Latest / Identity at the Center / #211 - Carolinas Identity Roundtable RBAC Discussion

Transcript

#211 - Carolinas Identity Roundtable RBAC Discussion · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with I
• 0:10
  am this is the go-to podcast. Now your host Jim McDonald and
• 0:18
  Jeff Steadman welcome to the identity of the sender podcast
• 0:22
  I'm Jeff and that's Jim. Hey Jim hey Jeff, how are you?
• 0:26
  Oh, not so bad yourself. Great, great.
• 0:28
  Hey I know we want to cover. Cover a lot of topics here today
• 0:32
  in our Preamble and the shows going to be different.
• 0:36
  So I don't know if you want to touch on that first and then
• 0:38
  come back to me with with my topic with art with our opening
• 0:42
  matter. Yeah, sure.
• 0:42
  So today we're gonna actually going to replay a round table
• 0:46
  that you, and I hosted with the Carolinas identity roundtables
• 0:49
  discussion we had around, role-based Access Control we did
• 0:52
  in December people, have not heard it.
• 0:54
  Unless you were part of that Round Table live, that day was.
• 0:57
  So we're going to kind of treat that as today's episode, kind of
• 1:00
  just kind. This quick intro and get to it.
• 1:01
  But what do you have? What do you have for me here?
• 1:03
  So what I have for you is I started thinking about our back
• 1:06
  and kind of going into that discussion was I want to talk
• 1:11
  about Ai and then I thought of a real cool angle that I had to
• 1:15
  ask you about which is AI robots and let's just take an example
• 1:21
  which I don't want to have the argument with it right now.
• 1:23
  Whether Siri, you know, the Apple voice module is AI or not.
• 1:29
  But my Question to you is, do you need to be polite to AI?
• 1:35
  Or can you just be Gruff and rude and just say, give me this?
• 1:39
  Give me that. It's interesting question and
• 1:43
  series not AI sweater are right now.
• 1:46
  It just listen to the voice response system and not even a
• 1:49
  very good one. Do you have to be nice to your
• 1:53
  AI? That's the question.
• 1:56
  You have to be polite. I would say no, but I also get
• 2:01
  the idea of, you know, please give me a table information,
• 2:05
  right? And type it in, I have, I, I,
• 2:09
  when I first started using like chat GP and things like that, I
• 2:12
  had more formal sentence structure asking for, here's
• 2:16
  what I'm looking for, Bubba blah.
• 2:18
  Now, I'm treating it depending on, which a, I'm using, whether
• 2:21
  it's Bings version, for example, which uses GPT for, or if I'm
• 2:26
  using just the chat GPT normal interface, Is I'm treating it
• 2:30
  almost like a search query instead of fully form sentences,
• 2:34
  for example, so it kind of depends what I'm doing it.
• 2:38
  But I would say for the most part, I am not polite, but I'm
• 2:42
  also not impolite, it's not like I'm like, hey, go get this.
• 2:45
  You son of a you know what fear there may be but I also I'm not
• 2:49
  doing please and thank yous and things like that.
• 2:52
  So I usually do as you please. And thank yous, which I think
• 2:55
  humanize it, but they might the back of my mind.
• 2:57
  I'm also like okay. It's not a human but it's kind
• 3:00
  of raised. Like you're not going to get in
• 3:02
  trouble for saying please and thank you too much.
• 3:04
  It's better to just say it when you don't have to, then not say
• 3:07
  it when you should be saying it. So I actually say Siri you know
• 3:14
  please give me directions to XY and Z which may be a little
• 3:18
  weird I guess and I kind of get that.
• 3:21
  But yeah it's just it's just like you know I you know, I have
• 3:26
  you seen you, I got you into watching Picard Right.
• 3:29
  Yeah, I have not seen this last that last season yet, though,
• 3:32
  okay. I haven't seen the last season
• 3:33
  yet, either. Or, I think I saw like, the
• 3:35
  first episode of the last season.
• 3:37
  Anyway, there was an episode where it was all the humanoid, a
• 3:44
  eyes, which I don't really remember what the right term for
• 3:47
  it was. But basically all the people
• 3:49
  were being real rude and treating the, you know, the
• 3:52
  people like data, like, they were just like, secondhand
• 3:55
  garbage, right? And then they, Got sick of it
• 3:59
  and came back to attack the humans and you know maybe that's
• 4:03
  the future were heading for is that they'll get sick of being
• 4:07
  mistreated a eyes. And I don't know I think at some
• 4:11
  point it'll have like once there's a physical manifestation
• 4:15
  in the real world that might be the changer, right?
• 4:18
  I think they look like people. Yeah doesn't necessarily I think
• 4:22
  have to look like a person but some sort of like I mean people
• 4:25
  have like this little cute little robot dog things.
• 4:28
  Right? And some people are Pleasant to
• 4:30
  the room, buzz in the room, and things like that, right, stuff
• 4:33
  like that. Some people aren't?
• 4:34
  I think once there's that, physical sort of connection
• 4:37
  there like, that's, that's maybe where things might change.
• 4:40
  But right now, most AI is just a text prop in a web browser or on
• 4:45
  your screen. It's kind of difficult to
• 4:47
  contextualize that as, you know, a human kind of concept or human
• 4:52
  sort of interaction when you're so used to just typing it into
• 4:55
  Google you type, you know, please and thank you and to
• 4:57
  Google. No, no.
• 4:58
  Don't I don't, ya know, I think that's it.
• 5:03
  That's probably a good differentiation.
• 5:06
  This kind of watching a video of the keynote from the CEO over at
• 5:13
  RSA. It was at the RSA conference,
• 5:16
  which was what last week and it was talking about Ai and
• 5:21
  identity and kind of like this. I don't know what to call it a
• 5:24
  collision course that were on, but how a I could actually make
• 5:28
  identity. Work better.
• 5:30
  And in his presentation he had kind of what was like a human
• 5:34
  form started out as like like a robot that turned into a human
• 5:40
  overlay and look like a real human was speaking to the camera
• 5:45
  and but it was an AI who was answering his questions.
• 5:49
  And I thought that was, you know, I don't know how far down
• 5:52
  the road that is in some areas. It's interesting in some like I
• 5:56
  am pulls what they call a, i I think it's a farce right?
• 6:01
  It's like no that's just like you know Advanced predictive
• 6:05
  capabilities of your system but it's a far cry from like what
• 6:11
  everybody's worried about like AI is going to make humans
• 6:16
  obsolete. Yeah.
• 6:18
  That video you mentioned for our essay that was good.
• 6:20
  You sent it to me and I watched it and I thought it was an
• 6:24
  interesting Tech demo. I don't know how much of it was
• 6:26
  live if I had to guess, it was probably scripted.
• 6:29
  I was kind of looking for like okay when they hit what are they
• 6:30
  hitting play and pause on this video with these right?
• 6:33
  Yeah for sure pre-canned response to things like that but
• 6:37
  the technology exists there's a company out there.
• 6:40
  I think it's called d d, i d or D Dash by D that does like these
• 6:43
  virtual Avatar things and you can make them say you know basic
• 6:46
  whatever you want, you give it a typed out script and it kind of
• 6:48
  figures it out. It's interesting because I think
• 6:51
  it adds that visual you know, maybe it's not a physical but
• 6:55
  it's something on your screen. You say, okay?
• 6:57
  What here is, you know and Quote, unquote, a person who is
• 7:00
  talking to me. So if you think about like
• 7:02
  today, a chatbot from the identity perspective, in the
• 7:04
  bottom, right of your web browser is probably a little
• 7:06
  thing that flies out. So I do ask me anything and then
• 7:09
  it's 50/50 whether or not I can actually answer your question,
• 7:12
  right directly help you. It's not really AI.
• 7:14
  It's basically just looking for keywords and phrases that map
• 7:18
  back somewhere, to some sort of script that's associated with,
• 7:21
  oh, you asked about billing, here are a bunch of links about
• 7:24
  billing, right? It's all that kind of stuff, but
• 7:26
  I think at some point, you know, AI is going to Get more.
• 7:31
  I don't democratized or more prevalent within stuff like
• 7:34
  this. You and I are actually talking
• 7:35
  about this yesterday when we were talking about kind of a I
• 7:38
  especially an identity products. Yeah, I think there is a big
• 7:41
  difference today between what we call AI and you know may of
• 7:45
  twenty twenty three verses May of 2021.
• 7:49
  I think there's been a big shift, you know, with these
• 7:52
  large language models coming out that really expands on what is
• 7:55
  it actually mean of AI? I think the in the good old
• 7:59
  days, you know, let's call it like 20 21 and before a I meant
• 8:03
  really just some sort of advanced pattern matching or you
• 8:06
  know things like that. I don't think that's AI anymore.
• 8:10
  I think that's kind of weak sauce, if that's what you're
• 8:11
  calling. Hey, I what I think of a
• 8:14
  identity I think of this is use case.
• 8:16
  I kind of mentioned you yesterday was kind of thought
• 8:18
  that might be interesting. Is I go into my Ig a product and
• 8:21
  I say, oh, I'm an axis. I'm conducting an access review
• 8:25
  and what do most people who do? If you struggle with, who is the
• 8:29
  person and what the heck, does this access even me?
• 8:31
  Or let me do if there was a assistant that I could call up
• 8:36
  and say, hey, who is this person?
• 8:37
  Tell me more about them. And what can this access do in
• 8:42
  terms that are easy to understand and sort of interface
• 8:44
  with that would be an interesting application.
• 8:46
  Because that solves, I think one of the biggest real world pain
• 8:49
  points of conducting, an excess of you, is the people who are
• 8:53
  supposed to do the review, don't know what they're doing.
• 8:57
  It's not necessarily their fault or their problem.
• 9:00
  They've just been does you know that Jim you own the blah, blah
• 9:03
  blah, Marketing Group, and you're going to review it every
• 9:05
  quarter or month or year and you know good luck figuring out if
• 9:10
  that is still correct. And you know here is 100 people
• 9:12
  have access to it that may or may not be, you know, be part of
• 9:15
  your department. I think that would solve any
• 9:17
  problem. I kind of wonder what the
• 9:19
  approach is going to be because I think wouldn't one of the
• 9:21
  things that you pointed out was that?
• 9:24
  Some of these are systems like create that human interface.
• 9:27
  So now, you're looking at, somebody looks like you're
• 9:29
  talking to a person. You present them with a
• 9:31
  question. Now somewhere in the background,
• 9:33
  they're scouring the data to come back with an answer.
• 9:37
  So maybe it's there's one technology that provides the
• 9:41
  human interface. Another technology like chat gpg
• 9:45
  that does this language model but I think you know on top of
• 9:51
  that overlay kind of the question that you wanted to ask
• 9:53
  was was really like, An advanced identity management question,
• 9:59
  which was, you know, kind of comparing who has access to what
• 10:04
  what are they actually using it. For, in other words, what is the
• 10:06
  access that they have that? They shouldn't have and modern I
• 10:11
  GA systems cannot answer that question.
• 10:14
  I think that's the next Revolution and I think that's
• 10:18
  how we get 20 trust, right? It's so funny.
• 10:22
  Like there's so many, it's not just your trust but at least
• 10:26
  privilege. There's so Many Caesars who I've
• 10:29
  talked to over the years who say we are we follow least privilege
• 10:33
  model. In other words, their policy is
• 10:36
  least privilege. But then we start talking about
• 10:38
  role-based access control which you know my feeling is that
• 10:43
  role-based access control is it's not least privilege created
• 10:47
  works against least privilege and roll mining.
• 10:51
  Takes it, even further. Is this are saying that 85% of
• 10:55
  the people have this access. So when it's just give it to
• 10:58
  100% like 15% more time, that's the exact opposite of least
• 11:04
  privilege, right? But ultimately, you know what's
• 11:07
  interesting, though, is like it's, there's a problem that I
• 11:10
  think is so hard to solve. In the Enterprise for existing
• 11:19
  infrastructure. So company controlled
• 11:22
  infrastructure but it seems like see IEM can clap Keem.
• 11:27
  Whatever you want to Cloud, entitlement identify the
• 11:32
  infrastructure and every cloud infrastructure does gonna.
• 11:35
  Yeah. Thanks.
• 11:37
  But it seems like we're getting closer to solving it there,
• 11:41
  right? And maybe it's because I think,
• 11:43
  Because the platform's make the information available and now
• 11:47
  you can say, okay, these are over-provisioned accounts versus
• 11:52
  these Council over here. You know, properly provisioned
• 11:56
  to me. It's like that's what we need to
• 11:58
  be able to do for applications. So we need to be able to do for
• 12:01
  active directory groups, and things like that, but the
• 12:04
  technology as far as I can tell is not out there today.
• 12:07
  Yeah. Well, collecting the data is one
• 12:09
  thing understanding the data and the context in which is
• 12:13
  presented as a Completely different thing.
• 12:15
  I hope we're getting closer to that, but yeah, it's going to be
• 12:19
  a layered approach. You'll have different searches
• 12:21
  interfaces, different types of things and maybe at some point
• 12:24
  you know someone will come out with, I do IGA 3.0 whatever that
• 12:28
  looks like and it maybe it is something is more modern.
• 12:30
  It's more, you know really leveraging true.
• 12:34
  AI not what we've been calling it.
• 12:35
  I for the last decade or so. But yeah, yeah.
• 12:38
  And so I think you made a great point though, right?
• 12:41
  It's like Gathering the data making.
• 12:43
  And so, do two different things to different things, that were
• 12:46
  not good at right now. And I think it's making sense of
• 12:49
  the data is where the AI really steps in because it's like, now
• 12:53
  you're looking at a problem that the human Bronte human mind
• 12:56
  cannot crunch are back was designed around.
• 12:59
  Let's make this so people can understand it.
• 13:02
  I think the next level is like, you know, people don't have to
• 13:07
  calculate the data or understand all the roles you can find out,
• 13:10
  like, you gave this access, this is what sex is.
• 13:13
  Being used in automatically, take away the access they're not
• 13:17
  using. Yeah, hey Jim.
• 13:18
  You're doing this axis for you. Here's this person.
• 13:21
  They've the last time they use this access was six months ago
• 13:24
  and here's why they used it. You know, we think you should
• 13:27
  get rid of it but you've got company policies to take it
• 13:30
  away. Do you want to override that?
• 13:32
  Yeah I mean there we go we just solved it.
• 13:35
  IJ 3.0 coming to a product near you.
• 13:37
  I'm sure. So we probably when I get to the
• 13:42
  interview or the wrong Table discussion.
• 13:44
  We did we had but it would be unfair for me to note that back
• 13:48
  by popular. Demand is our idac.
• 13:50
  Jingle tried something for 10 episodes.
• 13:53
  I like the voice, I'm going to use the voice but we're we went
• 13:56
  back to our guitar Jingles. So if you're a fan of that, and
• 14:00
  my terrible musicianship of putting that together, enjoy
• 14:07
  until we decide to change it again.
• 14:08
  I mean, a lot of people have come up to me and said miss the
• 14:12
  guitar jingle I had no idea that people were that interested.
• 14:17
  I liked it. I mean, I told you, I liked it
• 14:20
  but you know, I'll also be honest.
• 14:22
  I can't listen to a lot of our own episodes because I like here
• 14:26
  people, I do you need to exactly you have to listen because you
• 14:30
  had it. But yeah, I can I can avoid
• 14:33
  listening to myself. The other thing that I wanted to
• 14:36
  say is just, you know, in this isn't me trolling for more five
• 14:41
  star reviews and comments. Jean Apple podcast even though I
• 14:45
  don't have this control. But I did want to say, like, I
• 14:49
  was reading through some of them over the last few days.
• 14:52
  Since like there's one by MB Hedgehog, which I know you
• 14:56
  showed this on Twitter at one point, but it's like such a
• 15:00
  great review. And I think it like helps other
• 15:04
  people, you know, find the podcast right by more more
• 15:08
  reviews. We get, the more shows up in
• 15:11
  search results, so that's one good thing.
• 15:13
  Also, I just want people to know that when those comments are
• 15:16
  made, they get read by you and I and they are appreciated.
• 15:21
  Yeah, it's very cool to get some sort of acknowledgement, you
• 15:23
  know, usually it's just you and I sitting here on an afternoon
• 15:26
  or an evening staring at each other recording and you know
• 15:31
  figure things out and you know usually we've got to guess at
• 15:32
  this point but today it's just the two of us.
• 15:35
  But yeah, it's very cool and people take the time out to do
• 15:37
  that and that's really the best way.
• 15:39
  And as of now, the only way he can really help us is, you know,
• 15:42
  like Vibrate review, all that good stuff.
• 15:45
  That is, that means a lot to us. And, you know, certainly helps
• 15:48
  us get more traction in the space.
• 15:51
  I see the last time we've got for, we get to the are back.
• 15:54
  Discussion is identi verse coming up.
• 15:55
  It's only three weeks away Jim. So in three weeks you and I will
• 16:00
  be at a dentist's verse, I Denver's 2023, it's heading to
• 16:03
  Las Vegas, we're going to be there, join the digital identity
• 16:06
  community at the Aria Resort and Casino in Las Vegas, May 30th to
• 16:10
  June seconds. It's a must-attend event that
• 16:13
  This together over 2500 Security Professionals or four days of
• 16:16
  world class learning engagement entertainment.
• 16:19
  And as a data center listener, you can get 20% off of your
• 16:23
  registration, you only got a couple weeks left, so gotta get
• 16:26
  on that horse. You can use ID, code idv, 23-0,
• 16:31
  icen, 20 just rolls right off the tongue added in diverse.com
• 16:35
  will have a link on our show notes, make it easy, you click
• 16:38
  the link, it automatically puts the code in.
• 16:40
  And, you know, that helps us as well, write more people who use
• 16:42
  our code. And it shows that, hey, it's
• 16:44
  worth it to get the podcast out to, you know, some of these
• 16:47
  events and maybe do some Partnerships like we're doing
• 16:49
  Earth. I'd ever see.
• 16:50
  So yeah, and not to mention also on Tuesday night during the
• 16:55
  opening reception, will be set up on a mini stage outside of
• 16:59
  the expo hall, which is where the opening reception will be
• 17:03
  held. I don't think that's probably
• 17:05
  the table but what I'm saying we will be recording just outside.
• 17:08
  You use the term stage very Loosely, all the world's a
• 17:12
  stage. We just treat Shakespeare
• 17:13
  definition. Yeah.
• 17:15
  Yeah, but it's not going to just be us in the corner.
• 17:18
  Yeah, so hopefully, a lot of you can hang out.
• 17:23
  Listen to this record live. We're gonna have a few dropping
• 17:25
  guess, and really look forward to that.
• 17:28
  Yeah, 7 p.m. Tuesday night, local time.
• 17:31
  Las Vegas will be kicking things off there, and get things going.
• 17:35
  And hopefully see a lot of friendly faces and new and you
• 17:38
  know, familiar faces as well. We're always looking to meet
• 17:40
  with folks and stuff like that. So I'll have stickers too.
• 17:43
  You have stickers? Good?
• 17:44
  Okay, I'm outside. Have I've got no stickers left.
• 17:47
  I've got over 100 over. 100. Okay, all right.
• 17:51
  Should we get to the Carolinas identity Roundtable?
• 17:54
  Let's do that. Okay?
• 17:55
  So this is something that we did Jim and I December of twenty
• 17:59
  twenty-two. So just about roughly about five
• 18:01
  months ago, as a today, deftly want to thank Tom Lennon from a
• 18:04
  sales point. He's the one who invited us as a
• 18:07
  new member of the Carolinas. It was cool to kind of land with
• 18:11
  sort of my feet on the ground and meet up with someone.
• 18:13
  Minded people there that is base.
• 18:15
  So just to kind of preface discussion.
• 18:17
  It was around role-based access control and it was Jim.
• 18:20
  And I kind of Hosting this conversation with a couple other
• 18:23
  people, so we had Beth Goins. She's an information security, I
• 18:27
  am and governance manager at Arvest Bank.
• 18:30
  We also had Prince Jones who is a senior manager at train
• 18:33
  Technologies and then Ashley Rous, who is a lead information,
• 18:36
  security Analyst at Lowe's, and they were kind enough to set
• 18:39
  aside, you know, some time with us to kind and the group come
• 18:41
  talk about their experiences from a Role-based Access Control
• 18:45
  perspective in the real world. So this isn't theoretical.
• 18:48
  These are people who are doing in the real world and not only
• 18:51
  doing it. But doing it really well, I was
• 18:52
  kind of impressed with how far along they were in each of their
• 18:56
  Journeys and how they were able to make decisions and make their
• 19:01
  programs to success on at least on the roll base side of things.
• 19:05
  So hopefully people will enjoy that and I'll have links in our
• 19:09
  show notes or people want to connect with them directly and
• 19:10
  ask them questions as well as to the Carolina identity.
• 19:13
  Table as well on LinkedIn, which is only two group that Jim and I
• 19:16
  are part of. So, with that, I'll go ahead and
• 19:19
  roll the tape, and we'll talk with everyone in the next one.
• 19:23
  Thank you so much for the invite.
• 19:25
  Thanks Tom takes for not only inviting us to this, but also
• 19:28
  just the group in general, it's I'm a recent transplant down to
• 19:31
  the Carolinas. I come from Chicago for 40 years
• 19:34
  and 5 months ago. I made the Trek down to the
• 19:36
  mountains of Western North Asheville.
• 19:38
  I'm sorry, Western North Carolina in the Asheville area.
• 19:40
  So I've got Cedar Mountain kind of out my window right here.
• 19:43
  And I'm happy to join like-minded identity people.
• 19:46
  I'm joined by my friend Jim McDonald, he and I do a podcast
• 19:51
  like Tom mentions called identity the center.
• 19:53
  It is nothing to do with our day jobs, which is identity and
• 19:56
  access management consulting for a company called RSM, but we're
• 19:58
  not going to a commercial for them or anything really.
• 20:01
  But it's just something we've been doing for the last three
• 20:03
  years on the side. It's sort of like our night job.
• 20:06
  Our night gig that we do, and we've had a lot of great
• 20:08
  conversations over the years with folks, all across a tiny
• 20:11
  space listeners, you know? Send their topics in and stuff
• 20:15
  like that. So we try to keep it like a
• 20:17
  vendor neutral, safe place. We don't want to turn into like
• 20:20
  a boring like corporate podcast. So that's why, you know, we own
• 20:24
  it off to the side and we don't let the companies that we work
• 20:26
  for have too much say and what we do.
• 20:29
  So that's pretty much how we run it and you know hopefully people
• 20:32
  will check it out. The idea for today's
• 20:34
  conversation is basically take that spin of what we do on the
• 20:36
  podcasts and sort of bring it to the conversation here.
• 20:39
  And we're going to talk about role-based access control and
• 20:42
  whatever. We have topics like this.
• 20:43
  That are so meaty and juicy. We like to have different guests
• 20:45
  on with us to kind of lend their expertise.
• 20:48
  So I'm going to go around the room and give people a chance to
• 20:50
  introduce themselves. First we've got Beth Goins,
• 20:53
  she's the information security. I am and governance manager for
• 20:56
  Arvest Bank. Welcome back, thank you very
• 20:59
  much. Hi everybody.
• 21:01
  I have 20 plus years of experience an application
• 21:04
  development and product implementation and six years in
• 21:08
  the information security and governments governance space.
• 21:12
  My main focus for Energy management is ensuring that
• 21:15
  there is consistent and Equitable access for all users.
• 21:19
  While minimizing friction and working for a financial
• 21:23
  institution, my current position top priority is compliance.
• 21:29
  I first officially got into the identity space.
• 21:31
  When I was hired for a job where I just thought I was going to be
• 21:34
  working on an IBM Mainframe and ended up working in information
• 21:38
  security, and identity on my first day on, there was nothing
• 21:41
  like on-the-job training. You see, I have nightmares of
• 21:45
  rack F and administrating those. So yeah, we should probably
• 21:49
  share some War stories about that.
• 21:50
  Thanks for that. Next up.
• 21:51
  We've got prints Jones, he's a senior manager with train
• 21:53
  Technologies. Welcome Prince Little welcome.
• 21:56
  So, I am Prince Jones, I work at training, I started and my It
• 22:02
  Journey over 17 years ago and I've been doing our kind of our
• 22:07
  back type of work and identity work for the last probably 15
• 22:11
  years. I started in Oracle are 12
• 22:15
  Oracle 11i space. So that's why I got all of my
• 22:18
  guests, my juicy experience from and currently I am responsible
• 22:23
  for identity at train, where we're doing IGA apparently,
• 22:29
  access management and our Federation SSO solution.
• 22:33
  As I'm around brother. Glad to be here and to talk with
• 22:36
  your. Yeah.
• 22:37
  So just a few things going on. Nothing too heavy, right?
• 22:39
  Yes, if you watch any Ashley is next, she's actually real.
• 22:42
  She's the lead in Formation security analyst from Lowe's.
• 22:45
  Welcome, Ashley. Thank you.
• 22:47
  Hey everybody. And so I've been in the IT
• 22:51
  industry for about eight years. I started on the Consulting
• 22:55
  side, I'm doing a lot of it audits on a PCI compliance
• 23:01
  rocks. And then I actually moved from
• 23:03
  Consulting to the industry where I've been in the I am space and
• 23:08
  been focused mainly on our back for the past, three and a half
• 23:11
  years. So you kind of went the opposite
• 23:13
  path that myself and Jim, you started off in the in the dark
• 23:16
  side and then I did Jim and I started off in the light side
• 23:20
  and we moved to the dark side of Consulting a while back.
• 23:23
  So I guess congratulations. I'm getting out.
• 23:26
  Don't think you're next Donald's.
• 23:28
  Go for it. Hey, Jeff.
• 23:30
  First I want to thank you for introducing me as your friend.
• 23:32
  I mean, seven years of working together with somebody, you
• 23:36
  know, it's not always easy to stay friends, but you and I we
• 23:39
  do the podcast, we work great together.
• 23:42
  Our and really looking forward to talking with the group here
• 23:46
  today, we picked this topic of our back, because I don't think
• 23:51
  that, you know, we step into it as like the authoritative voice.
• 23:54
  I think everybody's got experience with our back, that
• 23:58
  can come to the table. Sure.
• 23:59
  Everybody who's listening in plus this panel upgrade, I am
• 24:04
  professionals. We've all got our experience
• 24:08
  with what works and what doesn't work.
• 24:10
  And so I think it's It's a great topic from that perspective, is
• 24:14
  something that we've all got a perspective on.
• 24:18
  Yeah, it's a difficult nut to crack.
• 24:19
  I think a lot of people get intimidated when they start
• 24:22
  hearing about role-based access control and sort of a horror
• 24:24
  stories that come along with it, hundreds thousands tens of
• 24:29
  thousands roll over it. How is this thing going to work?
• 24:31
  I think before we get too far along though.
• 24:33
  We probably want to Define what it is that our back is because I
• 24:37
  think there are lots of terminology that we use in the
• 24:40
  identity space. Where You know we might call it
• 24:43
  one thing. Maybe it's called entitlements
• 24:45
  in another system or maybe it's roles or maybe it is groups,
• 24:49
  right? There's a lot different ways to
• 24:50
  do it and I think what I'll do is I'll start off with Prince.
• 24:53
  How do you define role-based access control like what does
• 24:56
  that mean to you and your organization are.
• 24:59
  So I will explain it how I explain to kind of a leader
• 25:03
  right without the technicals and I basically just described it as
• 25:06
  this mechanism for how we Grant or restrict access to people and
• 25:10
  we typically do it. According to some type of
• 25:13
  persona, right? So you could think about it as a
• 25:15
  maybe it's your roll. What's your department or true
• 25:18
  position? So some information that we know
• 25:20
  about you that we say, okay? If you are a member of this
• 25:23
  group you get these access and you don't have to go and request
• 25:27
  these individual accesses so that's kind of how I summarize
• 25:30
  it to kind of, you know, help a leader understand what we're
• 25:33
  trying to accomplish here. Ashley.
• 25:35
  Do you agree with the way that that does that make sense to you
• 25:38
  and how you approach it as well? Or do you have a different spin
• 25:40
  on it for your organization? It does we have a very similar
• 25:44
  spin. I like to think of just are back
• 25:47
  as just an overall methodology that has two major pieces.
• 25:51
  So one is defining the subset of users that need access and
• 25:55
  pulling them into the role. And then the second one is what
• 25:57
  access do? They actually need to perform
• 25:59
  their job and helps restrict access to what they actually
• 26:04
  need. And eliminates the need for
• 26:06
  users to say, I'll have what, you know, Karen over here is
• 26:11
  having where she may have been with the company for years and
• 26:13
  years and years. And it kind of locks down that
• 26:15
  axis and stops kind of carryover axes over time.
• 26:19
  Yeah. I like to call that the the
• 26:20
  similar access snowball you start using model after and, you
• 26:24
  know, the, the janitor who became CEO, his probably still
• 26:27
  has access to the janitor closet.
• 26:29
  Maybe doesn't necessarily need it, right?
• 26:30
  Those sorts of things Beth. I know with a kayak of
• 26:33
  compliance Focus that you Have at the bank, there's probably a
• 26:36
  pretty big focus on the role side of thing.
• 26:39
  How do you guys? How do you guys?
• 26:40
  How do you define it with with your business stakeholders?
• 26:43
  And I guess, does it. Does it align with what you're
• 26:45
  hearing here? Absolutely.
• 26:48
  I defined role of space access as a bundling of entitlements or
• 26:52
  access that grants users access to systems based on their
• 26:56
  similar attributes. So, very similar to what
• 26:58
  everyone else has been saying. The attributes can be based on
• 27:01
  their religion, their division, their department, or sometimes.
• 27:04
  HR component, it can be worth, right?
• 27:07
  It can be requestable, but it's for consistent access for
• 27:11
  everybody. Jim from a Consulting side of
• 27:15
  things, you're going to be, are going to play the role of
• 27:16
  Consulting expert here in the identity space.
• 27:19
  What do we typically see when we're talking to, you know, like
• 27:22
  our clients around, we want to get into roles and the
• 27:27
  definitions that that we've heard here from Prince,
• 27:29
  actually, and Beth about. Does it make sense?
• 27:32
  Do you see Alternatives that are out there?
• 27:34
  When it comes to the definition of what a role is when it comes
• 27:37
  to Identity? Yeah, so there are alternatives,
• 27:40
  but first I want to say that Prince Beth and I actually, I
• 27:44
  think nailed in terms of, you know, it's really an
• 27:46
  organizational unit of rollers for entitlements or access, you
• 27:51
  as a consultant, I like to think of things in terms of our
• 27:54
  framework, you know, way to organize, your thinking around
• 27:58
  the topic. So roles get talked about in
• 28:02
  terms of the authentication authorization side, as well as
• 28:06
  the identity Administration and governance is So there's the
• 28:10
  identity Administration Governor side where you're creating the
• 28:13
  roles and your provisioning, the roles and could be going to
• 28:17
  multiple applications and turning into entitlements that
• 28:20
  the applications understand and then on the authorization and
• 28:24
  authentication side where you're enforcing them why that's
• 28:27
  important is because when you talk to somebody about roles,
• 28:31
  you have to understand what perspective they're coming from.
• 28:34
  I think the other thing when I think about roles, especially on
• 28:37
  that IGA side, The house is, you know, the organization around
• 28:42
  what are the different types of roles?
• 28:43
  I think there are mainly two. The first is kind of the
• 28:47
  birthright ring, which is what do I get?
• 28:51
  Because of who I am poor, you know, I take my HR record and
• 28:55
  I'm from this office and in this department, etc, etc.
• 28:59
  And can, what access can you key off of that fact, I'm an
• 29:03
  employee. So I get the VPN.
• 29:06
  I get this, I get that and then there are things.
• 29:09
  I can't do that and those are maybe.
• 29:11
  I'm on this project and my manager wants me to have access
• 29:16
  to this role and we call those requests will rolls.
• 29:19
  So you got Birthright roles and requests for roles so that
• 29:23
  division of sort of like what you are.
• 29:26
  And then what you can request after the fact Beth, is that
• 29:30
  something that you guys have touched on as part of the
• 29:33
  deployment, and how you've tackled roles or is that
• 29:35
  something that you're working towards, okay, where does that
• 29:37
  fit into maybe the strategy? I was I was going I think he's
• 29:41
  reading all my notes here because that's exactly where
• 29:43
  we're heading. We definitely want to if we look
• 29:46
  at access as a big piece of pie right you know and what we want
• 29:51
  to do is take access for people Birthright first, anything that
• 29:55
  we can do on a common attribute or something that we can grant
• 29:58
  automatically, it's going to be one big piece and so we're going
• 30:01
  to keep trying to narrow down with, actually has to do
• 30:03
  requestable to very specific job related duties.
• 30:07
  And so, yeah, we definitely are looking at Possible.
• 30:09
  And we're looking at the birds right to minimize but people
• 30:12
  have to actually ask for Prince, I think from a role perspective,
• 30:18
  if I'm not mistaken, you guys probably have a probably a
• 30:20
  pretty big Erp platform, which is pretty notorious for having
• 30:24
  an obscene amount of roles in it.
• 30:27
  And I guess when we talk about here, this concept of Birthright
• 30:31
  versus requestable, how are you guys looking at sort of
• 30:35
  addressing that differential between access?
• 30:39
  So little we actually put it into three different buckets.
• 30:43
  So we talked about this notion of Birthright which is said hey
• 30:46
  based on who I am, this is what I want to get.
• 30:49
  But when you talk about requestable access, you have
• 30:52
  something that is introduced to that mix and that is that you
• 30:56
  don't want this one to be still comply, it, right?
• 31:00
  And so there's this concept of. If I request something, I might
• 31:03
  need to have a objective approver, making sure that that
• 31:06
  access is appropriate. And then we talk, About, even
• 31:09
  with the with the birthright access, right?
• 31:12
  Making sure that it's a no such a way that that objective
• 31:15
  approver also cautions out for a segregation of Duties
• 31:18
  violations, right? So, as a publicly traded
• 31:20
  company, that is something that we probably all have kind of
• 31:24
  seen and had exposure to you. So just someone is requesting
• 31:27
  something. Typically, your manager is just
• 31:30
  not enough to prove that it has to have some type of objective
• 31:32
  approver and then an S OD process to make sure that, you
• 31:36
  know, the access that you're requesting in. even with the
• 31:39
  existing access you have would not compose a toxic combination
• 31:43
  for the organization, Ashley, we kind of touched on the the
• 31:47
  access snowball and Prince, just hit it again there.
• 31:51
  You know, from a role perspective, we're talking about
• 31:53
  this Birthright versus, you know, add-on roles.
• 31:56
  After the fact they could be doing, is probably a little bit
• 31:59
  of while. But where do things stand for
• 32:00
  your organization when it comes to how they've how they've
• 32:03
  tackled sort of that, that question, right?
• 32:05
  What do I get? When I walk in the door versus
• 32:08
  what happens to me, Day 2 Day? 3 day 100, whatever it may be,
• 32:12
  right. So I do agree that Request will
• 32:15
  is definitely a type of role that needs to be implemented.
• 32:19
  I'm to print this point to avoid the segregation of Duties
• 32:23
  violation. I think there's a way that you
• 32:26
  can configure them to restrict the type of roles that people
• 32:30
  can see that they are able to request.
• 32:32
  So that way, you kind of have that segregation of Duties in
• 32:35
  place already and And then once you start what was the other
• 32:39
  half of your question just from the requestable standpoint?
• 32:42
  I think, you know, the differential between this is
• 32:45
  what I get when Ashley walks in the door.
• 32:46
  She said, yes. So I think that is always
• 32:49
  evolving and changing in a great point.
• 32:52
  The bring up because as we evolve, those Birthright rolls,
• 32:55
  we also need to communicate. What axis is provisioned
• 32:58
  automatically to the business, to avoid them.
• 33:00
  Requesting those additional axis.
• 33:03
  So that one is part of the maintenance process that needs
• 33:07
  to be defined. Just who those stakeholders are
• 33:09
  and how they need to be communicated.
• 33:12
  I want to come back to something that got mentioned a couple
• 33:15
  times here and that segregation of Duties, I think that is
• 33:18
  probably a pain point that a lot of people struggle with but I
• 33:20
  want to kind of build up the conversation.
• 33:22
  We started with kind of like okay what's the definition of of
• 33:25
  roles and I think we've got enough information every kind of
• 33:27
  come up with a common standard around that or at least an
• 33:29
  understanding, maybe we don't agree, but it's the same what
• 33:33
  I'd like to understand now is this is a difficult nut as I
• 33:36
  said before to crack and get started with how did you know
• 33:41
  this? At kickoff, or this idea gets
• 33:44
  started to say, hey, you know what Prince went in and said,
• 33:47
  hey, we're going to do role-based access control and
• 33:49
  then, you know, it just went Full Speed Ahead, you know,
• 33:52
  Prince from your perspective. How did you actually get
• 33:55
  started? Implementing roles for your
• 33:57
  organization? Yeah.
• 33:59
  So typically, and I think this is probably going to be true for
• 34:02
  many companies. But typically, when we undertake
• 34:05
  something like this, it's not for quite convenience yet at
• 34:08
  first, it's typically because of an audit fine.
• 34:11
  See Type of right now but not mandate.
• 34:14
  And so we all kind of Corral rounded and say, okay, this is
• 34:17
  how we're going to address this, this finding and go on, fix it
• 34:20
  that way. And then it evolves to kind of.
• 34:24
  Okay, now that we like, we see this, we see the benefits of
• 34:27
  this. How could we start to do this in
• 34:28
  a way? That kind of as a tool to enable
• 34:31
  business. So I know we like to do pain
• 34:33
  Auditors a lot. There are the reason for all of
• 34:36
  our pains but they can also be the reason for actually getting
• 34:40
  things done. There's nothing like a good
• 34:41
  old-fashioned. A audit finding to really kind
• 34:43
  of wipe the fire on a budget or a manager or director or
• 34:46
  somebody they say, okay, we gotta fix this thing, Ashley.
• 34:49
  When you guys started down the role path, what was like the
• 34:52
  first couple of steps that you took to say?
• 34:54
  Okay, we're going to do this thing.
• 34:57
  Here's how we did it. Sure.
• 35:00
  So I actually started about a year after blows began
• 35:05
  implementing our back, but I think the driving force for our
• 35:09
  side was more from an operational perspective.
• 35:12
  To take some of the work offer operations team and to automate
• 35:16
  it and take some of that pressure off of them to allow
• 35:18
  them to do other Provisions that they need to do.
• 35:22
  But how we really got started was, we did some mining in a
• 35:29
  sample environment and just saw what the data produced.
• 35:32
  And then we went through and we would communicate with the
• 35:34
  stakeholders and say does this align with what you're saying,
• 35:37
  and then we played with the algorithms a little bit more
• 35:39
  until we can find you in that process back.
• 35:42
  How long of a process was it to mine that data and really kind
• 35:46
  of work with the business to establish, you know what what
• 35:49
  might have been the initial baselines for a role say
• 35:52
  initially about a year to a year and a half where those
• 35:55
  conversations were taking place because we would get our
• 35:57
  feedback, take it back to the different applications to use to
• 36:01
  C and B lined up with what the business was saying.
• 36:04
  Make sure we got all parties involved and then additionally,
• 36:07
  it's a lot of data clean up to that.
• 36:10
  You, you get a lot of access Has pulled into roles that, you
• 36:14
  know, from the scenario I said earlier were Karen's been in the
• 36:17
  business for how many years but so has 30 other co-workers.
• 36:20
  So a lot of the still axis gets pulled in so it's a lot of fine
• 36:24
  tuning to determine what is actually consistent and needed
• 36:27
  for the here and now yeah, definitely an overnight task
• 36:31
  right? Oh no it's like these things.
• 36:32
  Take forever. Yeah I think a daily consistency
• 36:35
  data quality got nested groups, people using groups, all kinds
• 36:39
  of things, you know. Beth I think I struck a chord
• 36:41
  about just now She had a little, the tight which when I said
• 36:44
  nested groups sounds to me like you got something you want to
• 36:47
  add in there. We end our panel yet.
• 36:50
  And the nested groups are a challenge for us here.
• 36:53
  That's for sure. Part of our process to is also
• 36:56
  breaking our entitlements down from a critical application
• 37:00
  perspective, or a high admin privilege, versus what we
• 37:04
  consider kind of, the lower level of distribution groups,
• 37:06
  and maybe shared folders, and things like that.
• 37:09
  So, we kind of classified our data a little bit and then,
• 37:11
  we're, Initially rolling out the roles based accessed on what I
• 37:15
  would consider the less priority items as far as like
• 37:18
  distribution groups and kind of high-level things that everybody
• 37:21
  has to have to get their job done.
• 37:23
  And we're holding aside the critical and administrative
• 37:25
  things to Dole out very specifically at added more
• 37:29
  requests for metal versus like a Birthright level.
• 37:32
  So definitely looking and changing our approach a little
• 37:34
  bit from a priority perspective of high priority.
• 37:37
  Height sensitive information versus less sensitive
• 37:40
  information Had there been instances where after you've
• 37:44
  gone through sort of, that analysis may be something that
• 37:47
  was marked as critical really wasn't so critical lunch menu.
• 37:50
  Something like that as I added something that was maybe not
• 37:54
  Marcus critical. Probably should have had a
• 37:56
  higher, you know, security or, you know, approval process
• 38:00
  around it. Did you address discover any of
• 38:02
  that kind of as your process went through every day.
• 38:05
  Every day we have a new discovery.
• 38:07
  There's always that little pocket of something over there.
• 38:09
  That wasn't labeled as admin and when you drill into Or no.
• 38:12
  Wow, that was, that was a big one, you know, and I again from
• 38:16
  the compliance area, I make sure that our entitlements are
• 38:19
  variable tag from a criticality perspective and it did not read
• 38:23
  only update or admin. Those are your big three, you
• 38:26
  know, and then we kind of go from there and then but PCI
• 38:29
  relevance and things. But yeah and and then a big one
• 38:33
  is putting something out there that should be worth, right?
• 38:35
  Everybody? Like internet access.
• 38:37
  You know, and if you drop that out there yeah it's not really
• 38:41
  over. Overly critical, people really
• 38:43
  do need to get to the internet. Yeah, I've seen that the last
• 38:46
  couple years especially with obviously covid working from
• 38:48
  home. There was a lot of scramble to
• 38:49
  get VPN in front of everybody. So I would imagine maybe there
• 38:53
  were some role justments made in the last couple of years to
• 38:57
  provide, you know, network access, you know, whatever.
• 38:59
  It may be. Jim you know, if we if we think
• 39:02
  about it from sort of the level of what, you know, other
• 39:05
  companies in the industry are in, this industry are doing at
• 39:07
  least this space of identity. Where do you typically see
• 39:10
  companies starting With roles, I think I'll kind of put my two
• 39:14
  cents in front and maybe you can either tell me, I'm crazy or
• 39:17
  whatever. I see rolls typically as a
• 39:21
  little bit more of a mature, step down a company's identity
• 39:24
  Journey typically you know, we're going to a company and
• 39:28
  we're kinda helping them out. It's well, we're still doing
• 39:30
  things by hand. It's manual faxes are coming in,
• 39:33
  right. Things are being printed out,
• 39:35
  and I think there's probably some level of Baseline identity
• 39:38
  capability that needs to exist before.
• 39:41
  Really? Makes sense to look at rolls and
• 39:44
  start to do, like the role now is to out.
• 39:45
  Ashley was mentioning before. How do you see sort of that
• 39:48
  process working? Or do you think it's viable to
• 39:50
  start with? Hey, let's start with rolls and
• 39:53
  then work backwards from there. I think we're all under under
• 39:56
  pressure to deliver. So I think doing some of the
• 40:00
  baseline or three rolls right off the bat makes sense.
• 40:05
  So if you're implementing an IGA system for the first time, for
• 40:09
  example, you know, automatically provisioning, somebody's it
• 40:14
  capabilities, there are SharePoint access, the VPN
• 40:18
  access to think those are things you can do.
• 40:21
  I think it comes down to kind of one of the things I making
• 40:24
  myself. Notes.
• 40:25
  Those folks are talking, there's so much good content here but is
• 40:29
  like this, a D20 concept, right? Because I was thinking one of
• 40:32
  the questions and I hope in my stealing from your questions
• 40:34
  here, but it's like when are you done, right?
• 40:37
  And it's like, you don't need a role for every single thing.
• 40:40
  You technically within your product it might be called roles
• 40:44
  and you have to have a role for everything that gets assigned,
• 40:47
  but you don't need to have kind of that traditional business
• 40:50
  role or technical role for every single thing.
• 40:55
  Thing, I think you have to prioritize.
• 40:58
  So a couple things in my opinion, the right way to go
• 41:02
  about this is first start by focusing on those.
• 41:06
  It roles that we talked about second is, go Department by
• 41:10
  department. So don't try and do a little bit
• 41:13
  with each department, pick an apartment where you have an IT
• 41:16
  liaison or somebody who represents that department, who
• 41:20
  really thinks roles as a good idea that's going to save their
• 41:24
  folks, a lot of Pray, if you get that person who really thinks is
• 41:28
  a good idea, they're going to put in the effort.
• 41:30
  So that's where I say to start and start with, you know, I
• 41:33
  think Ashley brought up the idea of like data mining.
• 41:37
  I ultimately feel like you have that data, you analyze that data
• 41:41
  and then you engineer your roles from the top down.
• 41:44
  So they make sense to human beings.
• 41:46
  I think if you let the a I do all the work, you get these
• 41:49
  roles that don't make any sense to people, and it's kind of like
• 41:54
  a You have to be able to explain what the role does.
• 41:58
  Somebody has to actually conceptualize.
• 42:00
  Like if I give this person Erp clerk access a list of login
• 42:06
  gives them access to the dashboard and lets them do these
• 42:09
  functions. It's not like all these nebulous
• 42:11
  things that could come with it. A couple other thoughts that I
• 42:16
  was having is, you know, you need to have business ownership
• 42:19
  over roles. So even if their it rolls, there
• 42:22
  should be an IT person who's assigned.
• 42:25
  As a business owner that role will, you don't want to have is
• 42:28
  like your cell Point, administrator be the owner of
• 42:32
  the role in like, you know, like who owns I roll while it's just
• 42:36
  the, I am person. No, should be a business owner,
• 42:39
  whether that's an IT person or someone that Finance or HR.
• 42:44
  And then the other point that I was the last one.
• 42:46
  I swear. But it was, you know, one of the
• 42:48
  things I was hearing over and over again.
• 42:50
  Was this idea of I am fatigued, you know, like when We set up
• 42:57
  our system and it's like constantly asking people for
• 43:00
  approval approve this and prove that they get blown away and
• 43:03
  they're just like yeah whatever whatever.
• 43:05
  It's the same thing with like make sense, some be rolls so the
• 43:13
  lunch menu idea like what about thinking about like it's lunch
• 43:18
  menus low-risk why not Auto approve and let that thing go
• 43:21
  through Yeah, you got there for a second.
• 43:24
  I think you're going for the fatigue part.
• 43:26
  We see that a lot with MFA fatigue and that's one of the
• 43:28
  common ways that people are getting breached is you get
• 43:31
  spammed a whole bunch of times on your phone's like, you know
• 43:34
  and you just end up hitting approved just make it go away in
• 43:36
  the person got in Sean asked a couple questions and I would
• 43:40
  certainly encourage folks who are out there, you know,
• 43:41
  watching and listening whatever. Maybe to throw them to the Q&A.
• 43:45
  I'm going to hit the second one first he sent and because I
• 43:46
  think this is a real important one.
• 43:48
  How do you tackle conversations with HR?
• 43:51
  Let's say, you know, you're running like a workday or an
• 43:53
  oracle. An ATP or something like that,
• 43:54
  right? There's this authoritative
• 43:55
  source for identity and continue to establish enough information
• 43:59
  to use membership criteria in a role without an issue of
• 44:03
  Upstream issue up without an issue of Upstream issues of I
• 44:07
  could say it just right. So what I think we're getting at
• 44:09
  here is you've got data coming for your authoritative Source?
• 44:12
  How do you make sure that really all the business stakeholders
• 44:16
  are part of this from the HR side to make sure that when
• 44:20
  you're designing roles and identities side and maybe Prince
• 44:22
  will go with you first. How do you make sure that
• 44:24
  there's not that conflict that business engagement with, you
• 44:27
  know, other non identity groups to make sure that those complex
• 44:31
  don't exist? Yeah.
• 44:32
  You know it's a really if I could simplify the answer I
• 44:36
  would say this phrase. Do with me and not do to me and
• 44:40
  when you bring people along you kind of show The Journey, you
• 44:44
  can kind of create this atmosphere of partnership and
• 44:47
  collaboration where when they're put in when you're working on
• 44:51
  information in each, alright? You're bringing them along to
• 44:55
  say, hey when you, we're going to key off of this information
• 44:59
  or would like to key off of this information, right?
• 45:01
  How are you process? Is they, are they robust?
• 45:03
  Are they accurate? Do you have process to catch
• 45:06
  when? You know, when you're when
• 45:07
  someone does not have a job title?
• 45:09
  Are you fixing that, right? Those type of things.
• 45:11
  So that way you don't have these, you know, unanticipated
• 45:14
  issues down the line. So you're bringing everybody
• 45:17
  along with their Journey because like so when said everyone
• 45:20
  really has a unique part to play the identity practitioner He
• 45:24
  does not know most time with these roles are what they give
• 45:27
  you access to do excetera. So I really think it's that
• 45:29
  collaborate collaborative process and iterative process
• 45:32
  over time and bringing people with you that kind of helps,
• 45:35
  make sure that everyone is kind of playing on the same team.
• 45:39
  I think, you know, the butterfly effect is absolutely a
• 45:43
  phenomenal phenomenal. When it comes to changes in
• 45:45
  rolls, right? Everyone really needs to
• 45:47
  understand that there are repercussions for changes in
• 45:51
  Source data. So, You know, if a role changes
• 45:55
  or a job title changes or a job code changes or whatever.
• 45:58
  May be your you really need your friends over on the uh RIT side
• 46:03
  or whoever is kind of managing the data within that system to
• 46:06
  be your friend. You know, Chris is echoing.
• 46:08
  Do with me, not to me, that's gold.
• 46:10
  That's obviously honey is sweeter than a stick.
• 46:13
  You try not to have the stick but, you know, honey is probably
• 46:16
  the better way to go through it. I want to kind of tease out this
• 46:20
  other than kind of the underlying thread of Engagement
• 46:22
  with the business. - that Shana was getting to, you know, Beth
• 46:26
  when you're going through this process of kind of roll design.
• 46:29
  How do you tackle that engagement with the business?
• 46:31
  Because Jim, I think mention an important thing here which is
• 46:33
  the business really should own. The role fits their data, they
• 46:37
  should be responsible and understands what it is that
• 46:40
  they're approving which sometimes can be a challenge.
• 46:43
  Yeah. So we have two topics there and
• 46:46
  I'm not sure which one to to hit first but one is from the end of
• 46:51
  line manager, you know, approving for their own peace
• 46:54
  and making sure that the roles of they're approving or what
• 46:57
  they're seeing. It has a good enough definition
• 46:59
  so they really can understand. We definitely get feedback on
• 47:02
  that all the time and then on the roll itself is having the
• 47:06
  owner actually go back and improve the content of that role
• 47:08
  and making sure that they truly do understand.
• 47:11
  The elements that they are certifying that Are inserted
• 47:14
  into that role. Just lots of communication out
• 47:18
  there with the business side and we're getting lots of feedback.
• 47:22
  You know, it's great when you get feedback because that means
• 47:24
  that the reefs reading or trying to be engaged with it and they
• 47:27
  don't understand what it is that we're pushing out.
• 47:29
  We need to listen to that, and figure out what we can do to
• 47:32
  make that more clear. Yeah, Sean breaks over the good
• 47:35
  point who are some time. We've got, you know,
• 47:37
  non-technical people who are responsible for technical things
• 47:40
  and they may not understand that.
• 47:42
  I think, you know, hit that sort of internal Consulting role
• 47:45
  that, you know, each of us might play for our organizations.
• 47:48
  Ashley, you know, when it comes to helping people understand,
• 47:52
  maybe how their change, how their decisions might impact
• 47:56
  Downstream. I am things.
• 47:58
  How do you typically engage with that in?
• 48:00
  Do you have any tips for us? Sure.
• 48:02
  So just going based on that constant communication.
• 48:06
  I think one of those things beginning from an HR perspective
• 48:10
  is just to see what type of notifications you can receive
• 48:13
  let them know. Hey, if you're making a change,
• 48:15
  a lot is no like it might be something that affects is so
• 48:18
  maybe not but always let us know in regards to application teams
• 48:22
  and their changes. I always try to encourage them
• 48:24
  to talk to us first before they want to update a rule because a
• 48:28
  lot of times they don't have the visibility to user perspectives
• 48:31
  that We do so that they can say, hey, I want to push this role to
• 48:35
  this user population and I'll go back and I'll pull the
• 48:38
  population and say, is this what you want?
• 48:41
  And they go, oh no, this is not what I want and like.
• 48:43
  Well, that's what you say. It looks like, let's define it.
• 48:45
  And tweak it, you kind of determined that working
• 48:49
  partnership value through those conversations.
• 48:51
  They see what level they can bring to the table.
• 48:54
  And then what level your team can bring to the table as well.
• 48:58
  Yeah, I think there's a yin and yang that comes to it when it's
• 49:00
  you're trying to help them and sometimes you have to help them,
• 49:03
  not be Their Own Worst Enemy. Yes, Shawn wants to know how
• 49:09
  many of us have successfully rolled out roles in our
• 49:12
  business. So I'm actually going to open
• 49:13
  this up to everybody. If you can use the raise hand
• 49:16
  feature in the in the webinar, I'd love to see just kind of
• 49:20
  account if you've rolled out. If you've successfully rolled
• 49:24
  out roles within your business, I'm going to give people a
• 49:27
  couple minutes kind of think about that if whether they
• 49:29
  really think they were successful or not because
• 49:31
  there's probably Different degrees of, you know, were we
• 49:33
  successful or what do we Define as at.
• 49:36
  I'm going to start with Prince when it comes to the role
• 49:40
  perspective. How successful do you think
• 49:43
  you've been to date and getting this put in place?
• 49:46
  Yeah. So the way I measures your test
• 49:49
  is I like to personally start with the small wins right?
• 49:52
  Because those small wins allow me to keep going and I say oh I
• 49:55
  see how that works. It starts to tell the story and
• 49:58
  go to that next phase. So for example, if we know Know
• 50:02
  that every employee is entitled to be PN access and there's a
• 50:06
  process of change management process now today that you
• 50:08
  request it, and it goes to all these approvers, that's
• 50:11
  approval, 40, get cetera. So to the business, they may
• 50:14
  say, you know what what it'd be great.
• 50:16
  If if if you are an employee and we do just had that on day one
• 50:20
  and I say yeah, that would be great and we could help you do
• 50:23
  it. So you start by addressing a
• 50:26
  problem. That is a pain point for them
• 50:28
  and then start to build into the security risk get set.
• 50:31
  So that way you have some small wins and you can get some
• 50:34
  momentum and it starts getting bigger and bigger.
• 50:36
  And that's how we kind of rolled out.
• 50:38
  Our roles in the organization were things that, you know, are
• 50:41
  very important to them. And then we start to say, okay,
• 50:43
  now that we've done that, what's the next model?
• 50:46
  What's the next iteration of this that we can continue to
• 50:49
  help strengthen our pressure? So I'm hearing sort of like the
• 50:53
  initial improv training of. Yes.
• 50:55
  And that's the answer. Like okay, how are we going to
• 50:58
  do this? Yes, we can.
• 50:59
  And here's how we're going to do it, right?
• 51:01
  Pull it in. The proper framework rules
• 51:03
  guardrails, whatever it may be Beth.
• 51:05
  What do you think from a success standpoint?
• 51:07
  How successful do you think rolls have been from a rollout
• 51:09
  perspective for your organization?
• 51:11
  Yeah, so you know what's the definition of done, right?
• 51:13
  I don't think we're ever going to be done.
• 51:15
  You know, it's going to be a constant Bridge painting, you
• 51:18
  know, where you can go back and new applications are introduced
• 51:20
  but from a success. Standpoint are our community has
• 51:25
  embraced it, and that is fantastic.
• 51:28
  Everyone is impacted from the end-user true, man.
• 51:31
  Is the path to prove, they're all impacted whether they didn't
• 51:34
  get their access on day. One that they needed to get
• 51:37
  their job done or the managers like you said or just tired of
• 51:39
  approving and processing things through.
• 51:42
  So everyone has embraced the idea of brass right now.
• 51:46
  Gorgeous Bright Walls, what can we get done day one that nobody
• 51:49
  really has to look at and that helps the employee have a great
• 51:53
  first day on the job. So 6s is, you know, positive
• 51:58
  feedback. There were reducing the friction
• 51:59
  for people and Getting some good feedback from integers that
• 52:03
  their time is not spent in a wasted way.
• 52:07
  Nobody wants to waste time as the one thing that bothers me,
• 52:09
  every time is sending a manager and approval for something that
• 52:12
  they're going to approve 100% of the time, like, what is the
• 52:15
  point of that? That's checkbox compliance at
• 52:17
  its worst? You know, I'm looking at the
• 52:20
  hands raised and I think we're in the minority we've only got
• 52:23
  really a couple hands that are raised that have actually that
• 52:26
  they think they've been successful so far, it sounds
• 52:27
  like Prince you've been successful Beth your
• 52:30
  organization and successful with it.
• 52:31
  Actually, what about your organization over at Lowe's?
• 52:34
  How successful do you think the rollout has been of role-based
• 52:37
  Access Control to date? I think we've been very
• 52:41
  successful with the rollout of roles.
• 52:43
  I think, you know, the everybody's Point rolls is
• 52:45
  something that you can never mark As done.
• 52:47
  So that fatigue will always stay in place because as users, you
• 52:51
  know, there's the birthright access and they're used to not
• 52:54
  improving that anymore. But then as your organization
• 52:56
  changes or your it landscape changes, there's new things that
• 52:59
  need to be improved and the users get to take that.
• 53:01
  Way. So there's always opportunity to
• 53:03
  improve your rules, but I think a big thing in our organization
• 53:08
  that we can show how successful we are, it is to actually take
• 53:11
  the time to do the analysis and the metrics to see.
• 53:14
  All right, we think our roles are successful, but how
• 53:16
  successful are they? So what percentage of the users
• 53:19
  actually receive a role is their subset of the population sets
• 53:22
  missing? Do they actually need a role?
• 53:24
  Do they not? And then also go at it from like
• 53:27
  a quantifiable view in terms of dollar amounts, just saying
• 53:31
  Here's what we have automated so far.
• 53:34
  How much does this actually save the money into our save the
• 53:37
  company in terms of dollars? So I saw a third hand raised up
• 53:41
  definitely still in the minority of the 40 or so people, we've
• 53:44
  got on the call today, it seems like there's a lot of work to be
• 53:47
  done when it comes to getting roles in place, which doesn't
• 53:51
  surprise me. I think roles are very
• 53:52
  difficult, and I'm going to put Jim on the spot here.
• 53:55
  Jim of the hundreds of clients that we've worked with what
• 53:57
  percentage would you say have successfully rolled out rolls?
• 54:04
  I mean it depends on what you mean by success, right?
• 54:08
  They like I mean to that point like if the success is when
• 54:12
  you've rolled it out and you're not doing it anymore, well 0%
• 54:16
  you're always going to be doing roles.
• 54:18
  But if you're talking about who have achieved value through the
• 54:23
  use of roles that is Success. Obviously, if you spent a
• 54:26
  million dollars and you have very little value, that's not a
• 54:29
  success rate, but I think a very high percentage people who
• 54:33
  Relations that do some form of roles tend to get, you know,
• 54:37
  outsides value especially the early roles because you tend to
• 54:41
  focus on the biggest bang for the buck.
• 54:44
  If I could, I took a note and I'm waited patiently so on the
• 54:48
  other question around HR data. So I feel like, you know, from a
• 54:52
  consultant perspective, there's two formal ways to handle that.
• 54:57
  So the first is, how do you prevent getting blindsided by
• 55:00
  this at the very low? Let's Art with how do you make
• 55:04
  sure that some change doesn't go into effect on your HR System
• 55:09
  that you weren't aware of and it crashes your system.
• 55:11
  So for me that's done in change management.
• 55:15
  So change management should be, you know, the HR System should
• 55:19
  be not changing values in their system without going through
• 55:25
  change management. You know.
• 55:26
  So they're not like middle of the week, just deciding to go
• 55:29
  from 3 digit location codes to for digital location codes.
• 55:33
  As you go through change management, most companies do
• 55:36
  like one or two rounds of change management where there's release
• 55:39
  notes, you have to have a member of your, I am team on the change
• 55:43
  management board so you can catch that.
• 55:46
  What you really should do though is catch that early when the
• 55:49
  project is being defined. And so as part of your sdlc, you
• 55:54
  should have security architect or IM arktech to looks for
• 55:57
  things that would trigger. Hey, this is going to affect us
• 56:02
  our feed from HR is going to break when we go from three
• 56:06
  digit codes for digit codes, if we don't make an adjustment so
• 56:10
  that they can input to that project team that hey, I am
• 56:15
  needs to be involved. Yeah, I think we're talking
• 56:17
  about there was like the IMC at the table right there, identity
• 56:20
  is threaded throughout an organization and really anybody
• 56:24
  who's working on identity whoever is leading that program.
• 56:26
  It is a program not a project for an organization.
• 56:30
  They should be involved heavily with any stuff.
• 56:33
  There's a a couple of questions that came in from Rashon and
• 56:36
  Christopher basically dealing with kind of a similar issue and
• 56:39
  that is data quality or missing data or changes in data from the
• 56:45
  authoritative source and Jimmy kind of touched on just now, you
• 56:49
  know, I feel bad for Chris and it's gonna stay here is like,
• 56:52
  yeah, they went through an acquisition and it broke.
• 56:55
  All their Birthright are back rolls because I'm guessing the
• 56:59
  authoritative Source change some data and the identity team
• 57:03
  either. Was involved and didn't have
• 57:05
  work, give it enough time to make updates, or most likely,
• 57:08
  they probably weren't as involved with it and found out
• 57:10
  sort of, after the fact, that's a tough one to come through.
• 57:14
  I mean, this is where communication is absolutely
• 57:16
  vital people need to know, just how integrated the identity
• 57:21
  program is with all of the systems, if it's done, right, is
• 57:25
  great, right? You reduce risk, everyone's
• 57:28
  having an easier process to get on board at off border off board
• 57:32
  a compliance. RIT all that stuff.
• 57:34
  It's a great easy button but if it's not coordinated well and
• 57:37
  not communicated. Well, it is an absolute
• 57:39
  nightmare so that is definitely an issue.
• 57:41
  And I think, you know, there's another part of this where
• 57:43
  Roshan was talking about sort of missing identity attributes
• 57:47
  within an authoritative source and how people are handling
• 57:51
  that. I think there's an opportunity
• 57:52
  probably to have some sort of like augmented attribute lists.
• 57:57
  It could be within your IJ platform, it could be within,
• 58:00
  maybe something like an active directory or ldap, that is Add
• 58:03
  by an authoritative Source. I'm curious, I'll start with you
• 58:06
  Ashley from a missing or broken attribute standpoint.
• 58:12
  Is that something that you've had to deal with in the past?
• 58:16
  If it and if not, if it's something were to come up, how
• 58:18
  do you think you would address that today?
• 58:20
  Sure it's definitely something we've gone through in the past
• 58:24
  but I think we try to catch it at the beginning as we onboard
• 58:27
  new applications. So we actually take the time to
• 58:29
  look at those attribute. Matt mappings and see what would
• 58:32
  be missing from this. Specific identities.
• 58:34
  So that's where we mainly capture it.
• 58:36
  So we don't push our. We don't on board or fully on
• 58:40
  board and say we're done until we get those attributes put into
• 58:45
  place. So that's probably how we combat
• 58:48
  at the most. And then for changes again, it's
• 58:53
  just that constant communication always have the seat at the
• 58:55
  table. I'm, you know, we always have
• 58:58
  somebody saved from architecture for I am at the table.
• 59:01
  Then you know, they About those potential, attribute changes.
• 59:05
  The Project's pods until we can all get into agreement on how
• 59:09
  that's going to affect all the downstream systems to rochon
• 59:13
  point. Like, I think sometimes, you
• 59:15
  know, I'm hopefully it'll never be a major disaster that
• 59:18
  happens, but sometimes it takes having one of those attribute
• 59:21
  changes for in the business to see how involved a complex--.
• 59:25
  Your I am system is and all the downstream effects.
• 59:28
  So that going forward, everybody's almost in a nervous
• 59:30
  State be like, we don't want to break anything.
• 59:32
  What do we need to do? Do and get everybody involved.
• 59:36
  Prince. I Would Imagine with the
• 59:37
  complexity that comes into you know, the size of an
• 59:40
  organization like yours. And there's God have been broken
• 59:44
  roles or things. Just not working the way they're
• 59:47
  supposed to. How do you tackle that sort of
• 59:49
  things? Maybe we can kind of crowd
• 59:51
  Source some information here that Chris can take back to help
• 59:54
  you. And I think everyone is kind of
• 59:57
  hit it on the head. I would just add one other
• 59:59
  thing. So we talked about this concept
• 1:00:01
  of change management, right? But one idea is To have identity
• 1:00:07
  as an approver to certain changes, right?
• 1:00:09
  So when they, if they are mature enough to go through a change
• 1:00:13
  management process, then it leaves.
• 1:00:15
  Now, it's not just a passive a we told you about it, right?
• 1:00:18
  You have to actually approve of that change.
• 1:00:20
  The other thing is having a near production type of test
• 1:00:23
  environment. So if you're making any material
• 1:00:25
  changes to the process, now you have these test plans where you
• 1:00:29
  want them through their paces and you should be seeing that in
• 1:00:32
  result. So if you change the world Etc
• 1:00:34
  now we don't have that configured Our system, the end
• 1:00:37
  result is that persons not going to get that access.
• 1:00:39
  It would have failed there where you could catch it.
• 1:00:41
  The other thing is you know even if something is working well
• 1:00:44
  that could be Integrations changes its excetera, it's
• 1:00:47
  important to have kpis. Those kpis allow you to
• 1:00:50
  continuously monitor the effectiveness of your program,
• 1:00:53
  right? So that when something does
• 1:00:55
  maturely change, you can pick it up and maybe try to work and
• 1:00:59
  mobilize. So solve it on the onslaught
• 1:01:01
  instead of like you know having this big old what's happening
• 1:01:04
  here. You want to know it first.
• 1:01:06
  Be the first of on a knowledge and address it.
• 1:01:07
  So I think if you kind of incorporate some of those
• 1:01:10
  strategies there it will make it a little bit better.
• 1:01:12
  Obviously you're not going to be able to compensate for every
• 1:01:15
  single scenario out there but those are some big rocks that I
• 1:01:18
  think will help companies kind of manage that I guess the
• 1:01:23
  prevention of a bad day hika, if something like that happened.
• 1:01:28
  This. Yeah, you mentioned kpis.
• 1:01:30
  It's almost like you're establishing sort of indicators
• 1:01:32
  of compromise to your identity platform, right?
• 1:01:35
  Something's not working. Seeing the way that it should
• 1:01:36
  be. And, you know, the goal is to
• 1:01:39
  catch it before. It becomes a problem, you know,
• 1:01:43
  when you've got a massive switch with, you know, with or
• 1:01:45
  authoritative sources that definitely screams change
• 1:01:48
  management and identity, see the table, all the way Beth.
• 1:01:51
  I'm going to put you on the spot here, because I'm going to put
• 1:01:53
  you in the same scenario as Chris.
• 1:01:55
  Maybe we can help him out. Your authoritative Source has
• 1:01:58
  changed overnight and you were not involved.
• 1:02:02
  What is your Monday morning going to look like and how are
• 1:02:05
  you going to To start to plot a path to recovery here.
• 1:02:09
  Yeah, I know definitely, one of those things is.
• 1:02:11
  You hope you have some triggers in place.
• 1:02:13
  You know, that would give you some alerts ahead and Tom and me
• 1:02:15
  and wipers and saying, you know, you try to make sure you, you
• 1:02:18
  know, what's happening, one of our big triggers would be one of
• 1:02:21
  my biggest fears is from our HR System people that are active or
• 1:02:25
  not active, right? That's going to turn everybody
• 1:02:27
  on or off from a gourd fry perspective.
• 1:02:30
  And we do have reports and things that are going out there
• 1:02:32
  monitoring for that flag and we haven't caused from the
• 1:02:37
  integration and Between the any noted change for the source, and
• 1:02:42
  then coming into our environment.
• 1:02:44
  So, if a couple of our big triggers more get modified, we
• 1:02:47
  have a notification string that's in place to let us know
• 1:02:50
  that prior to being posted. Now, of course it's a window but
• 1:02:53
  if you know, if you don't catch it, you're cut it out.
• 1:02:56
  Yeah. I think an immediate murder
• 1:02:58
  would probably be called major incident response and I'm sure I
• 1:03:01
  would be head of the table. And then like you said, back
• 1:03:03
  tracking, the changes that came in to see what might have caused
• 1:03:07
  it. That's it.
• 1:03:08
  That would be our approach to proactive is definitely better
• 1:03:11
  than reactive. It sounds to me.
• 1:03:14
  Like you've got like this identity bat signal that like
• 1:03:16
  shoots into the sky, it's like, oh my God, fucking this happen.
• 1:03:19
  We need somebody come and help us Giovanna help.
• 1:03:22
  Roshan out with the question he had and it's really around that
• 1:03:25
  missing data from a authoritative Source
• 1:03:27
  perspective. So let's say you've got to work
• 1:03:29
  day or an ATP or something like that.
• 1:03:31
  And there isn't enough data in there to be able to drive
• 1:03:36
  Downstream things that you want to have happen.
• 1:03:38
  And really, we're probably talking more about like
• 1:03:40
  attribute based access control, which I do want to leave some
• 1:03:42
  time, and I know we're getting a little short on time here, so
• 1:03:44
  we're gonna go that next. But what are some methods that
• 1:03:47
  people might want to think about?
• 1:03:49
  If there isn't enough data in your HR platform?
• 1:03:53
  Where else could I put data that might potentially Drive some
• 1:03:57
  role based decisions or attribute based decisions for
• 1:04:00
  Access? Yeah, architecturally speaking
• 1:04:02
  you could you have two options. I think one would be to build
• 1:04:07
  error handling To your connector.
• 1:04:10
  The other is to build some kind of layer of abstraction.
• 1:04:13
  So it would be like you said, maybe dump the leg, the data
• 1:04:17
  into a database or an ldap or something like that to, you
• 1:04:22
  know, kind of buffer, the data quality.
• 1:04:25
  Those are from, you know, that that I think is that technical
• 1:04:30
  answer to it. You know, there's something that
• 1:04:35
  I wanted to kind of back through the keep doing this back.
• 1:04:38
  Track to like an earlier conversation because I was
• 1:04:41
  bringing up a lot of things like.
• 1:04:43
  Okay, if you have this process, you've got, I am architect on
• 1:04:47
  the, you know, each of the projects and they're reviewing
• 1:04:50
  and your, you might be sitting there thinking like, oh,
• 1:04:53
  wouldn't it be nice to have all those people?
• 1:04:55
  Like the dress not reality Gem and I also I think it was
• 1:05:01
  actually made the statement. I like sometimes takes a
• 1:05:04
  disaster. Well, sometimes it does.
• 1:05:06
  But you know this is where As I am practitioners as leaders in
• 1:05:10
  the space, we've got to be telling our organization look.
• 1:05:14
  I am is Middle where I am is like other areas of it and needs
• 1:05:19
  to be treated with the same levels of discipline like
• 1:05:24
  project management like change management like having a
• 1:05:27
  governance body. You know it's got to be treated
• 1:05:31
  very seriously because if not things can break down very
• 1:05:36
  quickly, we can have that disaster.
• 1:05:38
  We Don't want it to come to that disaster, but it's very apparent
• 1:05:41
  when it does happen. Yeah, you mentioned early on
• 1:05:45
  their side of the, the alternative.
• 1:05:47
  I was thinking, you know, like I met our virtual directory, which
• 1:05:50
  is what Craig Reno wrote in as well.
• 1:05:52
  Met a virtual directories and health checks that he calls
• 1:05:55
  circuit breakers, right? These are all the technical
• 1:05:57
  controls and be put in place to sort of prevent a disaster.
• 1:06:01
  But they are still preventive as much as you can, does not
• 1:06:05
  replace the people and the process in front of it.
• 1:06:08
  To be able to try to head off. Some of the system's good
• 1:06:10
  Communications, make friends with the key links with your
• 1:06:15
  identity program, HR audit it, you know, if there's
• 1:06:20
  representatives for the business, Mitch brought up an
• 1:06:23
  unchanged an interesting point here which is absolutely true is
• 1:06:26
  that are back, doesn't work for everybody.
• 1:06:28
  And this is kind of where I want to take the conversation next
• 1:06:30
  because our back isn't the only way to do access control.
• 1:06:34
  There's also a back attribute based Access Control.
• 1:06:37
  There's pee. Back policy based access
• 1:06:39
  control, which you could argue maybe are sort of the same
• 1:06:42
  thing. And in the case of Life
• 1:06:45
  Sciences, which is the, the, the example, he's using, is they
• 1:06:48
  follow more of an entitlement based access control, which is a
• 1:06:51
  single entitlement. And so sad with a single roll,
• 1:06:55
  which sounds like there might be a lot of rules and really gives
• 1:06:58
  them granularity to be able to take an attribute based
• 1:07:00
  approach. And I'd like to understand, you
• 1:07:03
  know, I'll start with you Beth. What's next from a role
• 1:07:07
  perspective, right? We've got.
• 1:07:08
  We've been Talking about two are back but there are perfectly
• 1:07:11
  valuable other methods like a back and P back.
• 1:07:14
  That could be used are those things that you've you're
• 1:07:16
  currently exploring or looking at?
• 1:07:18
  Or where do those types of things fall from your strategy
• 1:07:22
  when it comes to managing access?
• 1:07:24
  Yeah, I mean, attribute-based is definitely, you know, we have
• 1:07:26
  some Birthright things which are based on people's attributes way
• 1:07:29
  that we're doing it and, and Larry rolls layering.
• 1:07:33
  We don't try to build everything into one role.
• 1:07:35
  We are actually trying to do a layering effect so that if
• 1:07:38
  someone it moves from one job to the other and different
• 1:07:40
  applications react differently. So and if I had everything
• 1:07:44
  bundled into one role for your job and you moved to another
• 1:07:47
  job, you might have to unroll people from a current
• 1:07:50
  application that they will still use in the next job.
• 1:07:53
  And we don't want to have to re-enroll them and have them
• 1:07:54
  start over. So depends on how different
• 1:07:57
  applications candle than enrollment in re-enrollment.
• 1:08:01
  So we've taken a layer in effect where it's an all Associates and
• 1:08:04
  then by region and then by location and then by department.
• 1:08:07
  So as people Move through the company.
• 1:08:09
  We can pick and choose those layers and reapply their access
• 1:08:12
  and that is definitely all based on their attributes.
• 1:08:16
  Prince, when you think about the strategy of roles, I want you to
• 1:08:20
  put on your 2023 prediction here since we were at the end of the
• 1:08:23
  year. How do you see roles evolving a
• 1:08:26
  train? Is it still going to be
• 1:08:28
  something are back? Have you started down maybe the
• 1:08:30
  path of a backer P back or some other methodologies for Access
• 1:08:33
  Control. Where do you think things are
• 1:08:34
  heading in the future? Yeah, and I think, you know,
• 1:08:38
  when I, when I think about, because we just got through this
• 1:08:41
  strategy discussion where they say, you know, where do we going
• 1:08:43
  to be doing? And one of the things I always
• 1:08:45
  say is and it's a, it's a, it's an answer.
• 1:08:47
  No one wants to hear what it's it depends.
• 1:08:49
  Right. And that's because we're
• 1:08:52
  supposed to say that. Yeah, it depicts henna and
• 1:08:54
  they're the reason the reason that is and I say it depends is
• 1:08:57
  because it really depends on what you're trying to
• 1:08:59
  accomplish. What the company's tolerance in
• 1:09:02
  maturity is at that time, they care and fee need, right?
• 1:09:06
  So, if you are thinking of these big Grand ideas, and you don't
• 1:09:10
  have the right support apparatus is in place, it's not going to
• 1:09:13
  be it's not going to be functional, right?
• 1:09:15
  If you have all this roles for all where you don't have the
• 1:09:20
  right, people to go and update them, Etc, understand what they
• 1:09:23
  are going to run into audit issue.
• 1:09:25
  So I think finding the right approach to the right situation
• 1:09:29
  is really should be the strategy and not try to boil the ocean
• 1:09:32
  and put one solution to fit all because our business is not a
• 1:09:35
  one-size-fits-all If it all, we apply different models and
• 1:09:38
  different things to different strategies.
• 1:09:39
  And so, if that's why you say it, kind of depends, but I think
• 1:09:42
  the evolution would be taken advantage of these new tools
• 1:09:45
  that are giving us insights excetera about how people are
• 1:09:49
  using our tools where we have roles that people have, but
• 1:09:52
  they're not using their not logging into Quan that back,
• 1:09:55
  making sure that we are using that kind of a defense in-depth
• 1:09:58
  approach to kind of find the right people for the right
• 1:10:00
  situation. Some a big old Marvel nerd.
• 1:10:03
  So I'm going to pull out Hawkeyes May example, right he's
• 1:10:06
  got the the oh bow and arrow. He's got a quiver with a whole
• 1:10:09
  bunch of different arrows. If you all kinds of weird stuff
• 1:10:11
  and maybe Batman's the same analogy, right?
• 1:10:12
  He's got the bat, the bat are back and the bat a back and
• 1:10:16
  whatever it may be. You do not have to follow one
• 1:10:20
  methodology, right? It's not like you're subscribing
• 1:10:23
  to, this is how we're going to be doing it and everyone must
• 1:10:26
  conform to this. This is not the Borg, right?
• 1:10:28
  We're not going to assimilate in this scenario.
• 1:10:30
  What we want to do is try to come up with the Right approach.
• 1:10:33
  And it may be very similar to like what Mitch has done with
• 1:10:35
  his organization. Sounds like where they've gone
• 1:10:37
  down this entitlement route and it's very granular but if it
• 1:10:41
  works, it works right. You don't necessarily need to do
• 1:10:44
  to get super crazy with it. So I think that's something you
• 1:10:46
  kind of think about Ashley. Let's put on your prognosticator
• 1:10:50
  had here. How do you feel about some of
• 1:10:53
  the other Alternatives when it comes to our back versus a back
• 1:10:56
  P back? And any other backs that might
• 1:10:58
  be out there? I think everybody said it.
• 1:11:01
  Well, I think the Alternatives are great, but it really depends
• 1:11:04
  on, you know, the situation at your organization.
• 1:11:07
  So, at least how I approach, you know, the future of our back in
• 1:11:12
  a back and P back and where we should use it.
• 1:11:14
  When is actually listen to the strategies of the organization,
• 1:11:17
  as a whole and what they're focused on and try to get your
• 1:11:20
  head in the game on where you know they're headed from it, I
• 1:11:23
  am or rolls perspective and then you take that use case and you
• 1:11:26
  see does it fit in our traditional are back model?
• 1:11:29
  Do we need to mold and shape it into an a back model?
• 1:11:32
  What is that actually look like? And so we're not just trying to
• 1:11:35
  come up with something out of thin air, we're actually using
• 1:11:38
  it for the specific, use case of the company that they needed
• 1:11:41
  that point in time. Jimmy and I spent an awful lot
• 1:11:44
  of time talking with you know vendors in this space other
• 1:11:47
  companies. Etc.
• 1:11:48
  What's the future of our back in a quick sound bite because I
• 1:11:52
  want to get to our closing out here.
• 1:11:53
  Yeah my prognostication is our back will be just a good
• 1:11:57
  conversation next December, as it is right now payback and P
• 1:12:02
  back. Our this basically the same
• 1:12:04
  thing there they use that they get applied at the time of
• 1:12:11
  authentication, authorization. So I've got these attributes
• 1:12:15
  about me when I go to Kasi to access the application rather
• 1:12:20
  than it looking in the database of roles.
• 1:12:22
  It just says you have these attributes.
• 1:12:24
  I'm going to give you this access the much more data-driven
• 1:12:28
  approach, which I think is ideally where a lot of
• 1:12:30
  organizations like to be, do they have the data to make
• 1:12:32
  successful? That is always the tricky
• 1:12:34
  question, right? I think there's varying levels
• 1:12:36
  of success that you can probably get to all right.
• 1:12:39
  Now we're coming up on time here and one of the things that we
• 1:12:41
  like to do on our podcasts, Identity at the center.com is to
• 1:12:45
  really end on a lighter note. And so we were kind of thinking
• 1:12:48
  about this, you know, what's the one of the questions want to do
• 1:12:50
  this is something that's not identity related.
• 1:12:52
  Just to kind of have fun towards the end.
• 1:12:54
  I'm going to pass it around the room real quick Prince.
• 1:12:57
  What is the best or worst meal you have ever had?
• 1:13:02
  It just happened recently, I bought it insta pot and I put
• 1:13:06
  chicken in the air and it takes like boiled.
• 1:13:10
  I don't know what it was, but I think for the chicken mark Cut,
• 1:13:13
  that's should be in the airfryer and not the Instant by instant
• 1:13:17
  pot. Chicken is amazing.
• 1:13:19
  So welcome to the club. Ashley, what about yourself?
• 1:13:23
  What's the best or worst meal you've ever had sugar?
• 1:13:26
  And I think mine comes just from a shock.
• 1:13:28
  So mine was actually when I took a trip to Germany.
• 1:13:31
  I just landed just wanted a drink, you know, was like, I'm
• 1:13:35
  tired. Let's like get a drink.
• 1:13:37
  Let's relax. And so I had somebody ordered
• 1:13:40
  for me and then I come back and I taste it and I'm like, that's
• 1:13:43
  It's not a beer. What is that?
• 1:13:44
  And it was banana flavored beer that you can imagine it exists.
• 1:13:49
  And so you know on first reaction was like oh this is the
• 1:13:52
  worst thing I've ever tasted and you get into any like actually,
• 1:13:55
  this is pretty good but it's very functional.
• 1:13:57
  Like it's not what you expected, but Anna's love those flavors
• 1:14:00
  that you need to be expecting. Otherwise it's like whoa, which
• 1:14:03
  is hit me. Exactly!
• 1:14:05
  That's what's the best meal or what?
• 1:14:07
  Worst meal you've ever had. Yeah, the worst villains ever
• 1:14:10
  had was the one that I made so I can blame nobody but myself.
• 1:14:13
  But I have learned the hard way that you do not ever put
• 1:14:16
  broccoli in a Crock-Pot. Just it's a hard.
• 1:14:18
  No, don't ever do it. Don't ever do to anybody that
• 1:14:20
  you love and your family. If you have that relative that
• 1:14:23
  you may want to do something fun for.
• 1:14:24
  Yeah, go ahead and do that, but it does.
• 1:14:26
  That was the worst of me like that might be the most value
• 1:14:29
  piece of information has come out of them.
• 1:14:30
  Some Tire hours, don't put broccoli in a Crock-Pot, Jim
• 1:14:34
  best or worst meal. You'd had my seal your answer.
• 1:14:37
  Jeff, that's take that we had in Vegas.
• 1:14:40
  That Wagyu steak. It's like a hunter over. $100,
• 1:14:43
  for a piece of meat with no sides singing.
• 1:14:46
  This is the biggest rip off until I ate it.
• 1:14:49
  Is there anything better than a really nice dinner that you're
• 1:14:51
  not paying for? I mean, but that's pretty,
• 1:14:53
  that's pretty good. There's the kind of jittery as a
• 1:14:56
  mortgage, your house for us. Yeah.
• 1:14:57
  No kidding. Speaking of, where's your house?
• 1:14:59
  I think my best meal was French Laundry.
• 1:15:00
  It was sort of a bucket-list item for us and my wife and I
• 1:15:04
  were finally able to take her parents there so that was pretty
• 1:15:07
  good. My worst is about us was pizza
• 1:15:09
  that I had in Paris which was completely awful would not.
• 1:15:13
  Man's. All right, we got two minutes.
• 1:15:15
  I got one more bonus question and I want to see you know from
• 1:15:17
  the folks who have stuck with us the end.
• 1:15:19
  I want to take a quick poll, how many people think Die Hard?
• 1:15:23
  Is a Christmas movie. Raise your hand if you think
• 1:15:26
  Die. Hard is a Christmas movie.
• 1:15:27
  I see best got her hand up. We're seeing the sea, okay.
• 1:15:30
  Yes now we're seeing hands all over the board over here this
• 1:15:33
  might solve maybe some of the conversations you might be
• 1:15:38
  having with your family around this time of year.
• 1:15:40
  You know what's the Christmas movie?
• 1:15:41
  You're going to watch. You can throw die.
• 1:15:43
  Hard out there because it absolutely, in my mind is a
• 1:15:45
  Christmas movie. So yeah, with that, we're going
• 1:15:48
  to ahead and kind of close things out.
• 1:15:49
  I'll pass over here to Tom. Thank you again for inviting us
• 1:15:52
  and thank you to Beth Prince and Ashley for joining us.
• 1:15:56
  You've been listening to Identity at the center.
• 1:15:59
  We hope you've enjoyed the show, make sure to like rate and
• 1:16:03
  review and we'll be back soon, but in the meantime, hit the
• 1:16:07
  website at identity at the center.com and find us on
• 1:16:11
  Twitter at Ivy. Casey podcast, see you next time
• 1:16:17
  on identity at the center.