and access management road map.
51:46
And originally we were going to call it a digital identity road.
51:48
And then we had this massive internal debate about what is
51:52
digital identity, what is identity and access management,
51:54
how do they overlap, do they overlap.
51:57
So the view, what I've kind of landed on is digital identity is
52:01
a kind of component within the broader identity and access
52:03
management sphere. So digital identity is really
52:06
the focus on, you know that online representation of of a
52:10
user, their attributes and and who they are.
52:13
Now that fits into a larger context of what can I do in the
52:17
authorization space, What actions should I be taking in
52:21
the kind of, you know, access control space and what
52:25
entitlements are attached to me. So those aren't necessarily
52:28
inherent in who I am in my identity, but they are things
52:31
that are attached to my identity once it's been established.
52:34
So we kind of look at digital identity as more of a
52:36
foundational component or the foundational component of
52:39
identity and access management more probably, OK.
52:42
So June 2022, Episode 151, Our fact checker gym working
52:47
feverishly behind the scenes, typing me notes as we're talking
52:50
through here. All right, let's start to wrap
52:53
things up. We like to end shows on a
52:55
lighter note. This has been a great
52:56
conversation. I think a lot of people will
52:58
really get a lot of value out of it.
53:00
But let's talk a little bit about hockey.
53:02
I know you're a hockey fan. If you could pick any former
53:07
professional hockey player to join your beer league team for a
53:10
season, who would it be and why? All right so the I'm a I'm a
53:17
grew up in the Massachusetts area, huge Boston Bruins fan.
53:20
And so, like, when you ask me this question, the most
53:22
immediate thing that came to my head was it would have to be
53:25
Bobby Orr, right? It would have to be Bobby Orr.
53:28
And then I actually pivoted a little bit.
53:31
And I think the right answer is actually Mario Lumiu for me.
53:34
And and one of the reasons it is because number one, he's he's a
53:38
monster. He's huge.
53:39
He's absolutely huge. So you roll him in beer league,
53:42
you know, not only is he going to roll with the best hands in
53:45
the game, the best shot in the game, he's also nobody's going
53:47
to mess with him. He's he's going to be an
53:48
absolute monster and you know Bob yours he's he's good sized
53:52
but you know he he wasn't he wasn't the biggest the biggest
53:55
guy in town so I think you know and and right now my dad my
54:00
uncle probably my grandfather are currently writing me out of
54:03
their wills but I think I got to go Mario Lemieux I I really do
54:07
think I have to go with that route so that's that's my answer
54:11
until I get disowned Jim. Who would you pick for your beer
54:16
league for a hockey player? So I grew up.
54:18
A Philadelphia Flyers fan, and I'm sorry, I knew that was going
54:24
to happen. So there's so many great ones to
54:26
choose from. But I think the answer to this
54:30
question is pick the best goalie.
54:33
So I'm going to go Ron Hexall, which is like, right in my era.
54:38
Because here's what I think it's like.
54:40
I might not score, but if you put Ron Hexall in a beer league,
54:44
hockey, I mean, you're not going to do any worse than a 00 tie
54:49
and you're going to get an. Enforcer, too, because he will
54:52
absolutely he'll he'll he'll throw the gloves down, too.
54:56
He shot a few goals, too. Yeah, so he might come out and
54:58
shoot. He had two or.
54:59
Three goals I don't remember. How many exactly, But yeah, yeah
55:02
and but. That was so rare back then.
55:05
I think it's a goalie is a good pick.
55:07
A goalie is a good pick. I I got to give you that.
55:09
What about you, Jeff? Well, I'm a Chicago.
55:12
Blackhawks fan. So I'm, I'm scrolling through my
55:15
roster of Blackhawks. I, you know, I grew up in the
55:18
era of Chris Chellios and Ed Belfour and Jeremy Roenick.
55:25
I'm torn, man. It's it's got to be somewhere
55:27
between Chris Chellios, Duncan Keith and Bob Probert.
55:31
And the only reason I mentioned Bob Probert is because Roby
55:34
yeah, he was a beast. He would fight anyone and
55:36
everyone at the same time. I was at a Blackhawks game where
55:40
he actually scaled the glass and started to go after a fan.
55:45
So I feel like that would be the perfect kind of compliment to
55:49
the beer league team is I You don't need a goalie when
55:52
everyone's on their back, so we're scared to score.
55:55
Right, exactly so. Yeah, I'll go with Bob Probert
55:58
just for the pure goon enforcer role.
56:03
And I feel like that's that's my final answer.
56:07
I do think that. That Ryan liked us until he
56:09
found out who our hockey allegiance was with.
56:12
But that's why the fact, the fact that you.
56:15
Have. Hockey allegiance is that I'm a
56:16
I'm a hardcore. You should love my sport kind of
56:19
person. So I I prefer the having, unless
56:23
you're a Canadians fan and then we'll have to have a completely
56:25
different conversation. But I can.
56:27
I can find the time of day as long as you've got the as long
56:30
as you've got the allegiance to to a team.
56:32
I actually happened. To be in Edmonton last winter
56:35
during hockey season and they were playing the Boston Bruins
56:40
and I was floored by how many Bruins fans flew all the way out
56:45
to. Edmonton is not the easiest
56:47
place to get to, but Calgary is totally different.
56:50
Maybe a lot of the people flew to Calgary and drove up to
56:53
Edmonton, but I mean, Bruins fans are well traveled, yeah,
56:58
and I I'll say. Every time I try I go to one of
57:00
these identity conferences. I I try and see if I can I can
57:05
get a game in not necessarily Bruins game but a game.
57:07
So I mean out of authenticated Seattle a couple years ago I got
57:10
to see the Kraken play. It was fantastic.
57:13
I was up in an IKO conference and I in Montreal and I I was
57:16
intending to go to the Montreal Canadiens game only there was
57:20
some kind of a technical glitch with the with the StubHub and I
57:23
got all the way to the rink and never got the tickets, so I
57:25
didn't get to go. But yeah, I I always try and try
57:29
and get to whatever the local rank is whenever I whenever I
57:32
get out there, I feel like. Hockey is still relatively
57:36
undiscovered for a lot of people, cuz I find playoff
57:38
hockey, the atmosphere in a stadium is unmatched for
57:42
anything I've ever been in. I mean, when the Chicago
57:45
Blackhawks were winning all the Stanley Cups for a few years
57:48
there, it was unbelievable. Yeah, you're sorry about that.
57:52
It was our turn. It was unbelievable to be in the
57:56
stadium and there's not a bad seat in the house and you can
57:58
just feel like you get goosebumps just kind of being in
58:01
there. And I've never experienced that
58:04
with other sports, you know, been to Bears games, I've been
58:08
to Bulls games even when the Bulls were in the 90s.
58:10
And with Jordan, you know, it was not the same.
58:12
It was pretty close. I'll be honest, It was pretty
58:13
close. But playoff hockey in Chicago at
58:18
United Center with the Blackhawks?
58:20
Hands down, the best sporting event for You know, the
58:23
environment that I've ever been to, Dad, I.
58:26
Think you don't appreciate hockey until you get to see it
58:29
in person? I think it it doesn't translate
58:32
as well to TV, particularly if if you're new to the sport and
58:35
you don't really have a a strong idea of what's going on.
58:38
But when you go watch in person, you get that, you know, Jeff to
58:42
your point the the kind of electricity of the crowd.
58:44
Plus you get, you know, you get to see how fast, how fast the
58:48
game is and how how quickly the puck moves and how big the guys
58:53
are. They're huge.
58:54
They're enormous. So it's, you know, it's it's
58:58
it's one of those things where most people when you finally
59:00
drag them to a hockey game, they end up at least falling in love
59:04
with the with the in person side of the game.
59:06
It's a little bit harder on TV, but but I love it.
59:10
It's it's core to gel games, and I agree.
59:12
With what Jeff was saying, like the energy's so high, I've also
59:15
been to minor league hockey and the sound of a hockey game is so
59:20
cool. Like when you're in a minor
59:22
league hockey game, there's, you know, generally not as many
59:25
people, right? The place has impact, but you
59:28
can really hear the game. You can hear the players
59:30
talking, You hear the, the stick hitting the ice.
59:34
Really cool sounding game. Yeah, college.
59:37
Hockey, too. College hockey's a another thing
59:40
that you know you can for 5 bucks, 10 bucks, you can go
59:44
watch some unbelievable players. You can get super close to the
59:47
ice, hear what's going on, see what's going on.
59:50
It's a yeah, it's it's a it's a really phenomenal sport and
59:53
everyone should love it as much as I do.
59:55
It's not great. For watching the game.
59:58
But if you get the chance to sit on the glass in the corners,
1:00:02
it's a completely different experience.
1:00:03
You're banging on the glass. You know people are getting
1:00:06
checked right into that, you know corner, you know all the
1:00:08
time and. It's a totally you can't see
1:00:11
anything, especially on the other end of the ice, but it's
1:00:14
right inside of your face, you know, with all the all the the
1:00:17
glass shaking and stuff like that, it's it's fun.
1:00:19
Yeah, I'm more of like a halfway.
1:00:21
Up the bull kind of guy. So you.
1:00:22
Yeah. I mean, at this point I want to
1:00:23
watch. And see the sport and go back
1:00:25
and forth. And I'm with you.
1:00:27
All right. I think we could talk Pocky for
1:00:29
a while but we're we're up over an hour at this point.
1:00:31
So I want to make sure we. Ryan, thank you so much for
1:00:33
being part of this. This is a great conversation.
1:00:36
We'll have links. In our show notes to you know,
1:00:38
connect with Ryan to NIST 863 for if you want to check that
1:00:42
out. Keep an eye out for revision 4.
1:00:43
Coming out to a NIST website near you.
1:00:47
Some point here in the next couple of months we'll be on the
1:00:49
web. We still are on the web, I
1:00:51
should say idacpodcast.com on Twitter or X or whatever it's
1:00:55
called by the time you hear this at IDAC podcasts, Mastodon at
1:00:59
IDAC podcast at Infosec, dot exchange, connect with Gemini on
1:01:04
LinkedIn, use that voicemail. And when a copy of Phil Winley's
1:01:07
book coming out in a couple, well, about a week or so
1:01:11
roughly. So you got about a week to go.
1:01:13
And yeah, don't forget to use our discount code for Identity
1:01:17
Week. America, IDAC 30 get 30% off all
1:01:21
the Identity Week conferences through 2000, 2020, four, I
1:01:24
should say Amsterdam, Singapore, DC.
1:01:28
We'll hope to see you at the DC-1.
1:01:30
So with that, we'll go ahead and leave it here for this week.
1:01:33
Thanks everybody for listening and we'll talk with everyone in
1:01:35
the next you've been listening to.
1:01:37
Identity at the Center. We hope you've enjoyed the show.
1:01:42
Make sure to like, rate and review and we'll be back soon,
1:01:46
but in the meantime, hit the website.
1:01:48
At identity@thecenter.com and find us on Twitter at IDAC
1:01:54
Podcast. See you next time on Identity at
1:01:59
the Center.